Tag: flaw
-
Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerability
Fortra has disclosed details of a critical security flaw in GoAnywhere Managed File Transfer (MFT) software that could result in the execution of arbitrary commands.The vulnerability, tracked as CVE-2025-10035, carries a CVSS score of 10.0, indicating maximum severity.”A deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a validly forged…
-
Entra ID vulnerability exposes gaps in cloud identity trust models, experts warn
Tags: advisory, api, cloud, cve, exploit, flaw, identity, microsoft, mitigation, risk, service, technology, update, vulnerabilityPatching is done, yet the risk lingers: While CVE-2025-55241 initially carried a maximum base severity score of 10.0 out of 10, Microsoft later revised its advisory on September 4 to rate the flaw at 8.7, reflecting its own exploitability assessment.Microsoft rolled out a fix globally within days of the initial report, adding that its internal…
-
HubSpot’s Jinjava Engine Flaw Exposes Thousands of Sites to RCE Attacks
A critical security vulnerability has been discovered in HubSpot’s Jinjava template engine, potentially exposing thousands of websites and applications to remote code execution attacks. The flaw, tracked as CVE-2025-59340, carries the maximum CVSS score of 10.0, indicating the severity of the security risk. Sandbox Bypass Enables Dangerous Exploits The vulnerability stems from a sandbox bypass mechanism…
-
Zero-Click Vulnerability in ChatGPT’s Agent Enables Silent Gmail Data Theft
Researchers at Radware found a zero-click flaw in ChatGPT Deep Research agent when connected to Gmail and browsing First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerability-chatgpt-agent-gmail/
-
WatchGuard Patches Critical Firebox Firewall Flaw (CVE-2025-9242) With 9.3 CVSS Score
WatchGuard has issued security updates addressing a vulnerability, tracked as CVE-2025-9242, affecting its Firebox firewall devices. This flaw involves an out-of-bounds write weakness within the Fireware OS, potentially allowing remote attackers to execute arbitrary code on vulnerable devices configured with IKEv2 VPN. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2025-9242-vulnerability/
-
OpenAI plugs ShadowLeak bug in ChatGPT that let miscreants raid inboxes
Radware says flaw enabled hidden email prompts to trick Deep Research agent into exfiltrating sensitive data First seen on theregister.com Jump to article: www.theregister.com/2025/09/19/openai_shadowleak_bug/
-
Google pushes emergency patch for Chrome 0-day check your browser version now
Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play First seen on theregister.com Jump to article: www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
-
Google pushes emergency patch for Chrome 0-day check your browser version now
Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play First seen on theregister.com Jump to article: www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
-
WatchGuard Issues Fix for 9.3-Rated Firebox Firewall Vulnerability
WatchGuard has issued a critical security alert for its Firebox firewalls due to a serious vulnerability, CVE-2025-9242. Learn what this ‘out-of-bounds write’ flaw means, which Fireware OS versions are affected, and the urgent steps to take to protect your network from remote attacks. First seen on hackread.com Jump to article: hackread.com/watchguard-fix-for-firebox-firewall-vulnerability/
-
WatchGuard Issues Fix for 9.3-Rated Firebox Firewall Vulnerability
WatchGuard has issued a critical security alert for its Firebox firewalls due to a serious vulnerability, CVE-2025-9242. Learn what this ‘out-of-bounds write’ flaw means, which Fireware OS versions are affected, and the urgent steps to take to protect your network from remote attacks. First seen on hackread.com Jump to article: hackread.com/watchguard-fix-for-firebox-firewall-vulnerability/
-
WatchGuard Issues Fix for 9.3-Rated Firebox Firewall Vulnerability
WatchGuard has issued a critical security alert for its Firebox firewalls due to a serious vulnerability, CVE-2025-9242. Learn what this ‘out-of-bounds write’ flaw means, which Fireware OS versions are affected, and the urgent steps to take to protect your network from remote attacks. First seen on hackread.com Jump to article: hackread.com/watchguard-fix-for-firebox-firewall-vulnerability/
-
Google pushes emergency patch for Chrome 0-day check your browser version now
Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play First seen on theregister.com Jump to article: www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
-
0-Click ChatGPT Agent Flaw Exposes Gmail Data to Attackers
Researchers have discovered acritical zero-click vulnerabilityin ChatGPT’s Deep Research agent that allows attackers to silently steal sensitive Gmail data without any user interaction. This sophisticated attack leveragesservice-side exfiltrationtechniques, making it invisible to traditional security defenses and representing a significant escalation in AI agent security threats. The Silent Data Theft Mechanism As per a report, the…
-
CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday released details of two sets of malware that were discovered in an unnamed organization’s network following the exploitation of security flaws in Ivanti Endpoint Manager Mobile (EPMM).”Each set contains loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised…
-
Entra ID Bug Could Have Exposed Every Microsoft Tenant
A flaw in Entra ID let attackers seize Microsoft tenants; learn how the patch and best practices protect cloud identity. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/entra-id-bug-microsoft-tenant/
-
WatchGuard patches ‘critical’ VPN flaw in firewalls that could lead to compromise
