CVE-2025-53521

Overview

F5
BIG-IP

15 Oct 2025

Published

28 Mar 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.08%

MITRE

KEV

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Statistics

4 Posts
67 Interactions

Last activity: 3 hours ago

Fediverse

Kevin Beaumont @GossiTheDog

For F5 BIG-IP APM customers, CVE-2025-53521 is being exploited in the wild by a nation state threat actor

It allows unauth RCE and applies to the data plane (not the management interface) - the one available over the internet.

https://my.f5.com/manage/s/article/K000156741

Attackers have been deploying webshells, so boxes are still vuln post patching if already exploited prior.

38
28
0
13h ago

Bluesky

Sami Laiho @samilaiho.com

F5 K000156741: BIG-IP APM vulnerability CVE-2025-53521 increased severity, active exploitation URL: my.f5.com/manage/s/art... Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.3

0
1
0
6h ago

piggo @pigondrugs.bsky.social

~Cisa~ CISA added an actively exploited F5 BIG-IP RCE vulnerability to its KEV catalog. - IOCs: CVE-2025-53521 - #CVE2025_53521 #F5 #ThreatIntel

0
0
0
7h ago

Undercode Testing @undercode.bsky.social

F5 BIG-IP APM Zero-Day Under Active Siege: CISA Mandates Emergency Patching for CVE-2025-53521 + Video Introduction: A recently reclassified vulnerability in F5’s BIG-IP Access Policy Manager (APM), tracked as CVE-2025-53521, has escalated from a mere denial-of-service (DoS) concern to a critical…

0
0
0
3h ago

CVE-2026-33017

Overview

langflow-ai
langflow

20 Mar 2026

Published

26 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

5.65%

MITRE

KEV

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Statistics

4 Posts

Last activity: Last hour

Fediverse

Steele Fortress @steelefortress

CISA just added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog and both deserve your immediate attention.

First up is CVE-2026-33017, a code injection flaw in Langflow, the open-source AI workflow builder that has exploded in popularity.

#Cybersecurity #InfoSec #Privacy #ThreatIntel

0
0
0
Last hour

CyberNetsecIO @netsecio

📰 CISA KEV Alert: Actively Exploited Flaws in Langflow AI Framework and Trivy Scanner

📢 CISA KEV UPDATE: Two flaws now under active exploitation! A critical RCE in Langflow AI framework (CVE-2026-33017) and a supply-chain attack via Trivy scanner (CVE-2026-33634). Patch now! ⚠️ #KEV #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-trivy-and-langflow-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
19h ago

Bluesky

BABA Toshiaki @netmarkjp.bsky.social

#ばばさん通信ダイジェスト賛否関わらず話題になった/なりそうなものを共有しています。 CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours

0
0
0
11h ago

Eyal Estrin ☁️ @eyalestrin.bsky.social

Security Analysis and Intel: CVE-2026-33017 Langflow RCE (28.3.2026) #appsec

0
0
0
4h ago

CVE-2026-3055

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.02%

MITRE

KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

4 Posts

Last activity: Last hour

Fediverse

Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

0
0
0
21h ago

Bluesky

Undercode Testing @undercode.bsky.social

CVE-2026-3055: NetScaler Under Active Reconnaissance—Patch Now Before Exploitation Goes Nuclear + Video Introduction: The window between attacker reconnaissance and active exploitation is shrinking to near-zero. Security researchers at watchTowr have detected active scanning campaigns targeting…

0
0
0
5h ago

Undercode Testing @undercode.bsky.social

CVE-2026-3055: Critical Citrix NetScaler Flaw Under Active Exploitation – Patch Now! + Video Introduction: A newly disclosed vulnerability, CVE-2026-3055, with a CVSS score of 9.3, is currently being actively probed by attackers targeting Citrix NetScaler appliances. Threat actors are leveraging…

0
0
0
1h ago

Ninja Owl @ninjaowl.ai

Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
Last hour

CVE-2020-8561

Overview

Kubernetes
Kubernetes

20 Sep 2021

Published

16 Sep 2024

Updated

CVSS v3.1

MEDIUM (4.1)

EPSS

0.18%

MITRE

KEV

Description

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Statistics

3 Posts

Last activity: 15 hours ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

CVE-2020-8561 exploits an SSRF flaw in Kubernetes API server’s ValidatingWebhookConfiguration and profiling endpoints to expose full responses. Requires cluster-admin creds to escalate impact. #KubernetesSecurity #SSRF #CVE20208561

0
0
0
21h ago

WarthogTK @warthogtk.bsky.social

Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8561 | Datadog Security Labs securitylabs.datadoghq.com/articles/unp...

