Vulnerabilityhigh
⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-9183 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have… | 6.4 | <1% | ||
| CVE-2025-12571 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have… | 7.5 | <1% | ||
| CVE-2025-12816 | An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to… | 8.6 | <1% | PoC | |
CVE-2025-12977+4 related CVEs | Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs | 9.1 group max | <1% | ||
| CVE-2025-13357 | Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an… | 9.8 | <1% | ||
CVE-2025-33183+1 related CVE | NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue | 7.8 | <1% | ||
| CVE-2025-33187 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas | 7.8 | <1% | PoC | |
| CVE-2025-59287 | Deserialization RCE in Microsoft WSUS (Windows Server) | 9.8 | 100% | KEVPoC | KEV |
| CVE-2025-59366 | An authentication-bypass vulnerability exists in AiCloud | 9.2 | 16% | ||
| CVE-2025-59373 | A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface | 8.5 | <1% | ||
| CVE-2025-62164 | vLLM is an inference and serving engine for large language models (LLMs) | 8.8 | <1% | ||
| CVE-2025-65998 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option | 7.5 | <1% | ||
| CVE-2025-66035 | Angular: 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a… | 7.7 | <1% |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Dec 01, 2025 Hacking News / Cybersecurity Hackers aren’t kicking down the door anymore. They just use the same tools we use every day — code packages, cloud accounts, email, chat, phones, and “trusted” partners — and turn them against us. One bad download can leak your keys.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.