CVE-2025-46382

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2025-46382

Technical details about CVE-2025-46382 are not publicly provided in the supplied documents; no specific affected product/version or remediation is confirmed. Monitor for updates.

CVE-2025-48496

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors...

The vulnerability of the Apache Kafka message dispatcher, related to deserialization mechanism flaws, allows attackers to trigger a service failure.

The vulnerability of the Apache Kafka message broker is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow a malicious actor to cause a service failure...

CVE-2025-49664

Exposure of sensitive information to an unauthorized actor in Windows User-Mode Driver Framework Host allows an authorized attacker to disclose information locally...

CVE-2025-47980

Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally...

CVE-2025-47980

Technical details about CVE-2025-47980 (affected product/components, root cause, impact, fixes) are not provided in the connected documents. Monitor for updates as more information becomes public.

Malicious code in restpilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea95902e229e600fed776ab58f9216738dd1db24c03890b9902da283f3413623 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors

Cybersecurity researchers have shed light on a previously undocumented threat actor called NightEagle aka APT-Q-95 that has been observed targeting Microsoft Exchange servers as a part of a zero-day exploit chain designed to target government, defense, and technology sectors in China. According t...

The vulnerability of the FactoryTalk Linx automation system’s software, related to insufficient verification of input data, allows a intruder to trigger a service failure.

The vulnerability of the FactoryTalk Linx automation system’s software is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending a malicious package...

CVE-2025-36004

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-36004 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-49715

Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network...

ALSA-2025:A003 Moderate: open-vm-tools security update

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fixes: open-vm-tools:A malicious actor with non-administrative...

Famous Chollima deploying Python version of GolangGhost RAT

In May 2025, Cisco Talos identified a Python-based remote access trojan RAT we call "PylangGhost," used exclusively by a North Korean-aligned threat actor. PylangGhost is functionally similar to the previously documented GolangGhost RAT, sharing many of the same capabilities. In recent campaigns,...

CVE-2025-33122 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege...

The vulnerability of the Local Security Authority (LSA) service on Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Local Security Authority LSA service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause a service failure...

CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...

TencentOS Server 3: cmake (TSSA-2023:0101)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0101 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-5485

User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequenc...