serisec

Category: Vulnerability News

  • Langchain Community SSRF Bypass Vulnerability Enables Access to Internal Services

    Langchain Community SSRF Bypass Vulnerability Enables Access to Internal Services A Server‑Side Request Forgery (SSRF) vulnerability has been identified in the langchain/community package, affecting versions up to 1.1.13. The flaw, tracked as CVE‑2026‑26019, has a moderate severity rating, with a CVSS 3.1 score, due on its potential to expose sensitive cloud metadata and internal infrastructure. The vulnerability originates from the RecursiveUrlLoader class, which…

  • 25 Vulnerabilities in Cloud Password Managers Allow Unauthorized Access and Modifications

    25 Vulnerabilities in Cloud Password Managers Allow Unauthorized Access and Modifications Researchers from ETH Zurich have uncovered 25 serious vulnerabilities in three leading cloud-based password managers: Bitwarden, LastPass, and Dashlane. These flaws enable a malicious server to bypass zero-knowledge encryption claims, allowing unauthorized access, modification, and recovery of users’ stored passwords and vault data. Bitwarden,…

  • Chrome 0-Day Vulnerability Actively Exploited by Attackers in the Wild

    Chrome 0-Day Vulnerability Actively Exploited by Attackers in the Wild Google has urgently patched a high-severity zero-day vulnerability in Chrome, confirming active exploitation in the wild. Tracked as CVE-2026-2441, the flaw is a use-after-free bug in the browser’s CSS handling, reported by independent researcher Shaheen Fazim just five days ago on February 11, 2026. The…

  • Threat Actor Allegedly Selling Critical Severity OpenSea 0-day Exploit Chain on Hacking Forums

    Threat Actor Allegedly Selling Critical Severity OpenSea 0-day Exploit Chain on Hacking Forums A threat actor is reportedly selling a purported critical severity zero-day exploit chain targeting OpenSea for $100,000 USD in Bitcoin or Monero. The listing claims the vulnerability remains unpatched and undisclosed, raising alarms in the NFT community. The exploit allegedly targets flaws…

  • CISA Warns of Microsoft Configuration Manager SQL Injection Vulnerability Exploited in Attacks

    CISA Warns of Microsoft Configuration Manager SQL Injection Vulnerability Exploited in Attacks CISA has issued an urgent alert about a critical SQL injection vulnerability in Microsoft Configuration Manager (SCCM). Tracked as CVE-2024-43468, this flaw lets unauthenticated attackers run malicious commands on servers and databases. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on February 12,…

  • Critical Vulnerability in Next-Mdx-Remote Allows Arbitrary Code Execution in React Server-Side Rendering

    Critical Vulnerability in Next-Mdx-Remote Allows Arbitrary Code Execution in React Server-Side Rendering Security advisory HCSEC-2026-01 revealed a critical vulnerability in the next-mdx-remote library that allows attackers to execute arbitrary code on servers rendering untrusted MDX content. Tracked as CVE-2026-0969, the issue affects versions 4.3.0 through 5.0.0 and is fixed in 6.0.0. Next-mdx-remote is a popular…

  • Palo Alto Networks Firewall Vulnerability Allows an Attacker to Force Firewalls into a Reboot Loop

    Palo Alto Networks Firewall Vulnerability Allows an Attacker to Force Firewalls into a Reboot Loop A critical denial-of-service (DoS) flaw in Palo Alto Networks’ PAN-OS software could let unauthenticated attackers crash firewalls into endless reboot cycles, potentially crippling enterprise networks. Dubbed CVE-2026-0229, the vulnerability lurks in the Advanced DNS Security (ADNS) feature. An attacker sends…

  • Windows Shell Security Feature 0-Day Vulnerability Let Attackers Bypass Authentication

    Windows Shell Security Feature 0-Day Vulnerability Let Attackers Bypass Authentication Microsoft released Microsoft Patch Tuesday updates to address a critical zero-day vulnerability in Windows Shell that is currently being actively exploited in the wild. Tracked as CVE-2026-21510, this security flaw allows remote attackers to bypass essential protection mechanisms, putting millions of Windows users at risk. The…

  • Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely

    Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely Microsoft has patched a critical remote code execution (RCE) flaw in the Windows Notepad app, tracked as CVE-2026-20841, which could let attackers run malicious code on victims’ machines. Disclosed on February 10, 2026, Microsoft Patch Tuesday updates, the vulnerability stems from improper neutralization of special…

  • Windows Remote Desktop Services 0-Day Vulnerability Exploited in the Wild to Escalate Privileges

    Windows Remote Desktop Services 0-Day Vulnerability Exploited in the Wild to Escalate Privileges Microsoft has patched CVE-2026-21533, a zero-day elevation of privilege vulnerability in Windows Remote Desktop Services (RDS) that attackers are exploiting in the wild to gain SYSTEM-level access. The flaw stems from improper privilege management and was addressed in the February 2026 Patch…

  • Critical FortiClientEMS Vulnerability Let Attackers Execute Malicious Code Remotely

    Critical FortiClientEMS Vulnerability Let Attackers Execute Malicious Code Remotely Fortinet has issued a critical security advisory warning administrators to immediately patch instances of FortiClientEMS, its central management solution for endpoint protection. The vulnerability, tracked as CVE-2026-21643, carries a CVSSv3 score of 9.1 and could allow unauthenticated, remote attackers to execute arbitrary code or unauthorized commands…

  • F5 Patches Critical Vulnerabilities in BIG-IP, NGINX, and Related Products

    F5 Patches Critical Vulnerabilities in BIG-IP, NGINX, and Related Products F5 released its February 2026 Quarterly Security Notification on February 4, announcing several medium and low-severity CVEs, plus a security exposure affecting BIG-IP, NGINX, and container services. These issues primarily stem from denial-of-service (DoS) risks and configuration weaknesses, potentially disrupting high-traffic environments like web application…

