Patch/Configuration Management

A hard-coded JSON Web Token could allow a remote attacker to upload files with root privileges.

On-premises SysAid IT support software instances have been impacted by a trio of XML External Entity injection vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777.

Internet exposure of Apache Pinot's primary components facilitated by Kubernetes LoadBalancer services, which remains unknown to the user, has already been exploited by threat actors to access user data.

Low-code AI builder is a leading tool for building agentic AI workflows.

Both flaws impact SonicWall SMA remote access devices and allow attackers to remotely inject commands and map file system paths.

Google has issued fixes for 47 Android vulnerabilities as part of this month's security update, one of which has already been leveraged by threat actors.

Security pros advise to patch right away because attackers could leverage the popular remote access devices to move laterally.