⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
- CVEs
- CVE-2025-53770CVE-2025-53771CVE-2025-49704CVE-2025-49706CVE-2025-6558CVE-2025-23266CVE-2025-54309CVE-2025-6965CVE-2025-37103CVE-2025-23267CVE-2025-20337CVE-2025-5333CVE-2025-48384CVE-2025-4919CVE-2025-53833CVE-2025-53506CVE-2025-41236CVE-2025-27210CVE-2025-27209CVE-2025-53906CVE-2025-50067CVE-2025-30751CVE-2025-6230CVE-2025-6231CVE-2025-6232CVE-2024-13972CVE-2025-7433CVE-2025-7472CVE-2025-27212CVE-2025-4657CVE-2025-2500CVE-2025-6023CVE-2025-6197CVE-2025-40776CVE-2025-40777CVE-2025-33043CVE-2025-2884CVE-2025-3052CVE-2025-31019
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-13972 | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining… | 8.8 | <1% | ||
| CVE-2025-20337 | Unauthenticated Injection Flaw Allows Root RCE in Cisco ISE and ISE-PIC | 10.0 | 74% | KEV | KEV |
| CVE-2025-23266 | NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary… | 9.0 | 3% | ||
| CVE-2025-23267 | NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a… | 8.5 | <1% | ||
| CVE-2025-2500 | A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below | 9.1 | <1% | ||
| CVE-2025-27209 | The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash | 7.5 | 1% | ||
| CVE-2025-27210 | An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX | 7.5 | 15% | ||
| CVE-2025-27212 | An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network | 9.8 | 1% | ||
| CVE-2025-2884 | TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with… | 6.6 | <1% | ||
| CVE-2025-3052 | An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software | 8.2 | <1% | ||
| CVE-2025-30751 | Vulnerability in the Oracle Database component of Oracle Database Server | 8.8 | <1% | ||
| CVE-2025-31019 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication… | 8.8 | <1% | ||
| CVE-2025-33043 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally | 6.1 | <1% | ||
| CVE-2025-37103 | Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication | 9.8 | 1% | ||
| CVE-2025-40776 | A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack | 8.6 | <1% | ||
| CVE-2025-40777 | If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other… | 7.5 | <1% | ||
| CVE-2025-41236 | VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter | 9.3 | 2% | ||
| CVE-2025-4657 | A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and… | 8.4 | <1% | ||
| CVE-2025-48384 | Exploited Link-Following RCE in Git via Malicious Submodule Paths | 8.0 | 4% | KEV | KEV |
| CVE-2025-4919 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes | 8.8 | 9% | ||
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
| CVE-2025-50067 | Vulnerability in Oracle Application Express (component | 9.0 | <1% | ||
| CVE-2025-5333 | Remote attackers can execute arbitrary code in the context of the vulnerable service process | 9.5 | <1% | ||
| CVE-2025-53506 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum… | 7.5 | 2% | ||
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% | ||
| CVE-2025-53833 | LaRecipe: Which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary… | 10.0 | 9% | ||
| CVE-2025-53906 | Vim: A path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip… | 4.1 | <1% | PoC | |
| CVE-2025-54309 | Unauthenticated Admin Access Bypass in CrushFTP (CVE-2025-54309) | 9.8 | 93% | KEVPoC | KEV |
| CVE-2025-6023 | Unauthenticated Open Redirect Leading to XSS in Grafana OSS | 7.6 | 42% | ||
| CVE-2025-6197 | Open Redirect in Grafana OSS Organization Switching | 4.2 | 70% | ||
CVE-2025-6231+2 related CVEs | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated… | 8.5 group max | <1% | ||
| CVE-2025-6558 | Actively Exploited Input Validation Flaw in Chrome ANGLE/GPU Allows Sandbox Escape | 8.8 | 11% | KEV | KEV |
| CVE-2025-6965 | Memory Corruption in SQLite < 3.50.2 Affecting Apple and Siemens Products | 7.2 | 76% | ||
| CVE-2025-7433 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution | 8.8 | <1% | ||
| CVE-2025-7472 | A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level… | 7.5 | <1% |
From the original article
13 min read at thehackernews.com
Even in well-secured environments, attackers are getting in—not with flashy exploits, but by quietly taking advantage of weak settings, outdated encryption, and trusted tools left unprotected. These attacks don’t depend on zero-days. They work by staying unnoticed—slipping through the cracks in what we monitor and what we assume is safe.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.