Government
Federal agencies have reported as ‘patched’ ASA or FTD devices running software versions vulnerable to attacks.
Hi, what are you looking for?
SecurityWeek
All posts tagged "exploited"
Vulnerabilities
Tracked as CVE-2025-9242 (CVSS score of 9.3), the flaw leads to unauthenticated, remote code execution on vulnerable firewalls.
Vulnerabilities
Amazon has seen a threat actor exploiting CVE-2025-20337 and CVE-2025-5777, two critical Cisco and Citrix vulnerabilities, as zero-days.
Vulnerabilities
Microsoft’s latest Patch Tuesday updates address more than 60 vulnerabilities in Windows and other products.
Vulnerabilities
A threat actor has exploited the issue to create a new administrator account and then used the account to execute remote access tools.
Malware & Threats
Threat actors exploited CVE-2025-21042 to deliver malware via specially crafted images to users in the Middle East.
Vulnerabilities
The critical vulnerability allows attackers to read arbitrary emails, including password reset messages.
Vulnerabilities
A critical vulnerability in Control Web Panel (CWP), tracked as CVE-2025-48703, allows remote, unauthenticated command execution.
Vulnerabilities
Broadcom has updated its advisory on CVE-2025-41244 to mention the vulnerability’s in-the-wild exploitation.
Malware & Threats
The Windows shortcut vulnerability has been seen in attacks conducted by Mustang Panda to drop the PlugX malware.
Malware & Threats
Exploits have been available publicly for over half a year, but the bug was previously targeted only for reconnaissance.
ICS/OT
Two DELMIA Apriso flaws can be chained together to gain privileged access to the application and execute arbitrary code remotely.
Vulnerabilities
Roughly 9 million exploit attempts were observed this month as mass exploitation of the critical vulnerabilities recommenced.
Vulnerabilities
The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks.
Vulnerabilities
CVE-2025-59287 allows a remote, unauthenticated attacker to execute arbitrary code and a PoC exploit is available.
Vulnerabilities
Patched in September, the SessionReaper bug could be exploited without authentication to bypass a security feature.
Vulnerabilities
The bug has been exploited in the wild as a zero-day and the US cybersecurity agency CISA has added it to its KEV catalog.
Vulnerabilities
Leading to code execution, authentication bypass, and privilege escalation, the flaws were added to CISA’s KEV list.
Vulnerabilities
The cybersecurity agency has added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
The unauthenticated local file inclusion bug allows attackers to retrieve the machine key and execute code remotely via a ViewState deserialization issue.
Vulnerabilities
The Head Mare hacktivist group has been exploiting the bugs to deploy the PhantomCore malware.
Vulnerabilities
Artificial Intelligence
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Cloud Security
