Vulnerabilities

CISA Adds Actively Exploited Sierra Wireless Router Flaw Allowing RCE Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high severity flaw affecting Sierra Wireless AirLink ALEOS routers to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The vulnerability, tracked as CVE-2018-4063, allows remote code execution (RCE) through a specially crafted HTTP request. CVE-2018-4063 Overview The vulnerability involves an unrestricted […]

CISA Adds Actively Exploited Sierra Wireless Router Flaw Allowing RCE Attacks Read More »

New React RSC Vulnerabilities Allow DoS Attacks and Source Code Exposure

The React development team has released security updates addressing two newly identified classes of vulnerabilities in React Server Components (RSC). If exploited, these weaknesses could allow attackers to trigger denial of service conditions or expose application source code, expanding the risk surface for environments already under pressure from recent React-related flaws. According to the React

New React RSC Vulnerabilities Allow DoS Attacks and Source Code Exposure Read More »

Unpatched Gogs Zero Day Actively Exploited Across More Than 700 Instances

A newly discovered and unpatched security vulnerability in Gogs is being actively exploited in the wild, with more than 700 compromised instances currently accessible over the internet. The findings were disclosed by Wiz following an investigation into a real world malware incident. The vulnerability, tracked as CVE-2025-8110 with a CVSS score of 8.7, affects the

Unpatched Gogs Zero Day Actively Exploited Across More Than 700 Instances Read More »

Active Attacks Abuse Gladinet Hard Coded Keys to Gain Unauthorized Access and Execute Code

Cybersecurity researchers are warning of ongoing attacks targeting Gladinet CentreStack and Triofox deployments, where threat actors are actively exploiting a weakness caused by hard coded cryptographic keys. According to new findings from Huntress, at least nine organizations have already been impacted. Security researcher Bryan Masters explained that the flaw allows attackers to access sensitive configuration

Active Attacks Abuse Gladinet Hard Coded Keys to Gain Unauthorized Access and Execute Code Read More »

.NET SOAPwn Flaw Enables File Writes and Remote Code Execution Through Rogue WSDL

Cybersecurity researchers have revealed a serious exploitation technique affecting enterprise applications built on the .NET ecosystem, enabling attackers to perform arbitrary file writes and potentially achieve remote code execution. The research was conducted by WatchTowr Labs, which internally named the issue SOAPwn. According to the researchers, the flaw stems from how certain .NET components process

.NET SOAPwn Flaw Enables File Writes and Remote Code Execution Through Rogue WSDL Read More »

WinRAR Vulnerability CVE-2025-6218 Actively Targeted by Multiple Threat Groups

A newly disclosed security flaw in WinRAR has been added to the U S Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog after investigators confirmed that threat actors are actively abusing it. The flaw, tracked as CVE-2025-6218 with a severity score of 7 point 8, is a path traversal issue that can

WinRAR Vulnerability CVE-2025-6218 Actively Targeted by Multiple Threat Groups Read More »

Fortinet, Ivanti, and SAP Release Urgent Fixes for Authentication and Code Execution Vulnerabilities

Security teams across multiple industries are racing to deploy urgent updates after Fortinet, Ivanti, and SAP released patches for high risk vulnerabilities that could allow attackers to bypass authentication controls or execute malicious code. The newly disclosed flaws are considered especially dangerous because of their potential to provide remote, unauthenticated access to critical systems at

Fortinet, Ivanti, and SAP Release Urgent Fixes for Authentication and Code Execution Vulnerabilities Read More »

Sneeit WordPress RCE Exploited in the Wild, and ICTBroadcast Bug Powering Frost Botnet Attacks

A severe security weakness found in the Sneeit Framework plugin for WordPress is currently being abused across live sites, based on information shared by Wordfence. The flaw, tracked as CVE-2025-6389 with a CVSS rating of 9.8, affects every version up to 8.3. Developers fixed the issue in version 8.4 released on August 5, 2025. The

Sneeit WordPress RCE Exploited in the Wild, and ICTBroadcast Bug Powering Frost Botnet Attacks Read More »

Researchers Find More Than 30 Flaws in AI Coding Tools Allowing Data Theft and RCE Attacks

Security analysts have uncovered more than 30 vulnerabilities across several artificial intelligence powered Integrated Development Environments that blend prompt injection weaknesses with trusted development features. These issues enable information theft and remote code execution. The combined flaws have been named IDEsaster by security researcher Ari Marzouk, also known as MaccariTA. The findings affect a wide

Researchers Find More Than 30 Flaws in AI Coding Tools Allowing Data Theft and RCE Attacks Read More »

Critical React2Shell Flaw Added to CISA KEV After Active Exploitation Confirmed

The United States Cybersecurity and Infrastructure Security Agency  (CISA) has officially added a severe security flaw in React Server Components to its Known Exploited Vulnerabilities (KEV) catalog following confirmed exploitation attempts in live environments. React2Shell Classified as a Maximum Severity Threat The vulnerability is tracked as CVE-2025-55182 with a CVSS score of 10.0. It involves a remote

Critical React2Shell Flaw Added to CISA KEV After Active Exploitation Confirmed Read More »