Tag: cvss

CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

Dec 30, 2025 6:52 PM

Tags: cve, cvss, cyber, email, exploit, flaw, remote-code-execution, software, vulnerability

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution.The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution…
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

Dec 30, 2025 6:52 PM

Tags: cve, cvss, cyber, email, exploit, flaw, remote-code-execution, software, vulnerability

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution.The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution…
React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web

Dec 29, 2025 12:55 PM

Tags: access, attack, backdoor, botnet, china, cvss, data, data-breach, espionage, exploit, flaw, framework, google, group, intelligence, Internet, linux, metric, network, remote-code-execution, service, strategy, tool, update, vulnerability

What the research quickly agreed on: Across early reports from Wiz, Palo Alto Networks’ Unit 42, Google AWS, and others, there was a strong alignment on the core mechanics of React2Shell. Researchers independently confirmed that the flaw lives inside React’s server-side rendering pipeline and stems from unsafe deserialization in the protocol used to transmit component…
NVIDIA Isaac Vulnerabilities Enable Remote Code Execution Attacks

Dec 24, 2025 7:19 PM

Tags: attack, cvss, cyber, flaw, nvidia, remote-code-execution, update, vulnerability

NVIDIA released critical security updates for its Isaac Launchable platform on December 23, 2025, addressing three severe vulnerabilities that could allow unauthenticated attackers to execute arbitrary code remotely. All three flaws carry a maximum CVSS score of 9.8, placing them in the critical severity category and requiring immediate attention from affected organizations. The security bulletin…
How to communicate cyber risk in commercial terms

Dec 24, 2025 12:19 AM

Tags: attack, business, cvss, cyber, risk, threat, vulnerability

Cyber risk is often discussed in technical language, often in a way which is difficult to decipher the real business impact. CVSS scores, vulnerabilities, attack paths and threat actors all have their place but for many decision”‘makers, this language doesn’t translate into real-world business outcomes. Small business leaders and non-technical executives need to understand what”¦…
The 3% Rule: How To Silence 97% of Your Cloud Alerts and Be More Secure

Dec 23, 2025 6:19 PM

Tags: access, ai, attack, breach, business, cloud, cve, cvss, data, data-breach, flaw, iam, identity, infrastructure, least-privilege, malicious, metric, network, ransomware, risk, security-incident, service, software, strategy, threat, tool, update, vulnerability, vulnerability-management

Prioritizing what to fix first and why that really matters Key takeaways The 97% distraction: Discover why the vast majority of your “Critical” alerts are just theoretical noise, and how focusing strictly on the 3% of findings that represent real, exploitable risk can drastically improve your security posture. Identity is the accelerant: Breaches rarely happen…
Critical n8n Vulnerability Exposes 103,000+ Automation Instances to RCE Attacks

Dec 23, 2025 2:19 PM

Tags: attack, automation, cve, cvss, cyber, flaw, open-source, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in n8n, a popular open-source workflow automation platform, threatens over 103,000 potentially vulnerable instances worldwide. Tracked as CVE-2025-68613 with a maximum CVSS severity score of 9.9, the flaw allows authenticated attackers to execute arbitrary code with n8n process privileges, risking complete instance compromise. Field Description CVE-ID CVE-2025-68613 CVSS Score…
PoC Exploit Released for Critical n8n RCE Vulnerability

Dec 23, 2025 2:19 PM

Tags: automation, cve, cvss, cyber, exploit, flaw, rce, remote-code-execution, vulnerability

Security researchers have confirmed the release of proof-of-concept (PoC) exploit code for CVE-2025-68613, a critical remote code execution flaw affecting n8n workflow automation platform. The vulnerability carries a maximum CVSS score of 10.0 and impacts versions from v0.211.0 through v1.120.3. n8n is widely deployed in enterprise environments where it automates critical workflows and integrates with…
Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances

Dec 23, 2025 9:19 AM

Tags: automation, cve, cvss, exploit, flaw, vulnerability

A critical security vulnerability has been disclosed in the n8n workflow automation platform that, if successfully exploited, could result in arbitrary code execution under certain circumstances.The vulnerability, tracked as CVE-2025-68613, carries a CVSS score of 9.9 out of a maximum of 10.0. The package has about 57,000 weekly downloads, according to statistics on npm.”Under certain…
Was sich hinter der hochbrisanten und noch aktiven Schwachstelle React2Shell verbirgt

