⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10035 | Deserialization Flaw in Fortra GoAnywhere MFT License Servlet Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-10585 | Actively Exploited V8 Type Confusion in Google Chrome (Heap Corruption) | 9.8 | 9% | KEV | KEV |
| CVE-2025-38501 | Linux kernel: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the… | 7.5 | 2% | ||
| CVE-2025-41248 | The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type… | 7.5 | <1% | ||
| CVE-2025-41249 | The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type… | 7.5 | <1% | ||
| CVE-2025-5115 | In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for… | 7.7 | 3% | ||
| CVE-2025-55241 | Azure Entra ID Elevation of Privilege Vulnerability | 10.0 | 2% | ||
CVE-2025-58060+1 related CVE | OpenPrinting CUPS: In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization… | 8.0 group max | 1% | PoC | |
| CVE-2025-5821 | The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3 | 9.8 | <1% | ||
| CVE-2025-58321 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability | 10.0 | 1% | ||
| CVE-2025-58434 | Unauthenticated Account Takeover via Password Reset Token Leak in Flowise | 9.8 | 76% | PoC ×3 | |
| CVE-2025-59340 | jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates | 10.0 | 2% | ||
| CVE-2025-59474 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking… | 5.3 | 5% | ||
| CVE-2025-8699 | Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards | 9.1 | <1% | ||
| CVE-2025-9242 | Out-of-Bounds Write in WatchGuard Fireware OS iked Enables Unauthenticated RCE | 9.3 | 92% | KEVPoC | KEV |
| CVE-2025-9961 | An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500 | 8.6 | 10% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | botnet.world | perational flexibility. It's advertised via the domain main.botnet[.]world. The malware launches watchdog threads that continuously |
From the original article
13 min read at thehackernews.com
The security landscape now moves at a pace no patch cycle can match. Attackers aren’t waiting for quarterly updates or monthly fixes—they adapt within hours, blending fresh techniques with old, forgotten flaws to create new openings. A vulnerability closed yesterday can become the blueprint for tomorrow’s breach.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.