  • Chrome Vulnerabilities Let Attackers Execute Arbitrary Code and Crash System

    Chrome Vulnerabilities Let Attackers Execute Arbitrary Code and Crash System Google has released a critical security update for the Chrome Stable channel, addressing two high-severity vulnerabilities that expose users to potential arbitrary code execution (ACE) and denial-of-service (DoS) attacks. The update pushes the browser version to 144.0.7559.132/.133 for Windows and macOS, and 144.0.7559.132 for Linux.…

  • Hackers Exploiting React Server Components Vulnerability in the Wild to Deploy Malicious Payloads

    Hackers Exploiting React Server Components Vulnerability in the Wild to Deploy Malicious Payloads Two months following the disclosure of CVE-2025-55182, exploitation activity targeting React Server Components has evolved from broad scanning into consolidated, high-volume attack campaigns. According to telemetry from GreyNoise collected between January 26 and February 2, 2026, threat actors are actively leveraging this…

  • Hikvision Wireless Access Points Vulnerability Enables Malicious Command Execution

    Hikvision Wireless Access Points Vulnerability Enables Malicious Command Execution A critical authenticated command execution vulnerability has been disclosed affecting multiple Hikvision Wireless Access Point (WAP) models. The flaw, tracked as CVE-2026-0709, stems from insufficient input validation in device firmware, potentially allowing attackers with valid credentials to execute arbitrary commands on affected systems. The vulnerability carries…

  • 1-Click Clawdbot Vulnerability Enable Malicious Remote Code Execution Attacks

    1-Click Clawdbot Vulnerability Enable Malicious Remote Code Execution Attacks A critical vulnerability in OpenClaw, the open-source AI personal assistant trusted by over 100,000 developers, has been discovered and weaponized into a devastating one-click remote code execution exploit. Security researchers at depthfirst General Security Intelligence uncovered a logic flaw that, when combined with other vulnerabilities, could…

  • Critical Johnson Controls Products Vulnerabilities Enables Remote SQL Injection Attacks

    Critical Johnson Controls Products Vulnerabilities Enables Remote SQL Injection Attacks A critical advisory addressing a severe SQL injection vulnerability affecting multiple Johnson Controls industrial control system products. The vulnerability, tracked as CVE-2025-26385, carries a maximum CVSS v3 severity score of 10.0, indicating the highest level of risk to affected infrastructure. The flaw stems from improper…

  • Critical Ivanti Endpoint Manager 0-day RCE Vulnerabilities Actively Exploited in Attacks

    Critical Ivanti Endpoint Manager 0-day RCE Vulnerabilities Actively Exploited in Attacks Two critical code-injection vulnerabilities have been disclosed in the Endpoint Manager Mobile (EPMM) platform, which are currently being actively exploited in real-world attacks. The security flaws, tracked as CVE-2026-1281 and CVE-2026-1340, allow unauthenticated attackers to execute arbitrary code remotely on vulnerable systems. The vulnerabilities…

  • 3,280,081 Fortinet Devices Online With Exposed Web Properties Under Risk

    3,280,081 Fortinet Devices Online With Exposed Web Properties Under Risk Over 3,280,081 Fortinet Devices Were exposed, with web properties running vulnerable Fortinet devices affected by CVE-2026-24858, a severe authentication-bypass flaw actively exploited in the wild. The vulnerability, rated 9.4 on the CVSS scale, affects multiple Fortinet product lines, including FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. Critical…

  • Critical Solarwinds Web Vulnerability Allows Remote Code Execution and Security Bypass

    Critical Solarwinds Web Vulnerability Allows Remote Code Execution and Security Bypass Multiple critical vulnerabilities in SolarWinds Web Help Desk (WHD), culminating in unauthenticated remote code execution (RCE) via Java deserialization in CVE-2025-40551, were uncovered by Horizon3.ai researchers. These flaws chain static credentials, security bypasses, and deserialization weaknesses, affecting versions prior to 2026.1. SolarWinds WHD, an…

  • WhatsApp New Strict Account Settings Option to Protect Your Account from Hackers

    WhatsApp New Strict Account Settings Option to Protect Your Account from Hackers WhatsApp has introduced Strict Account Settings, a lockdown-style security feature designed to protect users from highly sophisticated cyber-attacks. The new privacy feature is specifically tailored for individuals who may be targets of advanced threats, including journalists, activists, and public figures who face elevated…

  • Critical Vulnerability in Python PLY Library Enables Remote Code Execution – PoC Published

    Critical Vulnerability in Python PLY Library Enables Remote Code Execution – PoC Published A critical vulnerability has been identified in the PyPI-distributed version of PLY (Python Lex-Yacc) 3.11, allowing arbitrary code execution through unsafe deserialization of untrusted pickle files. The vulnerability, assigned CVE-2025-56005, affects the undocumented picklefile parameter in the yacc() function, which remains absent from official documentation despite…

  • Multiple Vulnerabilities in React Server Components Enable DoS Attacks

    Multiple Vulnerabilities in React Server Components Enable DoS Attacks Multiple critical security vulnerabilities have recently been disclosed in React Server Components, enabling threat actors to launch Denial-of-Service (DoS) attacks against vulnerable servers. The flaws, tracked as CVE-2026-23864 with a CVSS score of 7.5, are due to incomplete patches from previous security fixes and require immediate…

  • Apache Hadoop Vulnerability Exposes Systems Potential Crashes or Data Corruption