Dec 19, 2025 3:19 PM

Tags: bug, cvss, vulnerability

Anfang Dezember 2025 gab das Team hinter ‘React” der am weitesten verbreiteten Technologie für heutige Websites und digitale Dienste eine kritische Sicherheitslücke in einer seiner neuen Server-Funktion bekannt. Sicherheitsforscher nennen diesen Fehler ‘React2Shell” und stufen ihn mit CVSS 10.0 als höchst kritisch ein, da er es Fremden ermöglicht, Code auf einem Server auszuführen, […] First…
Was sich hinter der noch aktiven Schwachstelle React2Shell (CVE-2025-55182) verbirgt in einfachen Worten

Dec 19, 2025 2:19 PM

Tags: bug, cvss, vulnerability

Anfang Dezember 2025 gab das Team hinter ‘React” der am weitesten verbreiteten Technologie für heutige Websites und digitale Dienste eine kritische Sicherheitslücke in einer seiner neuen Server-Funktion bekannt. Sicherheitsforscher nennen diesen Fehler ‘React2Shell” und stufen ihn mit CVSS 10.0 als höchst kritisch ein, da er es Fremden ermöglicht, Code auf einem Server auszuführen, […] First…
HPE OneView Vulnerability Allows Remote Code Execution Attacks

Dec 18, 2025 10:19 PM

Tags: attack, cloud, cve, cvss, cyber, data, flaw, infrastructure, remote-code-execution, risk, software, vulnerability

A severe security vulnerability has been discovered in Hewlett Packard Enterprise OneView software, threatening enterprise infrastructure across data centers and hybrid cloud environments. The flaw, tracked as CVE-2025-37164, carries a maximum CVSS 3.1 severity score of 10.0, indicating critical risk requiring immediate remediation. The vulnerability permits unauthenticated remote attackers to execute arbitrary code on affected…
HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution

Dec 18, 2025 4:19 PM

Tags: control, cve, cvss, exploit, flaw, infrastructure, remote-code-execution, software, vulnerability

Hewlett Packard Enterprise (HPE) has resolved a maximum-severity security flaw in OneView Software that, if successfully exploited, could result in remote code execution.The critical vulnerability, assigned the CVE identifier CVE-2025-37164, carries a CVSS score of 10.0. HPE OneView is an IT infrastructure management software that streamlines IT operations and controls all systems via a First…
NVIDIA Isaac Lab Flaw Enables Remote Code Execution

Dec 17, 2025 9:19 AM

Tags: cve, cvss, cyber, flaw, framework, nvidia, remote-code-execution, vulnerability

NVIDIA has disclosed a critical security vulnerability in Isaac Lab, a component of the NVIDIA Isaac Sim framework, that could allow attackers to execute arbitrary code remotely. The company released security patches in December 2025 to address the deserialization flaw tracked as CVE-2025-32210. CVE ID Description CVSS Score Severity CWE CVE-2025-32210 Deserialization vulnerability in NVIDIA Isaac…
Microsoft Outlines Mitigation for React2Shell RCE Vulnerability in React Server Components

Dec 16, 2025 9:19 PM

Tags: authentication, cve, cvss, cyber, malicious, microsoft, mitigation, rce, remote-code-execution, risk, vulnerability

Microsoft has released comprehensive guidance on CVE-2025-55182, a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components and the Next.js framework. Assigned a maximum CVSS score of 10.0, this vulnerability enables attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP request, representing an unprecedented risk to modern React-based web…
Atlassian fixed maximum severity flaw CVE-2025-66516 in Apache Tika

Dec 15, 2025 5:19 PM

Tags: apache, cve, cvss, flaw, update, vulnerability

Atlassian released security updates to address dozens of flaws, including multiple critical-severity vulnerabilities. Atlassian addressed dozens of vulnerabilities impacting its products, including multiple critical-severity issues. One of the most severe bugs is a maximum-severity XML External Entity (XXE) injection flaw, tracked as CVE-2025-66516 (CVSS score of 10/10), in Apache Tika. CVE-2025-66516 carries a maximum CVSS rating…
Ivantis EPM-Systeme anfällig für Angriffe

Dec 11, 2025 2:32 PM

Tags: access, api, authentication, bug, cisa, cve, cvss, cyberattack, exploit, infrastructure, Internet, ivanti, malware, ransomware, social-engineering, software, update, vulnerability, xss

Unternehmen sollten ihre EPM-Systeme von Ivanti so bald wie möglich patchen, da dort schwerwiegende Sicherheitslücken entdeckt wurden.Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische…
Ivantis EPM-Systeme anfällig für Angriffe

Dec 11, 2025 2:32 PM

Tags: access, api, authentication, bug, cisa, cve, cvss, cyberattack, exploit, infrastructure, Internet, ivanti, malware, ransomware, social-engineering, software, update, vulnerability, xss

