Collecting Cyber-News from over 60 sources

Tag: cvss

Critical n8n Vulnerability Exposes 103,000+ Automation Instances to RCE Attacks

Dec 23, 2025 2:19 PM

Tags: attack, automation, cve, cvss, cyber, flaw, open-source, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in n8n, a popular open-source workflow automation platform, threatens over 103,000 potentially vulnerable instances worldwide. Tracked as CVE-2025-68613 with a maximum CVSS severity score of 9.9, the flaw allows authenticated attackers to execute arbitrary code with n8n process privileges, risking complete instance compromise. Field Description CVE-ID CVE-2025-68613 CVSS Score…
PoC Exploit Released for Critical n8n RCE Vulnerability

Dec 23, 2025 2:19 PM

Tags: automation, cve, cvss, cyber, exploit, flaw, rce, remote-code-execution, vulnerability

Security researchers have confirmed the release of proof-of-concept (PoC) exploit code for CVE-2025-68613, a critical remote code execution flaw affecting n8n workflow automation platform. The vulnerability carries a maximum CVSS score of 10.0 and impacts versions from v0.211.0 through v1.120.3. n8n is widely deployed in enterprise environments where it automates critical workflows and integrates with…
Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances

Dec 23, 2025 9:19 AM

Tags: automation, cve, cvss, exploit, flaw, vulnerability

A critical security vulnerability has been disclosed in the n8n workflow automation platform that, if successfully exploited, could result in arbitrary code execution under certain circumstances.The vulnerability, tracked as CVE-2025-68613, carries a CVSS score of 9.9 out of a maximum of 10.0. The package has about 57,000 weekly downloads, according to statistics on npm.”Under certain…
Was sich hinter der hochbrisanten und noch aktiven Schwachstelle React2Shell verbirgt

Dec 19, 2025 3:19 PM

Tags: bug, cvss, vulnerability

Anfang Dezember 2025 gab das Team hinter ‘React” der am weitesten verbreiteten Technologie für heutige Websites und digitale Dienste eine kritische Sicherheitslücke in einer seiner neuen Server-Funktion bekannt. Sicherheitsforscher nennen diesen Fehler ‘React2Shell” und stufen ihn mit CVSS 10.0 als höchst kritisch ein, da er es Fremden ermöglicht, Code auf einem Server auszuführen, […] First…
Was sich hinter der noch aktiven Schwachstelle React2Shell (CVE-2025-55182) verbirgt in einfachen Worten

Dec 19, 2025 2:19 PM

Tags: bug, cvss, vulnerability

Anfang Dezember 2025 gab das Team hinter ‘React” der am weitesten verbreiteten Technologie für heutige Websites und digitale Dienste eine kritische Sicherheitslücke in einer seiner neuen Server-Funktion bekannt. Sicherheitsforscher nennen diesen Fehler ‘React2Shell” und stufen ihn mit CVSS 10.0 als höchst kritisch ein, da er es Fremden ermöglicht, Code auf einem Server auszuführen, […] First…
HPE OneView Vulnerability Allows Remote Code Execution Attacks

Dec 18, 2025 10:19 PM

Tags: attack, cloud, cve, cvss, cyber, data, flaw, infrastructure, remote-code-execution, risk, software, vulnerability

A severe security vulnerability has been discovered in Hewlett Packard Enterprise OneView software, threatening enterprise infrastructure across data centers and hybrid cloud environments. The flaw, tracked as CVE-2025-37164, carries a maximum CVSS 3.1 severity score of 10.0, indicating critical risk requiring immediate remediation. The vulnerability permits unauthenticated remote attackers to execute arbitrary code on affected…
HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution

Dec 18, 2025 4:19 PM

Tags: control, cve, cvss, exploit, flaw, infrastructure, remote-code-execution, software, vulnerability

Hewlett Packard Enterprise (HPE) has resolved a maximum-severity security flaw in OneView Software that, if successfully exploited, could result in remote code execution.The critical vulnerability, assigned the CVE identifier CVE-2025-37164, carries a CVSS score of 10.0. HPE OneView is an IT infrastructure management software that streamlines IT operations and controls all systems via a First…
NVIDIA Isaac Lab Flaw Enables Remote Code Execution

Dec 17, 2025 9:19 AM

Tags: cve, cvss, cyber, flaw, framework, nvidia, remote-code-execution, vulnerability

NVIDIA has disclosed a critical security vulnerability in Isaac Lab, a component of the NVIDIA Isaac Sim framework, that could allow attackers to execute arbitrary code remotely. The company released security patches in December 2025 to address the deserialization flaw tracked as CVE-2025-32210. CVE ID Description CVSS Score Severity CWE CVE-2025-32210 Deserialization vulnerability in NVIDIA Isaac…
Microsoft Outlines Mitigation for React2Shell RCE Vulnerability in React Server Components

