Threat actorcritical
⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10680 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown… | 8.8 | 7% | ||
| CVE-2025-10932 | Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer | 8.2 | <1% | ||
CVE-2025-11621+1 related CVE | Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the… | 8.1 group max | <1% | ||
| CVE-2025-11705 | The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due… | 6.5 | <1% | ||
| CVE-2025-12080 | On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:… | 6.9 | <1% | ||
| CVE-2025-12450 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to… | 6.1 | <1% | ||
| CVE-2025-24893 | Unauthenticated RCE via Eval Injection in XWiki Platform SolrSearch | 9.8 | 100% | KEVPoC | KEV |
| CVE-2025-43995 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability | 9.8 | <1% | ||
| CVE-2025-49401 | Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO | 9.8 | <1% | ||
| CVE-2025-52665 | Unauthenticated Management API Exposure in Ubiquiti UniFi Access | 10.0 | 41% | ||
| CVE-2025-54603 | An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC… | 9.0 | <1% | ||
| CVE-2025-55315 | HTTP Request Smuggling in Microsoft ASP.NET Core Enables Security Feature Bypass | 9.9 | 66% | ||
| CVE-2025-55680 | Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally | 7.0 | <1% | ||
CVE-2025-55754+1 related CVE | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat | 9.6 group max | 10% | ||
| CVE-2025-5842 | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including… | 5.4 | <1% | ||
| CVE-2025-61932 | Unauthenticated RCE via spoofed packets in Motex LANSCOPE Endpoint Manager agents | 9.3 | 3% | KEV | KEV |
| CVE-2025-62725 | Docker Compose trusts the path information embedded in remote OCI compose artifacts | 8.9 | 14% | ||
| CVE-2025-6325 | Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons… | 9.8 | <1% | ||
| CVE-2025-6327 | Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web… | 10.0 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tatamotors.com | ata Motors' sites like E-Dukaan, FleetEdge, and cvtestdrive.tatamotors[.]com, including exposed Azuga API keys, two AWS keys, and an e |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Nov 03, 2025 Cybersecurity / Hacking News Cyberattacks are getting smarter and harder to stop. This week, hackers used sneaky tools, tricked trusted systems, and quickly took advantage of new security problems—some just hours after being found. No system was fully safe.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.