Unternehmen sollten ihre EPM-Systeme von Ivanti so bald wie möglich patchen, da dort schwerwiegende Sicherheitslücken entdeckt wurden.Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische…
High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking

Dec 10, 2025 2:32 PM

Tags: cve, cvss, cyber, endpoint, ivanti, malicious, risk, threat, vulnerability

A critical stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM) enables unauthenticated attackers to hijack administrator sessions by injecting malicious JavaScript into the management dashboard. The vulnerability, identified as CVE-2025-10573 with a CVSS score of 9.6, affects all versions below EPM 2024 SU4 SR1 and poses an immediate threat to enterprise environments managing…
High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking

Dec 10, 2025 2:32 PM

Tags: cve, cvss, cyber, endpoint, ivanti, malicious, risk, threat, vulnerability

A critical stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM) enables unauthenticated attackers to hijack administrator sessions by injecting malicious JavaScript into the management dashboard. The vulnerability, identified as CVE-2025-10573 with a CVSS score of 9.6, affects all versions below EPM 2024 SU4 SR1 and poses an immediate threat to enterprise environments managing…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Angriffe auf React RCE-Schwachstelle (CVE-2025-55182)

Dec 9, 2025 3:33 PM

Tags: cvss, cyberattack, rce, remote-code-execution, vulnerability

In den React Server Components gibt es eine kritische RCE-Schwachstelle (CVE-2025-55182) mit einem CVSS-Score von 10.0. Das ist seit einigen Tagen bekannt. Nun laufen massive Angriffswellen gegen verwundbare Webseiten und viele Firmenauftritte wurden bereits gehackt. React RCE-Schwachstelle (CVE-2025-55182) React ist … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/09/angriffe-auf-react-rce-schwachstelle-cve-2025-55182/
Remote Code Execution und CVSS 10.0 – React Schwachstelle öffnet Angreifern den Weg zu Web-Apps

Dec 9, 2025 7:32 AM

Tags: cvss, remote-code-execution, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/kritische-sicherheitsluecke-react-server-komponenten-nextjs-apps-a-8f3cd6d728f03f2513394f131fa15210/
Remote Code Execution und CVSS 10.0 – React Schwachstelle öffnet Angreifern den Weg zu Web-Apps

Dec 9, 2025 7:32 AM

Tags: cvss, remote-code-execution, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/kritische-sicherheitsluecke-react-server-komponenten-nextjs-apps-a-8f3cd6d728f03f2513394f131fa15210/
Warnung von Apache vor kritischer Schwachstelle in Tika-Modul

Dec 9, 2025 6:32 AM

Tags: apache, cve, cvss, software, vulnerability

Zum 4. Dezember 2025 haben die Apache-Software-Foundation vor einer kritischer Schwachstelle im Tika-Modul gewarnt. Der Schwachstelle CVE-2025-66516 wurde ein CVSS-Score von 10.0 (höchster Wert) zugewiesen. Tika erkennt und extrahiert Metadaten aus über 1.000 verschiedenen Dateiformaten. In der Mitteilung CVE-2025-66516: Apache Tika … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/07/warnung-von-apache-vor-kritischer-schwachstelle-in-tika-modul/
Critical Cal.com Flaw Allows Attackers to Bypass Authentication Using Fake TOTP Codes

Dec 8, 2025 7:35 AM

Tags: access, authentication, cve, cvss, cyber, exploit, flaw, password, unauthorized, vulnerability

Cal.com has disclosed a critical authentication bypass vulnerability that could allow attackers to gain unauthorized access to user accounts by exploiting a flaw in password verification logic. The flaw, tracked as CVE-2025-66489 and assigned a critical CVSS v4 score of 9.3, affects all versions of Cal.com up to and including 5.9.7. Users are urged to…
Critical React2Shell RCE Flaw Actively Exploited to Run Malicious Code

Dec 8, 2025 7:35 AM

Tags: attack, cve, cvss, cyber, exploit, flaw, framework, malicious, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in React Server Components has emerged as an active exploitation target, with security researchers observing widespread automated attacks across the internet. The flaw, tracked asCVE-2025-55182and dubbed >>React2Shell,
Critical React2Shell RCE Flaw Actively Exploited to Run Malicious Code

Dec 8, 2025 7:35 AM

Tags: attack, cve, cvss, cyber, exploit, flaw, framework, malicious, rce, remote-code-execution, vulnerability

A critical remote code execution vulnerability in React Server Components has emerged as an active exploitation target, with security researchers observing widespread automated attacks across the internet. The flaw, tracked asCVE-2025-55182and dubbed >>React2Shell,