Cybersecurity researchers discovered two critical buffer overflow vulnerabilities (CVE-2025-31700 and CVE-2025-31701) in Dahua smart camera firmware that allow attackers to remotely hijack devices without authentication. The flaws affect multiple camera series with firmware built before Ap...
A critical vulnerability (CVE-2025-49113, CVSS 9.9) in Roundcube webmail has been discovered after remaining hidden for ten years. This post-authenticated remote code execution flaw affects all versions prior to 1.6.11/1.5.10 LTS and allows authenticated users to execute arbitrary code thr...
A financially motivated threat actor called Mimo is exploiting CVE-2025-32432, a critical RCE vulnerability in Craft CMS, to deploy cryptojacking operations. After gaining access through the vulnerability, attackers install a web shell that downloads a malicious script, which removes compe...
Critical vulnerabilities in Craft CMS are being actively exploited in zero-day attacks. Threat actors are chaining CVE-2024-58136 (CVSS 9.0) and CVE-2025-32432 (CVSS 10.0) to gain unauthorized server access. The second vulnerability allows unauthenticated remote code execution through the ...
SAP has released emergency patches for a critical zero-day vulnerability (CVE-2025-31324, CVSS 10.0) in NetWeaver's Visual Composer that's under active exploitation. The unauthenticated file upload flaw allows attackers to upload malicious files and execute remote code without authenticati...
