Trending now

CVE-2025-9961 is a remote code execution (RCE) vulnerability found in TP-Link routers, specifically affecting the CWMP (CPE WAN Management Protocol) binary. An authenticated attacker can exploit this flaw to remotely execute arbitrary code on the affected devices. The vulnerability can be triggered by sending malformed SOAP requests. The vulnerability is a stack-based buffer overflow within the cwmp process. Security researchers bypassed Address Space Layout Randomization (ASLR) by brute-forcing the base address of the standard C library. Successful exploitation allows an attacker to gain full control of the router, potentially intercepting traffic, launching attacks on the local network, or adding the device to a botnet. The exploit often involves using a return-to-libc (ret2libc) technique to call the system() function with a command to download and execute a malicious binary from an attacker-controlled server.

CVE-2025-21042 is an out-of-bounds write vulnerability found in Samsung's libimagecodec.quram.so library. This library is responsible for handling image parsing and decoding on Samsung Galaxy devices. The vulnerability is triggered when processing a specially crafted image file, leading to a write operation outside the allocated memory boundaries. Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected devices. This can be achieved through various channels such as email attachments, messaging apps, or web browsing, where the device processes an attacker-supplied image. A patch has been released in the SMR Apr-2025 Release 1 security update to address this vulnerability.

CVE-2025-6554 is a type confusion vulnerability found in the V8 JavaScript engine, which is used in Chrome and other Chromium-based browsers. This vulnerability can be exploited by remote, unauthenticated attackers by serving crafted HTML pages to targeted users. If successful, the attacker can trick V8 into misinterpreting memory types, potentially leading to arbitrary read/write operations. In some scenarios, this could allow for full remote code execution. Google is aware that the vulnerability is being actively exploited in the wild. A security update has been released for Chrome to address this zero-day vulnerability. The vulnerability was discovered by Clément Lecigne of Google's Threat Analysis Group (TAG) on June 25, 2025.

CVE-2025-41244 is a local privilege escalation vulnerability affecting VMware Tools and VMware Aria Operations. It stems from overly broad regular expression patterns in the `get-versions.sh` component used by both VMware Tools and Aria Operations' Service Discovery Management Pack (SDMP). The `get_version()` function in this script scans for listening sockets and then executes matched binaries to retrieve version information. However, the use of the non-whitespace shorthand `\S` unintentionally includes user-writable directories such as `/tmp/httpd`. Attackers can exploit this by staging malicious binaries in these user-writable locations. The privileged VMware context then executes these binaries, leading to a local privilege escalation. By mimicking system binaries in writable paths, CVE-2025-41244 violates CWE-426: Untrusted Search Path, offering trivial local privilege escalation opportunities.

CVE-2025-49844 is a vulnerability in Redis that stems from improper memory management within its embedded Lua interpreter. The core issue is a use-after-free bug that can be triggered via a specially crafted Lua script. An authenticated user can manipulate the garbage collection process, exploiting freed memory pointers to potentially execute arbitrary code within the Redis server's process. This vulnerability exists in all Redis versions that include Lua scripting support. Redis has released patches to address this vulnerability. For more information on remediation, see the security advisory from Redis.

CVE-2025-21043 is a vulnerability affecting Samsung devices running Android versions 13, 14, 15, and 16. It is an out-of-bounds write vulnerability found in `libimagecodec.quram.so`, a closed-source image parsing library developed by Quramsoft. This library is used to process image formats. The vulnerability allows remote attackers to execute arbitrary code on affected devices. Samsung has released a security patch in their September 2025 Security Maintenance Release (SMR) to address the "incorrect implementation" that caused the vulnerability. It was reported that this vulnerability was exploited in zero-day attacks.

CVE-2025-8671, also known as "MadeYouReset," is an HTTP/2 denial-of-service (DoS) vulnerability that exploits a mismatch in how some HTTP/2 implementations handle server-sent stream resets. Discovered by researchers from Tel Aviv University and Imperva, the vulnerability arises because certain servers incorrectly treat these resets as stream closures. An attacker can trigger these resets using crafted HTTP/2 frames, such as malformed WINDOW_UPDATE or PRIORITY frames. By rapidly triggering server-side resets, an attacker can cause the server to handle an unbounded number of concurrent streams on a single connection, bypassing the standard `MAX_CONCURRENT_STREAMS` limit. This leads to excessive consumption of server resources, potentially causing a denial-of-service condition due to memory or processing capability exhaustion. Affected implementations include Apache Tomcat, F5 BIG-IP, Netty, and others.

CVE-2025-64458 affects Django's HTTP redirect handling on Windows systems. The vulnerability lies in the `HttpResponseRedirect` and `HttpResponsePermanentRedirect` functions. It is caused by slow NFKC normalization in Python on Windows. An attacker could exploit this by sending crafted URLs with excessive Unicode characters. This can cause Django's redirect functions to consume large amounts of CPU time, potentially leading to performance degradation or a denial-of-service. Django versions 5.2, 5.1, 4.2, and the beta version 6.0 are affected. Patches have been released in versions 5.2.8, 5.1.14, and 4.2.26.

CVE-2025-6218 is a directory traversal remote code execution vulnerability that affects RARLAB WinRAR. It allows remote attackers to execute arbitrary code on affected installations. Exploitation of this vulnerability requires user interaction, as the target must visit a malicious page or open a malicious file. The vulnerability lies in how WinRAR handles file paths within archive files, where a specially crafted file path can cause the process to traverse to unintended directories. By leveraging this vulnerability, an attacker can execute code within the security context of the current user.

CVE-2025-48593 is a critical zero-click vulnerability in the Android System component that manages essential device functions. It allows attackers to remotely execute malicious code without any user interaction or additional privileges. The vulnerability stems from insufficient validation of user input and affects Android versions 13 through 16. Successful exploitation of CVE-2025-48593 could give attackers full control over affected devices, potentially leading to data theft, ransomware deployment, or the use of compromised smartphones as nodes in botnet attacks. Google has released a security patch in the November 2025 Android Security Bulletin to address this vulnerability.