Tag: cisa
-
U.S. CISA adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, office, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2009-0556 is a memory corruption flaw…
-
CISA tags max severity HPE OneView flaw as actively exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a maximum-severity HPE OneView vulnerability as actively exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-tags-max-severity-hpe-oneview-flaw-as-actively-exploited/
-
CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, microsoft, office, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities are listed below -CVE-2009-0556 (CVSS score: 8.8) – A code injection vulnerability in Microsoft Office First seen on thehackernews.com…
-
CISA Issues Warning on WHILL Model C2 Wheelchair Takeover Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a severe security flaw in WHILL Model C2 electric wheelchairs and Model F power chairs that could allow attackers to hijack the devices via Bluetooth. The vulnerability, tracked as CVE-2025-14346, carries a CVSS v3 score of 9.8, indicating critical severity. Security researchers…
-
CISA Alerts on Active Exploitation of MongoDB Vulnerability CVE-2025-14847
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning about the active exploitation of CVE-2025-14847, a severe vulnerability affecting MongoDB and MongoDB Server. The flaw was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on December 29, 2025, signaling that threat actors are actively targeting this security weakness in real-world attacks.…
-
CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, network, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2023-52163 (CVSS score: 8.8), relates to a case of command injection that allows post-authentication remote code First seen on thehackernews.com…
-
Take a Beat on AI, CISA Tells OT Operators
International Coalition Highlights Security Risks in OT’s Rush to AI. Hurriedly integrating AI into industrial systems isn’t the wisest idea, the U.S. Cybersecurity and Infrastructure Security Agency and its domestic and international partners warned earlier this month. We don’t want [operators] treating AI like a magical black box, explained a CISA official. First seen on…
-
CISA loses key employee behind early ransomware warnings
The future of a program that has helped prevent an estimated $9 billion in economic damages is now unclear. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-ransomware-warning-program-key-employee-left/808589/
-
U.S. CISA adds a flaw in Digiever DS-2105 Pro to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Digiever DS-2105 Pro flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Digiever DS-2105 Pro vulnerability, tracked as CVE-2023-52163 (CVSS Score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Digiever DS-2105 Pro is a network video recorder (NVR) device designed…
-
CISA flags ASUS Live Update CVE, but the attack is years old
An ASUS Live Update vulnerability tracked as CVE-2025-59374 has been making the rounds in infosec feeds, with some headlines implying recent or ongoing exploitation. A closer look, however, shows the CVE documents a historic supply-chain attack in an End-of-Life (EoL) software product, not a new attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-asus-live-update-cve-but-the-attack-is-years-old/
-
CISA warns of continued threat activity linked to Brickstorm malware
Officials provided additional evidence showing its ability to maintain persistence and evade defenses. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-warns-of-continued-threat-activity-linked-to-brickstorm-malware/808499/
-
Not all CISA-linked alerts are urgent: ASUS Live Update CVE-2025-59374
An ASUS Live Update vulnerability tracked as CVE-2025-59374 has been making the rounds in infosec feeds, with some headlines implying recent or ongoing exploitation. A closer look, however, shows the CVE documents a historic supply-chain attack in an End-of-Life (EoL) software product, not a new attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/not-all-cisa-linked-alerts-are-urgent-asus-live-update-cve-2025-59374/
-
Polygraph Controversy at CISA Sparks Internal Investigation, Six Staff Placed on Leave
A failed polygraph test taken by the acting head of the Cybersecurity and Infrastructure Security Agency (CISA) has triggered an internal investigation at the Department of Homeland Security, placing at least six long-serving career officials on administrative leave and deepening turmoil inside the federal government’s lead civilian cyber defense agency. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-acting-director-polygraph-test/
-
Security Affairs newsletter Round 555 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. ATM Jackpotting ring busted: 54 indicted by DoJ U.S. CISA adds a flaw in WatchGuard Fireware…
-
U.S. CISA adds a flaw in WatchGuard Fireware OS to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a WatchGuard Fireware OS flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WatchGuard Firebox OS vulnerability, tracked as CVE-2025-14733 (CVSS Score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is a critical out-of-bounds write vulnerability in WatchGuard Fireware…
-
‘Critical’ WatchGuard Firebox Vulnerability Exploited In Attacks
A critical-severity vulnerability impacting customers of WatchGuard’s next-generation firewall, Firebox, has seen exploitation in cyberattacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed Friday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-critical-watchguard-firebox-vulnerability-exploited-in-attacks
-
‘Critical’ WatchGuard Firebox Vulnerability Exploited In Attacks
