⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More
- CVEs
- CVE-2025-53690CVE-2025-38352CVE-2025-48543CVE-2025-42957CVE-2025-9377CVE-2025-29927CVE-2025-52856CVE-2025-52861CVE-2025-0309CVE-2025-21483CVE-2025-27034CVE-2025-6203CVE-2025-58161CVE-2025-5931CVE-2025-53772CVE-2025-9864CVE-2025-9696CVE-2025-57833CVE-2025-24204CVE-2025-55305CVE-2025-53149CVE-2025-6519CVE-2025-52549CVE-2025-52548CVE-2025-58782CVE-2025-55190CVE-2025-1079CVE-2025-4613
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-0309 | An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system | 6.0 | <1% | ||
| CVE-2025-1079 | Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature | 7.8 | <1% | PoC | |
| CVE-2025-21483 | Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs | 9.8 | <1% | ||
| CVE-2025-24204 | The issue was addressed with improved checks | 9.8 | 1% | ||
| CVE-2025-27034 | Memory corruption while selecting the PLMN from SOR failed list | 9.8 | <1% | ||
| CVE-2025-29927 | Middleware Authorization Bypass in Vercel Next.js (CVE-2025-29927) | 9.1 | 99% | PoC ×4 | |
| CVE-2025-38352 | Actively Exploited TOCTOU Race Condition in Linux Kernel POSIX CPU Timers | 7.8 | 1% | KEVPoC ×2 | KEV |
| CVE-2025-42957 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC | 9.9 | 2% | ||
| CVE-2025-4613 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… | 7.1 | <1% | PoC | |
| CVE-2025-48543 | Use-After-Free in Android Runtime Enables Sandbox Escape and Local Privilege Escalation | 8.8 | <1% | KEV | KEV |
CVE-2025-6519+2 related CVEs | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password | 9.3 group max | <1% | ||
| CVE-2025-52856 | An improper authentication vulnerability has been reported to affect VioStor | 9.3 | <1% | ||
| CVE-2025-52861 | A path traversal vulnerability has been reported to affect VioStor | 7.0 | <1% | ||
| CVE-2025-53149 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally | 7.8 | <1% | PoC | |
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP | 9.0 | 61% | KEVPoC | KEV |
| CVE-2025-53772 | Deserialization RCE in Microsoft Web Deploy 4.0 | 8.8 | 24% | ||
| CVE-2025-55190 | Argo CD: In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with… | 9.9 | 6% | PoC | |
| CVE-2025-55305 | Electron: In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6… | 6.1 | <1% | ||
| CVE-2025-57833 | SQL injection in Django FilteredRelation column aliases | 8.1 | 26% | PoC | |
| CVE-2025-58161 | MobSF: In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated… | 1.3 | <1% | PoC | |
| CVE-2025-58782 | Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons | 6.5 | 1% | ||
| CVE-2025-5931 | The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5 | 8.8 | <1% | ||
| CVE-2025-6203 | A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU… | 7.5 | <1% | ||
| CVE-2025-9377 | OS Command Injection in TP-Link Archer C7 (EU) and TL-WR841N/ND (MS) Routers | 8.6 | 41% | KEV | KEV |
| CVE-2025-9696 | The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details | 9.4 | <1% | ||
| CVE-2025-9864 | Rejected reason: This CVE ID was assigned in error to a vulnerability that was both introduced and fixed before the code landed in the Stable channel of… | — | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fileripple.com | alware called JSCoreRunner. Once downloaded from sites like fileripple[.]com, the malware establishes connections with a remote server |
From the original article
13 min read at thehackernews.com
Cybersecurity never slows down. Every week brings new threats, new vulnerabilities, and new lessons for defenders. For security and IT teams, the challenge is not just keeping up with the news—it’s knowing which risks matter most right now.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.