    Apache Hadoop Vulnerability Exposes Systems Potential Crashes or Data Corruption A moderate-severity vulnerability in the Hadoop Distributed File System (HDFS) native client could allow attackers to trigger system crashes or corrupt critical data through maliciously crafted URI inputs. The vulnerability, tracked as CVE-2025-27821, affects Apache Hadoop versions 3.2.0 through 3.4.1. Stems from an out-of-bounds write…

  • New Instagram Vulnerability Exposes Private Posts to Anyone

    New Instagram Vulnerability Exposes Private Posts to Anyone A critical server-side vulnerability in Instagram’s infrastructure allowed unauthenticated attackers to access private photos and captions without a login or follower relationship, according to a disclosure released this week by security researcher Jatin Banga. The vulnerability, which was reportedly patched silently by Meta in October 2025, relied…

  • CISA Warns of Critical VMware vCenter RCE Vulnerability Exploited in Attacks

    CISA Warns of Critical VMware vCenter RCE Vulnerability Exploited in Attacks The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Broadcom’s VMware vCenter Server to its Known Exploited Vulnerabilities (KEV) catalog. This addition confirms that active exploitation of CVE-2024-37079 has been detected in the wild, posing a significant risk to enterprise…

  • Hackers Exploiting telnetd Vulnerability for Root Access – Public PoC Released

    Hackers Exploiting telnetd Vulnerability for Root Access – Public PoC Released Active exploitation of a critical authentication bypass vulnerability in the GNU InetUtils telnetd server (CVE-2026-24061) has been observed in the wild, allowing unauthenticated attackers to gain root access to Linux systems. The vulnerability, which affects GNU InetUtils versions 1.9.3 through 2.7, enables remote code…

  • Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access

    Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access Cisco has disclosed a critical zero-day remote code execution (RCE) vulnerability, CVE-2026-20045, actively exploited in the wild. Affecting key Unified Communications products, this flaw allows unauthenticated attackers to run arbitrary commands on the underlying OS, potentially gaining root access. The Cisco…

  • Fortinet SSO Vulnerability Actively Exploited to Hack Firewalls and Gain Admin Access

    Fortinet SSO Vulnerability Actively Exploited to Hack Firewalls and Gain Admin Access A critical vulnerability in Fortinet’s Single Sign-On (SSO) feature for FortiGate firewalls, tracked as CVE-2025-59718, is under active exploitation. Attackers are leveraging it to create unauthorized local admin accounts, granting full administrative access to internet-exposed devices. Multiple users have reported identical attack patterns,…

  • Google Chrome 144 Update Patches High-Severity V8 Vulnerability

    Google Chrome 144 Update Patches High-Severity V8 Vulnerability A new Stable-channel release of Chrome version 144 addresses a high-severity vulnerability in the V8 JavaScript engine. The update, version 144.0.7559.96/.97 for Windows and Mac and 144.0.7559.96 for Linux, began rolling out on January 21, 2026, and will reach all users over the coming days and weeks.…

  • Critical GNU InetUtils Vulnerability Allows Unauthenticated Root Access Via “-f root”

    Critical GNU InetUtils Vulnerability Allows Unauthenticated Root Access Via “-f root” A critical remote authentication bypass vulnerability has been disclosed in GNU InetUtils affecting the telnetd server component. The flaw, reported by a security researcher on January 19, 2026, allows unauthenticated attackers to gain root access by exploiting improper input sanitization in the telnetd authentication…

  • Critical Oracle WebLogic Server Proxy Vulnerability Lets Attackers Compromise the Server

    Critical Oracle WebLogic Server Proxy Vulnerability Lets Attackers Compromise the Server Oracle has disclosed a severe security vulnerability affecting its Fusion Middleware suite, specifically targeting the Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Assigned CVE-2026-21962, this flaw carries the maximum severity rating and poses an immediate threat to enterprise environments that use…

  • WhisperPair Attack Allows Hijacking of Laptops, Earbuds Without User Consent – Millions Affected

    WhisperPair Attack Allows Hijacking of Laptops, Earbuds Without User Consent – Millions Affected A critical vulnerability in Google’s Fast Pair protocol that allows attackers to hijack Bluetooth audio accessories and track users without their knowledge or consent.​ Security researchers from KU Leuven have uncovered a vulnerability, tracked as CVE-2025-36911 and dubbed WhisperPair, that affects hundreds…

  • Windows SMB Client Vulnerability Enables Attacker to Own Active Directory

    Windows SMB Client Vulnerability Enables Attacker to Own Active Directory A critical vulnerability in Windows SMB client authentication that enables attackers to compromise Active Directory environments through NTLM reflection exploitation. Classified as an improper access control vulnerability, this vulnerability allows authorized attackers to escalate privileges via carefully orchestrated authentication relay attacks over network connections. Seven…

  • Redmi Buds Vulnerability Allow Attackers Access Call Data and Trigger Firmware Crashes

    Redmi Buds Vulnerability Allow Attackers Access Call Data and Trigger Firmware Crashes Security researchers have uncovered significant vulnerabilities in the firmware of Xiaomi’s popular Redmi Buds series, specifically affecting models ranging from the Redmi Buds 3 Pro up to the latest Redmi Buds 6 Pro. The discovery highlights critical flaws in the Bluetooth implementation of…

  • New Kerberos Relay Attack Uses DNS CNAME to Bypass Mitigations – PoC Released

    New Kerberos Relay Attack Uses DNS CNAME to Bypass Mitigations – PoC Released A critical flaw in Windows Kerberos authentication that significantly expands the attack surface for credential relay attacks in Active Directory environments. By abusing how Windows clients handle DNS CNAME responses during Kerberos service ticket requests, attackers can coerce systems into requesting tickets…

