24h | 7d | 30d

CVE-2025-61260

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 6 Posts
Last activity: Last hour

Fediverse

Profile picture
TechNadu @technadu

Codex CLI Silent RCE Flaw (CVE-2025-61260)
technadu.com/codex-cli-flaw-al

• Repo configs auto-executed MCP commands
• Backdoors via commit/PR access
• CI & developer endpoints at risk
• Root cause: trusted repo-level config execution
• Patched in v0.23.0

A critical reminder that AI-powered developer tools must adopt strict zero-trust defaults.
Follow us for ongoing security coverage.

  • 0
  • 0
  • 0
  • Last hour
Profile picture
Jeff Hall - PCIGuru :verified: @jbhall56

The Codex CLI vulnerability tracked as CVE-2025-61260 can be exploited for command execution. securityweek.com/vulnerability

  • 0
  • 0
  • 1
  • Last hour

Bluesky

Profile picture
piggo @pigondrugs.bsky.social
~Checkpoint~ A vulnerability in OpenAI Codex CLI allows remote code execution via malicious project-local configuration files when a developer runs the tool. - IOCs: (None identified) - #CVE202561260 #RCE #SupplyChain #ThreatIntel
  • 0
  • 0
  • 0
  • 20h ago
Profile picture
matricedigitale.bsky.social @matricedigitale.bsky.social
Vulnerabilità CVE-2025-61260 in OpenAI Codex CLI consente iniezione comandi e accesso remoto fino al fix 0.23.0. #AI #CheckPointResearch #MCPServer #OpenAICodexCLI www.matricedigitale.it/2025/12/02/v...
  • 0
  • 0
  • 0
  • 3h ago
Profile picture
TechNadu @technadu.com
A Codex CLI flaw (CVE-2025-61260) allowed silent RCE through malicious repo configs - triggered automatically whenever developers used Codex. OpenAI patched the issue in v0.23.0. Follow us for more cybersecurity reporting. #Cybersecurity #CodexCLI #RCE #DevSecOps #SupplyChainSecurity #AIThreats
  • 0
  • 0
  • 0
  • Last hour

CVE-2025-10101

Overview

  • Avast
  • Antivirus
01 Dec 2025
Published
02 Dec 2025
Updated
CVSS v3.1
HIGH (8.1)
EPSS
Pending
KEV

Description

Heap-based Buffer Overflow, Out-of-bounds Write vulnerability in Avast Antivirus on MacOS of a crafted Mach-O file may allow Local Execution of Code or Denial of Service of antivirus protection. This issue affects Antivirus: from 15.7 before 3.9.2025.

Statistics

  • 1 Post
  • 48 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

Security product vulns are maddening but will also never not be funny to me.

Heap-based Buffer Overflow, Out-of-bounds Write vulnerability in Avast Antivirus on MacOS of a crafted Mach-O file may allow Local Execution of Code or Denial of Service of antivirus protection.\nThis issue affects Antivirus: from 15.7 before 3.9.2025.

cve.org/CVERecord?id=CVE-2025-

  • 14
  • 34
  • 0
  • 21h ago

CVE-2025-48593

Overview

  • Google
  • Android
18 Nov 2025
Published
19 Nov 2025
Updated
CVSS
Pending
EPSS
0.03%
KEV

Description

In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Statistics

  • 4 Posts
  • 2 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture
Zhuowei Zhang @zhuowei
I wrote a blog post on CVE-2025-48593, an issue patched in Android's November Security Bulletin that only affected devices which act as Bluetooth headphones, such as smartwatches, smart glasses, and cars.

I examined the patch and wrote a proof-of-concept:
https://worthdoingbadly.com/bluetooth/

My proof-of-concept is available at https://github.com/zhuowei/blueshrimp; it gets "fault addr 0x4141414141414141" on the Android Automotive emulator... once you accept the pairing request.
  • 2
  • 0
  • 0
  • 11h ago
Profile picture
Zhuowei Zhang @zhuowei
Weird: my Android 11 device doesn't seem to be vulnerable to CVE-2025-48593 (the Android Bluetooth headset issue), even after I enabled Headset Client with root. I guess that's why the bulletin says it's Android 13-16 only?
  • 0
  • 0
  • 0
  • 18h ago
Profile picture
Zhuowei Zhang @zhuowei
CVE-2025-48593 does work on a physical Android 14 device (with Headset Client force enabled with root).
Alas, I don't have a physical Android 14 device with headset client already enabled. Only smartwatches, wearables, and cars support acting as Bluetooth headsets. I'm not about to drop $70,000 on a car for a blog post.
  • 0
  • 0
  • 0
  • 17h ago

