Patch/Configuration Management

The vulnerability resides in SmarterMail's APT unauthenticated ForceResetPassword API endpoint.

The vulnerability stemmed from an unchecked return value in GitLab's authentication services, enabling attackers with knowledge of a target's account ID to circumvent two-factor authentication by submitting forged device responses.

Misconfigurations turn apps meant for security training into cloud attack vectors.

Fortinet plans to update a FortiGate patch it first issued last month in the coming days.

The command injection vulnerability was discovered by Zoom's Offensive Security team within Zoom Node Multimedia Routers (MMRs) prior to version 5.2.1716.0.

Nearly half of the 100,000 WordPress sites with the ACF Extended plugin could still be impacted by the critical vulnerability, tracked as CVE-2025-14533, which could be leveraged to facilitate procurement of administrative permissions, according to BleepingComputer.

Cyber Press reports that a severe vulnerability in Microsoft's Azure Active Directory integration for Windows Admin Center allowed attackers with local admin access to bypass authentication and seize control of any machine in the same Azure tenant.

The vulnerabilities, discovered by the AI security startup Cyata, include a path validation bypass (CVE-2025-68145), an unrestricted git_init issue (CVE-2025-68143), and an argument injection in git_diff (CVE-2025-68144).