  • Google’s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles

    Google’s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles Google’s Vertex AI contains default configurations that allow low-privileged users to escalate privileges by hijacking Service Agent roles. XM Cyber researchers identified two attack vectors in the Vertex AI Agent Engine and Ray on Vertex AI, which Google deemed “working as intended. Service…

  • Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild

    Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability in its Secure Email Gateway and Secure Email and Web Manager appliances. Tracked as CVE-2025-20393, the flaw allows unauthenticated attackers to execute arbitrary root-level commands via crafted HTTP requests to the…

  • Go 1.25.6 and 1.24.12 Patch Critical Vulnerabilities Lead to DoS and Memory Exhaustion Risks

    Go 1.25.6 and 1.24.12 Patch Critical Vulnerabilities Lead to DoS and Memory Exhaustion Risks The Go programming language team has rolled out emergency point releases, Go 1.25.6 and 1.24.12, to address six high-impact security flaws. These updates fix denial-of-service (DoS) vectors, arbitrary code execution risks, and TLS mishandlings that could expose developers to remote attacks.…

  • New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories

    New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories A critical misconfiguration in AWS CodeBuild enabled unauthenticated attackers to seize control of key AWS-owned GitHub repositories, including the widely used AWS JavaScript SDK powering the AWS Console itself. This supply chain vulnerability threatened platform-wide compromise, potentially injecting malicious code into applications and…

  • Fortinet FortiSIEM Vulnerability CVE-2025-64155 Actively Exploited in Attacks

    Fortinet FortiSIEM Vulnerability CVE-2025-64155 Actively Exploited in Attacks Fortinet FortiSIEM vulnerability CVE-2025-64155 is under active exploitation, as confirmed by Defused through their honeypot deployments. This critical OS command injection flaw enables unauthenticated remote code execution, posing severe risks to enterprise security monitoring systems. CVE-2025-64155 stems from improper neutralization of special elements in OS commands within…

  • Palo Alto Networks Firewall Vulnerability Allows Attacker to Trigger DoS Attacks

    Palo Alto Networks Firewall Vulnerability Allows Attacker to Trigger DoS Attacks Palo Alto Networks has patched a critical denial-of-service vulnerability in its PAN-OS firewall software, tracked as CVE-2026-0227, which lets unauthenticated attackers disrupt GlobalProtect gateways and portals. The flaw carries a CVSS v4.0 base score of 7.7 (HIGH severity), stemming from improper checks for unusual conditions…

  • Microsoft SQL Server Vulnerability Allows Attackers to Elevate Privileges over a Network

    Microsoft SQL Server Vulnerability Allows Attackers to Elevate Privileges over a Network Microsoft released security updates on January 13, 2026, addressing a critical elevation of privilege vulnerability in SQL Server that enables authorized attackers to bypass authentication controls and gain elevated system privileges remotely. Tracked as CVE-2026-20803, the vulnerability stems from missing authentication mechanisms for…

  • New Angular Vulnerability Enables an Attacker to Execute Malicious Payload

    New Angular Vulnerability Enables an Attacker to Execute Malicious Payload A critical Cross-Site Scripting (XSS) vulnerability has been discovered in Angular’s Template Compiler, affecting multiple versions of both @angular/compiler and @angular/core packages. Tracked as CVE-2026-22610, this vulnerability allows attackers to bypass Angular’s built-in security protections and execute arbitrary JavaScript code within victim browsers. The Vulnerability…

  • 100,000+ n8n Instances Exposed to Internet Vulnerable to RCE Attacks

    100,000+ n8n Instances Exposed to Internet Vulnerable to RCE Attacks A critical vulnerability affecting the popular n8n workflow automation platform has put over 100,000 internet-exposed instances at severe risk. Security researchers from The Shadowserver Foundation discovered that 105,753 unique n8n instances are vulnerable to remote code execution (RCE) attacks through CVE-2026-21858. n8n is a workflow…

  • Multiple Hikvision Vulnerabilities Let Attackers Cause Device Malfunction Using Crafted Packets

    Multiple Hikvision Vulnerabilities Let Attackers Cause Device Malfunction Using Crafted Packets Hikvision, a leading provider of surveillance and access control systems, faces serious security risks from two newly disclosed stack overflow vulnerabilities. These flaws, tracked as CVE-2025-66176 and CVE-2025-66177, allow attackers on the same local area network (LAN) to trigger device malfunctions by sending specially…

  • Critical InputPlumber Vulnerabilities Allows UI Input Injection and Denial-of-Service

    Critical InputPlumber Vulnerabilities Allows UI Input Injection and Denial-of-Service Critical vulnerabilities in InputPlumber, a Linux input device utility used in SteamOS, could allow attackers to inject UI inputs and cause denial-of-service conditions on affected systems. The SUSE researchers tracked as CVE-2025-66005 and CVE-2025-14338, which affect InputPlumber versions before v0.69.0 and stem from inadequate D-Bus authorization mechanisms. InputPlumber combines…

  • Critical Zlib Vulnerability Let Attackers Trigger Buffer Overflow by Invoking untgz

    Critical Zlib Vulnerability Let Attackers Trigger Buffer Overflow by Invoking untgz A severe global buffer overflow vulnerability has been discovered in the zlib untgz utility version 1.3.1.2. Allowing attackers to corrupt memory and potentially execute malicious code through specially crafted command-line input.​ The security flaw resides in the TGZfname() function of the untgz utility, where…

  • SmarterTools SmarterMail Vulnerability Enables Remote Code Execution Attack – PoC Released

