A critical flaw (CVE-2025-10184) in OnePlus OxygenOS allows any app to read users’ SMS/MMS data without permission. The PoC is public, but a fix is unavailable.Export to Sheets

Rapid7 exposed the unauthenticated RCE chain in Cisco ASA/FTD. CVE-2025-20362 bypasses auth to reach CVE-2025-20333, a buffer overflow in the WebVPN Lua script. Patch immediately.

Cybersecurity firms are sounding the alarm over a critical vulnerability in Fortinet FortiWeb, the company’s Web Application Firewall (WAF) product. The flaw, which has been observed activel…

Critical alert: Twonky Server suffers unpatched flaws (CVE-2025-13315/16) allowing full takeover. Vendor has no fix; isolate your server immediately.

SantaStealer, a new MaaS info-stealer, is being aggressively marketed on the dark web. It's a BluelineStealer rebrand that uses C code and open-source libraries to steal crypto wallets and credentials, despite having amateur anti-analysis features.

In the run-up to the New Year holidays, underground marketplaces often see a surge of freshly minted data-stealing

Attackers are bypassing AWS SES sandbox limits by pivoting to WorkMail. Rapid7 reveals how this abuse creates a blind spot for defenders.

Lotus Blossom compromises Notepad++ infrastructure to deploy "Chrysalis" malware. Rapid7 reveals the group using Microsoft Warbird to evade detection.

Cybersecurity researchers persist in their investigation of a sophisticated incursion targeting the ubiquitous text editor Notepad++, which remained