Security product vulns are maddening but will also never not be funny to me.

Heap-based Buffer Overflow, Out-of-bounds Write vulnerability in Avast Antivirus on MacOS of a crafted Mach-O file may allow Local Execution of Code or Denial of Service of antivirus protection.\nThis issue affects Antivirus: from 15.7 before 3.9.2025.

https://www.cve.org/CVERecord?id=CVE-2025-10101

"A security advisory being sent out due to a woops. Noted as CVE-2025-66270, that woops could allow an attacker to entirely skip proper authentication": KDE Connect security advisory released due to possible authentication bypass https://www.gamingonlinux.com/2025/12/kde-connect-security-advisory-released-due-to-possible-authentication-bypass/

KDE Project Security Advisory
=============================

Title:           KDE Connect: Impersonation of paired devices, bypassing authentication
Risk rating:     Critical
CVE:             CVE-2025-66270

[…]

Workaround
==========

Until you can upgrade to a non-vulnerable version, we advise you to stop KDE Connect when on
untrusted networks like those on airports or conferences and/or unpair all devices from KDE Connect.

And another one:

Heap-based Buffer Overflow, Out-of-bounds Read vulnerability in Avast Antivirus on MacOS when scanning a malformed file may allow Local Execution of Code or Denial-of-Service of the anitvirus engine process.This issue affects Antivirus: from 8.3.70.94 before 8.3.70.98.

https://www.cve.org/CVERecord?id=CVE-2025-8351

sev:CRIT account takeover in Mattermost.

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).

https://www.cve.org/CVERecord?id=CVE-2025-12421

🚨 In this week’s Threat Alert article, CrowdSec highlights active exploitation of CVE-2025-64095, a critical DNN file upload flaw. Attackers are probing sites for defacement and XSS attacks.

Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2025-64095

#CVE #CVE202564095 #threatalert #cybersecurity

⚠️ CVE-2025-13803: Medium severity flaw in MediaCrush 1.0.0/1.0.1. Improper Host header neutralization enables HTTP header injection & possible XSS. No auth/user action needed. Mitigate with header validation & WAF rules. https://radar.offseq.com/threat/cve-2025-13803-improper-neutralization-of-http-hea-0a82351b #OffSeq #infosec #vuln

Since a week my honeypots are seeing an increase in attacks targeting CVE-2023-7304 (Ruijie RG-UAC nmc_sync.php Command Injection)

#honeypot #infosec #dfir #cybersecurity #exploitation

Buffer overread in OpenVPN. See what happens when you enable IPv6?

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106

And another one:

Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.

https://www.cve.org/CVERecord?id=CVE-2025-3500