Do Son Zoom rolls out security updates for 6 newly disclosed flaws in Workplace, Rooms, and SDK, addressing DoS, info disclosure, and XSS across all platforms. Update now!
XSS
Three flaws in Frappe Framework allow account takeover via password reset token leaks, XSS via file upload, and SQL injection. Update self-hosted ERPNext immediately!
JPCERT/CC warns of critical flaws in ELECOM wireless LAN routers, including unauthenticated RCE (CVSS 9.8) via Telnet/SOAP. Many affected models are unsupported; replace them immediately.
Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.
Two high-severity Ubiquiti flaws allow privilege escalation via XSS in UCRM and authenticated SQL injection in UISP. Update immediately!
GitLab issues urgent updates for high-severity flaws in CE/EE, including HTML injection (account takeover) and CI/CD code injection. Upgrade to 18.0.2, 17.11.4, or 17.10.8 immediately.
CISA adds two critical vulnerabilities to KEV: Erlang/OTP (RCE) and Roundcube (XSS). Actively exploited, these flaws pose severe risks to systems and email accounts.
CERT Polska warns of a critical Roundcube XSS flaw (CVE-2024-42009) exploited by UNC1151 in spear phishing, stealing credentials and compromising Polish organizations.
A high-severity XSS flaw (CVE-2025-5806) in Jenkins Gatling Plugin bypasses CSP, risking session hijacking and credential theft. Downgrade to v1.3.0 immediately!
Broadcom releases critical patches for three Stored XSS vulnerabilities (CVE-2025-22243, CVE-22244, CVE-22245) in VMware NSX, Cloud Foundation & Telco Cloud. Update immediately!
High-severity flaws (CVE-2025-20298 & CVE-2025-20297) impact Splunk Enterprise & Universal Forwarder. Learn how to protect your data.
Hitachi Energy's Asset Suite, used in power gen, faces severe vulnerabilities including XSS, plaintext passwords, & RCE. Immediate action advised to secure systems.
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
New CrossPUSH & CrossSXG attacks exploit HTTP/2 and SXG to bypass Same-Origin Policy, enabling XSS and cookie manipulation.
Grafana rushed an emergency patch for CVE-2025-4123, a high-severity XSS flaw that was made public. Upgrade now to prevent unauthorized access.
A reflected XSS flaw in GlobalProtect (CVE-2025-0133) allows malicious JavaScript execution. PoC exploit code is available. Update your PAN-OS.
Broadcom addresses four new vulnerabilities in VMware ESXi, vCenter, Workstation, and Fusion, ranging from command execution to XSS. Update now.
Serious vulnerabilities in pfSense put networks at risk. Could your firewall be hacked? Learn about the exploits and how to stay safe.
Learn about the Label Studio XSS flaw (CVE-2025-47783) that allows attackers to inject malicious scripts. Protect your data labeling projects.
Jenkins plugins hit by CVE-2025-47884 (CVSS 9.1) and more—flaws enable impersonation, XSS, and authentication bypass. Patch now to secure pipelines.
Russia-linked APT28 (Sednit/Fancy Bear) targets vulnerable webmail with XSS in Operation RoundPress, stealing data from global entities.
JPCERT reports critical flaws in a-blog cms, including CVE-2025-36560 (CVSS 9.2). Attackers could hijack sessions and access sensitive data.