Vulnerability intelligence

Updated 8 minutes ago

Feeds

Trending now

CVEs trending on social media within the last 24 hours

Hypemeter

690100

Current score

Nice

  1. 1

    CVE-2025-32463 Published Jun 30, 2025

    Hype score

    69

    critical 9.3

    sudo

    CVE-2025-32463 is a vulnerability that affects Sudo versions 1.9.14 to 1.9.17 inclusive. It allows a local user to gain root access. This is possible because the `/etc/nsswitch.conf` file from a user-controlled directory is used with the `--chroot` option. An attacker can exploit this vulnerability by using Sudo's `-R` or `--chroot` option to execute arbitrary commands as root, even if they are not listed in the `sudoers` file. The vulnerability was fixed in Sudo version 1.9.17p1.

  2. 2

    CVE-2025-6554 Published Jun 30, 2025

    Hype score

    52

    CVE-2025-6554 is a type confusion vulnerability found in the V8 JavaScript engine, which is used in Chrome and other Chromium-based browsers. This vulnerability can be exploited by remote, unauthenticated attackers by serving crafted HTML pages to targeted users. If successful, the attacker can trick V8 into misinterpreting memory types, potentially leading to arbitrary read/write operations. In some scenarios, this could allow for full remote code execution. Google is aware that the vulnerability is being actively exploited in the wild. A security update has been released for Chrome to address this zero-day vulnerability. The vulnerability was discovered by Clément Lecigne of Google's Threat Analysis Group (TAG) on June 25, 2025.

  3. 3

    CVE-2025-32462

    Hype score

    41

    sudo

    CVE-2025-32462 affects Sudo versions before 1.9.17p1. When Sudo is used with a sudoers file that specifies a host that is neither the current host nor ALL, it allows listed users to execute commands on unintended machines. This vulnerability has existed since the implementation of the host option in Sudo v1.8.8, released in September 2013. The vulnerability can be exploited when Sudo rules are configured to restrict certain hostnames or hostname patterns. In such cases, privilege escalation to root may occur without requiring a specific exploit. To mitigate this vulnerability, it is recommended to install Sudo version 1.9.17p1 or later.

See more

Known exploited

Sourced from CISA's Known Exploited Vulnerability (KEV) catalog.

  1. CVE-2025-48928 Published May 28, 2025

    medium 4.0

    Exploit known

    The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

  2. CVE-2025-48927 Published May 28, 2025

    medium 5.3

    Exploit known

    The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

  3. CVE-2025-6543 Published Jun 25, 2025

    Hype score

    30

    critical 9.2

    Exploit known

    NetScaler ADCNetScaler GatewayCitrix

    CVE-2025-6543 is a memory overflow vulnerability found in Citrix NetScaler ADC and NetScaler Gateway. It affects appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The vulnerability stems from improper restriction of operations within the bounds of a memory buffer. Successful exploitation of CVE-2025-6543 could lead to unintended control flow and a denial-of-service (DoS) condition. Exploits targeting this vulnerability have been observed in the wild, prompting Citrix to release security updates.

See more

Insights

See more

Our Security Team's most recent CVE analysis

  1. CVE-2025-4428

    high 7.2

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated May 19, 2025

    This CVE references a Java Expression Language injection vulnerability in Ivanti EPMM, which allows a user with access to a particular API to execute arbitrary code.

    In conjunction with CVE-2025-4427 - an auth bypass vulnerability which gives access to the API in question - this can be used by an unauthenticated attacker.

    More information on exact vulnerable versions can be found here - you should patch immediately if vulnerable. Note that in the recommended deployment of EPMM, where the API is not accessible to the internet, the impact is reduced.

    Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

  2. Link to CVE page

    Intruder Insights

    Updated Apr 28, 2025

    If caching is in use on this application, it is likely this can be used to poison the cache, causing the modified data to be shown to other users.

    There is also potential to then use this for cross-site scripting, although, this would depend on how the data is processed by the client, and will not be the case for all applications.

    In order for this application to be vulnerable, React Router must be used in Framework mode.

    React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

  3. CVE-2025-30406

    critical 9.0

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated Apr 14, 2025

    This vulnerability is caused by the installer for the application using a hardcoded value for the validation and decryption key (sometimes known as the machine keys). These values are the same for all instances created by the vulnerable installer, and so an attacker can find these keys for your instance very easily.

    If an attacker possesses these keys, they can execute code of their choice on the server remotely using well-known methods.

    Updating to the latest version will cause the keys to be regenerated to secret values.

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.