Tag: flaw
-
A rival Tea app for men is leaking its users’ personal data and driver’s licenses
The newly launched app, now trending on Apple’s App Store, contains at least one major security flaw that exposes the private information of its users, including their uploaded selfies and government-issued IDs. First seen on techcrunch.com Jump to article: techcrunch.com/2025/08/06/a-rival-tea-app-for-men-is-leaking-its-users-personal-data-and-drivers-licenses/
-
Five-Year-Old D-Link Bugs See Active Exploitation
CISA Lists Flaws as Actively Exploited. Hackers are actively exploiting years-old flaws in obsolete Wi-Fi cameras and video recorders made by D-Link, warn U.S. cybersecurity authorities. Possibly Chinese hackers have used one of the flaws to implant HiatusRAT malware. Attackers don’t care if a vulnerability is new or old. First seen on govinfosecurity.com Jump to…
-
Trend Micro fixes two actively exploited Apex One RCE flaws
Trend Micro patched two critical Apex One flaws (CVE-2025-54948, CVE-2025-54987) exploited in the wild, allowing RCE via console injection. Trend Micro released fixes for two critical vulnerabilities, tracked as CVE-2025-54948 and CVE-2025-54987 (CVSS score of 9.4), in Apex One on-prem consoles. The cybersecurity vendor confirmed that both issues were actively exploited in the wild. Both…
-
Attackers Exploit Critical Trend Micro Apex One Zero-Day Flaw
Two critical vulnerabilities affect the security vendor’s management console, one of which is under active exploitation. The company has updated cloud-based products but won’t have a patch for its on-premises version until mid-August. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/attackers-exploit-trend-micro-apex-one-zero-day-flaw
-
Top US energy companies frequently exposed to critical security flaws
A report from security firm SixMap shows that a large number of energy companies use equipment with vulnerabilities that are located on potentially exposed ports. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/top-us-energy-companies-frequently-exposed-to-critical-security-flaws/756950/
-
Nvidia patches critical Triton server bugs that threaten AI model security
This could matter to AI everywhere: Wiz researchers focused their analysis on Triton’s Python backend, citing its popularity and central role in the system. While it handles models written in Python, it also serves as a dependency for several other backendsmeaning models configured under different frameworks may still rely on it during parts of the…
-
Critical Flaw in ADOdb SQLite3 Driver Allows Arbitrary SQL Execution
A critical security vulnerability has been discovered in the popular ADOdb PHP database abstraction library that could allow attackers to execute arbitrary SQL statements, posing significant risks to applications using SQLite3 databases. The flaw, designated as CVE-2025-54119, affects all versions of ADOdb up to and including 5.22.9. Field Details CVE ID CVE-2025-54119 Vulnerability Type SQL…
-
Android gets patches for Qualcomm flaws exploited in attacks
Google has released security patches for six vulnerabilities in Android’s August 2025 security update, including two Qualcomm flaws exploited in targeted attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/android-gets-patches-for-qualcomm-flaws-exploited-in-attacks/
-
SonicWall investigates possible zero-day amid Akira ransomware surge
SonicWall probes possible new zero-day after spike in Akira ransomware attacks on Gen 7 firewalls with SSLVPN enabled. SonicWall is investigating a potential new zero-day after a surge in Akira ransomware attacks targeting Gen 7 firewalls with SSLVPN enabled. The company is working to determine if the incidents stem from an existing flaw or a…
-
Chaining NVIDIA’s Triton Server flaws exposes AI systems to remote takeover
New flaws in NVIDIA’s Triton Server let remote attackers take over systems via RCE, posing major risks to AI infrastructure. Newly revealed security flaws in NVIDIA’s Triton Inference Server for Windows and Linux could let remote, unauthenticated attackers fully take over vulnerable servers. According to Wiz Research team, chaining these vulnerabilities enables remote code execution…
-
Streamlit Vulnerability Exposes Users to Cloud Account Takeover Attacks
A critical security flaw in Streamlit, the popular open-source framework for building data applications, has been discovered that could allow cybercriminals to execute cloud account takeover attacks and manipulate financial data systems. The vulnerability, found in Streamlit’s file upload feature, demonstrates how a simple oversight in client-side validation can lead to devastating consequences for organizations…
-
Nvidia Patches Critical RCE Vulnerability Chain
The flaws in the company’s Triton Inference Server enables model theft, data leaks, and response manipulation. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/nvidia-patches-critical-rce-vulnerability-chain
-
SonicWall Investigating If Zero-Day Flaw Is Behind Recent Attacks
SonicWall said Monday it’s investigating whether a zero-day vulnerability has been exploited in cyberattacks targeting Gen 7 firewalls with SSLVPN enabled. First seen on crn.com Jump to article: www.crn.com/news/security/2025/sonicwall-investigating-if-zero-day-flaw-is-behind-recent-attacks
-
Akira Ramps Up Assault on SonicWall Firewalls, Suggesting Zero-Day
An uptick of ransomware activity by the group in late July that uses the vendor’s SSL VPN devices for initial intrusion shows evidence of an as-yet-undisclosed flaw under exploitation. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/akira-sonicwall-firewalls-zero-day
-
NVIDIA Triton Bugs Let Unauthenticated Attackers Execute Code and Hijack AI Servers
