⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10035 | Deserialization Flaw in Fortra GoAnywhere MFT License Servlet Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox | 7.5 | 92% | KEVPoC | KEV |
| CVE-2025-11462 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges | 9.3 | <1% | ||
| CVE-2025-27237 | In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification… | 7.3 | <1% | ||
| CVE-2025-36604 | Unauthenticated OS Command Injection in Dell Unity 5.5 and Prior | 9.8 | 64% | ||
| CVE-2025-37728 | Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked | 5.4 | <1% | ||
| CVE-2025-42701 | A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary… | 5.6 | <1% | ||
| CVE-2025-42706 | A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files | 6.5 | <1% | ||
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting | 9.9 | 83% | PoC | |
| CVE-2025-53967 | Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST… | 8.0 | 6% | ||
| CVE-2025-56383 | Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code | 8.4 | <1% | ||
| CVE-2025-5947 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0 | 9.8 | 4% | ||
| CVE-2025-59489 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended… | 7.4 | <1% | PoC | |
| CVE-2025-61882 | Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2025-61884 | Unauthenticated SSRF in Oracle E-Business Suite Configurator | 7.5 | 96% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | breachforums.hn | S. Federal Bureau of Investigation (FBI) seized a website ("breachforums[.]hn") that was being used by Scattered LAPSUS$ Hunters to ext |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Oct 13, 2025 Cybersecurity / Hacking News Every week, the cyber world reminds us that silence doesn’t mean safety. Attacks often begin quietly — one unpatched flaw, one overlooked credential, one backup left unencrypted. By the time alarms sound, the damage is done.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.