CISA Flags 6 Vulnerabilities – Apple, Apache, Adobe , D-Link, Joomla Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified six security vulnerabilities that are being actively exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

CVE-2023-27524 is a high-severity vulnerability in Apache Superset. It has a CVSS score of 8.9 and could allow remote code execution. The issue was resolved in version 2.1.

• International

Google to pay Texas $1.4 billion for location tracking practices

By infosecbulletin / Monday , May 12 2025

Google will pay about $1.4 billion to Texas to settle two lawsuits regarding location tracking and biometric data storage without...

Read More

• International

YouTube geo-blocks at least 4 Bangladeshi TV channels in India

By infosecbulletin / Friday , May 9 2025

YouTube has restricted access to at least four Bangladeshi television channels in India following a takedown request from the Indian...

Read More

• Alert

Microsoft Patches Four Critical Azure and Power Apps Vulns

By infosecbulletin / Friday , May 9 2025

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...

Read More

• Uncategorized

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

By infosecbulletin / Thursday , May 8 2025

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...

Read More

• Alert
• Vulnerabilities

SonicWall Patches 3 Flaws in SMA 100 Devices

By infosecbulletin / Thursday , May 8 2025

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...

Read More

• Cyber Attack
• Ransomware

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

By infosecbulletin / Thursday , May 8 2025

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...

Read More

• Alert
• Vulnerabilities

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

By infosecbulletin / Thursday , May 8 2025

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....

Read More

• Alert
• Hot Topic
• International

CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

By infosecbulletin / Wednesday , May 7 2025

Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...

Read More

• Alert

Hacker exploited Samsung MagicINFO 9 Server RCE flaw

By infosecbulletin / Wednesday , May 7 2025

Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...

Read More

• Alert

CISA adds Langflow flaw to its KEV catalog

By infosecbulletin / Tuesday , May 6 2025

CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...

Read More

In April 2023, Horizon3.ai’s Naveen Sunkavally revealed a problem with Apache Superset. The issue allows unauthorized attackers to remotely execute code, steal credentials, and compromise data.

It is currently unknown how the vulnerability is being exploited. CISA has also included five other flaws.

CVE-2023-38203 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-29300 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CVE-2023-41990 (CVSS score: 7.8) – Apple Multiple Products Code Execution Vulnerability

CVE-2016-20017 (CVSS score: 9.8) – D-Link DSL-2750B Devices Command Injection Vulnerability

CVE-2023-23752 (CVSS score: 5.3) – CVE-2023-41990, fixed in iOS 15.7.8 and iOS 16.3, was exploited by unknown actors in Operation Triangulation spyware attacks to execute code remotely via a specially crafted iMessage PDF attachment.

Federal agencies need to fix the mentioned bugs by January 29, 2024, to protect their networks from threats.