All KEV entries should include not only platform-specific relevance indicators and CVE origin details but also attack chain and attack path context, said the OX team.
Brazil-based Unimed, which is the largest healthcare cooperative worldwide, had at least 14 million patient conversations with doctors and its chatbot "Sara" leaked by an unsecured instance of the open-source real-time data transmission platform Kafka, according to Cybernews.
Cyber Security News reports that malicious actors could exploit a new low-severity vulnerability in Apache Tomcat's CGI servlet, tracked as CVE-2025-46701, to circumvent security configuration under certain conditions.
More than 1.6 million files belonging to thousands of Etsy, Poshmark, Embroly, and TikTok shop customers, most of whom are located in the U.S., have been exposed as a result of a pair of unsecured Azure Blob Storage containers, Cybernews reports.
Versa Networks' centralized management and orchestration platform Versa Concerto has been impacted by a trio of serious vulnerabilities, which could be leveraged for authentication evasion and arbitrary code execution, according to BleepingComputer.
Chinese state-backed threat operation UNC5221 has launched attacks exploiting the recently addressed Ivanti Endpoint Manager Mobile flaws, tracked as CVE-2025-4427 and CVE-2025-4428, against telecommunications, healthcare, government, defense, finance, and aviation organizations in North America, Europe, and the Asia-Pacific since May 15, The Hacker News reports.
