vulnerability

Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices

April 11, 2025

A threat actor that has been using known old FortiOS vulnerabilities to breach FortiGate devices for years has also been leveraging a clever trick to maintain undetected …

FortiSwitch vulnerability may give attackers control over vulnerable devices (CVE-2024-48887)

April 10, 2025

Fortinet has released patches for flaws affecting many of its products, among them a critical vulnerability (CVE-2024-48887) in its FortiSwitch appliances that could allow …

WhatsApp vulnerability could be used to infect Windows users with malware (CVE-2025-30401)

April 9, 2025

WhatsApp users are urged to update the Windows client app to plug a serious security vulnerability (CVE-2025-30401) that may allow attackers to trick users into running …

WinRAR MotW bypass flaw fixed, update ASAP (CVE-2025-31334)

April 7, 2025

WinRAR users, upgrade your software as soon as possible: a vulnerability (CVE-2025-31334) that could allow attackers to bypass Windows’ Mark of the Web (MotW) security …

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)

April 3, 2025

A suspected Chinese APT group has exploited CVE-2025-22457 – a buffer overflow bug that was previously thought not to be exploitable – to compromise appliances …

Attackers are leveraging Cisco Smart Licensing Utility static admin credentials (CVE-2024-20439)

April 3, 2025

CVE-2024-20439, a static credential vulnerability in the Cisco Smart Licensing Utility, is being exploited by attackers in the wild, CISA has confirmed on Monday by adding the …

Critical Firefox, Tor Browser sandbox escape flaw fixed (CVE-2025-2857)

March 28, 2025

Google’s fixing of CVE-2025-2783, a Chrome zero-day vulnerability exploited by state-sponsored attackers, has spurred Firefox developers to check whether the browser …

CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825)

March 27, 2025

CrushFTP has fixed a critical vulnerability (CVE-2025-2825) in its enterprise file transfer solution that could be exploited by remote, unauthenticated attackers to access …

Ingress-nginx vulnerabilities can lead to Kubernetes cluster takeover

March 25, 2025

Wiz researchers have unearthed several critical vulnerabilities affecting Ingress NGINX Controller for Kubernetes (ingress-nginx) that may allow attackers to take over …

Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927)

March 24, 2025

A critical vulnerability (CVE-2025-29927) in the open source Next.js framework can be exploited by attackers to bypass authorization checks and gain unauthorized access to web …

NAKIVO Backup & Replication vulnerability exploited by attackers (CVE-2024-48248)

March 21, 2025

A vulnerability (CVE-2024-48248) in NAKIVO Backup and Replication, a backup, ransomware protection and disaster recovery solution designed for organizations of all sizes and …

Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120)

March 20, 2025

Veeam has released fixes for a critical remote code execution vulnerability (CVE-2025-23120) affecting its enterprise Veeam Backup & Replication solution, and is urging …