VulnHub

AI-Powered Cybersecurity Intelligence

Last Update Check:

Latest Intelligence

darkreading
'Easily Exploitable' Langflow Vulnerability Requires Immediate Patching

A critical vulnerability in the Langflow AI builder has been identified, scoring 9.8 on the CVSS scale, making it highly exploitable. This flaw allows remote execution of arbitrary commands, posing a significant risk to affected systems and requiring immediate attention from users.


Impact: Langflow AI builder

In the Wild: Yes

Age: Recently disclosed

Remediation: Apply patches

Vulnerability

Published:

SecurityWeek
Applying the OODA Loop to Solve the Shadow AI Problem

The article discusses the issue of shadow AI within organizations and emphasizes the importance of taking immediate actions to manage and mitigate its risks. It suggests applying the OODA Loop framework to effectively address the challenges posed by unauthorized AI usage while also harnessing its potential benefits.


Impact: Not specified

In the Wild: Unknown

Age: Unknown

Remediation: Implement immediate actions to manage shadow AI usage and apply the OODA Loop framework.

Published:

The Hacker News
Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet

Threat actors are exploiting vulnerabilities in outdated GeoVision IoT devices to integrate them into a Mirai botnet for DDoS attacks. This activity, identified by Akamai SIRT, highlights the risks associated with end-of-life devices and their potential to be weaponized in cyberattacks.


Impact: ["GeoVision IoT devices"]

In the Wild: Yes

Age: Discovered in early April 2025

Remediation: Apply patches, update software

Exploit

Published:

darkreading
CISA Warns 2 SonicWall Vulnerabilities Under Active Exploitation

CISA has issued a warning regarding two vulnerabilities in SonicWall's SMA devices, which are designed for secure remote access and have previously been targeted by threat actors. The active exploitation of these vulnerabilities poses significant risks to organizations relying on these devices for remote connectivity.


Impact: ["SonicWall SMA devices"]

In the Wild: Yes

Age: Recently disclosed

Remediation: Apply patches

Published:

darkreading
Addressing the Top Cyber-Risks in Higher Education

The article emphasizes the urgent need for security leaders in higher education to enhance their visibility across institutional networks and systems while continuously educating users on cybersecurity best practices. This focus is critical as cyber-attacks become more frequent and sophisticated, posing significant risks to educational institutions.


Impact: Not specified

In the Wild: Unknown

Age: Unknown

Remediation: Continuously educate users on best practices

Published:

The Hacker News
New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims

Cybersecurity researchers have identified two groups, Reckless Rabbit and Ruthless Rabbit, that are executing investment scams using fake celebrity endorsements and sophisticated traffic distribution systems. This highlights the evolving tactics of cybercriminals in targeting victims through social media platforms like Facebook.


Impact: Not specified

In the Wild: Yes

Age: Recently disclosed

Remediation: None available

Published:

SecurityWeek
Hacker Conversations: John Kindervag, a Making not Breaking Hacker

John Kindervag is recognized for creating the Zero Trust Model, which emphasizes security through rigorous verification. Unlike traditional hackers, he focuses on constructive approaches to cybersecurity rather than malicious activities.


Impact: Not specified

In the Wild: Unknown

Age: Unknown

Remediation: None available

Published:

SecurityWeek
Second Wave of Attacks Hitting SAP NetWeaver After Zero-Day Compromise

Threat actors are exploiting SAP NetWeaver instances by leveraging webshells that were deployed through a recently discovered zero-day vulnerability. This second wave of attacks underscores the ongoing risk and exploitation of vulnerable systems in the wild.


Impact: ["SAP NetWeaver"]

In the Wild: Yes

Age: Recently disclosed

Remediation: Apply patches

Zero-day Vulnerability

Published:

SecurityWeek
US Charges Yemeni Man for Black Kingdom Ransomware Attacks

Rami Khaled Ahmed, a 36-year-old from Yemen, has been charged for orchestrating ransomware attacks known as Black Kingdom between 2021 and 2023. This case highlights the ongoing threat of ransomware and the international efforts to combat cybercrime.


Impact: Not specified

In the Wild: Unknown

Age: Recent charges

Remediation: None available

Ransomware

Published:

All CISA Advisories
Unsophisticated Cyber Actor(s) Targeting Operational Technology

CISA has identified unsophisticated cyber actors targeting ICS/SCADA systems within critical infrastructure sectors, particularly in Energy and Transportation. The lack of proper cyber hygiene and exposed assets may lead to serious consequences, including operational disruptions and potential physical damage.


Impact: ["ICS/SCADA systems", "Energy sector", "Transportation systems"]

In the Wild: Unknown

Age: Recently disclosed

Remediation: Review the fact sheet for guidance on reducing cyber threat risks.

Published:

All CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2025-27363, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability represents a significant risk to federal networks, prompting CISA to urge timely remediation by all organizations to protect against cyberattacks.


Impact: Not specified

In the Wild: Yes

Age: Recently disclosed

Remediation: Remediate identified vulnerabilities by the due date, prioritize timely remediation of Catalog vulnerabilities.

CVE Vulnerability

Published:

All CISA Advisories
CISA Releases Three Industrial Control Systems Advisories

CISA released three advisories on May 6, 2025, focusing on vulnerabilities in Industrial Control Systems (ICS) from various vendors. These advisories are crucial for users and administrators to understand current security issues and implement necessary mitigations.


Impact: ["Optigo Networks ONS NC600", "Milesight UG65-868M-EA", "BrightSign Players"]

In the Wild: Unknown

Age: Recently disclosed

Remediation: Review newly released ICS advisories for technical details and mitigations.

Published:

All CISA Advisories
BrightSign Players

The article discusses a critical vulnerability in BrightSign players that allows for privilege escalation and arbitrary code execution due to execution with unnecessary privileges. This vulnerability affects specific versions of BrightSign OS and poses significant risks to various critical infrastructure sectors.


Impact: ["BrightSign OS series 4 players (Versions prior to v8.5.53.1)", "BrightSign OS series 5 players (Versions prior to v9.0.166)"]

In the Wild: No

Age: Recently disclosed

Remediation: Apply patches to update to v8.5.53.1 for series 4 players and v9.0.166 for series 5 players.

CVE Vulnerability Update

Published:

All CISA Advisories
Milesight UG65-868M-EA

The Milesight UG65-868M-EA industrial gateway has a vulnerability that allows admin users to inject arbitrary shell commands due to improper access control for volatile memory containing boot code. This issue is significant as it could potentially allow unauthorized access and manipulation of critical systems.


Impact: ["Milesight UG65-868M-EA"]

In the Wild: No

Age: Recently disclosed

Remediation: Update to firmware version 60.0.0.46 and follow CISA's defensive measures.

CVE Vulnerability Update

Published:

All CISA Advisories
Optigo Networks ONS NC600

The Optigo Networks ONS NC600 has a significant vulnerability due to the use of hard-coded credentials, which could allow attackers to execute OS commands remotely. This issue is critical, with a CVSS score of 9.3, highlighting the need for immediate attention and remediation by affected users.


Impact: ["Optigo Networks ONS NC600"]

In the Wild: No

Age: Recently disclosed

Remediation: Users should implement mitigations such as using a dedicated NIC, setting up a router firewall, and connecting via secure VPN.

Phishing CVE Vulnerability Update

Published: