CTEM is the New SOC: Shifting from Monitoring Alerts to Measuring Risk

Introduction: Security at a Tipping Point Security Operations Centers SOCs were built for a different era, one defined by perimeter-based thinking, known threats, and manageable alert volumes. But today’s threat landscape doesn’t play by those rules. The sheer volume of telemetry, overlapping...

CVE-2025-4231 PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface

A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

CVE-2024-7562 affects InstallShield Standalone MSI packages built with multiple InstallScript custom actions across versions 2021 R2, 2022 R2, and 2023 R2. The issue is a potential elevation of privilege with local attack vector and low attacker privileges, leading to impacts on confidentiality, ...

CVE-2025-49467: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges...

PT-2025-25334

Name of the Vulnerable Software and Affected Versions InstallShield versions 2021 R2 through 2023 R2 Description A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. Recommendations For...

macOS 15.x < 15.3.1 (122900)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.3.1. It is, therefore, affected by a vulnerability: - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. CVE-2025-43200 Note that Nessus has not tested for this issue bu...

Flexera InstallShield security vulnerabilities

Flexera InstallShield is a development kit that creates Microsoft Windows installers from Flexera USA. A security vulnerability exists in InstallShield versions 2023 R2, 2022 R2, and 2021 R2 that stems from a potential elevation of privilege when configuring multiple InstallScript customization...

CVE-2025-5890

A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate...

CVE-2025-49013

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

MAL-2025-4923 Malicious code in ac-mvc-cid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 110e255563acbb72629ba03afd504713dfd8fbbdcd576258dde5d481975ac5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8270

The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control TCC policies, enabling the exploitation or abuse of permissions specified in its entitlements e.g., microphone, camera, automation, network client. Since Rocket.Chat was not...

CVE-2024-32119

CVE-2024-32119 affects Fortinet FortiClientEMS, specifically versions 7.4.0 and before 7.2.4. The issue is an improper authentication (CWE-287) that could allow an unauthenticated attacker, who knows a targeted user’s FCTUID and VDOM, to perform operations such as uploading or tagging on behalf o...

Description of the security update for SharePoint Enterprise Server 2016: June 10, 2025 (KB5002732)

Description of the security update for SharePoint Enterprise Server 2016: June 10, 2025 KB5002732 Applies To SharePoint Server 2016 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft Word remote code execution vulnerability. To...

CVE-2025-26521: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based...

PT-2025-24657 · WordPress · Wpfactory Min Max Step Quantity Limits Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Min Max Step Quantity Limits Manager for WooCommerce versions 5.1.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows unauthorized actions to be performed on behalf of a user. This...

Microsoft Visual Studio initializeCommand Insufficient UI Warning Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Visual Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

@actions-for-rust/core (>=0.1.6, <=0.1.8), @actions-rs-plus/core (>=0.0.0, <=0.11.1) +138 more potentially affected by CVE-2025-5890 via @actions/glob (>=0.1.2, <=0.7.0)

@actions/glob NPM version =0.1.2, =0.1.6, =0.0.0, =0.1.0, =0.1.0, =1.0.1-2a6268e89ea5fbc66dadd1d897cac75b3f0a63e4.0, =0.1.0, =1.0.0, =4.0.0, =3.2.5, =1.1.0-rc.0, =3.2.2, =3.2.6 - @cirunlabs/cache 4.0.3 and more Source cves: CVE-2025-5890 Source advisory: SNYK:JS-ACTIONSGLOB-11484208...