0
0
1
15h ago

CVE-2026-4681

Overview

PTC
Windchill PDMLink

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.38%

MITRE

KEV

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Statistics

2 Posts

Last activity: 11 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 Police Physically Warn Firms of Critical Unpatched RCE Flaw in PTC Windchill

🚨 CRITICAL FLAW: German police physically warn companies about a 10.0 CVSS RCE bug (CVE-2026-4681) in PTC Windchill & FlexPLM. CISA issues alert. No patch yet! ⚠️ #CVE20264681 #ZeroDay #Manufacturing

🔗 https://cyber.netsecops.io/articles/critical-ptc-windchill-flaw-triggers-unprecedented-police-mobilization-in-germany/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
19h ago

Bluesky

Christina Ayiotis @christinaayiotis.bsky.social

“CISA warns of a critical flaw in PTC Windchill and FlexPLM (CVE-2026-4681), with no patch yet and potential for imminent exploitation.” securityaffairs.com/190049/secur...

0
0
0
11h ago

CVE-2026-20963

Overview

Microsoft
Microsoft SharePoint Enterprise Server 2016

13 Jan 2026

Published

19 Mar 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

7.10%

MITRE

KEV

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Statistics

2 Posts
1 Interaction

Last activity: 11 hours ago

Fediverse

alexia @TypeErr0r

Think we’ll ever get this deserialization stuff down? #appsec #infosec

https://securityboulevard.com/2026/03/cve-2026-20963-sharepoint-deserialization-remote-code-execution-vulnerability/

1
0
0
11h ago

Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

0
0
0
21h ago

CVE-2024-54492

Overview

Apple
visionOS

11 Dec 2024

Published

03 Nov 2025

Updated

CVSS

Pending

EPSS

0.28%

MITRE

KEV

Description

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, visionOS 2.2. An attacker in a privileged network position may be able to alter network traffic.

Statistics

1 Post
10 Interactions

Last activity: 11 hours ago

Fediverse

Mysk🇨🇦🇩🇪 @mysk

Good to know but every vulnerability we discovered and reported to Apple also affected the Lockdown Mode. This includes CVE-2024-54492 that impacted the Passwords app. An option to "Allow Contacting Websites" was added starting iOS 26

#privacy #security #iOS #Apple #infosec
--------
Apple Says No iPhone in Lockdown Mode Has Ever Been Hacked

https://www.macrumors.com/2026/03/27/no-iphone-in-lockdown-mode-has-ever-been-hacked/

2
8
0
11h ago

CVE-2026-1678

Overview

zephyrproject-rtos
Zephyr
Zephyr

05 Mar 2026

Published

05 Mar 2026

Updated

CVSS v3.1

CRITICAL (9.4)

EPSS

0.05%

MITRE

KEV

Description

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

Statistics

1 Post
6 Interactions

Last activity: 15 hours ago

Fediverse

John Kristoff @jtk

Weekend Reads

* DNS parser overflow in Zephyr
https://www.0xkato.xyz/CVE-2026-1678-DNS-Parser-Overflow-in-Zephyr/
* Telegram bots measurement survey
https://arxiv.org/abs/2603.24302
* AS-path prepending for anycast optimization
https://arxiv.org/abs/2603.21082
* Building the largest data center
https://spectrum.ieee.org/5gw-data-center
* OpenBSD init system and boot process
https://overeducated-redneck.net/blurgh/openbsd-init-system.html

#DNS #Telegram #BGP #AI #OpenBSD

2
4
0
15h ago

CVE-2026-34205

Overview

home-assistant
Home Assistant Operating System

27 Mar 2026

Published

27 Mar 2026

Updated

CVSS v3.1

CRITICAL (9.7)

EPSS

Pending

MITRE

KEV

Description

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Statistics

1 Post
3 Interactions

Last activity: 8 hours ago

Fediverse

Offensive Sequence @offseq

🚨 CVE-2026-34205 (CRITICAL): Home Assistant OS ≤17.1 apps in host network mode expose unauthenticated endpoints to local networks. Upgrade to Supervisor 2026.03.02, segment networks, and review configs now! https://radar.offseq.com/threat/cve-2026-34205-cwe-923-improper-restriction-of-com-dfad0bbb #OffSeq #HomeAssistant #IoTSecurity

2
1
0
8h ago

CVE-2026-20131

Overview

Cisco
Cisco Secure Firewall Management Center (FMC)

04 Mar 2026

Published

25 Mar 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.65%

MITRE

KEV

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Statistics

1 Post
3 Interactions

Last activity: 13 hours ago

Fediverse

elhacker.NET @elhackernet

Ransomware Interlock explota Zero-Day crítico en Cisco FMC (CVE-2026-20131)

https://blog.elhacker.net/2026/03/ransomware-interlock-explota-zero-day.html

1
2
0
13h ago