CVE-2025-14847

Overview

MongoDB Inc.
MongoDB Server

19 Dec 2025

Published

31 Dec 2025

Updated

CVSS v4.0

HIGH (8.7)

EPSS

65.77%

MITRE

KEV

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Statistics

2 Posts

Last activity: 1 hour ago

Bluesky

セキュリティ対策Lab @securitylab-jp.bsky.social

MongoDBの「MongoBleed」がCISAのKEVに追加(CVE-2025-14847) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃 #DataBreach

0
0
0
7h ago

OpsMatters @opsmatters.com

The latest update for #ArmoSec includes "Best #threatdetection & response solutions for #cloud-native applications in 2026" and "MongoBleed (CVE-2025-14847): Unauthenticated Memory Disclosure in #MongoDB". #Cybersecurity https://opsmtrs.com/3fde7yI

0
0
0
1h ago

CVE-2025-68926

Overview

rustfs
rustfs

30 Dec 2025

Published

30 Dec 2025

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.07%

MITRE

KEV

Description

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.77, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.77 contains a fix for the issue.

Statistics

1 Post
3 Interactions

Last activity: 3 hours ago

Fediverse

Pete Keen @zrail

RustFS, a distributed object storage system written by LLMs, but in rust so it's fine everything is fine, hardcoded a fully privileged API token, apparently from Alpha.13 through Alpha.77.

If you're running any of those versions, probably you want to upgrade asap.

https://nvd.nist.gov/vuln/detail/CVE-2025-68926

#rustfs #selfhosted #selfhosting #homelab

2
1
0
3h ago

CVE-2025-38352

Overview

Linux
Linux

22 Jul 2025

Published

03 Nov 2025

Updated

CVSS

Pending

EPSS

0.19%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

Statistics

1 Post
2 Interactions

Last activity: 19 hours ago

Fediverse

DragonJAR @dragonjar

ShinyHunters intenta hackear Resecurity pero solo accede a una honeypot, reforzando el valor de estas trampas digitales; Francia investiga la propagación de deepfakes sexuales generados por IA, aumentando la urgencia de regulaciones; Finlandia detiene a dos por dañar un cable submarino clave; y surge una crítica vulnerabilidad en el kernel de Android (CVE-2025-38352) que exige parches inmediatos. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 04/01/26 📆 |====

🔐 SHINYHUNTERS AFIRMA HACKEO A RESCURITY, PERO LA EMPRESA REVELA UNA TRAMPA

El grupo de cibercriminales ShinyHunters asegura haber vulnerado los sistemas de Resecurity y extraído datos internos críticos. Sin embargo, Resecurity desmiente la brecha real, señalando que los atacantes solo accedieron a una honeypot, un entorno simulado con información falsa diseñado para rastrear y estudiar sus acciones. Este caso destaca la importancia de las honeypots como estrategia defensiva para detectar y analizar amenazas sin comprometer datos sensibles. Conoce cómo estas tácticas protegen a las empresas y fortalecen la seguridad digital. Más detalles e implicaciones aquí 👉 https://djar.co/kP53NL

🤖 FRANCIA INVESTIGA DEEPFAKES SEXUALES GENERADOS POR IA EN REDES SOCIALES

Francia ha iniciado una investigación contra la creación y difusión de deepfakes sexualmente explícitos generados por inteligencia artificial, especialmente en la plataforma X (antes Twitter). Esta práctica afecta gravemente la privacidad y seguridad de mujeres y adolescentes, quienes han denunciado la publicación de imágenes manipuladas que las muestran desnudas sin consentimiento. El caso abre un debate sobre la regulación de contenidos digitales y la protección legal ante delitos tecnológicos, resaltando la urgencia de estrategias para combatir la desinformación y el acoso digital. Lee más sobre esta amenaza emergente y sus consecuencias 👉 https://djar.co/5A85Yj

🇫🇮 FINLANDIA ARRESTA A DOS TRIPULANTES POR DAÑOS A CABLE SUBMARINO CRÍTICO

Autoridades finlandesas detuvieron a dos tripulantes de un buque de carga sospechosos de causar daños a un cable submarino que es vital para las comunicaciones y la infraestructura digital regional. Este incidente puede generar interrupciones en la conectividad y vulnerar la seguridad cibernética de servicios clave, subrayando la fragilidad de las infraestructuras físicas que soportan el tráfico de datos global. Se trata de un recordatorio sobre la necesidad de proteger estos activos estratégicos frente a actos de sabotaje o accidentes. Descubre cómo este hecho puede impactar la ciberseguridad regional 👉 https://djar.co/SxFA

🛡️ CVE-2025-38352: NUEVA VULNERABILIDAD EN EL KERNEL DE ANDROID

Un reciente análisis destapa una vulnerabilidad crítica en el kernel de Android, identificada en 2025 bajo el código CVE-2025-38352. El reporte profundiza en la naturaleza del fallo, presenta una demostración y detalla posibles extensiones y métodos de explotación que podrían comprometer dispositivos móviles a gran escala. Este hallazgo enfatiza la necesidad de aplicar parches de seguridad y mantener sistemas actualizados para evitar ataques que podrían afectar millones de usuarios. Infórmate aquí sobre cómo proteger tus dispositivos y qué esperar en próximos parches 👉 https://djar.co/bf529

1
1
0
19h ago

CVE-2025-53859

Overview

F5
NGINX Plus

13 Aug 2025

Published

04 Nov 2025

Updated

CVSS v3.1

LOW (3.7)

EPSS

0.09%

MITRE

KEV

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Statistics

2 Posts

Last activity: 17 hours ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

URGENT: CVE-2025-53859 patched in #Fedora 42 for nginx-mod-modsecurity. Memory leak in NGINX 1.28.1 mail module allows worker process memory disclosure. Read more: 👉 tinyurl.com/2s46cru2 #Security

0
0
0
18h ago

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

Critical security update for nginx on #Fedora 42 The nginx 1.28.1 release addresses CVE-2025-53859, a memory disclosure vulnerability in the mail module's authentication handling. This affects systems using the NAXSI web application firewall module.Read more: 👉 tinyurl.com/w9n8e5e #Security

0
0
0
17h ago

CVE-2025-68456

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 20 hours ago

Bluesky

Undercode Testing @undercode.bsky.social

Craft CMS Under Siege: Exploiting CVE-2025-68456 for Remote Code Execution – A Deep Dive Analysis + Video Introduction: A critical vulnerability, CVE-2025-68456, has been uncovered in Craft CMS, a popular content management system powering over 150,000 websites. This flaw allows unauthenticated…

0
0
0
20h ago

CVE-2025-29927

Overview

vercel
next.js

21 Mar 2025

Published

08 Apr 2025

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

92.90%

MITRE

KEV

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Statistics

1 Post

Last activity: 22 hours ago

Bluesky

Philippe Vynckier @pvynckier.bsky.social

Best of 2025: CVE-2025-29927 – Understanding the Next.js Middleware Vulnerability - Security Boulevard securityboulevard.com/2026/01/cve-...

0
0
0
22h ago

CVE-2025-53773

Overview

Microsoft
Microsoft Visual Studio 2022 version 17.14

12 Aug 2025

Published

10 Nov 2025

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.87%

MITRE

KEV

Description

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

Statistics

1 Post

Last activity: 14 hours ago

Bluesky

今日視界 @g0rosato.bsky.social

【AI安全】間接提示詞注入實現RCE(CVE-2025-53773繞過分析)

0
0
0
14h ago