China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations

The House Select Committee on China has formally issued an advisory warning of an "ongoing" series of highly targeted cyber espionage campaigns linked to the People's Republic of China PRC amid contentious U.S.–China trade talks. "These campaigns seek to compromise organizations and individuals...

CVE-2025-7843

The Auto Save Remote Images Drafts plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetchimages function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to...

PT-2025-37018

Name of the Vulnerable Software and Affected Versions: Auto Save Remote Images Drafts plugin for WordPress versions up to and including 1.0.9 Description: The Auto Save Remote Images Drafts plugin for WordPress is susceptible to a Server-Side Request Forgery SSRF issue. This allows authenticated...

Linux Distros Unpatched Vulnerability : CVE-2019-2137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the endCall function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of acce...

Linux Distros Unpatched Vulnerability : CVE-2023-36325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2p before 2.3.0 Java allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services aka eepsites via a correlation attack across the IPv4 and...

Linux Distros Unpatched Vulnerability : CVE-2022-23942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

CVE-2025-54116

Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally...

CVE-2025-54116

Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally...

CVE-2025-54103

Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally...

CVE-2025-54103

Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally...

CVE-2025-53805

Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network...

CVE-2025-53805

Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network...

CVE-2025-54116 Windows MultiPoint Services Elevation of Privilege Vulnerability

...

CVE-2025-54116

CVE-2025-54116 affects Windows MultiPoint Services with Improper access control that enables local privilege escalation by an authorized user. CVSS 3.1 base score 7.3 (Local, Privilege Required Low, User Interaction Required, High Confidentiality/Integrity/Availability impact). The Connected docu...

CVE-2025-54116 Windows MultiPoint Services Elevation of Privilege Vulnerability

...

CVE-2025-55245 Xbox Gaming Services Elevation of Privilege Vulnerability

...

CVE-2025-55245 Xbox Gaming Services Elevation of Privilege Vulnerability

...

CVE-2025-55245

CVE-2025-55245 affects Microsoft Xbox Gaming Services and is caused by improper link resolution before file access ("link following"), enabling an authorized local attacker to elevate privileges. The vulnerability is mapped to a local attack vector with high impact on confidentiality, integrity, ...

CVE-2025-55139

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges to enumerate internal...

CVE-2025-52915

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...