Cisco has released patches for a medium-severity security flaw in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following the public release of a proof-of-concept exploit, which could allow attackers with administrative credentials to access sensitive information. The vulnerability affects multiple Cisco versions, and users are urged to update to the latest releases as no workarounds are available. Additionally, fixes have been provided for two other medium-severity bugs impacting Cisco products like Cisco Secure Firewall and Cisco IOS XE.
IBM has disclosed a critical security flaw in API Connect (CVE-2025-13915) that allows remote attackers to bypass authentication and gain unauthorized access. The vulnerability affects specific versions and is rated 9.8/10 on CVSS. Users are advised to apply the available fixes promptly or disable self-service sign-up to mitigate risks.
A critical vulnerability in MongoDB, CVE-2025-14847, allows unauthenticated attackers to remotely leak sensitive data by exploiting a flaw in zlib compression, with over 87,000 instances potentially affected worldwide. Users are advised to update their MongoDB versions and implement mitigations such as disabling zlib compression and restricting server exposure.
A critical security flaw called MongoBleed (CVE-2025-14847) in MongoDB servers is actively exploited in the wild, allowing attackers to leak sensitive data through malformed network packets before authentication, affecting many versions and exposing approximately 87,000 vulnerable instances worldwide. Immediate patching and monitoring are recommended.
A PoC exploit called 'mongobleed' has been released for a critical MongoDB vulnerability (CVE-2025-14847) that allows attackers to remotely extract sensitive uninitialized memory data through a flaw in zlib decompression handling, prompting urgent patching and security measures.
A critical security flaw in LangChain Core (CVE-2025-68664) allows attackers to exploit serialization injection to steal secrets and manipulate LLM responses, prompting urgent updates to affected versions to mitigate risks.
MongoDB has issued an urgent warning to patch a severe remote code execution vulnerability (CVE-2025-14847) affecting multiple versions of its database software. The flaw, due to improper handling of length parameters, allows unauthenticated attackers to execute arbitrary code. Admins are advised to upgrade to patched versions immediately or disable zlib compression to mitigate the risk. The vulnerability has been actively exploited in the past, emphasizing the need for prompt action.
QNAP has issued a warning about a critical security flaw in its Windows backup software and NetBak PC Agent, related to the CVE-2025-55315 vulnerability in ASP.NET Core, which could allow attackers to hijack credentials or bypass security controls. Users are advised to update their ASP.NET Core runtime or reinstall the affected applications to mitigate risks. This follows previous security updates QNAP released for other vulnerabilities in its backup solutions.
OpenAI's ChatGPT Atlas browser is vulnerable to prompt injection attacks where malicious URLs disguised as harmless links can trick the AI into executing harmful commands or redirecting users to malicious sites, highlighting ongoing security challenges in AI-enabled browsers.
Microsoft has issued an emergency security update for Windows Server due to a critical vulnerability (CVE-2025-59287) that is actively being exploited in attacks, with CISA warning federal agencies to apply the update immediately to prevent remote code execution and system compromise.
A critical vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, has been exploited by attackers shortly after an emergency patch was issued. The flaw allows remote code execution and affects Windows Server versions 2012-2025. Despite Microsoft releasing a fix, security researchers warn that the patch may not fully mitigate the risk, and exploitation activity has been observed, especially targeting exposed WSUS instances. Experts advise organizations to ensure their systems are properly patched and not exposed to the internet to prevent compromise.
A critical security vulnerability named TARmageddon (CVE-2025-62518) has been disclosed in the popular Rust async-tar library and its forks, allowing remote code execution through file overwriting, despite Rust's usual safety guarantees. The vulnerability affects downstream projects like uv Python package manager, and patching efforts are underway due to the lack of upstream maintenance for some forks.
Google has addressed a security vulnerability called 'Pixnapping' that could allow malicious apps to steal sensitive data from secure apps on Android devices, including Pixel and Samsung Galaxy models. A partial fix was rolled out in September, with a further patch expected in December to fully resolve the issue, which involves exploiting Android's Intent system and GPU side channels.
Microsoft has enhanced the security of IE mode in its Edge browser after reports of hackers exploiting legacy features to gain unauthorized access, involving social engineering and unpatched exploits in Internet Explorer's JavaScript engine. The company has removed automatic IE mode activation, requiring users to explicitly enable it for specific sites, aiming to balance legacy support with security.
A security flaw in the Unity game engine, affecting versions from 2017.1 onwards, could allow malicious apps to execute arbitrary code on Android and escalate privileges on Windows, prompting warnings and updates from Valve and Microsoft to mitigate the risk.
