⚡ Weekly Recap: Zero-Day Exploits, Insider Threats, APT Targeting, Botnets and More
- CVEs
- CVE-2025-30397CVE-2025-30400CVE-2025-32701CVE-2025-32706CVE-2025-32709CVE-2025-27920CVE-2025-42999CVE-2024-11182CVE-2025-4664CVE-2025-4632CVE-2025-32756CVE-2025-4427CVE-2025-4428CVE-2025-3462CVE-2025-3463CVE-2025-47729CVE-2025-31644CVE-2025-22249CVE-2025-27696CVE-2025-4317CVE-2025-23166CVE-2025-47884CVE-2025-47889CVE-2025-4802CVE-2025-47539
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-11182 | Unauthenticated Cross-Site Scripting (XSS) in MDaemon Email Server Webmail | 5.3 | 33% | KEV | KEV |
| CVE-2025-22249 | VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability | 8.2 | <1% | ||
| CVE-2025-23166 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the… | 7.5 | <1% | ||
| CVE-2025-27696 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read… | 5.3 | 1% | ||
| CVE-2025-27920 | Directory Traversal in Srimax Output Messenger Before 2.0.63 | 8.8 | 2% | KEV | KEV |
CVE-2025-32706+4 related CVEs | Heap-Based Buffer Overflow in Windows CLFS Driver Enables Local Privilege Escalation | 7.8 group max | 2% | KEVPoC ×2 | KEV |
| CVE-2025-31644 | Authenticated Command Injection in F5 BIG-IP (Appliance Mode) | 8.5 | 27% | ||
| CVE-2025-32756 | Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone | 9.8 | 31% | KEV | KEV |
| CVE-2025-3462 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may… | 8.4 | <1% | ||
| CVE-2025-3463 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS… | 9.4 | <1% | ||
| CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader | 9.1 | 13% | KEVRansomwarePoC | KEV |
| CVE-2025-4317 | The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all… | 8.8 | 1% | ||
CVE-2025-4428+1 related CVE | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API | 8.8 group max | 88% | KEV | KEV |
| CVE-2025-4632 | Actively Exploited Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 24% | KEV | KEV |
| CVE-2025-4664 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page | 4.3 | 6% | ||
| CVE-2025-47539 | Incorrect Privilege Assignment Allows Privilege Escalation in Eventin WordPress Plugin | 9.8 | 28% | ||
| CVE-2025-47729 | Hidden cleartext message storage in TeleMessage TM SGNL archiving backend | 4.9 | <1% | KEV | KEV |
| CVE-2025-47884 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment… | 9.1 | <1% | ||
| CVE-2025-47889 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing… | 9.8 | <1% | ||
| CVE-2025-4802 | Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared… | 7.8 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | blackdb.cc | lead administrator of BlackDB.cc from 2018 to the present. "BlackDB.cc illegally offered for sale compromised account and server c |
From the original article
13 min read at thehackernews.com
Cybersecurity leaders aren’t just dealing with attacks—they’re also protecting trust, keeping systems running, and maintaining their organization’s reputation. This week’s developments highlight a bigger issue: as we rely more on digital tools, hidden weaknesses can quietly grow. Just fixing problems isn’t enough anymore—resilience needs to be built into everything from the ground up.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.