Patch/Configuration Management

CVE-20225-20393 was placed on CISA's Known Exploited Vulnerabilities (KEV) catalog on Dec. 17.

The issue centers on a flaw, CVE-2025-68493, found in the XWork component, which involves unsafe XML parsing.

The vulnerability, present in various versions of PAN-OS software, enables an unauthenticated attacker to trigger a DoS condition.

WhisperPair vulnerabilities stem from improper implementation of Google's Fast Pair protocol, which enables quick device connections.

The vulnerability stems from flaws in the plugin's handling of "direct request" mode, where it accepted requests without proper cryptographic verification.

The tool specifically targets access control vulnerabilities in Salesforce Aura, the framework powering Experience Cloud sites.

The vulnerability, discovered by Zach Hanley of Horizon3.ai, resides in the phMonitor service, which handles logging security events.

ServiceNow has addressed a critical vulnerability within its AI Platform that could have allowed threat actors to impersonate users and execute arbitrary actions.