Data breachcritical
⚡ Weekly Recap: VPN Exploits, Oracle's Silent Breach, ClickFix Surge and More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-10668 | There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim | 5.9 | <1% | ||
| CVE-2024-3660 | A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the… | 9.8 | 2% | ||
| CVE-2025-1268 | Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer… | 9.4 | <1% | ||
| CVE-2025-1449 | A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing | 7.5 | <1% | ||
| CVE-2025-2008 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… | 8.8 | 1% | ||
| CVE-2025-20139 | A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of… | 7.5 | <1% | ||
| CVE-2025-20212 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause… | 7.7 | <1% | ||
| CVE-2025-22457 | Unauthenticated Stack Buffer Overflow RCE in Ivanti Connect Secure | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2025-24061 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally | 7.8 | 1% | ||
| CVE-2025-2407 | Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network | 9.3 | <1% | ||
| CVE-2025-24362 | In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the… | 7.1 | 1% | ||
| CVE-2025-27520 | Unauthenticated RCE via Insecure Deserialization in BentoML | 9.8 | 41% | PoC | |
| CVE-2025-2780 | The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the… | 8.8 | <1% | ||
| CVE-2025-2798 | The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21 | 9.8 | <1% | ||
| CVE-2025-30065 | RCE via Malicious Avro Schema Parsing in Apache Parquet Java (parquet-avro) | 10.0 | 44% | PoC | |
| CVE-2025-31552 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This… | 9.3 | <1% | ||
| CVE-2025-31553 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting… | 9.3 | <1% | ||
| CVE-2025-31579 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword… | 9.3 | <1% |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Apr 07, 2025 Threat Intelligence / Cybersecurity Today, every unpatched system, leaked password, and overlooked plugin is a doorway for attackers. Supply chains stretch deep into the code we trust, and malware hides not just in shady apps — but in job offers, hardware, and cloud services we rely on every day. Hackers don’t need sophisticated exploits anymore.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.