Dec 16, 2025 9:19 PM

Tags: authentication, cve, cvss, cyber, malicious, microsoft, mitigation, rce, remote-code-execution, risk, vulnerability

Microsoft has released comprehensive guidance on CVE-2025-55182, a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components and the Next.js framework. Assigned a maximum CVSS score of 10.0, this vulnerability enables attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP request, representing an unprecedented risk to modern React-based web…
Atlassian fixed maximum severity flaw CVE-2025-66516 in Apache Tika

Dec 15, 2025 5:19 PM

Tags: apache, cve, cvss, flaw, update, vulnerability

Atlassian released security updates to address dozens of flaws, including multiple critical-severity vulnerabilities. Atlassian addressed dozens of vulnerabilities impacting its products, including multiple critical-severity issues. One of the most severe bugs is a maximum-severity XML External Entity (XXE) injection flaw, tracked as CVE-2025-66516 (CVSS score of 10/10), in Apache Tika. CVE-2025-66516 carries a maximum CVSS rating…
Ivantis EPM-Systeme anfällig für Angriffe

Dec 11, 2025 2:32 PM

Tags: access, api, authentication, bug, cisa, cve, cvss, cyberattack, exploit, infrastructure, Internet, ivanti, malware, ransomware, social-engineering, software, update, vulnerability, xss

Unternehmen sollten ihre EPM-Systeme von Ivanti so bald wie möglich patchen, da dort schwerwiegende Sicherheitslücken entdeckt wurden.Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische…
Ivantis EPM-Systeme anfällig für Angriffe

Dec 11, 2025 2:32 PM

Tags: access, api, authentication, bug, cisa, cve, cvss, cyberattack, exploit, infrastructure, Internet, ivanti, malware, ransomware, social-engineering, software, update, vulnerability, xss

Unternehmen sollten ihre EPM-Systeme von Ivanti so bald wie möglich patchen, da dort schwerwiegende Sicherheitslücken entdeckt wurden.Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische…
High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking

Dec 10, 2025 2:32 PM

Tags: cve, cvss, cyber, endpoint, ivanti, malicious, risk, threat, vulnerability

A critical stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM) enables unauthenticated attackers to hijack administrator sessions by injecting malicious JavaScript into the management dashboard. The vulnerability, identified as CVE-2025-10573 with a CVSS score of 9.6, affects all versions below EPM 2024 SU4 SR1 and poses an immediate threat to enterprise environments managing…
High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking

Dec 10, 2025 2:32 PM

Tags: cve, cvss, cyber, endpoint, ivanti, malicious, risk, threat, vulnerability

A critical stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM) enables unauthenticated attackers to hijack administrator sessions by injecting malicious JavaScript into the management dashboard. The vulnerability, identified as CVE-2025-10573 with a CVSS score of 9.6, affects all versions below EPM 2024 SU4 SR1 and poses an immediate threat to enterprise environments managing…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Angriffe auf React RCE-Schwachstelle (CVE-2025-55182)

Dec 9, 2025 3:33 PM

Tags: cvss, cyberattack, rce, remote-code-execution, vulnerability

In den React Server Components gibt es eine kritische RCE-Schwachstelle (CVE-2025-55182) mit einem CVSS-Score von 10.0. Das ist seit einigen Tagen bekannt. Nun laufen massive Angriffswellen gegen verwundbare Webseiten und viele Firmenauftritte wurden bereits gehackt. React RCE-Schwachstelle (CVE-2025-55182) React ist … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/09/angriffe-auf-react-rce-schwachstelle-cve-2025-55182/
Remote Code Execution und CVSS 10.0 – React Schwachstelle öffnet Angreifern den Weg zu Web-Apps

Dec 9, 2025 7:32 AM

Tags: cvss, remote-code-execution, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/kritische-sicherheitsluecke-react-server-komponenten-nextjs-apps-a-8f3cd6d728f03f2513394f131fa15210/
Remote Code Execution und CVSS 10.0 – React Schwachstelle öffnet Angreifern den Weg zu Web-Apps

Dec 9, 2025 7:32 AM

Tags: cvss, remote-code-execution, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/kritische-sicherheitsluecke-react-server-komponenten-nextjs-apps-a-8f3cd6d728f03f2513394f131fa15210/
Warnung von Apache vor kritischer Schwachstelle in Tika-Modul

