Vulnerabilitycritical
⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More
- CVEs
- CVE-2025-20393CVE-2025-40602CVE-2025-23006CVE-2025-14733CVE-2025-11901CVE-2025-14302CVE-2025-14303CVE-2025-14304CVE-2025-37164CVE-2025-59374CVE-2025-66430CVE-2025-33213CVE-2025-33214CVE-2025-54947CVE-2025-13780CVE-2025-34352CVE-2025-14265CVE-2025-40806CVE-2025-40807CVE-2025-32210CVE-2025-64374CVE-2025-64669CVE-2025-46295CVE-2025-68154CVE-2025-14558
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11901 | An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690… | 7.0 | <1% | ||
| CVE-2025-13780 | pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from… | 8.8 | <1% | ||
| CVE-2025-14265 | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and… | 9.1 | <1% | ||
| CVE-2025-14302 | Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability | 7.0 | <1% | ||
| CVE-2025-14303 | Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability | 7.0 | <1% | ||
| CVE-2025-14304 | Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd | 7.0 | <1% | ||
| CVE-2025-14558 | The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages | 7.2 | 7% | PoC | |
| CVE-2025-14733 | Unauthenticated Out-of-Bounds Write RCE in WatchGuard Fireware OS | 9.3 | 29% | KEVRansomware | KEV |
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands | 10.0 | 32% | KEV | KEV |
| CVE-2025-23006 | Unauthenticated Deserialization RCE in SonicWall SMA1000 Appliances | 9.8 | 23% | KEVRansomware | KEV |
| CVE-2025-32210 | Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured… | 6.5 | <1% | ||
| CVE-2025-33213 | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue | 8.8 | <1% | ||
| CVE-2025-33214 | NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue | 8.8 | <1% | ||
| CVE-2025-34352 | JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM… | 8.5 | <1% | ||
| CVE-2025-37164 | Unauthenticated Remote Code Execution in HPE OneView | 9.8 | 90% | KEVPoC | KEV |
| CVE-2025-40602 | Missing Authorization Flaw in SonicWall SMA1000 Appliance Management Console | 6.6 | 3% | KEV | KEV |
CVE-2025-40806+1 related CVE | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1) | 6.9 group max | <1% | ||
| CVE-2025-46295 | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the… | 9.8 | 1% | ||
| CVE-2025-54947 | In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists | 9.8 | <1% | ||
| CVE-2025-59374 | Supply Chain-Embedded Malicious Code in ASUS Live Update Utility | 9.3 | 1% | KEV | KEV |
| CVE-2025-64374 | Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors | 9.9 | <1% | ||
| CVE-2025-64669 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2025-66430 | Plesk 18.0 has Incorrect Access Control | 9.1 | <1% | ||
| CVE-2025-68154 | systeminformation is a System and OS information library for node.js | 8.1 | 13% | PoC |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Dec 22, 2025 Hacking News / Cybersecurity Cyber threats last week showed how attackers no longer need big hacks to cause big damage. They’re going after the everyday tools we trust most — firewalls, browser add-ons, and even smart TVs — turning small cracks into serious breaches.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.