A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. CVSSv3.1 8.2 (HIGH) · EPSS 6th percentile
In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run imm CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer. CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile
In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors. CVSSv3.1 9.6 (CRITICAL) · EPSS 31th percentile
Bishop Fox disclosed a critical vulnerability chain in Arista Next Generation Firewalls affecting three CVEs: CVE-2025-6980 (information disclosure exposing VPN credentials), CVE-2025-6979 (reflected XSS for credential theft), and CVE-2025-6978 (command injection for RCE). Researchers confirmed the XSS-to-RCE chain is exploitable in real-world conditions and that Arista's patch for CVE-2025-6978 does not fully remediate the underlying issues, leaving administrator-level exploitation possible.
Volexity documents ongoing campaigns by Russian APT UTA0355 abusing Microsoft 365 OAuth and Device Code authentication workflows to phish credentials from targeted users. The threat actor creates fake websites impersonating legitimate European security conferences (Belgrade Security Conference, Brussels Indo-Pacific Dialogue), uses rapport-building phishing, compromised accounts, and out-of-band communication via WhatsApp/Signal to socially engineer victims into granting unauthorized account access.
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6. CVSSv3.1 9.8 (CRITICAL) · EPSS 96th percentile
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. CVSSv3.1 8.8 (HIGH)
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetectD binary. This vulnerability allows attackers to execute arbitrary commands via a crafted input. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi endpoint. This vulnerability allows attackers to execute arbitrary commands via a crafted input. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile
Nuclei Templates v10.3.4 release adds 68 new detection templates covering 27 CVEs, including critical RCE, XXE, auth-bypass, and file-upload vulnerabilities across Oracle Identity Manager, GeoServer, Eclipse BIRT, Zoho ManageEngine, and WordPress plugins. The release includes templates for recent 2025 CVEs (Astro XSS, Oracle auth-bypass, GeoServer XXE) alongside older critical flaws, with bug fixes addressing false negatives in log-file detection and false positives in WordPress theme checks.
Trend Micro disclosed an active PureRAT campaign targeting job seekers via spear-phishing emails containing weaponized archives. The attack chain abuses Foxit PDF Reader through DLL side-loading (msimg32.dll), deploys a hidden Python environment via nested directory obfuscation, and achieves persistence through registry autorun entries. The RAT exfiltrates browser credentials and maintains C&C communication using self-signed certificates with anomalous validity periods.
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile
NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data. CVSSv3.1 8.4 (HIGH) · EPSS 15th percentile
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures. CVSSv3.1 8.3 (HIGH)
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection. CVSSv3.1 8.3 (HIGH) · EPSS 26th percentile
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile
Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low) CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile