Do Son A high-severity Siemens SiPass flaw allows unauthenticated remote attackers to cause a denial-of-service condition. Update to V2.95.3.18.
Vulnerability
A critical flaw (CVE-2025-35003) in Apache NuttX RTOS allows RCE or DoS via crafted Bluetooth packets. Update to version 12.9.0 now.
A critical Canon printer vulnerability (CVE-2025-2146, CVSS 9.8) allows network attackers to execute arbitrary code. Update firmware now.
A critical pre-authentication RCE vulnerability in vBulletin 5.x and 6.x allows full server compromise. A PoC exploit is available.
A critical WSO2 vulnerability (CVE-2024-6914, CVSS 9.8) allows unauthenticated account takeover via a SOAP service, including admin access.
An unauthenticated flaw in GNOME's remote desktop (CVE-2025-5024) allows attackers to repeatedly crash Linux environments, preventing recovery even after systemd restarts.
A Ghostscript vulnerability (CVE-2025-48708) embeds plaintext passwords in encrypted PDF files, undermining document security. Update now!
ABB's ASPECT BMS has 32 security flaws, with some critical RCE and privilege escalation vulnerabilities having no planned fixes for legacy systems.
Critical NETGEAR flaw (CVE-2025-4978) allows full admin access via hidden backdoor. Exploit details and PoC analysis inside.
Canon urges users to mitigate high-severity flaws in a range of printers that could allow sensitive data extraction.
A high-severity flaw (CVE-2025-47947) in ModSecurity's Apache module allows DoS via JSON. PoC exists, no workaround, and a patch is expected soon.
A high-severity flaw (CVE-2025-48026) in Mitel OpenScape Xpressions allows unauthenticated attackers to read sensitive local files, including voicemail.
Google Chrome released an update with 8 security fixes, including a high-severity use-after-free vulnerability (CVE-2025-5063). Update your browser now!
Grafana rushed an emergency patch for CVE-2025-4123, a high-severity XSS flaw that was made public. Upgrade now to prevent unauthorized access.
GitLab released urgent updates (18.0.1+) fixing high-severity flaws, including a DoS vulnerability (CVE-2025-0993) and a 2FA bypass (CVE-2024-12093).
NIST introduces the Likely Exploited Vulnerability (LEV) metric, a new way to estimate which CVEs have likely been exploited in the wild.
Critical vulnerabilities (CVSS 9.8) in the Langroid Python framework allow remote code execution in LLM applications. Update to version 0.53.15 now!
AutomationDirect's MB-Gateway has a critical (CVSS 10) flaw allowing unauthenticated remote access and RCE. Hardware limits prevent a software fix; replacement is recommended.
A high-severity path traversal flaw in setuptools can allow RCE, exposing millions of Python users. Update to 78.1.1 now.
A high-severity BIND DNS server vulnerability allows remote attackers to crash servers using malformed TSIG signatures. Urgent update advised.
A reflected XSS flaw in GlobalProtect (CVE-2025-0133) allows malicious JavaScript execution. PoC exploit code is available. Update your PAN-OS.
A critical containerd flaw (CVE-2025-47290) allows malicious container images to hijack the host filesystem. Update to version 2.1.1 now.