A critical-severity vulnerability impacting customers of WatchGuard’s next-generation firewall, Firebox, has seen exploitation in cyberattacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed Friday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-critical-watchguard-firebox-vulnerability-exploited-in-attacks
-
‘Critical’ WatchGuard Firebox Vulnerability Exploited In Attacks
A critical-severity vulnerability impacting customers of WatchGuard’s next-generation firewall, Firebox, has seen exploitation in cyberattacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed Friday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-critical-watchguard-firebox-vulnerability-exploited-in-attacks
-
Actively Exploited ASUS Vulnerability Added to CISA’s KEV List
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, malicious, software, supply-chain, update, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical ASUS vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. CVE-2025-59374 affects ASUS Live Update software and stems from a sophisticated supply chain compromise that embedded malicious code into legitimate software distributions. Supply Chain Attack Details The vulnerability involves…
-
U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple and Gladinet CentreStack and Triofox flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: Cisco reported a December 10 campaign…
-
U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple and Gladinet CentreStack and Triofox flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: Cisco reported a December 10 campaign…
-
CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, malicious, supply-chain, update, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting ASUS Live Update to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2025-59374 (CVSS score: 9.3), has been described as an “embedded malicious code vulnerability” introduced by means of a supply chain compromise First…
-
DataDome’s Commitment to the CISA Secure by Design Pledge
DataDome details how it aligns with CISA’s Secure by Design Pledge, outlining strong authentication, secure defaults, supply chain security, logging, and transparency. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/datadomes-commitment-to-the-cisa-secure-by-design-pledge/
-
DataDome’s Commitment to the CISA Secure by Design Pledge
DataDome details how it aligns with CISA’s Secure by Design Pledge, outlining strong authentication, secure defaults, supply chain security, logging, and transparency. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/datadomes-commitment-to-the-cisa-secure-by-design-pledge/
-
CISA Adds Actively Exploited Fortinet Signature Verification Flaw to KEV Catalog
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, marking the latest Fortinet vulnerability being actively exploited in the wild. The flaw affects multiple Fortinet products and poses a significant threat to organisations relying on FortiCloud single sign-on (SSO) authentication. Vulnerability Details CVE-2025-59718 represents an improper…
-
CISA-Advisory warnt vor Attacken auf KRITIS
Die CISA hat Anfang Dezember ein Advisory veröffentlicht, indem verschiedene Behörden wie das BSI zusammen vor aktuellen Angriffen auf KRITIS warnen. Pro-russische Hacktivisten führen derzeit Angriffe mit geringer Wirkung auf KRITIS aus. Sie nutzen minimal gesicherte, direkt über das Internet verbundene VNC-Verbindungen (Virtual Network Computing), um in OT-Steuerungsgeräte innerhalb KRITIS einzudringen oder sich Zugang zu ihnen…
-
U.S. CISA adds a flaw in multiple Fortinet products to its Known Exploited Vulnerabilities catalog
U.S. CISA adds a vulnerability impacting multiple products to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability, tracked as CVE-2025-59718 (CVSS Score of 9.1), to its Known Exploited Vulnerabilities (KEV) catalog. Threat actors started exploiting two critical flaws, tracked as CVE-2025-59718 and CVE-2025-59719 (CVSS score of 9.1),…
-
CISA Alerts on Actively Exploited Gladinet CentreStack and Triofox Flaws
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert regarding a critical security vulnerability affecting Gladinet CentreStack and Triofox. The agency has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating that hackers are actively exploiting it in attacks. The vulnerability, identified as CVE-2025-14611, involves a serious issue with how these…
-
CISA Alerts on Actively Exploited Gladinet CentreStack and Triofox Flaws
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert regarding a critical security vulnerability affecting Gladinet CentreStack and Triofox. The agency has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating that hackers are actively exploiting it in attacks. The vulnerability, identified as CVE-2025-14611, involves a serious issue with how these…
-
FortiGate firewall credentials being stolen after vulnerabilities discovered
Tags: access, advisory, ai, attack, authentication, best-practice, breach, ceo, cisa, credentials, cve, cyberattack, cybersecurity, data, data-breach, exploit, firewall, flaw, fortinet, hacker, infrastructure, Internet, kev, least-privilege, login, malicious, network, password, software, theft, threat, update, vulnerabilityCSO. “So far, the pattern of activity has appeared to be opportunistic in nature. While it is difficult to estimate the number of devices directly vulnerable to this vulnerability, there are hundreds of thousands of Fortinet appliances accessible on the public internet through specialized search engines. This allows threat actors to opportunistically attempt exploitation against…