    SmarterTools SmarterMail Vulnerability Enables Remote Code Execution Attack – PoC Released A critical pre-authentication remote code execution vulnerability, identified as CVE-2025-52691, has been discovered in SmarterTools’ SmarterMail solution. The flaw received a maximum CVSS score of 10.0, indicating its severe nature and potential impact on affected systems. SmarterTools describes SmarterMail as “a secure, all-in-one business…

  • GitLab Patches Multiple Vulnerabilities that Enables Arbitrary Code Execution

    GitLab Patches Multiple Vulnerabilities that Enables Arbitrary Code Execution GitLab has released emergency security patches for multiple versions of its platform, addressing eight vulnerabilities that could enable arbitrary code execution and unauthorized access in self-managed installations. The updated versions 18.7.1, 18.6.3, and 18.5.5 were deployed to GitLab.com on January 7, 2026, with self-hosted customers strongly…

  • Linux Battery Utility Flaw Lets Hackers Bypass Authentication and Tamper System Settings

    Linux Battery Utility Flaw Lets Hackers Bypass Authentication and Tamper System Settings A critical security vulnerability has been discovered in TLP, a widely used Linux laptop battery optimization utility, allowing local attackers to bypass authentication controls and manipulate system power settings without authorization. Security researchers from openSUSE identified a severe authentication bypass flaw in the…

  • Forcepoint DLP Vulnerability Enables Memory Manipulation and Arbitrary Code Execution

    Forcepoint DLP Vulnerability Enables Memory Manipulation and Arbitrary Code Execution A critical security flaw in Forcepoint One DLP Client has been disclosed, allowing attackers to bypass vendor-implemented Python restrictions and execute arbitrary code on enterprise endpoints. The vulnerability, tracked as CVE-2025-14026, undermines the data loss prevention security controls designed to protect sensitive organizational data. The…

  • Eaton Vulnerabilities Let Attackers Execute Arbitrary Code On the Host System

    Eaton Vulnerabilities Let Attackers Execute Arbitrary Code On the Host System A critical security advisory addressing multiple vulnerabilities discovered in the Eaton UPS Companion (EUC) software. These security flaws, if exploited, could allow attackers to execute arbitrary code on the host system, potentially giving them complete control over affected devices. The advisory, identified as ETN-VA-2025-1026, highlights…

  • Multiple Vulnerabilities in QNAP Tools Let Attackers Obtain Secret Data

    Multiple Vulnerabilities in QNAP Tools Let Attackers Obtain Secret Data QNAP has patched multiple security vulnerabilities in its License Center application that could allow attackers to access sensitive information or disrupt services on affected NAS devices. The issues, tracked as CVE-2025-52871 and CVE-2025-53597, were disclosed on January 3, 2026. QNAP rated the flaws as Moderate severity and confirmed that the issues have been resolved in the latest…

  • 10,000+ Fortinet Firewalls Still Exposed to 5-year Old MFA Bypass Vulnerability

    10,000+ Fortinet Firewalls Still Exposed to 5-year Old MFA Bypass Vulnerability Over 10,000 Fortinet firewalls worldwide remain vulnerable to CVE-2020-12812, a multi-factor authentication (MFA) bypass flaw disclosed over five and a half years ago. Shadowserver recently added the issue to its daily Vulnerable HTTP Report, highlighting persistent exposure amid active exploitation confirmed by Fortinet in…

  • Lessons From Mongobleed Vulnerability (CVE-2025-14847) That Actively Exploited In The Wild

    Lessons From Mongobleed Vulnerability (CVE-2025-14847) That Actively Exploited In The Wild The cybersecurity community was alarmed in late December 2025 when MongoDB announced a serious vulnerability called “Mongobleed” (CVE-2025-14847). This high-severity flaw allows unauthenticated attackers to steal sensitive data directly from server memory. With a CVSS score of 8.7 and over 87,000 potentially vulnerable MongoDB…

  • Apache NuttX Vulnerability Let Attackers to Crash Systems

    Apache NuttX Vulnerability Let Attackers to Crash Systems A newly disclosed use-after-free vulnerability in Apache NuttX RTOS could allow attackers to cause system crashes and unintended filesystem operations, prompting urgent security warnings for users running network-exposed services. The flaw, tracked as CVE-2025-48769 and rated moderate in severity, affects a wide range of NuttX versions and…

  • Critical IBM API Connect Vulnerability Let Attackers Bypass Logins

    Critical IBM API Connect Vulnerability Let Attackers Bypass Logins A critical security alert regarding a severe vulnerability in the IBM API Connect platform that could allow remote attackers to bypass authentication mechanisms. Discovered during internal testing, the flaw poses a significant risk to organizations relying on the platform for API management. It grants unauthorized actors…

  • Critical Apache StreamPipes Vulnerability Let Attackers Seize Admin Control

    Critical Apache StreamPipes Vulnerability Let Attackers Seize Admin Control A security patch addressing a critical privilege escalation vulnerability that allows unauthorized users to gain administrative access to the data streaming platform. The flaw, tracked as CVE-2025-47411 and rated important, affects Apache StreamPipes versions 0.69.0 through 0.97.0. The vulnerability stems from a flawed user ID creation…

  • 2.5 Million+ Malicious Request From Hackers Attacking Adobe ColdFusion Servers

    2.5 Million+ Malicious Request From Hackers Attacking Adobe ColdFusion Servers A coordinated exploitation campaign that generated more than 2.5 million malicious requests against Adobe ColdFusion servers and 47+ other technology platforms during the Christmas 2025 holiday period. The operation was attributed to a single threat actor operating from Japan-based infrastructure. This indicates an advanced scanning…

  • MongoBleed (CVE-2025-14847) Now Exploited in the Wild: MongoDB Servers at Critical Risk

