vulnerability

Critical Firefox, Tor Browser sandbox escape flaw fixed (CVE-2025-2857)

March 28, 2025

Google’s fixing of CVE-2025-2783, a Chrome zero-day vulnerability exploited by state-sponsored attackers, has spurred Firefox developers to check whether the browser …

CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825)

March 27, 2025

CrushFTP has fixed a critical vulnerability (CVE-2025-2825) in its enterprise file transfer solution that could be exploited by remote, unauthenticated attackers to access …

Ingress-nginx vulnerabilities can lead to Kubernetes cluster takeover

March 25, 2025

Wiz researchers have unearthed several critical vulnerabilities affecting Ingress NGINX Controller for Kubernetes (ingress-nginx) that may allow attackers to take over …

Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927)

March 24, 2025

A critical vulnerability (CVE-2025-29927) in the open source Next.js framework can be exploited by attackers to bypass authorization checks and gain unauthorized access to web …

NAKIVO Backup & Replication vulnerability exploited by attackers (CVE-2024-48248)

March 21, 2025

A vulnerability (CVE-2024-48248) in NAKIVO Backup and Replication, a backup, ransomware protection and disaster recovery solution designed for organizations of all sizes and …

Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120)

March 20, 2025

Veeam has released fixes for a critical remote code execution vulnerability (CVE-2025-23120) affecting its enterprise Veeam Backup & Replication solution, and is urging …

Siemens Teamcenter vulnerability could allow account takeover (CVE-2025-23363)

February 27, 2025

A high-severity vulnerability (CVE-2025-23363) in the Siemens Teamcenter product lifecycle management (PLM) software could allow an attacker to steal users’ valid …

Attackers are chaining flaws to breach Palo Alto Networks firewalls

February 19, 2025

Exploitation attempts targeting CVE-2025-0108, a recently disclosed authentication bypass vulnerability affecting the management web interface of Palo Alto Networks’ …

Swap EOL Zyxel routers, upgrade Netgear ones!

February 5, 2025

There will be no patches for EOL Zyxel routers under attack via CVE-2024-40891, the company has confirmed. Meanwhile, Netgear has issued patches for critical flaws affecting …

Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411)

February 4, 2025

CVE-2025-0411, a Mark-of-the-Web bypass vulnerability in the open-source archiver tool 7-Zip that was fixed in November 2024, has been exploited in zero-day attacks to deliver …

Man charged with stealing $65 million by exploting DeFI protocols vulnerabilities

February 4, 2025

A Canadian man has been indicted in federal court in New York for exploiting vulnerabilities in two decentralized finance (DeFi) protocols to fraudulently obtain about $65 …

Patient monitors with backdoor are sending info to China, CISA warns

January 31, 2025

Contec CMS8000, a patient monitor manufactured by a Chinese company, and Epsimed MN-120, which is the same monitor but relabeled, exfiltrate patients’ data to a …