Category: Security, Vulnerabilities

A high severity flaw affecting Broadcom’s Brocade Fabric OS (FOS) has allowed attackers to run arbitrary code on affected environments with full root-level privileges. The flaw, tracked as CVE-2025-1976, is particularly dangerous as it can allow complete takeover of FOS devices, including Fibre switches and directors, which are core to Storage Area Networks (SANs), potentially…

Read more →

Commvault is warning customers of a critical vulnerability affecting Command Center, a web-based management console for its data protection and backup offerings. The flaw, tracked as CV-2025-34028, could allow remote attackers to execute arbitrary code without authentication on affected Linux as well as Windows installations. “This Commvault vulnerability underscores a significant risk: attackers can exploit…

Read more →

Weeks after BIOS developer AMI released an update fixing a critical vulnerability in its MegaRAC baseband management controller (BMC) firmware used in many enterprise servers and storage systems, OEM patches addressing the issue are slowly trickling out. A BMC is an embedded chip that allows IT teams to monitor, troubleshoot, and control servers remotely via…

Read more →

A flaw in SSL.com’s domain control validation (DCV) process allowed attackers to bypass verification and issue fraudulent SSL certificates for any domain linked to certain email providers. According to an exploit demonstrated by a security researcher going by the alias Sec Reporter, attackers could abuse SSL.com’s misinterpretation of email-based validation methods. “SSL.com failed to conduct…

Read more →

ASUS is urging customers with AiCloud enabled on their ASUS routers to immediately upgrade firmware against a critical vulnerability that allows unauthorized activities by remote actors. Tracked as CVE-2025-2492, the vulnerability is an authentication bypass issue receiving a critical severity rating of CVSS 9.2 out of 10. “An improper authentication control vulnerability exists in certain…

Read more →

Apple is urging immediate patching of two zero-day vulnerabilities in its CoreAudio and RPAC components, citing their use in what the iPhone maker describes as “extremely sophisticated attacks.” Tracked as CVE-2025-31200 (CoreAudio) and CVE-2025-31201 (RPAC), the vulnerabilities were exploited in the wild to carry out code execution and memory corruption attacks, respectively. “Apple is aware…

Read more →

A critical race condition bug affecting the Nvidia Container Toolkit, which received a fix in September, might still be open to attacks owing to incomplete patching. Tracked as CVE-2024-0132, the flaw is a critical – CVSS 9 out of 10 – Time-of-Check Time-of-Use (TOCTOU) vulnerability that could allow a specifically crafted container image to gain…

Read more →

In a new campaign, threat actors have been trying to access EC2 Instance Metadata, which consists of sensitive virtual server information like IP address, instance ID, and security credentials by exploiting server-side request forgery (SSRF) bugs in websites hosted on AWS. According to observations made by F5 Labs, threat actors exploited Instance Metadata Service version…

Read more →

Meta is warning Whatsapp users of an issue affecting its Windows rollouts that could allow attackers to perform remote code execution (RCE) on systems running the vulnerable releases. Tracked as CVE-2025-30401, the flaw potentially allows threat actors to trick users into running maliciously crafted files with misleading filename extensions. “Due to a failing in Whatsapp,…

Read more →

Linux admins who have enabled the unprivileged user namespace restriction in their recent Ubuntu environments should take action to close three new vulnerabilities that allow a threat actor to bypass the supposed protection. This warning comes after researchers at Qualys found three different ways this hardening feature can, under certain circumstances, be bypassed.  “It needs…

Read more →

Broadcom is warning customers of a high-severity, authentication bypass flaw, now fixed, affecting VMWare Tools for Windows. Tracked as CVE-2025-22230, the issue stems from improper access control and could allow privilege escalation on the affected system. “An authentication bypass vulnerability in VMware Tools for Windows was privately reported to VMware,” said Broadcom in a security…

Read more →

The Kubernetes project has released patches for five vulnerabilities in a widely used popular component called the Ingress NGINX Controller that’s used to route external traffic to Kubernetes services. If exploited, the flaw could allow attackers to completely take over entire clusters. “Based on our analysis, about 43% of cloud environments are vulnerable to these…

Read more →

The Cybersecurity and Infrastructure Security Agency (CISA) has added a patched, high-severity vulnerability affecting NAKIVO’s backup and replication software to its known exploited vulnerability (KEV) catalog. The flaw, tracked as CVE-2024-48248, is a path traversal issue that received a high severity rating with CVSS 8.6 out of 10 and was marked “critical” by NAKIVO in…

Read more →

Keysight Technologies’ Ixia Vision product family has been found to contain critical security vulnerabilities that could allow remote attackers to compromise affected devices. According to a newly issued alert from the Cybersecurity and Infrastructure Security Agency (CISA), these flaws expose the devices to risks such as remote code execution, unauthorized file downloads, and system crashes,…

Read more →

Businesses around the globe have over 12,000 vulnerable instances of the GFI KerioControl application — a unified threat management (UTM) firewall software designed for small and mid-sized enterprises. The unpatched instances remained high weeks after the patches were issued for a critical RCE bug. Tracked as CVE-2024-52875, the vulnerability is an improper input sanitization error…

Read more →

Apple has rolled out emergency security patches after discovering that an “extremely sophisticated attack” exploited a flaw in its USB Restricted Mode, potentially targeting specific individuals. The company released updates for iOS and iPadOS to fix the vulnerability, which could allow attackers with physical access to disable security protections on locked devices. “A physical attack…

Read more →

Hackers are exploiting a high-severity remote code execution (RCE) flaw in Cityworks deployments — a GIS-centric asset and work order management software —  to execute codes on a customers’ Microsoft web servers. In a coordinated advisory with the US Cybersecurity and Infrastructure Security Agency (CISA), Cityworks’ developer Trimble said that the vulnerability, tracked as CVE-2025-0994…

Read more →

Cisco is warning enterprise admins of two critical flaws within its identity and management (IAM) solution, Identity Services Engine (ISE), that could allow attackers to obtain unauthorized privileges and run arbitrary commands on affected systems. Tracked as CVE-2025-20124 and CVE-2025-20125, the flaws have received a critical severity rating of CVSS 9.9 and 9.1 out of…

Read more →

VMware has fixed multiple high-severity vulnerabilities affecting its cloud management platform (CMP), VMware Aria, which could allow attackers to steal sensitive credentials from the virtualization giant’s IT management and logging solutions. Parent company Broadcom, in an advisory issued on Thursday, revealed that two out of five recently disclosed vulnerabilities are “high severity” information disclosure flaws…

Read more →

Vulnerability remediation is taking a severe hit as security teams are faced with fatigue from a growing number of publicly disclosed vulnerabilities. According to an analysis by S&P Global Ratings, a joint division of S&P Global and the cyber risk analytics company Guidewire, almost three-quarters of organizations are either occasionally or infrequently remediating the vulnerabilities…

Read more →