Patch/Configuration Management

The paper reveals that only 32% of vulnerabilities in the CISA KEV catalog are immediately exploitable for initial access, challenging the common misconception that it lists the most severe flaws.

The vulnerability, tracked as CVE-2025-67987, allows any user with a subscriber-level account or higher to inject commands into the database.

The study identified approximately 4.96 million IP addresses with publicly accessible .git directories.

Exploited Ivanti EPMM RCEs hit agencies, prompting emergency patching amid fears of global spread.

The AI company says all bugs were validated by human researchers to weed out false positives.

Researchers used a crafted Git repo and exploited a race condition to achieve RCE.

Infosecurity Magazine reports that open-source automation platform n8n has been impacted by a pair of maximum severity sandbox escape flaws that could enable total server takeover and credential compromise.

BleepingComputer reports that the high-severity VMware ESXi sandbox escape issue, tracked as CVE-2025-22225, was confirmed by the Cybersecurity and Infrastructure Security Agency to have been harnessed in ransomware attacks nearly a year after the flaw was added to the agency's Known Exploited Vulnerabilities catalog.