Vulnerabilities
Fresh attacks targeted three VMware ESXi vulnerabilities that were disclosed in March 2025 as zero-days.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild.
Vulnerabilities
Intel has informed customers about several high-severity vulnerabilities that can lead to privilege escalation and even code execution.
Vulnerabilities
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
Vulnerabilities
The vulnerabilities could be exploited to leak credentials for external SQL connections or crash an agent service.
Vulnerabilities
The bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials.
Vulnerabilities
Tracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication.
Vulnerabilities
The maximum-severity code injection flaw can be exploited without authentication for remote code execution.
Vulnerabilities
An error in the firmware-upload handler leads to devices starting an unauthenticated root-level Telnet service.
Vulnerabilities
Four vulnerabilities have been fixed in the latest release of Veeam Backup & Replication.
Malware & Threats
The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands.
Vulnerabilities
The flaw is tracked as CVE-2025-54957 and its existence came to light in October 2025 after it was discovered by Google researchers.
Vulnerabilities
With 24 new vulnerabilities known to be exploited by ransomware groups, the list now includes 1,484 software and hardware flaws.
Privacy
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day.
Vulnerabilities
GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday.
Vulnerabilities
Tracked as CVE-2020-12812, the exploited FortiOS flaw allows threat actors to bypass two-factor authentication.
Vulnerabilities
Dubbed MongoBleed, the high-severity flaw allows unauthenticated, remote attackers to leak sensitive information from MongoDB servers.
Vulnerabilities
The critical-severity bug in the Fireware OS’s iked process leads to unauthenticated remote code execution.
Vulnerabilities
Tracked as CVE-2025-37164, the critical flaw could allow unauthenticated, remote attackers to execute arbitrary code.
Vulnerabilities
Tracked as CVE-2025-59374, the issue is a software backdoor implanted in Asus Live Update in a supply chain attack.
Vulnerabilities
The medium-severity flaw has been exploited in combination with a critical bug for remote code execution.
Malware & Threats
The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
Artificial Intelligence
The startup takes an agentic approach to preventing vulnerability exploitation by uncovering exposure across assets.
Supply Chain Security
From open source libraries to AI-powered coding assistants, speed-driven development is introducing new third-party risks that threat actors are increasingly exploiting.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)