VulnHub

The Ashlar-Vellum products Cobalt, Xenon, Argon, Lithium, and Cobalt Share have critical vulnerabilities, specifically an Out-of-Bounds Write and a Heap-based Buffer Overflow, which could allow attackers to disclose information or execute arbitrary code. The vulnerabilities have a CVSS v4 score of 8.4, indicating a high severity level, and users are urged to update their software to mitigate risks.

The SiRcom SMART Alert (SiSA) system has a critical vulnerability due to missing authentication for critical functions, allowing unauthorized remote access to backend APIs. This could enable attackers to manipulate emergency sirens, posing a significant risk to public safety and critical infrastructure.

The Zenitel TCIV-3+ device has critical vulnerabilities, including OS Command Injection and Cross-site Scripting, with a CVSS v4 score of 10.0, indicating a severe risk of arbitrary code execution and denial-of-service. Users are strongly advised to upgrade to version 9.3.3.0 or later to mitigate these risks.

Rockwell Automation's Arena Simulation software has a stack-based buffer overflow vulnerability that could allow local attackers to execute arbitrary code. The vulnerability, identified as CVE-2025-11918, has a CVSS v4 score of 7.1, indicating a significant risk for affected installations, particularly in critical manufacturing sectors.

The article discusses a new variant of malware that executes malicious code during the preinstallation phase, posing a significant risk to build and runtime environments. This increase in potential exposure highlights the severity of the threat and the need for immediate attention from cybersecurity professionals.

Researchers have identified five critical vulnerabilities in Fluent Bit, a telemetry agent, that could be exploited to compromise cloud infrastructures. These flaws enable attackers to bypass authentication, execute remote code, and cause denial-of-service conditions, posing significant risks to cloud security.

Grafana has issued security updates to fix a critical vulnerability, CVE-2025-41115, with a CVSS score of 10.0. This flaw in the SCIM component can lead to privilege escalation and user impersonation under specific configurations.

SonicWall has addressed high-severity vulnerabilities in its firewalls and email security appliances that could lead to denial-of-service attacks, arbitrary code execution, or unauthorized file access. The urgency of these patches highlights the critical nature of securing network infrastructure against potential exploitation.

SquareX has alleged a vulnerability in the Comet browser that allows for the execution of local commands through a hidden API, while Perplexity disputes these claims, labeling the research as fake. This disagreement highlights potential security concerns regarding the Comet browser and the credibility of vulnerability disclosures in the cybersecurity community.