The industry is obsessed with vulnerabilities. From vulnerability assessment to vulnerability management to exposure management and even zero days, we love to talk about vulnerabilities. But what about misconfiguration? By definition it's a vulnerability or weakness, but it doesn't have a CVE (common vulnerability enumeration). Should we ignore it?...
Over 870 online instances of the N-able N-central management, automation, and orchestration tool used by managed service providers continue to be impacted by the insecure deserialization flaw, tracked as CVE-2025-8875, and command injection vulnerability, tracked as CVE-2025-8876, which have been exploited in limited attacks, SecurityWeek reports.
Observed attacks involving the recently disclosed WinRAR path traversal flaw, tracked as CVE-2025-8088, and the older Microsoft Internet Explorer resource management errors issue and Microsoft Excel remote code execution bug, tracked as CVE-2013-3893 and CVE-2007-0671, have prompted their inclusion in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, reports Security Affairs.
Updates have been issued by the Matrix Foundation to resolve a pair of high-severity flaws in the Matrix federated communications protocol, according to The Record, a news site by cybersecurity firm Recorded Future.
