vulnerability

Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)

April 17, 2025

CVE-2025-24054, a Windows NTLM hash disclosure vulnerability that Microsoft has issued patches for last month, has been leveraged by threat actors in campaigns targeting …

Critical flaws fixed in Nagios Log Server

April 15, 2025

The Nagios Security Team has fixed three critical vulnerabilities affecting popular enterprise log management and analysis platform Nagios Log Server. About the flaws The …

Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices

April 11, 2025

A threat actor that has been using known old FortiOS vulnerabilities to breach FortiGate devices for years has also been leveraging a clever trick to maintain undetected …

FortiSwitch vulnerability may give attackers control over vulnerable devices (CVE-2024-48887)

April 10, 2025

Fortinet has released patches for flaws affecting many of its products, among them a critical vulnerability (CVE-2024-48887) in its FortiSwitch appliances that could allow …

WhatsApp vulnerability could be used to infect Windows users with malware (CVE-2025-30401)

April 9, 2025

WhatsApp users are urged to update the Windows client app to plug a serious security vulnerability (CVE-2025-30401) that may allow attackers to trick users into running …

WinRAR MotW bypass flaw fixed, update ASAP (CVE-2025-31334)

April 7, 2025

WinRAR users, upgrade your software as soon as possible: a vulnerability (CVE-2025-31334) that could allow attackers to bypass Windows’ Mark of the Web (MotW) security …

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)

April 3, 2025

A suspected Chinese APT group has exploited CVE-2025-22457 – a buffer overflow bug that was previously thought not to be exploitable – to compromise appliances …

Attackers are leveraging Cisco Smart Licensing Utility static admin credentials (CVE-2024-20439)

April 3, 2025

CVE-2024-20439, a static credential vulnerability in the Cisco Smart Licensing Utility, is being exploited by attackers in the wild, CISA has confirmed on Monday by adding the …

Critical Firefox, Tor Browser sandbox escape flaw fixed (CVE-2025-2857)

March 28, 2025

Google’s fixing of CVE-2025-2783, a Chrome zero-day vulnerability exploited by state-sponsored attackers, has spurred Firefox developers to check whether the browser …

CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825)

March 27, 2025

CrushFTP has fixed a critical vulnerability (CVE-2025-2825) in its enterprise file transfer solution that could be exploited by remote, unauthenticated attackers to access …

Ingress-nginx vulnerabilities can lead to Kubernetes cluster takeover

March 25, 2025

Wiz researchers have unearthed several critical vulnerabilities affecting Ingress NGINX Controller for Kubernetes (ingress-nginx) that may allow attackers to take over …

Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927)

March 24, 2025

A critical vulnerability (CVE-2025-29927) in the open source Next.js framework can be exploited by attackers to bypass authorization checks and gain unauthorized access to web …