⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-12812 | MFA Bypass via Username Case Change in Fortinet FortiOS SSL VPN | 9.8 | 45% | KEVRansomware | KEV |
| CVE-2023-52163 | Missing Authorization Enables Command Injection in Digiever DS-2105 Pro NVRs | 8.8 | 97% | KEVPoC ×3 | KEV |
| CVE-2025-13008 | An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated… | 8.6 | <1% | ||
| CVE-2025-13836 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length | 6.3 | 2% | ||
| CVE-2025-14847 | Unauthenticated Heap Memory Disclosure in MongoDB Server (MongoBleed) | 8.7 | 83% | KEVPoC ×6 | KEV |
| CVE-2025-26794 | Critical Unauthenticated SQL Injection in Exim 4.98 | 9.8 | 77% | ||
| CVE-2025-44016 | A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious… | 8.8 | <1% | ||
| CVE-2025-68613 | Authenticated RCE in n8n Workflow Automation Expression Evaluation | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-68615 | Unauthenticated buffer overflow in net-snmp snmptrapd crashes daemon | 9.8 | 42% | PoC | |
| CVE-2025-68664 | Serialization Injection in LangChain Core dumps()/dumpd() Exposes Secrets | 8.2 | 43% | PoC ×2 |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Dec 29, 2025 Hacking News / Cybersecurity Last week’s cyber news in 2025 was not about one big incident. It was about many small cracks opening at the same time. Tools people trust every day behave in unexpected ways.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.