There are three high-severity vulnerabilities in the NVIDIA NeMo Framework that could allow attackers to execute remote code, potentially compromising AI systems and leading to data tampering. The security flaws, identified as CVE-2025-23249, CVE-2025-23250, and CVE-2025-23251, each received a CVSS…
Category: Cyber Security News
Critical Langflow Vulnerability Allows Malicious Code Injection – Technical Details Revealed
Cybersecurity researchers have uncovered a critical remote code execution (RCE) vulnerability in Langflow, an open-source platform widely used for visually composing AI-driven agents and workflows. Designated as CVE-2025-3248, this high-severity vulnerability carries a CVSS score of 9.8, placing it in…
Commvault RCE Vulnerability Let Attackers Breach Vault – PoC Released
A critical pre-authenticated Remote Code Execution (RCE) vulnerability affecting Commvault’s backup and data protection platform. The vulnerability, tracked as CVE-2025-34028, could allow attackers to compromise enterprise backup systems without requiring authentication, potentially putting organizations’ most critical data at risk. The…
Cisco Confirms Multiple Products Impacted by Erlang/OTP SSH Server RCE Vulnerability
Cisco Systems has issued a critical security advisory confirming that multiple products across its portfolio are affected by a remote code execution (RCE) vulnerability in the Erlang/OTP SSH server (CVE-2025-32433). The flaw, which carries a maximum CVSSv3.1 score of 10.0,…
Threat Actors Turn More Sophisticated & Exploiting Zero-Day Vulnerabilities – Google Warns
Cybersecurity defenders face increasingly sophisticated adversaries as threat actors continue evolving their methods to circumvent modern defense systems. According to the newly released M-Trends 2025 report, attackers are demonstrating enhanced capabilities to create custom malware ecosystems, identify and exploit zero-day…
Redis DoS Vulnerability: Attackers Can Exhaust Server Memory or Cause Crashes
A high-severity vulnerability in Redis, the popular open-source in-memory data structure store, that could allow unauthenticated attackers to cause denial-of-service conditions by exhausting server memory. Tracked as CVE-2025-21605 with a CVSS score of 7.5, this vulnerability affects all Redis versions…
GitLab Security Update – Patch for XSS, DoS & Account Takeover Vulnerabilities
GitLab has released critical security patches addressing multiple high-severity vulnerabilities in its platform, highlighting robust security measures amid increasing cyber threats. The company has issued patch versions 17.11.1, 17.10.5, and 17.9.7 for both Community Edition (CE) and Enterprise Edition (EE).…
Blue Shield Leaked Health Info of 4.7M patients with Google Ads
Blue Shield of California has disclosed a significant data breach affecting 4.7 million members, representing the majority of its nearly 6 million customers. The health insurance provider revealed that protected health information (PHI) was inadvertently shared with Google’s advertising platforms…
SonicWall SSLVPN Vulnerability Let Remote Attackers Crash Firewall Appliances
SonicWall has disclosed a critical security vulnerability in its SSLVPN service that allows unauthenticated remote attackers to crash affected firewall appliances, potentially causing significant disruptions to enterprise networks. The vulnerability, tracked as CVE-2025-32818, received a high severity CVSS score of…
Threat Actors Using Weaponized SVG Files to Redirect Users to Malicious Websites
Phishing campaigns have evolved significantly in 2025, with threat actors increasingly leveraging unconventional file formats to bypass security solutions. A particularly concerning trend involves the weaponization of Scalable Vector Graphics (SVG) files, which are being embedded with malicious JavaScript code…
1000+ Unique IPs Attacking Ivanti Connect Secure Systems to Exploit Vulnerabilities
A significant increase in suspicious scanning activity targeting Ivanti Connect Secure (ICS) and Ivanti Pulse Secure (IPS) VPN systems, signaling a potential coordinated reconnaissance effort by threat actors. The spike, registering more than 230 unique IP addresses probing ICS/IPS endpoints…
Microsoft to Offer Rewards Up to $30,000 for AI Vulnerabilities
Microsoft has launched an expanded bug bounty program offering rewards of up to $30,000 for researchers who identify critical vulnerabilities in AI systems within its Dynamics 365 and Power Platform products. The initiative, announced by Microsoft Security Response, aims to…
Building a Cyber-Aware Culture – CISO’s Step-by-Step Plan
A cyber-aware culture is the backbone of any resilient organization in today’s digital world. As cyber threats become more advanced and frequent, safeguarding sensitive data and systems can no longer rest solely with IT departments. Chief Information Security Officers (CISOs)…
Beyond Compliance – How VPs of Security Drive Strategic Cybersecurity Initiatives
In an era where cyber threats evolve faster than regulatory frameworks, Vice Presidents (VPs) of Security are redefining their roles from compliance enforcers to strategic business leaders. While adherence to standards like GDPR and HIPAA remains critical, forward-thinking security executives…
Critical Commvault RCE Vulnerability Lets Remote Attackers Execute Arbitrary Code
A significant security vulnerability (CVE-2025-34028) has been discovered in Commvault Command Center Innovation Release, enabling unauthenticated attackers to execute arbitrary code remotely. The vulnerability, which carries a high CVSS score of 9.0, affects explicitly version 11.38 of the Command Center…
WhatsApp’s New Advanced Chat Privacy Feature to Protect Sensitive Conversations
WhatsApp has announced the rollout of its new “Advanced Chat Privacy” feature, designed to give users greater control over the confidentiality of their conversations. Building on its foundation of end-to-end encryption, which ensures that only the sender and recipient can…
Ripple XPRL Official NPM Package Hijacked To Inject Private Key Stealing Malware
A significant supply chain attack targeting cryptocurrency users. The official XRPL (Ripple) NPM package, which serves as the JavaScript SDK for the XRP Ledger, was compromised with malicious code designed to steal cryptocurrency private keys, potentially affecting hundreds of thousands…
The Evolving Role of the CISO – Balancing Risk and Innovation in the Digital Age
The Evolving role of the Chief Information Security Officer (CISO) has transcended its roots in technical oversight to become a cornerstone of organizational strategy. As digital transformation accelerates, fueled by cloud computing, artificial intelligence, and IoT, CISOs grapple with a…
Building A Unified Security Strategy: Integrating Digital Forensics, XDR, And EDR For Maximum Protection
In the rapidly evolving world of cybersecurity, organizations are confronted with increasingly sophisticated threats that demand a coordinated and multi-layered defense approach. The days of relying on isolated security tools are long gone, as modern attack vectors now target various…
FireEye EDR Agent Vulnerability Let Attackers Inject Malicious Code
A significant vulnerability in the FireEye Endpoint Detection and Response (EDR) agent that could allow attackers to inject malicious code and render critical security protections ineffective. The vulnerability, tracked as CVE-2025-0618, was disclosed today and highlights the ongoing challenges in…