CVE-2025-68164 is a low-severity information disclosure vulnerability in JetBrains TeamCity versions prior to 2025.11. It allows an authenticated user with high privileges to perform port enumeration via the Perforce connection test feature. The vulnerability does not impact integrity or availability and requires no user interaction beyond authentication. There are no known exploits in the wild, and no patches have been published yet. The CVSS score is 2.7, reflecting limited confidentiality impact and the need for privileged access. European organizations using TeamCity, especially those integrating Perforce for version control, should be aware of this issue. Mitigation involves restricting high-privilege access, monitoring usage of the Perforce connection test, and applying patches once available. Countries with significant software development sectors and JetBrains customer bases, such as Germany, France, and the UK, are more likely to be affected.
CVE-2025-68163 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity versions prior to 2025.11, specifically on the agentpushInstall page. The vulnerability allows an attacker with high privileges and requiring user interaction to inject malicious scripts that are stored and executed in the context of other users. The CVSS score is 3.5 (low severity) due to the requirement of privileges and user interaction, and the limited impact on confidentiality and integrity. No known exploits are currently in the wild. European organizations using TeamCity should be aware of this vulnerability and apply updates once available. The threat primarily affects development and CI/CD environments where TeamCity is deployed. Mitigation involves restricting access to the affected page, monitoring for suspicious activity, and applying patches when released. Countries with significant software development sectors and high adoption of JetBrains tools, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2025-68162 is a low-severity vulnerability in JetBrains TeamCity versions before 2025.11, involving the Maven embedder's ability to load extensions via project configuration. This CWE-829 weakness allows an attacker with high privileges to load potentially malicious extensions, leading to integrity impacts without affecting confidentiality or availability. Exploitation requires authenticated access with high privileges and no user interaction. Although the CVSS score is low (2.7), the vulnerability could allow unauthorized modification of build processes or configurations. No known exploits are currently reported in the wild. European organizations using TeamCity for CI/CD pipelines should review their access controls and update to the fixed version once available. Countries with significant software development industries and widespread TeamCity adoption are more likely to be impacted. Mitigations include restricting high privilege accounts, auditing project configurations, and monitoring for unusual extension loads.
This case study demonstrates an autonomous application security (AppSec) workflow using Chrome DevTools via the MCP protocol against the OWASP Juice Shop vulnerable web application. The findings include stack-trace exposure due to improper error handling and a directory traversal vulnerability that allows retrieval of confidential files. The workflow significantly reduces testing time from 600 minutes to 3.5 minutes, highlighting the efficiency of agent-based and browser-level tooling in AppSec. Although the vulnerabilities are well-known classes, their presence in Juice Shop serves as a proof of concept for automated detection. No known exploits are currently in the wild. The threat primarily illustrates the potential for automated tools to uncover critical web application flaws quickly. European organizations running web applications with similar misconfigurations or using Chrome DevTools-based automation should be aware of these risks. Mitigation involves improving error handling, validating and sanitizing user inputs to prevent directory traversal, and integrating automated security testing into development pipelines. Countries with strong web application development sectors and high adoption of Chrome-based tooling, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted.
An autonomous code analyzer has outperformed all human teams in identifying zero-day vulnerabilities in open-source software (OSS) during a recent competition. This development highlights a significant advancement in automated vulnerability discovery capabilities. While no specific vulnerabilities or affected software versions have been disclosed, the emergence of such powerful automated tools could accelerate the identification and potential exploitation of zero-day flaws. European organizations relying heavily on OSS may face increased risk exposure if threat actors adopt similar technologies. The threat does not currently have known exploits in the wild, but the critical severity suggests a high potential impact. Mitigation should focus on enhancing OSS security auditing, integrating automated analysis tools, and improving incident response readiness. Countries with strong OSS development communities and critical infrastructure dependent on OSS are most likely to be affected. Given the potential for rapid discovery and exploitation of vulnerabilities, the suggested severity is critical. Defenders should prioritize proactive vulnerability management and continuous monitoring to mitigate emerging risks from automated zero-day discovery tools.
CVE-2025-64725 is a low-severity vulnerability in Weblate versions prior to 5.15 that allows a user to accept an invitation intended for a different user due to incorrect user management (CWE-286). This flaw can lead to unauthorized acceptance of invitations if a session with an invitation is left unattended. The vulnerability requires local access with low privileges, user interaction, and has a high attack complexity, limiting its exploitability. No known exploits are currently in the wild, and a patch is available in version 5.15. European organizations using Weblate should update promptly and avoid leaving invitation sessions unattended to mitigate risk. The impact is limited mainly to confidentiality and integrity of invitation acceptance, with no direct availability impact. Countries with significant open source development and localization activities, such as Germany, France, and the UK, are more likely to be affected due to higher Weblate usage. Overall, the threat is low but warrants attention in environments where Weblate is used for collaborative translation projects.
Frogblight is a medium-severity Android banking Trojan primarily targeting users in Turkey. It masquerades as legitimate apps, initially as a court case file viewer and later as common apps like Chrome, to trick victims into installation. The malware steals banking credentials via official government websites and has extensive spyware capabilities, including SMS interception, app enumeration, device info collection, and sending arbitrary SMS messages. It employs advanced persistence and anti-deletion techniques and is distributed mainly through smishing campaigns exploiting legal concerns. Although currently focused on Turkey, its sophisticated remote control features and ongoing development pose risks if it spreads. No CVSS score exists, but the threat impacts confidentiality and integrity significantly with moderate ease of exploitation and no user interaction beyond initial install. European organizations with Turkish-speaking users or business ties should monitor for potential spillover. Mitigations include user education on smishing, app installation restrictions, SMS monitoring, and enhanced mobile endpoint protection.
