vulnerability

Critical Citrix NetScaler bug fixed, upgrade ASAP! (CVE-2025-5777)

June 23, 2025

Citrix has fixed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and NetScaler Gateway reminiscent of the infamous and widely exploited CitrixBleed flaw. The …

Chaining two LPEs to get “root”: Most Linux distros vulnerable (CVE-2025-6018, CVE-2025-6019)

June 18, 2025

Qualys researchers have unearthed two local privilege escalation vulnerabilities (CVE-2025-6018, CVE-2025-6019) that can be exploited in tandem to achieve root access on most …

iOS zero-click attacks used to deliver Graphite spyware (CVE-2025-43200)

June 13, 2025

A zero-click attack leveraging a freshly disclosed Messages vulnerability (CVE-2025-43200) has infected the iPhones of two European journalists with Paragon’s Graphite …

Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016)

June 10, 2025

Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. …

Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113)

June 9, 2025

With an exploit for a critical Roundcube vulnerability (CVE-2025-49113) being offered for sale on underground forums and a PoC exploit having been made public, attacks …

Attackers hit MSP, use its RMM software to deliver ransomware to clients

May 28, 2025

A threat actor wielding the DragonForce ransomware has compromised an unnamed managed service provider (MSP) and pushed the malware onto its client organizations via …

Vulnerabilities found in NASA’s open source software

May 27, 2025

Vulnerabilities in open source software developed and used in-house by NASA could be exploited to breach their systems, claims Leon Juranić, security researcher and founder of …

Unpatched Windows Server vulnerability allows full domain compromise

May 22, 2025

A privilege escalation vulnerability in Windows Server 2025 can be used by attackers to compromise any user in Active Directory (AD), including Domain Admins. “The …

Flawed WordPress theme may allow admin account takeover on 22,000+ sites (CVE-2025-4322)

May 21, 2025

A critical vulnerability (CVE-2025-4322) in Motors, a WordPress theme popular with car/motor dealerships and rental services, can be easily exploited by unauthenticated …

CISA: Recently fixed Chrome vulnerability exploited in the wild (CVE-2025-4664)

May 16, 2025

A high-severity Chrome vulnerability (CVE-2025-4664) that Google has fixed on Wednesday is being leveraged by attackers, CISA has confirmed by adding the flaw to its Known …

Samsung patches MagicINFO 9 Server vulnerability exploited by attackers

May 15, 2025

Companies running Samsung MagicINFO, a platform for managing content on Samsung commercial digital displays, should upgrade to the latest available version of its v9 branch to …

Ivanti EPMM vulnerabilities exploited in the wild (CVE-2025-4427, CVE-2025-4428)

May 13, 2025

Attackers have exploited vulnerabilities in open-source libraries to compromise on-prem Ivanti Endpoint Manager Mobile (EPMM) instances of a “very limited” number …