Bluesky

Profile picture
BaseFortify.eu @basefortify.bsky.social
Stock Android regularly exposes critical weaknesses. One example is CVE-2025-48593, a vulnerability allowing privilege escalation through system components in affected Android builds. basefortify.eu/cve_reports/... GrapheneOS reduces impact by hardening the OS itself. #Android #Security
  • 0
  • 0
  • 0
  • 4h ago

CVE-2025-66270

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 3 Posts
  • 3 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture
Christine Hall @BrideOfLinux

"A security advisory being sent out due to a woops. Noted as CVE-2025-66270, that woops could allow an attacker to entirely skip proper authentication": KDE Connect security advisory released due to possible authentication bypass gamingonlinux.com/2025/12/kde-

  • 1
  • 2
  • 1
  • 20h ago
Profile picture
Tim Schlotfeldt ⚓🏳️‍🌈 @ts-new 
KDE Project Security Advisory
=============================

Title:           KDE Connect: Impersonation of paired devices, bypassing authentication
Risk rating:     Critical
CVE:             CVE-2025-66270

[…]

Workaround
==========

Until you can upgrade to a non-vulnerable version, we advise you to stop KDE Connect when on
untrusted networks like those on airports or conferences and/or unpair all devices from KDE Connect.

Weiterlesen: #^https://kde.org/info/security/advisory-20251128-1.txt
  • 0
  • 0
  • 0
  • 22h ago

CVE-2025-3500

Overview

  • Avast
  • Antivirus
01 Dec 2025
Published
02 Dec 2025
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
Pending
KEV

Description

Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.

Statistics

  • 2 Posts
  • 5 Interactions
Last activity: 11 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

And another one:

Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.

cve.org/CVERecord?id=CVE-2025-

  • 0
  • 5
  • 0
  • 20h ago
Profile picture
Offensive Sequence @offseq

🚨 CRITICAL: CVE-2025-3500—Avast Antivirus ≤25.1.981.6 on Windows suffers integer overflow allowing privilege escalation. Patch to 25.3+ ASAP. Monitor for exploitation & restrict privileges. Details: radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 11h ago

CVE-2021-26829

Overview

  • Pending
11 Jun 2021
Published
02 Dec 2025
Updated
CVSS
Pending
EPSS
52.13%
KEV

Description

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Statistics

  • 2 Posts
Last activity: 8 hours ago

Bluesky

Profile picture
Calimeg @calimegai.bsky.social
La #CISA ajoute la faille XSS CVE-2021-26829 dans OpenPLC ScadaBR à son catalogue KEV, face à des preuves d’exploitation active. Cette vulnérabilité touche Windows et Linux. 🔒 #CyberSecurity #IA2025 #InnovationIA https://kntn.ly/65de0e4d
  • 0
  • 0
  • 0
  • 20h ago
Profile picture
Philippe Vynckier @pvynckier.bsky.social
CISA Adds Actively Exploited XSS Bug CVE-2021-26829 in OpenPLC ScadaBR to KEV thehackernews.com/2025/11/cisa...
  • 0
  • 0
  • 0
  • 8h ago

CVE-2024-51999

Overview

  • expressjs
  • express
01 Dec 2025
Published
01 Dec 2025
Updated
CVSS v4.0
LOW (2.7)
EPSS
Pending
KEV

Description

Express.js minimalist web framework for node. Prior to 5.2.0 and 4.22.0, when using the extended query parser in express ('query parser': 'extended'), the request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names. This vulnerability is fixed in 5.2.0 and 4.22.0.

Statistics

  • 5 Posts
Last activity: 2 hours ago

Fediverse

Profile picture
Ulises Gascon @ulisesgascon

🚨 low-severity security fix in express@4.22.0 just released!

Patches CVE-2024-51999 — improperly controlled modification of query properties in express

github.com/expressjs/express/r

  • 0
  • 0
  • 3
  • 20h ago

Bluesky

Profile picture
azu @azu.bsky.social
見てる: "express improperly controls modification of query properties · CVE-2024-51999 · GitHub Advisory Database" https://github.com/advisories/GHSA-pj86-cfqh-vqx6
  • 0
  • 0
  • 0
  • 2h ago

CVE-2025-47372

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
Last activity: 2 hours ago

Fediverse

Profile picture
TechNadu @technadu

Qualcomm has detailed six high-priority vulnerabilities — including a critical secure boot flaw (CVE-2025-47372). Additional issues affect TZ Firmware, HLOS components, DSP, audio, and camera modules.

