Tag: vulnerability

U.S. CISA adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog

Dec 10, 2025 11:32 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windows

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-6218 is a WinRAR directory traversal flaw (formerly…
Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero-day

Dec 10, 2025 11:32 AM

Tags: exploit, microsoft, office, powershell, update, vulnerability, windows, zero-day

Microsoft Patch Tuesday security updates for December 2025 address 57 vulnerabilities, including three critical flaws. Microsoft Patch Tuesday security updates for December 2025 addressed 57 vulnerabilities in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Exchange Server, Azure, Copilot, PowerShell, and Windows Defender. Three vulnerabilities are rated Critical, while the rest are…
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days

Dec 10, 2025 11:32 AM

Tags: exploit, flaw, microsoft, vulnerability, windows, zero-day

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild.Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the…
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days

Dec 10, 2025 11:32 AM

Tags: exploit, flaw, microsoft, vulnerability, windows, zero-day

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild.Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the…
Key cybersecurity takeaways from the 2026 NDAA

Dec 10, 2025 8:32 AM

Tags: access, ai, attack, awareness, best-practice, control, cyber, cybersecurity, data, defense, framework, governance, government, group, guide, infrastructure, injection, intelligence, international, malicious, military, ml, mobile, monitoring, network, nist, privacy, resilience, risk, risk-assessment, service, spyware, supply-chain, theft, threat, tool, training, unauthorized, vulnerability

AI and machine learning security and procurement requirements: Recognizing that AI now underpins everything from battlefield planning to intelligence analysis, the bill introduces sweeping requirements to safeguard these systems from emerging digital threats.The NDAA spells out a spate of policy and procurement practices that the military should meet regarding artificial intelligence and machine learning (ML).…
Key cybersecurity takeaways from the 2026 NDAA

Dec 10, 2025 8:32 AM

Tags: access, ai, attack, awareness, best-practice, control, cyber, cybersecurity, data, defense, framework, governance, government, group, guide, infrastructure, injection, intelligence, international, malicious, military, ml, mobile, monitoring, network, nist, privacy, resilience, risk, risk-assessment, service, spyware, supply-chain, theft, threat, tool, training, unauthorized, vulnerability

AI and machine learning security and procurement requirements: Recognizing that AI now underpins everything from battlefield planning to intelligence analysis, the bill introduces sweeping requirements to safeguard these systems from emerging digital threats.The NDAA spells out a spate of policy and procurement practices that the military should meet regarding artificial intelligence and machine learning (ML).…
Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws

Dec 10, 2025 6:32 AM

Tags: authentication, cve, exploit, flaw, fortinet, ivanti, sap, vulnerability

Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution.The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 and First seen…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Fixed and 3 Zero-days

Dec 10, 2025 5:33 AM

Tags: cyber, exploit, flaw, microsoft, update, vulnerability, zero-day

Microsoft’s final Patch Tuesday of 2025 has been released, addressing 56 vulnerabilities across its product suite. The December update includes patches for three zero-day vulnerabilities, one of which is confirmed to be actively exploited in the wild. Among the resolved flaws, two are rated as >>Critical,>Important
Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Fixed and 3 Zero-days

Dec 10, 2025 5:33 AM

Tags: cyber, exploit, flaw, microsoft, update, vulnerability, zero-day

Microsoft’s final Patch Tuesday of 2025 has been released, addressing 56 vulnerabilities across its product suite. The December update includes patches for three zero-day vulnerabilities, one of which is confirmed to be actively exploited in the wild. Among the resolved flaws, two are rated as >>Critical,>Important
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Microsoft Patch Tuesday for December 2025, Snort rules and prominent vulnerabilities

Dec 10, 2025 1:32 AM

Tags: exploit, microsoft, update, vulnerability

The Patch Tuesday for December of 2025 includes 57 vulnerabilities, including two that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the two “critical” vulnerabilities is “less likely.” First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/microsoft-patch-tuesday-december-2025/
Microsoft Patch Tuesday for December 2025, Snort rules and prominent vulnerabilities

Dec 10, 2025 1:32 AM

Tags: exploit, microsoft, update, vulnerability

The Patch Tuesday for December of 2025 includes 57 vulnerabilities, including two that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the two “critical” vulnerabilities is “less likely.” First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/microsoft-patch-tuesday-december-2025/
Patchday: Windows 10/11 Updates (9. Dezember 2025)

Dec 10, 2025 12:32 AM

Tags: microsoft, update, vulnerability, windows

Am 9. Dezember 2025 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft kumulative Updates für die noch unterstützten Client-Betriebssystem-Versionen von Windows 10 (mit ESU-Lizenz) und Windows 11 veröffentlicht. Hier einige Details zu diesen Updates, die Schwachstellen sowie Probleme beheben … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/10/patchday-windows-10-11-updates-9-dezember-2025/
Ivanti warns customers of new EPM flaw enabling remote code execution

