The vulnerability of the Tray Monitor Service in backup and data recovery software on computers and servers running Acronis Agent and Acronis CyberProtect 16 allows attackers to enhance their privileges.

The vulnerability of the Tray Monitor Service in backup and data recovery software on Acronis Agent and Acronis CyberProtect 16 software for data protection involves deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware

The threat actor known as Space Pirates has been linked to a malicious campaign targeting Russian information technology IT organizations with a previously undocumented malware called LuckyStrike Agent. The activity was detected in November 2024 by Solar, the cybersecurity arm of Russian...

CVE-2025-22869 vulnerabilities

Vulnerabilities for packages: grafana-mimir, caddy-fips, minio-operator, amazon-cloudwatch-agent-operator-fips, apko, ferretdb, spire-controller-manager, temporal-ui-server-fips, flux-notification-controller-fips, k3s, velero-fips, kube-fluentd-operator, kiam, src, fluent-bit-plugin-loki,...

CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2025-047)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.12.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-047 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError...

CVAD: How to install Citrix Profile Management WMI Plug-in on the VDA

This article lists the steps to install the Citrix Profile Management WMI Plug-in on the VDA...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: mockery, cortex, hello-world-golang, k3s, kube-rbac-proxy, kubernetes-dns-node-cache, ctop, docker-cli, secrets-store-csi-driver-provider-gcp, render-template, kpt, kind, php-fpmexporter, sbom-scorecard, wazero, nri-mssql, speedtest-go, yam, nri-prometheus,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: mockery, cortex, hello-world-golang, k3s, kube-rbac-proxy, kubernetes-dns-node-cache, ctop, docker-cli, secrets-store-csi-driver-provider-gcp, render-template, kpt, kind, php-fpmexporter, sbom-scorecard, wazero, nri-mssql, speedtest-go, yam, nri-prometheus,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: mockery, cortex, hello-world-golang, k3s, kube-rbac-proxy, kubernetes-dns-node-cache, ctop, docker-cli, secrets-store-csi-driver-provider-gcp, render-template, kpt, kind, php-fpmexporter, sbom-scorecard, wazero, nri-mssql, speedtest-go, yam, nri-prometheus,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: mockery, cortex, hello-world-golang, k3s, kube-rbac-proxy, kubernetes-dns-node-cache, ctop, docker-cli, secrets-store-csi-driver-provider-gcp, render-template, kpt, kind, php-fpmexporter, sbom-scorecard, wazero, nri-mssql, speedtest-go, yam, nri-prometheus,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: caddy-fips, metacontroller, ferretdb, hello-world-golang, aws-efs-csi-driver, src, fulcio-fips, crossplane-provider-aws, src-fingerprint, harbor-scanner-trivy-fips, gotenberg, capslock, libnvidia-container, addon-resizer-fips, redka,...

Important: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called...

openSUSE Security Advisory (SUSE-SU-2024:0974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-27364

In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...

CVE-2025-27364

In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...

The vulnerability of the NetScaler Console application delivery management service and the NetScaler Agent, related to insecure privilege management, allows attackers to escalate their privileges.

The vulnerability of the NetScaler Console delivery management service and the NetScaler Agent agent is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

openSUSE Security Advisory (SUSE-SU-2025:0611-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-27364

In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...

CVE-2025-27364

In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...

CVE-2025-20059

Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9...