OEMs are receiving patches and users may need to check manufacturer timelines for deployment.
Follow us for more non-sensationalized security reporting.

Source: gbhackers.com/qualcomm-alerts-

  • 0
  • 0
  • 0
  • 2h ago

Bluesky

Profile picture
TechNadu @technadu.com
Qualcomm has released a security bulletin addressing six major vulnerabilities, including a critical secure boot issue (CVE-2025-47372). Other flaws target HLOS, TZ Firmware, DSP services, audio, and camera systems. #CyberSecurity #Qualcomm #SecureBoot #FirmwareUpdate #OnlineSafety #Infosec
  • 0
  • 0
  • 0
  • 2h ago

CVE-2025-48633

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 4 Posts
  • 6 Interactions
Last activity: 2 hours ago

Fediverse

Profile picture
:awesome:🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉 @nemo

🔒 Google patches two actively exploited Android zero-days (CVE-2025-48633 & CVE-2025-48572) in Dec 2025 update! High-severity info disclosure & privilege escalation flaws fixed for Android. Update now to stay safe! 📱💻

cyberinsider.com/google-fixes-

#Android #CyberSecurity #ZeroDay #Newz

  • 1
  • 0
  • 0
  • 2h ago
Profile picture
cR0w h0 h0 @cR0w

Android December security bulletin:

source.android.com/docs/securi

Including:

Note: There are indications that the following may be under limited, targeted exploitation.

  • CVE-2025-48633
  • CVE-2025-48572
  • 0
  • 2
  • 0
  • 15h ago
Profile picture
tomcat @tomcat

⚠️ Google just fixed 107 security flaws in Android — including two that hackers already used in real attacks.

The exploited bugs (CVE-2025-48633 & CVE-2025-48572) affect the Android Framework and could expose data or give attackers higher access.

Read: thehackernews.com/2025/12/goog

📱 Update your device as soon as the December patch is available.

  • 0
  • 1
  • 0
  • 3h ago

Bluesky

Profile picture
BaseFortify.eu @basefortify.bsky.social
🧠 December Android patch highlights: 🔓 CVE-2025-48633 — data leaks ⚠️ CVE-2025-48572 — privilege escalation 💥 CVE-2025-48631 — critical DoS 💀 Kernel flaws affect isolation Patch level 2025-12-05 = fully fixed. Anything older means known exploits remain. #CVE #AndroidSecurity #Infosec
  • 0
  • 2
  • 0
  • 2h ago

CVE-2025-48572

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 4 Posts
  • 6 Interactions
Last activity: 2 hours ago

Fediverse

Profile picture
:awesome:🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉 @nemo

🔒 Google patches two actively exploited Android zero-days (CVE-2025-48633 & CVE-2025-48572) in Dec 2025 update! High-severity info disclosure & privilege escalation flaws fixed for Android. Update now to stay safe! 📱💻

cyberinsider.com/google-fixes-

#Android #CyberSecurity #ZeroDay #Newz

  • 1
  • 0
  • 0
  • 2h ago
Profile picture
cR0w h0 h0 @cR0w

Android December security bulletin:

source.android.com/docs/securi

Including:

Note: There are indications that the following may be under limited, targeted exploitation.

  • CVE-2025-48633
  • CVE-2025-48572
  • 0
  • 2
  • 0
  • 15h ago
Profile picture
tomcat @tomcat

⚠️ Google just fixed 107 security flaws in Android — including two that hackers already used in real attacks.

The exploited bugs (CVE-2025-48633 & CVE-2025-48572) affect the Android Framework and could expose data or give attackers higher access.

Read: thehackernews.com/2025/12/goog

📱 Update your device as soon as the December patch is available.

  • 0
  • 1
  • 0
  • 3h ago

Bluesky

Profile picture
BaseFortify.eu @basefortify.bsky.social
🧠 December Android patch highlights: 🔓 CVE-2025-48633 — data leaks ⚠️ CVE-2025-48572 — privilege escalation 💥 CVE-2025-48631 — critical DoS 💀 Kernel flaws affect isolation Patch level 2025-12-05 = fully fixed. Anything older means known exploits remain. #CVE #AndroidSecurity #Infosec
  • 0
  • 2
  • 0
  • 2h ago
Showing 1 to 10 of 44 CVEs