vulnerability

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610)

April 25, 2025

Researchers have uncovered three serious vulnerabilities in Rack, a server interface used by most Ruby web app frameworks (Ruby on Rails, Sinatra, Hanami, Roda, and others). …

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028)

April 24, 2025

If your organization is using Commvault Command Center for your data protection, backup creation, configuration and restoration needs, you should check whether your on-premise …

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433)

April 22, 2025

There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. “All …

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035)

April 18, 2025

CVE-2021-20035, an old vulnerability affecting Sonicwall Secure Mobile Access (SMA) 100 series appliances, is being exploited by attackers. Sonicwall confirmed it by updating …

Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)

April 17, 2025

CVE-2025-24054, a Windows NTLM hash disclosure vulnerability that Microsoft has issued patches for last month, has been leveraged by threat actors in campaigns targeting …

Critical flaws fixed in Nagios Log Server

April 15, 2025

The Nagios Security Team has fixed three critical vulnerabilities affecting popular enterprise log management and analysis platform Nagios Log Server. About the flaws The …

Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices

April 11, 2025

A threat actor that has been using known old FortiOS vulnerabilities to breach FortiGate devices for years has also been leveraging a clever trick to maintain undetected …

FortiSwitch vulnerability may give attackers control over vulnerable devices (CVE-2024-48887)

April 10, 2025

Fortinet has released patches for flaws affecting many of its products, among them a critical vulnerability (CVE-2024-48887) in its FortiSwitch appliances that could allow …

WhatsApp vulnerability could be used to infect Windows users with malware (CVE-2025-30401)

April 9, 2025

WhatsApp users are urged to update the Windows client app to plug a serious security vulnerability (CVE-2025-30401) that may allow attackers to trick users into running …

WinRAR MotW bypass flaw fixed, update ASAP (CVE-2025-31334)

April 7, 2025

WinRAR users, upgrade your software as soon as possible: a vulnerability (CVE-2025-31334) that could allow attackers to bypass Windows’ Mark of the Web (MotW) security …

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)

April 3, 2025

A suspected Chinese APT group has exploited CVE-2025-22457 – a buffer overflow bug that was previously thought not to be exploitable – to compromise appliances …

Attackers are leveraging Cisco Smart Licensing Utility static admin credentials (CVE-2024-20439)