CVE-2025-20169

creationtimestamp| type| source ---|---|--- 2025-02-05 16:37:05+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113952255128702135 2025-02-05 17:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh35luk6r2c 2025-02-05 19:09:21+00:00| seen|...

CVE-2025-20170

creationtimestamp| type| source ---|---|--- 2025-02-05 16:37:05+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113952255128702135 2025-02-05 17:15:56+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh35ofn6c2t 2025-02-05 19:09:15+00:00| seen|...

CVE-2025-0413

creationtimestamp| type| source ---|---|--- 2025-02-04 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-082/ 2025-02-04 23:16:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113948163353121381 2025-02-05 00:16:47+00:00| seen|...

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

The Trend ZDI team offers an analysis on how CVE-2025-0411, a zero-day vulnerability in 7-Zip, was actively exploited to target Ukrainian organizations in a SmokeLoader campaign involving homoglyph attacks...

PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N Description: an attack...

BeyondTrust Zero-Day Breach Exposed 17 SaaS Customers via Compromised API Key

BeyondTrust has revealed it completed an investigation into a recent cybersecurity incident that targeted some of the company's Remote Support SaaS instances by making use of a compromised API key. The company said the breach involved 17 Remote Support SaaS customers and that the API key was used...

CVE-2025-0910

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-065/ 2025-02-11 20:16:43+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwi2h7yeo2a 2025-02-11 21:13:36+00:00| seen|...

CVE-2025-0909

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-064/ 2025-02-11 20:16:40+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwi2ecozc2a 2025-02-11 21:13:39+00:00| seen|...

CVE-2025-0899

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-061/ 2025-02-11 20:16:16+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwhznbysg2a 2025-02-12 00:04:29+00:00| seen|...

Apple users: Update your devices now to patch zero-day vulnerability

Apple has released a host of security updates across many devices, including for a zero-day bug which is being actively exploited in iOS. Apple said: "A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against...

Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More

Apple has released software updates to address several security flaws across its portfolio, including a zero-day vulnerability that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-24085 CVSS scores: 7.3/7.8, has been described as a use-after-free bug in the Core Med...

CVE-2025-24149

creationtimestamp| type| source ---|---|--- 2025-01-27 22:18:51+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxv2hjpy2c 2025-01-28 00:23:41+00:00| seen| https://t.me/cvedetector/16541 2025-03-18 04:00:00+00:00| seen|...

CVE-2025-24124

creationtimestamp| type| source ---|---|--- 2025-01-27 22:18:04+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxtmyoz72r 2025-01-28 18:48:58+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113907475072892051 2025-03-18 04:00:00+00:00| seen|...

CVE-2024-54497

creationtimestamp| type| source ---|---|--- 2025-01-27 22:15:54+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxprgjhv2n 2025-03-18 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-169/...

SonicWall SMA Appliances Exploited in Zero-Day Attacks

Critical security flaw in SonicWall SMA 1000 appliances CVE-2025-23006 exploited as a zero-day. Rated CVSS 9.8, patch immediately…...

Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet

Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service DDoS attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since Jun...

GHSA-79XX-VF93-P7CX Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

Summary The researcher discovered zero-day vulnerability Cross-Site Scripting XSS vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response. Details When generating the HTML from an xlsx file containing multiple sheets, a navigation menu i...

A week in security (January 13 – January 19)

Last week on Malwarebytes Labs: iMessage text gets recipient to disable phishing protection so they can be phished The new rules for AI and encrypted messaging, with Mallory Knodel Lock and Code S06E01 Insurance company accused of using secret software to illegally collect and sell location data ...

CVE-2025-0569

creationtimestamp| type| source ---|---|--- 2025-01-20 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-052/ 2025-01-30 20:35:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113919219768954176 2025-01-30 21:15:59+00:00| seen|...

CVE-2025-0570

creationtimestamp| type| source ---|---|--- 2025-01-20 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-050/ 2025-01-30 20:35:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113919219783242151 2025-01-30 21:16:02+00:00| seen|...