Do Son Microsoft's November Patch Tuesday fixes 68 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel zero-day allowing local attackers to gain SYSTEM privileges via a race condition.
zero-day
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology patched a Critical (CVSS 9.8) RCE zero-day flaw (CVE-2025-12686) in BeeStation OS. The vulnerability, found during Pwn2Own, allows remote attackers to execute arbitrary code. Update to v1.3.2-65648.
Mandiant exposed UNC6485 exploiting a Triofox zero-day (CVE-2025-12480). The critical flaw allows unauthenticated admin takeover by spoofing the HTTP Host header to bypass authentication checks.
QNAP patched 7 zero-day flaws in QTS/QuTS hero and apps (HBS 3, Malware Remover) after being hacked by researchers at Pwn2Own Ireland 2025. Update urgently.
Chinese APT BRONZE BUTLER exploited CVE-2025-61932 in Motex LANSCOPE Endpoint Manager to gain SYSTEM access. CISA added the actively exploited zero-day to KEV.
The Brash exploit leverages a missing rate limit on Chromium's document.title API to trigger a Denial-of-Service attack, crashing browsers in seconds.
An iOS exploit developer was shocked to receive an Apple warning after being targeted by the same kind of state-sponsored mercenary spyware he researches.
CISA added a Critical (CVSS 10.0) RCE flaw (CVE-2025-54253) in Adobe Experience Manager Forms to its KEV Catalog due to active exploitation. Patch is mandatory by Nov 5.
Microsoft patched 193 vulnerabilities this month, including six zero-days (four exploited) and issued the final update for Windows 10 (KB5066791).
Microsoft updated Edge’s IE Mode policy after a Chakra zero-day was exploited via phishing. Users must now manually enable and whitelist domains to prevent remote device compromise.
A Zero-Day LFI flaw (CVE-2025-11371) in Gladinet/Triofox is being actively exploited. Attackers retrieve the Web.config machine key to chain into an unauthenticated RCE exploit.
CISA added the Zimbra XSS zero-day (CVE-2025-27915) to its KEV Catalog due to active exploitation since January. Attackers use malicious .ICS files to steal mail data.
CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.
A zero-day flaw in VMware Tools (CVE-2025-41244) allows local attackers to gain root privileges. NVISO confirmed exploitation by a Chinese APT. A public PoC is now available.
A public PoC has been released for CVE-2025-24085, a zero-day flaw in Apple's Core Media framework that allows a malicious app to elevate its privileges. Update now.
Cisco patches a Critical 9.9 zero-day (CVE-2025-20333) in ASA/FTD VPN web servers. Authenticated attackers can exploit the flaw for root-level Remote Code Execution.
Cisco patches CVE-2025-20362, a medium-high zero-day vulnerability in ASA/FTD VPN web servers that is being exploited to gain unauthorized access to restricted resources.
Two WordPress Core vulnerabilities (XSS and Info Exposure) affecting versions up to 6.8.2 were accidentally exposed before patches were ready.
A critical SNMP flaw (CVE-2025-20352) in Cisco IOS/IOS XE is being actively exploited, allowing attackers root access. Urgent patching and mitigation required!
CISA has added a high-severity V8 zero-day (CVE-2025-10585) to its exploited vulnerabilities catalog. An urgent Chrome update is available to patch the flaw.
Libraesva has issued an urgent advisory for a command injection flaw in its ESG. The bug, which has been exploited, allows remote command execution via a malicious email.
Google has released an urgent Chrome update, patching a V8 zero-day (CVE-2025-10585) being exploited in the wild, along with other high-severity flaws.