    MongoBleed (CVE-2025-14847) Now Exploited in the Wild: MongoDB Servers at Critical Risk A high-severity unauthenticated information-leak vulnerability in MongoDB Server, dubbed MongoBleed after the infamous Heartbleed bug, is now being actively exploited in real-world attacks. MongoDB has disclosed CVE-2025-14847, a critical flaw affecting multiple supported and legacy server versions that allows unauthenticated remote attackers to…

  • 87,000+ MongoDB Instances Vulnerable to MongoBleed Flaw Exposed Online – PoC Exploit Released

    87,000+ MongoDB Instances Vulnerable to MongoBleed Flaw Exposed Online – PoC Exploit Released A high-severity vulnerability in MongoDB Server that allows unauthenticated remote attackers to siphon sensitive data from database memory. Dubbed “MongoBleed” due to its automated similarities to the infamous Heartbleed bug, the flaw tracks as CVE-2025-14847 and carries a CVSS score of 7.5.…

  • Mongobleed PoC Exploit Tool Released for MongoDB Flaw that Exposes Sensitive Data

    Mongobleed PoC Exploit Tool Released for MongoDB Flaw that Exposes Sensitive Data A proof-of-concept (PoC) exploit dubbed “mongobleed” for CVE-2025-14847, a critical unauthenticated memory leak vulnerability in MongoDB’s zlib decompression handling. Dubbed by its creator Joe Desimone as a way to bleed sensitive server memory, the flaw lets attackers remotely extract uninitialized data without credentials,…

  • TeamViewer DEX Vulnerabilities Let Attackers Trigger DoS Attack and Expose Sensitive Data

    TeamViewer DEX Vulnerabilities Let Attackers Trigger DoS Attack and Expose Sensitive Data Multiple critical vulnerabilities in TeamViewer DEX Client’s Content Distribution Service (NomadBranch.exe), formerly part of 1E Client. Affecting Windows versions before 25.11 and select older branches, the flaws stem from improper input validation (CWE-20), potentially enabling attackers on the local network to execute code,…

  • M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users

    M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users An information disclosure vulnerability in M-Files Server enables authenticated attackers to capture and reuse session tokens from active users. Potentially gaining unauthorized access to sensitive document management systems. The flaw, tracked as CVE-2025-13008, affects multiple versions across different release branches and carries a high-severity…

  • Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems

    Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems A critical vulnerability in LangChain’s core library (CVE-2025-68664) allows attackers to exfiltrate sensitive environment variables and potentially execute code through deserialization flaws. Discovered by a Cyata researcher and patched just before Christmas 2025, the issue affects one of the most popular AI frameworks with…

  • Net-SNMP Vulnerability Enables Buffer Overflow and the Daemon to Crash

    Net-SNMP Vulnerability Enables Buffer Overflow and the Daemon to Crash A new critical vulnerability affecting the Net-SNMP software suite has been disclosed, posing a significant risk to network infrastructure worldwide. Tracked as CVE-2025-68615, this security flaw allows remote attackers to trigger a buffer overflow, leading to a service crash or potentially a more severe system compromise.…

  • Hackers Exploiting Three-Year-Old FortiGate Vulnerability to Bypass 2FA on Firewalls

    Hackers Exploiting Three-Year-Old FortiGate Vulnerability to Bypass 2FA on Firewalls Cybercriminals are actively abusing a long-patched Fortinet FortiGate flaw from July 2020, slipping past two-factor authentication (2FA) on firewalls and potentially granting unauthorized access to VPNs and admin consoles. Fortinet’s PSIRT team detailed the in-the-wild attacks in a recent blog post, urging admins to audit…

  • Critical MongoDB Vulnerability Exposes Sensitive Data via Zlib Compression

    Critical MongoDB Vulnerability Exposes Sensitive Data via Zlib Compression A critical security vulnerability, tracked as CVE-2025-14847, that could allow attackers to extract uninitialized heap memory from database servers without authentication. The flaw resides in MongoDB’s zlib compression implementation and affects multiple versions of the database platform.​ The vulnerability enables client-side exploitation of the MongoDB Server’s zlib…

  • CISA Adds Digiever Authorization Vulnerability to KEV List Following Active Exploitation

    CISA Adds Digiever Authorization Vulnerability to KEV List Following Active Exploitation A critical vulnerability affecting Digiever DS-2105 Pro network video recorders was added to the Known Exploited Vulnerabilities (KEV) catalog on December 22, 2025, following evidence of active exploitation in the wild. CVE-2023-52163 is a missing authorization vulnerability in Digiever DS-2105 Pro devices. That enables…

  • 100+ Cisco Secure Email Devices Exposed to Zero‑Day Exploited in the Wild

    100+ Cisco Secure Email Devices Exposed to Zero‑Day Exploited in the Wild Security researchers have identified at least 120 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager devices vulnerable to a critical zero-day flaw that attackers are actively exploiting in the wild. The vulnerability, tracked as CVE-2025-20393, currently has no available patch,…

  • 25,000+ FortiCloud SSO-Enabled Devices Exposed to Remote Attacks

    25,000+ FortiCloud SSO-Enabled Devices Exposed to Remote Attacks Over 25,000 Fortinet devices worldwide with FortiCloud Single Sign-On (SSO) enabled, leaving them potentially exposed to remote attacks. The finding stems from enhanced device fingerprinting in a new Device Identification report, which scanned global IP addresses and flagged these systems as openly advertising their SSO configuration. FortiCloud…

  • WatchGuard 0-day Vulnerability Exploited in the Wild to Hijack Firewalls

    WatchGuard 0-day Vulnerability Exploited in the Wild to Hijack Firewalls An urgent security update has been released to fix a critical zero-day vulnerability in WatchGuard Firebox firewalls. With warnings that hackers are already actively exploiting the flaw in the wild to take control of affected devices. The vulnerability, tracked as CVE-2025-14733, carries a critical severity score…

