Alert

Security vulnerabilities in Apple’s AirPlay Protocol and SDK put both third-party and Apple devices at risk of various attacks, including remote code execution. Oligo Security researchers found flaws that can be exploited in zero-click and one-click remote code execution (RCE) attacks, man-in-the-middle (MITM) attacks, denial of service (DoS) attacks, and …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two high-severity security flaws affecting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) catalog on Monday due to evidence of active exploitation. The vulnerabilities in question are listed below: CVE-2025-1976 (CVSS score: 8.6): A code …

On April 24, 2025, CISA published seven advisories addressing security issues, vulnerabilities, and exploits related to Industrial Control Systems (ICS). ICSA-25-114-01 Schneider Electric Modicon Controllers ICSA-25-114-02 ALBEDO Telecom Net.Time – PTP/NTP Clock ICSA-25-114-03 Vestel AC Charger ICSA-25-114-04 Nice Linear eMerge E3 ICSA-25-114-05 Johnson Controls Software House iSTAR Configuration Utility (ICU) …

Shadow servers found 454 vulnerable SAP NetWeaver systems at risk from a critical zero-day exploit currently being used in attacks. CVE-2025-31324 is a vulnerability that lets unauthenticated attackers upload malicious files to affected systems, risking full system compromise. A severe flaw with a CVSS score of 10.0 affects the Metadata …

A critical vulnerability tracked as CVE-2025-43859 has been disclosed in h11, a minimalist, I/O-agnostic HTTP/1.1 protocol library written in Python. Rated CVSS 9.1, the flaw could enable request smuggling attacks in applications where h11 is paired with a misconfigured or buggy HTTP proxy. “A leniency in h11’s parsing of line …

NVIDIA has released a software security update for its GPU Display Driver to fix multiple vulnerabilities affecting both the driver and NVIDIA VGPU Software on various operating systems. The security bulletin lists various identified Common Vulnerabilities and Exposures (CVEs). The NVIDIA GPU Driver for Linux has a vulnerability (CVE-2025-23244) that …

The SessionShark phishing kit bypasses Office 365 MFA by stealing session tokens. Experts warn about real-time attacks using fake login pages and Telegram alerts. SlashNext security experts have found a new tool, “SessionShark,” used by cyber criminals to steal Microsoft Office 365 login information. It can bypass multi-factor authentication (MFA), …

In Q1 2025, VulnCheck identified evidence of 159 CVEs publicly disclosed for the first time as exploited in the wild. The disclosure of known exploited vulnerabilities was from 50 different sources. “We continue to see vulnerabilities being exploited at a fast pace with 28.3% of vulnerabilities being exploited within 1-day …

The NVIDIA NeMo Framework has three vulnerabilities that could enable attackers to execute remote code, risking AI system compromise and data tampering. The security flaws CVE-2025-23249, CVE-2025-23250, and CVE-2025-23251 have a CVSS base score of 7.6, indicating a significant risk to users of the popular generative AI framework. On April …

Cisco issued a security advisory about a remote code execution (RCE) vulnerability (CVE-2025-32433) affecting multiple products in its portfolio due to issues in the Erlang/OTP SSH server. The flaw with a CVSSv3.1 score of 10.0 allows unauthenticated attackers to run arbitrary code on vulnerable systems by misusing SSH message handling …