Dec 9, 2025 6:32 AM

Tags: apache, cve, cvss, software, vulnerability

Zum 4. Dezember 2025 haben die Apache-Software-Foundation vor einer kritischer Schwachstelle im Tika-Modul gewarnt. Der Schwachstelle CVE-2025-66516 wurde ein CVSS-Score von 10.0 (höchster Wert) zugewiesen. Tika erkennt und extrahiert Metadaten aus über 1.000 verschiedenen Dateiformaten. In der Mitteilung CVE-2025-66516: Apache Tika … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/07/warnung-von-apache-vor-kritischer-schwachstelle-in-tika-modul/
Critical Cal.com Flaw Allows Attackers to Bypass Authentication Using Fake TOTP Codes

Dec 8, 2025 7:35 AM

Tags: access, authentication, cve, cvss, cyber, exploit, flaw, password, unauthorized, vulnerability

Cal.com has disclosed a critical authentication bypass vulnerability that could allow attackers to gain unauthorized access to user accounts by exploiting a flaw in password verification logic. The flaw, tracked as CVE-2025-66489 and assigned a critical CVSS v4 score of 9.3, affects all versions of Cal.com up to and including 5.9.7. Users are urged to…
Critical React2Shell RCE Flaw Actively Exploited to Run Malicious Code

Dec 8, 2025 7:35 AM

Tags: attack, cve, cvss, cyber, exploit, flaw, framework, malicious, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in React Server Components has emerged as an active exploitation target, with security researchers observing widespread automated attacks across the internet. The flaw, tracked asCVE-2025-55182and dubbed >>React2Shell,
Critical React2Shell RCE Flaw Actively Exploited to Run Malicious Code

Dec 8, 2025 7:35 AM

Tags: attack, cve, cvss, cyber, exploit, flaw, framework, malicious, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in React Server Components has emerged as an active exploitation target, with security researchers observing widespread automated attacks across the internet. The flaw, tracked asCVE-2025-55182and dubbed >>React2Shell,
2.15M Next.js Web Services Exposed Online, Active Attacks Reported Update Immediately

Dec 6, 2025 9:32 AM

Tags: attack, cve, cvss, cyber, data-breach, flaw, service, update, vulnerability

Security teams worldwide are rushing to patch systems after the disclosure of a critical React vulnerability, CVE-2025-55182, widely known as “React2Shell.” The flaw affects React Server Components (RSC) and has a maximum CVSS score of 10, the highest possible rating, signaling critical impact and ease of exploitation. Censys telemetry shows that more than 2.15 million internet”‘facing services are…
2.15M Next.js Web Services Exposed Online, Active Attacks Reported Update Immediately

Dec 6, 2025 9:32 AM

Tags: attack, cve, cvss, cyber, data-breach, flaw, service, update, vulnerability

Security teams worldwide are rushing to patch systems after the disclosure of a critical React vulnerability, CVE-2025-55182, widely known as “React2Shell.” The flaw affects React Server Components (RSC) and has a maximum CVSS score of 10, the highest possible rating, signaling critical impact and ease of exploitation. Censys telemetry shows that more than 2.15 million internet”‘facing services are…
Maximum-severity XXE vulnerability discovered in Apache Tika

Dec 6, 2025 5:32 AM

Tags: apache, cve, cvss, injection, malicious, vulnerability

A maximum severity vulnerability in Apache Tika, tracked as CVE-2025-66516 (CVSS score of 10.0), allows XML external entity attacks. CVE-2025-66516 carries a maximum CVSS rating of 10.0 because it lets attackers trigger an XXE injection in Apache Tika’s core, PDF, and parser modules. An attacker can embed a malicious XFA file inside a PDF and…
Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

Dec 5, 2025 6:32 PM

Tags: apache, cve, cvss, flaw, injection, update, vulnerability

A critical security flaw has been disclosed in Apache Tika that could result in an XML external entity (XXE) injection attack.The vulnerability, tracked as CVE-2025-66516, is rated 10.0 on the CVSS scoring scale, indicating maximum severity.”Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an First seen…
China-Nexus Hackers Exploiting React2Shell Vulnerability in Active Attacks

Dec 5, 2025 2:32 PM

Tags: attack, china, cve, cvss, cyber, exploit, group, hacker, intelligence, threat, vulnerability

Within hours of the public disclosure of CVE-2025-55182 on December 3, 2025, Amazon threat intelligence teams detected active exploitation attempts from multiple China-nexus threat groups, including Earth Lamia and Jackpot Panda. This critical vulnerability in React Server Components carries a maximum CVSS score of 10.0 and poses an immediate threat to organizations running vulnerable versions…
CVSS 10.0 – Identitätsdiebstahl und Rechteausweitung in Grafana

Dec 5, 2025 7:32 AM

Tags: cvss

First seen on security-insider.de Jump to article: www.security-insider.de/grafana-sicherheitsluecke-tipps-updates-a-1c3890a8f70e6296806d6b2a9ef4dfd7/