  • Cisco AsyncOS 0-Day Vulnerability Exploited in the Wild to run System-level Commands

    Cisco AsyncOS 0-Day Vulnerability Exploited in the Wild to run System-level Commands An active campaign exploiting a zero-day vulnerability in Cisco AsyncOS Software, targeting Secure Email Gateway (formerly Email Security Appliance, ESA) and Secure Email and Web Manager (formerly Content Security Management Appliance, SMA). The attack, spotted since late November 2025 and publicly disclosed on…

  • Chrome Security Update – Patch for Critical Vulnerabilities that Enables Remote Code Execution

    Chrome Security Update – Patch for Critical Vulnerabilities that Enables Remote Code Execution Google has released Chrome version 143.0.7499.146/.147 to address critical security vulnerabilities that could enable remote code execution on affected systems. The update is now rolling out to Windows and Mac users, with Linux receiving version 143.0.7499.146. Full deployment is expected over the…

  • Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

    Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild An active intrusion is targeting critical authentication bypass vulnerabilities in Fortinet’s FortiGate appliances and related products. Threat actors are exploiting CVE-2025-59718 and CVE-2025-59719 to perform unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting attackers administrative access. Fortinet disclosed the flaws in a PSIRT…

  • Windows Remote Access Connection Manager Vulnerability Enables Arbitrary Code Execution

    Windows Remote Access Connection Manager Vulnerability Enables Arbitrary Code Execution A critical security issue involving the Windows Remote Access Connection Manager (RasMan) that allows local attackers to execute arbitrary code with System privileges. While investigating CVE-2025-59230, the vulnerability that Microsoft addressed in the October 2025 security updates. 0patch security analysts discovered a complex exploit chain that…

  • CISA Adds Sierra Router Vulnerability to KEV Catalogue Following Active Exploitation

    CISA Adds Sierra Router Vulnerability to KEV Catalogue Following Active Exploitation A critical vulnerability affecting Sierra Wireless routers has been added to its Known Exploited Vulnerabilities (KEV) catalog. This decision comes after evidence emerged that the flaw is being actively exploited in the wild. Posing significant risks to organizations that still utilize these legacy devices.…

  • CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks

    CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability in Google Chromium’s ANGLE graphics engine to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-14174, the flaw allows remote attackers to trigger out-of-bounds memory access via a malicious HTML page,…

  • Apple 0-Day Vulnerabilities Exploited in Sophisticated Attacks Targeting iPhone Users

    Apple 0-Day Vulnerabilities Exploited in Sophisticated Attacks Targeting iPhone Users Apple patches two WebKit zero-day flaws actively exploited in sophisticated attacks targeting specific iPhone users running iOS versions prior to 26.​ The iOS 26.2 and iPadOS 26.2 updates, released December 12, 2025, address CVE-2025-43529 and CVE-2025-14174 in WebKit. CVE-2025-43529 involves a use-after-free vulnerability enabling arbitrary…

  • Apache Struts 2 DoS Vulnerability Let Attackers Crash Server

    Apache Struts 2 DoS Vulnerability Let Attackers Crash Server A critical denial-of-service vulnerability has been discovered in Apache Struts 2, affecting multiple versions of the popular web application framework. The vulnerability, identified as CVE-2025-64775, exploits a file leak in multipart request processing that can cause disk exhaustion and server crashes. Organizations running affected versions should…

  • CISA Warns of OSGeo GeoServer 0-Day Vulnerability Exploited in Attacks

    CISA Warns of OSGeo GeoServer 0-Day Vulnerability Exploited in Attacks An urgent warning about a critical security flaw in OSGeo GeoServer, a widely used open-source geographic data-sharing server. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are actively leveraging this zero-day flaw in attacks targeting both public…

  • New Vulnerabilities in React Server Components Allow DoS Attacks and Source Code Leaks

    New Vulnerabilities in React Server Components Allow DoS Attacks and Source Code Leaks Less than a week after addressing a critical Remote Code Execution (RCE) vulnerability, the React team has disclosed three additional security flaws affecting React Server Components (RSC). Security researchers discovered these new issues while attempting to bypass the mitigations for the previous…

  • Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data

    Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data A critical information disclosure vulnerability in Windows Defender Firewall Service, which could allow authorized attackers to access sensitive heap memory on affected systems. The vulnerability, tracked as CVE-2025-62468, was assigned an Important severity rating and released on December 9, 2025. The flaw stems from an…

  • Adobe Acrobat Reader Vulnerabilities Let Attackers Execute Arbitrary Code and Bypass Security

    Adobe Acrobat Reader Vulnerabilities Let Attackers Execute Arbitrary Code and Bypass Security Critical security updates for Acrobat and Reader are available, addressing multiple vulnerabilities that could allow attackers to execute arbitrary code and bypass essential security features. Adobe issued security bulletin APSB25-119 on December 9, 2025, with a priority rating of 3, affecting both Windows and macOS…

  • Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild

    Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild Google has released an urgent security update for the Chrome browser to address a high-severity zero-day vulnerability that is currently being exploited in the wild. This emergency patch is part of the latest Stable channel update, bringing the version to 143.0.7499.109/.110 for Windows and…

  • Windows PowerShell 0-Day Vulnerability Let Attackers Execute Malicious Code

    Windows PowerShell 0-Day Vulnerability Let Attackers Execute Malicious Code Security update addressing a dangerous Windows PowerShell vulnerability that allows attackers to execute malicious code on affected systems. The vulnerability, tracked as CVE-2025-54100, was publicly disclosed on December 9, 2025, and represents a significant security risk for organizations worldwide. The flaw stems from improper neutralization of…