Dec 10, 2025 12:32 AM

Tags: cve, endpoint, flaw, ivanti, remote-code-execution, software, vulnerability, xss

Ivanti warns users to address a newly disclosed Endpoint Manager vulnerability that could let attackers execute code remotely. Software firm Ivanti addressed a newly disclosed vulnerability, tracked as CVE-2025-10573 (CVSS score 9.6), in its Endpoint Manager (EPM) solution. The vulnerability is a Stored XSS that could allow a remote unauthenticated attacker to execute arbitrary >>Stored…
SAP fixes three critical vulnerabilities across multiple products

Dec 10, 2025 12:32 AM

Tags: sap, update, vulnerability

SAP has released its December security updates addressing 14 vulnerabilities across a range of products, including three critical-severity flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-fixes-three-critical-vulnerabilities-across-multiple-products/
Microsoft Security Update Summary (9. Dezember 2025)

Dec 9, 2025 11:32 PM

Tags: microsoft, office, update, vulnerability, windows, zero-day

Microsoft hat am 9. Dezember 2025 Sicherheitsupdates für Windows-Clients und -Server, für Office sowie für weitere Produkte veröffentlicht. Die Sicherheitsupdates beseitigen 56 Schwachstellen (CVEs), eine davon wurde als 0-day klassifiziert und wird ausgenutzt. Nachfolgend findet sich ein kompakter … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/09/microsoft-security-update-summary-9-dezember-2025/
Google Patches AI Flaw That Turned Gemini Into a Spy

Dec 9, 2025 9:33 PM

Tags: ai, corporate, credentials, data, email, flaw, google, malware, spy, vulnerability

Zero-Click Vulnerability Let Attackers Weaponize Enterprise AI Assistant. Google patched a vulnerability in Gemini Enterprise that allowed attackers to steal corporate data through a shared document, calendar invitation or email without any user action or security alerts. No malware was executed, no credentials were phished and no data left through approved channels. First seen on…
Microsoft releases Windows 10 KB5071546 extended security update

Dec 9, 2025 9:33 PM

Tags: microsoft, update, vulnerability, windows, zero-day

Microsoft has released the KB5071546 extended security update to resolve 57 security vulnerabilities, including three zero-day flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5071546-extended-security-update/
Indirect Malicious Prompt Technique Targets Google Gemini Enterprise

Dec 9, 2025 8:33 PM

Tags: ai, cybercrime, google, intelligence, malicious, vulnerability

Noma Security today revealed it has discovered a vulnerability in the enterprise edition of Google Gemini that can be used to inject a malicious prompt that instructs an artificial intelligence (AI) application or agent to exfiltrate data. Dubbed GeminiJack, cybercriminals can use this vulnerability to embed a malicious prompt in, for example, a Google Doc..…
Broadside Mirai Botnet Hijacks Ship Cameras for DDoS

Dec 9, 2025 8:33 PM

Tags: access, botnet, cctv, ddos, exploit, vulnerability

The Broadside Mirai variant exploits vulnerable maritime DVRs to gain stealthy access and threaten global shipping. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/broadside-mirai-botnet-hijacks-ship-cameras-for-ddos/
Fortinet warns of critical FortiCloud SSO login auth bypass flaws

Dec 9, 2025 8:33 PM

Tags: flaw, fortinet, login, update, vulnerability

Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-forticloud-sso-login-auth-bypass-flaws/
Indirect Malicious Prompt Technique Targets Google Gemini Enterprise

Dec 9, 2025 8:33 PM

Tags: ai, cybercrime, google, intelligence, malicious, vulnerability

Noma Security today revealed it has discovered a vulnerability in the enterprise edition of Google Gemini that can be used to inject a malicious prompt that instructs an artificial intelligence (AI) application or agent to exfiltrate data. Dubbed GeminiJack, cybercriminals can use this vulnerability to embed a malicious prompt in, for example, a Google Doc..…
Windows 11 KB5072033 & KB5071417 cumulative updates released

Dec 9, 2025 8:33 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released Windows 11 KB5072033 and KB5071417 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-kb5072033-and-kb5071417-cumulative-updates-released/
Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

Dec 9, 2025 6:32 PM

Tags: access, automation, backup, breach, cloud, control, data, data-breach, defense, detection, dns, encryption, firmware, flaw, infrastructure, intelligence, Internet, metric, mobile, network, resilience, software, strategy, supply-chain, tool, update, vulnerability, zero-day

Cloud complexity and policy traps: Networks, however, no longer stay confined to racks. They live in routing tables, BGP sessions, cloud control planes and software-defined overlays. Many organizations rush to multi-region cloud setups, believing geographic distance alone guarantees resilience. It does not. Last year, I oversaw a global e-commerce platform with active-passive failover across two…