CVE-2025-60786 is a high-severity Zip Slip vulnerability affecting the import project component of iceScrum v7.54 Pro On-prem. It allows attackers with limited privileges to execute arbitrary code by uploading a specially crafted ZIP file. The vulnerability stems from improper validation of file paths during ZIP extraction, leading to directory traversal and potential overwriting of critical files. Exploitation does not require user interaction but does require some level of privilege (PR:L). No known exploits are currently in the wild. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 8.8. European organizations using iceScrum Pro On-prem should prioritize patching and implement strict file validation and access controls to mitigate risk. Countries with significant software development sectors and iceScrum adoption are most at risk.
A security researcher has developed an open-source AI-powered autonomous exploitation framework using a 1.7 billion parameter model (Qwen3) that automates reconnaissance, vulnerability analysis, and exploit execution locally without relying on paid APIs. This tool leverages LangGraph's ReAct agents to chain offensive security tasks, potentially lowering the barrier for attackers to conduct complex exploits. Although no specific vulnerabilities or affected software versions are identified, the framework's capability to autonomously discover and exploit vulnerabilities poses a significant risk. There are currently no known exploits in the wild using this tool, but its availability could accelerate the development and deployment of automated attacks. European organizations could face increased threats, especially those with exposed internet-facing assets and legacy or unpatched systems. Mitigation requires proactive vulnerability management, network segmentation, and enhanced monitoring for automated attack patterns. Countries with advanced digital infrastructure and high-value targets, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the potential for remote code execution and full automation without user interaction, the threat severity is assessed as high. Defenders should prioritize detection of AI-driven attack behaviors and invest in threat intelligence to anticipate evolving exploitation techniques.
MITRE has published its list of the top 25 most dangerous software weaknesses projected for 2025, highlighting critical areas of software security risk. This list serves as a prioritized guide for developers, security professionals, and organizations to focus their vulnerability management and secure coding efforts. While no specific exploits are currently known in the wild for these weaknesses, their identification underscores potential future attack vectors. European organizations relying on software development and deployment must pay close attention to these weaknesses to prevent exploitation that could compromise confidentiality, integrity, and availability. The threat landscape outlined by MITRE is relevant globally but particularly impactful in regions with high software development activity and critical infrastructure. Mitigation requires targeted secure coding practices, rigorous code reviews, and integration of automated vulnerability detection tools tailored to these weaknesses. Countries with strong technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the broad scope and potential impact of these weaknesses, the suggested severity is high. Defenders should prioritize awareness and remediation efforts based on this authoritative guidance to reduce future risk exposure.
The BlackForce phishing kit, first seen in August 2025, is a sophisticated phishing toolkit designed to steal credentials and bypass multi-factor authentication (MFA) using Man-in-the-Browser (MitB) attacks. It impersonates popular brands, leveraging advanced evasion techniques such as blocklists for security vendors and web crawlers to avoid detection. The kit uses a dual-channel communication setup, separating phishing servers from Telegram-based data drops, enabling real-time alerts to attackers. Its attack chain includes user validation, credential capture, and session management via a command-and-control panel. Rapid version updates indicate active development to enhance resilience and evade defenses. The kit targets users through multiple phishing domains, many mimicking streaming services, suggesting a broad attack surface. European organizations face risks from credential theft and MFA bypass, potentially leading to unauthorized access and data breaches. Mitigation requires targeted detection of phishing domains, enhanced user awareness, and monitoring of Telegram-based communications. Countries with high streaming service usage and digital service adoption, such as Spain, Germany, and the UK, are likely most affected.
A high-severity vulnerability in Notepad++ allowed attackers to push malicious update files to users, potentially compromising their systems. The flaw enabled unauthorized code execution via the update mechanism, posing risks to confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the issue was serious enough to warrant an urgent fix by the Notepad++ development team. European organizations using Notepad++ for development or administrative tasks could be targeted if attackers leverage this flaw. Mitigation involves promptly applying the fixed update and verifying update sources. Countries with high software development activity and widespread Notepad++ usage, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity due to the potential for remote code execution without user interaction and broad impact scope. Defenders should prioritize patching and monitoring update channels for anomalies to prevent exploitation.
A Ukrainian hacker has been charged with assisting Russian hacktivist groups, highlighting ongoing cyber conflict dynamics between these nations. While no specific vulnerabilities or exploits are detailed, this development underscores the risks posed by insider threats and state-affiliated cyber activities. The incident may increase cyber espionage, sabotage, or disruption attempts targeting European organizations linked to Ukraine or Russia. European entities should be vigilant about potential retaliatory or opportunistic attacks leveraging insider knowledge. Mitigation should focus on enhancing insider threat detection, monitoring for unusual access patterns, and strengthening collaboration with law enforcement. Countries with significant geopolitical ties to Ukraine and Russia, such as Poland, Germany, and the Baltic states, are likely to be most affected. Given the lack of technical exploit details, the severity is assessed as medium due to the potential for indirect impacts on confidentiality and availability. Defenders should prioritize intelligence sharing and proactive threat hunting to mitigate emerging risks from this geopolitical cyber tension.
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9.
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.