Tags: ai, control, exploit, flaw, intelligence, linux, nvidia, open-source, remote-code-execution, windowsA newly disclosed set of security flaws in NVIDIA’s Triton Inference Server for Windows and Linux, an open-source platform for running artificial intelligence (AI) models at scale, could be exploited to take over susceptible servers.”When chained together, these flaws can potentially allow a remote, unauthenticated attacker to gain complete control of the server, achieving remote…
-
LegalPwn Attack Tricks GenAI Tools Into Misclassifying Malware as Safe Code
A new security flaw, LegalPwn, exploits a weakness in generative AI tools like GitHub Copilot and ChatGPT, where malicious code is disguised as legal disclaimers. Learn why human oversight is now more critical than ever for AI security. First seen on hackread.com Jump to article: hackread.com/legalpwn-attack-genai-tools-misclassify-malware-safe-code/
-
FUJIFILM Printer Flaw Allows Attackers to Trigger DoS Attacks
FUJIFILM Business Innovation has disclosed a critical vulnerability affecting multiple printer models that could allow attackers to launch denial-of-service (DoS) attacks through specially crafted network packets. The vulnerability, tracked as CVE-2025-48499, affects the Internet Printing Protocol (IPP) and Line Printer Daemon (LPD) protocol processing capabilities of affected devices. Vulnerability Details The security flaw stems from…
-
âš¡ Weekly Recap: VPN 0-Day, Encryption Backdoor, AI Malware, macOS Flaw, ATM Hack & More
Malware isn’t just trying to hide anymore”, it’s trying to belong. We’re seeing code that talks like us, logs like us, even documents itself like a helpful teammate. Some threats now look more like developer tools than exploits. Others borrow trust from open-source platforms, or quietly build themselves out of AI-written snippets. It’s not just…
-
Bitdefender Warns Users to Update Dahua Cameras Over Critical Flaws
Security researchers at Bitdefender have found two critical vulnerabilities (CVE-2025-31700, CVE-2025-31701) in popular Dahua security cameras, including the Hero C1 model. First seen on hackread.com Jump to article: hackread.com/bitdefender-update-dahua-cameras-critical-flaws/
-
Pi-hole Data Breach Exposes Donor Emails Through WordPress Plugin Flaw
A trusted name in open-source privacy software is facing tough questions after a recent data breach exposed donor names and email addresses. Here’s what happened, why it matters, and what you need to know. What Happened? On July 28, 2025, members of the Pi-hole community reported suspicious emails sent to addresses used only for Pi-hole……
-
Lovense flaws expose emails and allow account takeover
Lovense fixed bugs exposing emails and allowing account takeovers. Company CEO may take legal action after the flaws were publicly disclosed. Lovense, a manufacturer of internet-connected sex toys, fixed two vulnerabilities that exposed users’ emails and allowed remote account takeovers. A researcher known as BobDaHacker recently disclosed the flaws after Lovense claimed it would take…
-
Critical Squid Flaw Allows Remote Code Execution by Attackers
A severe security vulnerability in the widely-used Squid HTTP proxy has been disclosed, potentially exposing millions of systems to remote code execution attacks. The flaw, designated as CVE-2025-54574 and SQUID-2025:1, represents a critical buffer overflow vulnerability in the software’s URN handling mechanism that could allow attackers to execute arbitrary code on affected systems. Vulnerability Details…
-
Critical HashiCorp Vulnerability Allows Attackers to Run Code on Host Machine
HashiCorp has disclosed a critical security vulnerability affecting its Vault products that could allow privileged operators to execute arbitrary code on the underlying host machine. The flaw, designated CVE-2025-6000 and tracked as HCSEC-2025-14, impacts both Community and Enterprise editions of Vault across multiple versions spanning several years of releases. Vulnerability Details and Impact The security…
-
AI-Powered Cursor IDE Exposes Users to Silent Remote Code Execution
Cybersecurity researchers at Aim Labs have discovered a critical vulnerability in the popular AI-powered Cursor IDE that enables attackers to achieve silent remote code execution on developer machines. The vulnerability, dubbed >>CurXecute,
-
Pi-hole Plugin Flaw Exposes Donor Names and Email Addresses in Data Breach
A Pi-hole donor has reported receiving spam email to an address created exclusively for their donation to the popular network-level ad blocker, raising concerns about a potential data breach affecting the project’s donor database. The incident, reported on Reddit’s Pi-hole community forum under investigation status, suggests that donor email addresses may have been compromised or…
-
Google Patches Vulnerability That Let Anyone Hide Search Results
Google’s Refresh Outdated Content tool was exploited to de-index a press article, exposing a flaw that allowed attackers to suppress valid web content. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-search-refresh-outdated-content-exploit/
-
Hacker Exposes Amazon Q Security Flaws Using Covert Code
A hacker recently injected code into Amazon Q in order to warn users of the platform’s potential security flaws. But the outcome could have been much worse. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-amazon-q-data-wiping-prompt-security-hack/
-
Microsoft SharePoint Hackers Switch Gears to Spread Ransomware
Threat actors exploit SharePoint flaws to access internal systems, steal sensitive data, and carry out surveillance, impersonation, and extortion. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-sharepoint-vulnerabilities-exploitation/