Who is affected?: A list of the nearly three dozen firewall models affected by CVE-2025-9242 is available from WatchGuard’s website. The vulnerable versions of the Fireware OS are 2025.1, 12.x, 12.5.x (T15 & T35 models), 12.3.1 (FIPS-certified release), and 11.x (end of life). These are addressed (in the same order) by updating to versions 2025.1.1,…
-
Google pushes emergency patch for Chrome 0-day – check your browser version now
Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play First seen on theregister.com Jump to article: www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
-
This Microsoft Entra ID Vulnerability Could Have Been Catastrophic
A pair of flaws in Microsoft’s Entra ID identity and access management system could have allowed an attacker to gain access to virtually all Azure customer accounts. First seen on wired.com Jump to article: www.wired.com/story/microsoft-entra-id-vulnerability-digital-catastrophe/
-
Google Confirms Real-World Attacks on Chrome Vulnerability CVE-2025-10585
Google has issued an urgent security alert for all users of its Chrome browser, confirming that an active exploit targeting a critical vulnerability, CVE-2025-10585, is currently being used in real-world attacks. The flaw resides in Chromium’s V8 JavaScript engine and has prompted Google to release an emergency update for all desktop versions of Chrome. First…
-
Google Confirms Real-World Attacks on Chrome Vulnerability CVE-2025-10585
Google has issued an urgent security alert for all users of its Chrome browser, confirming that an active exploit targeting a critical vulnerability, CVE-2025-10585, is currently being used in real-world attacks. The flaw resides in Chromium’s V8 JavaScript engine and has prompted Google to release an emergency update for all desktop versions of Chrome. First…
-
TP-Link Router Zero-Day Lets Attackers Execute Code by Bypassing ASLR
Researchers have uncovered a zero-day vulnerability in TP-Link routers that allows attackers to bypass Address Space Layout Randomization (ASLR) and execute arbitrary code remotely. Tracked as CVE-2025-9961, this flaw resides in the CWMP (TR-069) binary and can be triggered through malformed SOAP requests, granting full control of affected devices. A detailed technical walkthrough of discovery,…
-
Critical WatchGuard Vulnerability Lets Unauthenticated Attackers Run Arbitrary Code
WatchGuard released an advisory detailing a critical vulnerability in its Firebox line of network security appliances. Tracked as CVE-2025-9242, the flaw resides in the iked component of WatchGuard’s Fireware OS. An out-of-bounds write in the IKEv2 handling routine can allow a remote, unauthenticated attacker to execute arbitrary code on affected devices. Overview of the Vulnerability…
-
Zero Day Malware
Cybersecurity is a race against time. Every day, businesses face sophisticated threats designed to exploit the smallest vulnerabilities. Among the most dangerous of these are Zero Day Malware attacks, malicious software that targets unknown flaws before vendors or defenders even know they exist. Zero day malware represents the pinnacle of stealth and danger. Unlike First…
-
Zero Day Malware
Cybersecurity is a race against time. Every day, businesses face sophisticated threats designed to exploit the smallest vulnerabilities. Among the most dangerous of these are Zero Day Malware attacks, malicious software that targets unknown flaws before vendors or defenders even know they exist. Zero day malware represents the pinnacle of stealth and danger. Unlike First…
-
Hackers Abuse RTL/LTR Text Tricks and Browser Flaws to Mask Malicious Links
Cybersecurity researchers at Varonis Threat Labs have uncovered a persistent vulnerability that has remained unaddressed for over a decade, allowing attackers to exploit browser handling of Right-to-Left (RTL) and Left-to-Right (LTR) text scripts to create deceptive URLs. This technique, known as BiDi Swap, enables threat actors to craft malicious links that appear legitimate to unsuspecting…
-
Apple Releases iOS 26, macOS Tahoe 26 and 50+ Security Fixes
Apple just fixed more than 50 security flaws across iPhone, iPad, Mac, Watch, TV, and Vision Pro. The post Apple Releases iOS 26, macOS Tahoe 26 and 50+ Security Fixes appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-ios26-macos26-release-security-fixes/
-
Microsoft OneDrive Auto-Sync Flaw Leaks Enterprise Secrets from SharePoint Online
A new report from Entro Labs reveals that one in five exposed secrets in large organizations can be traced back to SharePoint. Rather than a flaw in SharePoint itself, the real culprit is a simple convenience feature: OneDrive’s default auto-sync. When OneDrive silently backs up key folders like Desktop and Documents to SharePoint Online, it…
-
Apple Patches 0-Day Vulnerabilities in Older iPhones and iPads
Apple has released critical security updates for older iPhone and iPad models, addressing a zero-day vulnerability that has reportedly been exploited in sophisticated targeted attacks. The iOS 16.7.12 and iPadOS 16.7.12 updates, released on September 15, 2025, patch a serious security flaw affecting legacy Apple devices. Active Exploitation Confirmed The vulnerability, tracked as CVE-2025-43300, represents…
-
Chaos Mesh Critical Vulnerabilities Expose Kubernetes Clusters to Takeover
Security Research recently uncovered four new flaws, CVE-2025-59358, CVE-2025-59359, CVE-2025-59360, and CVE-2025-59361, in the default configuration of the Chaos Controller Manager GraphQL server, a popular open-source chaos engineering platform for Kubernetes. Three of these flaws carry a maximum CVSS 3.1 score of 9.8, enabling any pod in the cluster to run arbitrary commands or inject…