Trending now

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2026-58115 is a missing authentication vulnerability affecting the Node-RED HTTP interface bundled with Siemens SIMATIC IoT2050 Advanced devices running Industrial OS (versions prior to V4.3.4.1). Because the Node-RED editor and admin API are exposed without access control by default, an unauthenticated remote attacker with network access can reach the programming interface. By deploying malicious flows containing built-in nodes—such as `exec` or `function` nodes—attackers can execute arbitrary system commands on the underlying server. In late October 2026, security researchers observed active exploitation of this vulnerability in the wild. Attackers targeted exposed instances by sending HTTP POST requests to deploy malicious flows, which automatically downloaded Linux bot payloads and established persistent web shells to execute remote commands. Siemens has addressed the issue in Industrial OS version V4.3.4.1 and later. For standalone Node-RED installations, administrators are advised to enable the `adminAuth` setting and restrict the editor from public internet access.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

CVE-2025-32433 is a vulnerability found in the Erlang/OTP SSH server. It stems from a flaw in the SSH protocol message handling, which allows an attacker with network access to execute arbitrary code on the server without authentication. Specifically, the vulnerability enables a malicious actor to send connection protocol messages before authentication takes place. Successful exploitation could lead to full compromise of the host, unauthorized access, manipulation of sensitive data, or denial-of-service attacks.

CVE-2024-25600 is a Remote Code Execution (RCE) vulnerability affecting the Bricks Builder plugin for WordPress. This vulnerability exists in versions up to and including 1.9.6. The vulnerability stems from improper handling of user input within the Bricks Builder plugin, which allows unauthenticated attackers to inject and execute arbitrary PHP code remotely on the server. Exploitation could lead to full site compromise, data theft, and potential malware distribution. A patch addressing this vulnerability has been released in Bricks Builder plugin version 1.9.6.1 or higher.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2025-3699 is a vulnerability affecting Mitsubishi Electric air conditioning systems. It stems from a missing authentication process for critical functions within the affected systems. This vulnerability exists in multiple models, including G-50, AE-200 series, and EW-50 series, specifically impacting versions 3.37 and prior for G-series devices and older versions for AE/EW series devices. Successful exploitation of CVE-2025-3699 could allow an unauthenticated attacker to bypass authentication, illegally control the air conditioning systems, disclose sensitive system information, and potentially tamper with the device firmware. It is recommended to update the firmware to versions newer than 3.37 for G-series devices and 8.01 for AE/EW-series devices.

CVE-2025-1974 is a vulnerability within the Ingress NGINX Controller for Kubernetes, specifically affecting the admission controller component. This flaw falls under a group of vulnerabilities collectively known as "IngressNightmare." The vulnerability arises because the admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject arbitrary NGINX configurations. This results in code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which could lead to a complete cluster takeover.

CVE-2026-73695 is a path traversal vulnerability affecting Control Web Panel (CWP) versions prior to webpanel_version 1.16. The flaw resides in the `services/users/index.php` file, where an attacker-supplied module name is concatenated directly into an include path without proper sanitization, such as an allowlist, `basename()`, or traversal checks. By injecting directory traversal sequences into the module name parameter, an attacker can achieve local file inclusion (LFI). This allows the inclusion of arbitrary local PHP files on the server, which can lead to the execution of arbitrary PHP code within the user panel context. The vulnerability is remotely exploitable over the network, requiring low-privilege access and no user interaction.

CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR. It allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild. It was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. The vulnerability was exploited in phishing attacks to deliver RomCom malware. The attackers can trick the program into saving a file in a different location than the user intended, such as the computer's Startup folder. This allows the attackers to execute their own code. WinRAR patched the vulnerability in version 7.13.