CVE-2024-51324

Overview

Pending

11 Feb 2025

Published

12 Feb 2025

Updated

CVSS

Pending

EPSS

0.11%

MITRE

KEV

Description

An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnerable Driver) attack.

Statistics

1 Post

Last activity: 4 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 DeadLock Ransomware Uses Vulnerable Baidu Driver to Blind EDRs

DeadLock ransomware evolves, using a novel BYOVD attack to disable EDRs. 🛡️ The campaign exploits a vulnerable Baidu AV driver (CVE-2024-51324) to gain kernel-level control and kill security processes. #Ransomware #BYOVD #CyberSecurity #DeadLock

🔗 https://cyber.netsecops.io/articles/deadlock-ransomware-deploys-byovd-tactic-to-disable-edr/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
4h ago

CVE-2025-66644

Overview

Array Networks
ArrayOS AG

05 Dec 2025

Published

09 Dec 2025

Updated

CVSS v3.1

HIGH (7.2)

EPSS

12.19%

MITRE

KEV

Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Statistics

2 Posts

Last activity: 12 hours ago

Fediverse

Dark Web Informer :verified_paw: @DarkWebInformer

🚨CISA Kev Catalog has added two more vulnerabilities

CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability

CVSS: 9.8

CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability

CVSS: 7.1

https://darkwebinformer.com/cisa-kev-catalog/

0
0
0
19h ago

Bluesky

ohhara @shiojiri.com

CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability

0
0
0
12h ago

CVE-2025-65958

Overview

open-webui
open-webui

04 Dec 2025

Published

08 Dec 2025

Updated

CVSS v3.1

HIGH (8.5)

EPSS

0.04%

MITRE

KEV

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.

Statistics

1 Post

Last activity: 22 hours ago

Bluesky

Checkmarx Zero @checkmarxzero.bsky.social

🚨 CVE-2025-65958 | Open WebUI | Authenticated SSRF (High) Authenticated users can force the server to send HTTP requests to arbitrary URLs, enabling internal network scanning and access to internal services. Affects versions < 0.6.37. Patch: Upgrade to v0.6.37 buff.ly/1dg6IHi buff.ly/Yewlmqu

0
0
0
22h ago

CVE-2022-37055

Overview

Pending

28 Aug 2022

Published

09 Dec 2025

Updated

CVSS

Pending

EPSS

83.52%

MITRE

KEV

Description

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

Statistics

2 Posts

Last activity: 12 hours ago

Fediverse

Dark Web Informer :verified_paw: @DarkWebInformer

🚨CISA Kev Catalog has added two more vulnerabilities

CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability

CVSS: 9.8

CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability

CVSS: 7.1

https://darkwebinformer.com/cisa-kev-catalog/

0
0
0
19h ago

Bluesky

ohhara @shiojiri.com

CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability

0
0
0
12h ago

CVE-2025-55554

Overview

Pending

25 Sep 2025

Published

26 Sep 2025

Updated

CVSS

Pending

EPSS

0.05%

MITRE

KEV

Description

pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().

Statistics

1 Post

Last activity: 17 hours ago

Bluesky

SecQube | Harvey | AI Platform for MS Graph @secqube.com

CVE-2025-55554 pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long(). scq.ms/3MmLlQr #MicrosoftSecurity #cybersecurity

0
0
0
17h ago

CVE-2025-67504

Overview

WBCE
WBCE_CMS

09 Dec 2025

Published

09 Dec 2025

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

0.03%

MITRE

KEV

Description

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Statistics

1 Post

Last activity: 16 hours ago

Fediverse

Offensive Sequence @offseq

🔒 CVE-2025-67504: WBCE CMS <1.6.5 uses weak rand() for password generation, allowing attackers to predict or brute-force credentials. CRITICAL—upgrade to 1.6.5+ now! Monitor for suspicious logins. https://radar.offseq.com/threat/cve-2025-67504-cwe-331-insufficient-entropy-in-wbc-5bf971f6 #OffSeq #Vuln #WBCECMS #Security

0
0
0
16h ago

CVE-2025-54988

Overview

Apache Software Foundation
Apache Tika PDF parser module
org.apache.tika:tika-parser-pdf-module

20 Aug 2025

Published

04 Nov 2025

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Statistics

1 Post

Last activity: 11 hours ago

Bluesky

Sami Laiho @samilaiho.com

Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected URL: lists.apache.org/thread/s5x3k... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0

0
0
0
11h ago

CVE-2025-67461

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 5 hours ago

Bluesky

ripjyr.bsky.social @ripjyr.bsky.social

Zoomに、Mediumの脆弱性情報 ZSB-25051 が公開されました。「CVE-2025-67461 : Zoom Rooms for macOS - External Control of File Name or Path」 CVSSv3: 5 →　https://www.zoom.com/en/trust/security-bulletin/ZSB-25051/

0
0
0
5h ago

CVE-2025-59287

Overview

Microsoft
Windows Server 2019

14 Oct 2025

Published

22 Nov 2025

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

62.31%

MITRE

KEV

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Statistics

1 Post

Last activity: 11 hours ago

Bluesky

Finn John @finnjohn3344.bsky.social

Microsoft Rushes Emergency Fix for WSUS Remote Code Execution Flaw (CVE-2025-59287)

0
0
0
11h ago

CVE-2024-3400

Overview

Palo Alto Networks
PAN-OS

12 Apr 2024

Published

21 Oct 2025

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

94.30%

MITRE

KEV

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Statistics

1 Post

Last activity: 23 hours ago

Bluesky

CyberVeille @cyberveille-ch.bsky.social

📢 Vaste campagne d’attaques contre les portails Palo Alto GlobalProtect depuis 7 000+ IP 📝 Selon Cyber Security News, une campagne d’exploitation… https://cyberveille.ch/posts/2025-12-08-vaste-campagne-dattaques-contre-les-portails-palo-alto-globalprotect-depuis-7-000-ip/ #CVE_2024_3400 #Cyberveille

0
0
0
23h ago