  • CISA Warns of WinRAR 0-Day RCE Vulnerability Exploited in Attacks

    CISA Warns of WinRAR 0-Day RCE Vulnerability Exploited in Attacks A high-priority warning regarding a critical security flaw in WinRAR, the popular file compression tool used by millions of Windows users. The vulnerability, tracked as CVE-2025-6218, is currently being exploited by attackers to compromise systems and execute malicious code. The specific flaw is known as a…

  • Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs

    Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs A critical zero-click vulnerability dubbed “GeminiJack” in Google Gemini Enterprise and previously Vertex AI Search that let attackers steal sensitive corporate data from Gmail, Calendar, and Docs with minimal effort. According to Noma Labs, it was considered an architectural flaw rather than merely a bug.…

  • Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild

    Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild Microsoft has released urgent security updates to address a zero-day vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that is currently being exploited in the wild. Assigned the identifier CVE-2025-62221, this elevation of privilege flaw affects a wide range of Windows…

  • SAP Security Patch Day: Fix for Critical Vulnerabilities in SAP Solution Manager, NetWeaver, and Other Products

    SAP Security Patch Day: Fix for Critical Vulnerabilities in SAP Solution Manager, NetWeaver, and Other Products SAP released 14 new security notes on its monthly Security Patch Day on December 9, 2025, addressing vulnerabilities across key products, including SAP Solution Manager, NetWeaver, Commerce Cloud, and more. Three critical flaws with CVSS scores exceeding 9.0 demand…

  • 500+ Apache Tika Toolkit Instances Vulnerable to Critical XXE Attack Exposed Online

    500+ Apache Tika Toolkit Instances Vulnerable to Critical XXE Attack Exposed Online Over 565 internet-exposed Apache Tika Server instances are vulnerable to a critical XML External Entity (XXE) injection flaw. That could enable attackers to steal sensitive data, launch denial-of-service attacks, or conduct server-side request forgery operations. The vulnerability, tracked as CVE-2025-66516, affects tika-core versions…

  • Burp Suite’s Scanning Arsenal Powered With Detection for Critical React2Shell Vulnerabilities

    Burp Suite’s Scanning Arsenal Powered With Detection for Critical React2Shell Vulnerabilities PortSwigger has enhanced Burp Suite’s scanning arsenal with the latest update to its ActiveScan++ extension, introducing detection for the critical React2Shell vulnerabilities (CVE-2025-55182 and CVE-2025-66478). This server-side request forgery (SSRF) flaw in React applications allows attackers to execute arbitrary shell commands, potentially leading to…

  • Next.js Released a Scanner to Detect and Update Apps Impacted by React2Shell Vulnerability

    Next.js Released a Scanner to Detect and Update Apps Impacted by React2Shell Vulnerability A dedicated command-line tool, fix-react2shell-next, to help developers immediately detect and patch the critical “React2Shell” vulnerability (CVE-2025-66478). This new scanner offers a one-line solution to identify vulnerable versions of Next.js and React Server Components (RSC). Automatically apply the required security updates included in…

  • Researchers Hack Google’s Gemini CLI Through Prompt Injections in GitHub Actions

    Researchers Hack Google’s Gemini CLI Through Prompt Injections in GitHub Actions A critical vulnerability class dubbed “PromptPwnd,” affects AI agents integrated into GitHub Actions and GitLab CI/CD pipelines. This flaw allows attackers to inject malicious prompts via untrusted user inputs like issue titles or pull request bodies, tricking AI models into executing privileged commands that…

  • 2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway – Patch Now

    2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway – Patch Now A critical unauthenticated remote code execution vulnerability dubbed “React2Shell” is actively being exploited in the wild, putting millions of web services at risk. On December 3, React disclosed CVE-2025-55182, a critical flaw in React Server Components with a CVSS score of…

  • Avast Antivirus Sandbox Vulnerabilities Let Attackers Escalate Privileges

    Avast Antivirus Sandbox Vulnerabilities Let Attackers Escalate Privileges Security researchers from the SAFA team have uncovered four kernel heap overflow vulnerabilities in Avast Antivirus, all traced to the aswSnx kernel driver. The flaws, now tracked collectively as CVE-2025-13032, could allow a local attacker to escalate privileges to SYSTEM on Windows 11 if successfully exploited. The…

  • Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely

    Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely A critical command injection vulnerability in the open-source network monitoring tool Cacti allows authenticated attackers to execute arbitrary code remotely, potentially compromising the entire monitoring infrastructure. The flaw, tracked as CVE-2025-66399, affects all versions up to 1.2.28 and stems from inadequate input validation in the…

  • Splunk Enterprise Vulnerabilities Allows Privileges Escalation Via Incorrect File Permissions

    Splunk Enterprise Vulnerabilities Allows Privileges Escalation Via Incorrect File Permissions A high-severity vulnerability has been disclosed in Splunk affecting its Enterprise and Universal Forwarder products for Windows, stemming from incorrect file permissions during installation and upgrades. The vulnerability, tracked as CVE-2025-20386 for Splunk Enterprise and CVE-2025-20387 for Universal Forwarder. Allows non-administrator users to access sensitive…

  • Vim for Windows Vulnerability Let Attackers Execute Arbitrary Code

    Vim for Windows Vulnerability Let Attackers Execute Arbitrary Code A critical security vulnerability has been discovered in Vim for Windows that could allow attackers to execute malicious code on users’ computers. The vulnerability, identified as CVE-2025-66476, affects Vim versions before 9.1.1947 and has been rated high severity, with a CVSS score of 7.8. The flaw…