Ransomwarecritical
⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-58260 | A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with… | 7.6 | <1% | ||
| CVE-2025-10547 | An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform… | 9.8 | <1% | ||
| CVE-2025-10725 | Red Hat Openshift AI Service: A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter… | 9.9 | <1% | ||
| CVE-2025-27915 | Stored XSS in Zimbra Collaboration Suite Classic Web Client via Malicious ICS Files | 5.4 | 4% | KEVPoC | KEV |
| CVE-2025-30247 | An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to… | 9.3 | 1% | ||
| CVE-2025-4008 | Unauthenticated Command Injection RCE in Smartbedded Meteobridge | 8.7 | 93% | KEVPoC | KEV |
| CVE-2025-41250 | VMware vCenter contains an SMTP header injection vulnerability | 8.5 | <1% | ||
| CVE-2025-41251 | VMware NSX contains a weak password recovery mechanism vulnerability | 8.1 | <1% | ||
| CVE-2025-41252 | Description: VMware NSX contains a username enumeration vulnerability | 7.5 | <1% | ||
| CVE-2025-43400 | An out-of-bounds write issue was addressed with improved bounds checking | 6.3 | 6% | ||
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting | 9.9 | 83% | PoC | |
| CVE-2025-52906 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This… | 9.3 | 13% | ||
| CVE-2025-57714 | An unquoted search path or element vulnerability has been reported to affect NetBak Replicator | 8.5 | <1% | ||
| CVE-2025-59934 | Formbricks: Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs… | 9.4 | 8% | ||
| CVE-2025-59951 | Termix: The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the… | 9.2 | 5% | PoC | |
| CVE-2025-61882 | Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2025-9230 | Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write | 7.5 | 2% | ||
| CVE-2025-9231 | Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM… | 6.5 | 2% | ||
| CVE-2025-9232 | Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and… | 5.9 | 2% |
From the original article
13 min read at thehackernews.com
The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today’s security landscape.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.