CVE-2025-32433 is a critical vulnerability in the Erlang/OTP SSH server involving missing authentication for a critical function. This flaw allows attackers to execute arbitrary commands remotely without valid credentials, leading to unauthenticated remote code execution. The vulnerability arises from improper handling of SSH protocol messages. It affects multiple products implementing Erlang/OTP SSH server, including Cisco, NetApp, and SUSE. The vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild.
CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in RoundCube Webmail. It allows a remote attacker to exploit a desanitization issue in the message_body() function, enabling theft and unauthorized sending of emails via crafted messages. This vulnerability has been exploited in the wild.
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
ConnectWise ScreenConnect has an improper authentication vulnerability (CVE-2025-3935) that could enable a ViewState code injection attack. If machine keys are compromised, this vulnerability may lead to remote code execution. The vulnerability has a high severity score of 8.1 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.
ASUS Lyra Mini and ASUS GT-AC2900 routers have an improper authentication vulnerability (CVE-2021-32030) that allows attackers to gain unauthorized administrative access. The vulnerability is critical with a CVSS score of 9.8 and has been exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.
Craft CMS versions prior to 5.7.5 and 4.15.3 contain a vulnerability where an unauthenticated attacker can externally control a web parameter assumed to be immutable. This flaw allows injection of arbitrary values, including PHP code, into a known local file on the server. The vulnerability has been exploited in the wild and can be chained with another vulnerability (CVE-2024-58136) for potentially greater impact. A fix is available in versions 5.7.5 and 4.15.3.
ASUS RT-AX55 routers have an OS command injection vulnerability (CVE-2023-39780) that allows a remote, authenticated attacker to execute arbitrary commands on the device. This vulnerability has a high severity score of 8.8 and has been exploited in the wild. It requires authentication but no user interaction. The vulnerability impacts confidentiality, integrity, and availability of affected devices.
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
This Red Hat security advisory addresses multiple vulnerabilities in the mingw-freetype library and libsoup components affecting Red Hat Enterprise Linux 8. The issues include out-of-bounds writes, integer overflows, heap buffer overflows, null pointer dereferences, double frees, and denial of service conditions. These vulnerabilities impact font parsing and HTTP request handling functionality. The advisory rates the overall security impact as Important and provides updates to mitigate these issues.
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104)
* kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The ViciousTrap campaign involves a threat actor compromising over 5,500 edge devices, including SOHO routers, SSL VPNs, DVRs, and BMC controllers, primarily end-of-life models. The attacker exploits CVE-2023-20118 to deploy a script named NetGhost, which redirects incoming traffic to attacker-controlled infrastructure, effectively turning these devices into distributed honeypots. The campaign has been active since March 2025 and targets more than 50 device brands, mainly across Asia, with infrastructure hosted in Malaysia. The actor appears to be collecting exploitation attempts and possibly zero-day vulnerabilities by observing traffic through these compromised devices. The campaign is linked to a medium severity threat with known exploitation in the wild.
