CVE-2025-29927

creationtimestamp| type| source ---|---|--- 2025-03-21 15:40:16+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lkvkd4ny2y2v 2025-03-21 15:45:51+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114201195359591645 2025-03-21 16:48:51+00:00| seen|...

PT-2025-12460 · Absolute Security +1 · Secure Access

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: This is the first Baseboard Management Controller BMC-related issue to appear on the CISA Known Exploited Vulnerabilities KEV list. It has been observed being exploited in the wild. Recommendations...

VulnCheck KEV: CVE-2025-30259

The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated...

Patch it up: Old vulnerabilities are everyone’s problems

Welcome to this week's edition of the Threat Source newsletter. Let's pick up where we left off in my last newsletter. Please mark your calendars: The free support for Windows 10 will end on October 14, 2025. When a software loses vendor support, it no longer receives patches or updates. As...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24201link is external Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability CVE-2025-21590link is external Juniper Junos OS Improper Isolation or...

BulletProof FTP Client 2010.74 Buffer Overflow

BulletProof FTP Client version 2010.74 suffers from a buffer overflow vulnerability. Exploit Title: BulletProof FTP Client v2010.74 - Buffer Overflow PoC Discovered by: Ahmet Ümit BAYRAM Discovered Date: 14.09.2023 Vendor Homepage: http://www.bpftp.com Software Link:...

PT-2025-10828 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows Win32 Kernel Subsystem versions prior to the fixed version Description: A use-after-free vulnerability in the Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. The vulnerability has been...

CVE-2025-24813

creationtimestamp| type| source ---|---|--- 2025-03-10 17:14:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lk22hs7zke24 2025-03-10 17:38:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7027 2025-03-10 17:45:38+00:00| seen|...

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-25181link is external Advantive VeraCore SQL Injection Vulnerability CVE-2024-57968link is external Advantive VeraCore Unrestricted File Upload Vulnerability...

CVE-2020-5775

creationtimestamp| type| source ---|---|--- 2025-03-09 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-03-09 2026-06-23 14:06:19+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/06cf3e8b-5bea-44c8-9546-6e0aa85bffd2...

CVE-2023-47248

creationtimestamp| type| source ---|---|--- 2025-03-05 21:01:59+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ljnutmfxed2z 2025-03-27 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-03-27 2025-05-26 00:00:00+00:00| exploited| The...

CISA Identifies Five New Vulnerabilities Currently Being Exploited

Of the five, one is a Windows vulnerability, another is a Cisco vulnerability. We don't have any details about who is exploiting them, or how. News article. Slashdot thread...

Linux Distros Unpatched Vulnerability : CVE-2021-37833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A reflected cross-site scripting XSS vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution ...

Linux Distros Unpatched Vulnerability : CVE-2021-43975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel through 5.15.2, hwatlutilsfwrpcwait in drivers/net/ethernet/aquantia/atlantic/hwatl/hwatlutils.c allows an attacker who can introduce a...

Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities

Google has released its monthly Android Security Bulletin for March 2025 to address a total of 44 vulnerabilities, including two that it said have come under active exploitation in the wild. The two high-severity vulnerabilities are listed below - CVE-2024-43093 - A privilege escalation flaw in...

Linux Distros Unpatched Vulnerability : CVE-2020-14621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JAXP. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7...

Linux Distros Unpatched Vulnerability : CVE-2018-1000667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption crashed of nasm when handling a crafted file due to function...

pearsondental.com Cross Site Scripting vulnerability OBB-4031504

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-38514

creationtimestamp| type| source ---|---|--- 2025-02-27 21:02:06+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lj6s25smgr2t 2025-03-09 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-03-09 2025-03-29 00:00:00+00:00| exploited| The...

CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday placed two security flaws impacting Microsoft Partner Center and Synacor Zimbra Collaboration Suite ZCS to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerabilities in...