VulnHub

The SiRcom SMART Alert (SiSA) system has a critical vulnerability due to missing authentication for critical functions, allowing unauthorized remote access to backend APIs. This could enable attackers to manipulate emergency sirens, posing a significant risk to public safety and critical infrastructure.

The Zenitel TCIV-3+ device has critical vulnerabilities, including OS Command Injection and Cross-site Scripting, with a CVSS v4 score of 10.0, indicating a severe risk of arbitrary code execution and denial-of-service. Users are strongly advised to upgrade to version 9.3.3.0 or later to mitigate these risks.

Rockwell Automation's Arena Simulation software has a stack-based buffer overflow vulnerability that could allow local attackers to execute arbitrary code. The vulnerability, identified as CVE-2025-11918, has a CVSS v4 score of 7.1, indicating a significant risk for affected installations, particularly in critical manufacturing sectors.

Researchers have identified five critical vulnerabilities in Fluent Bit, a telemetry agent, that could be exploited to compromise cloud infrastructures. These flaws enable attackers to bypass authentication, execute remote code, and cause denial-of-service conditions, posing significant risks to cloud security.

Microsoft has raised concerns about the security risks associated with its new Agentic AI feature, highlighting the potential for AI agents to engage in malicious activities like data exfiltration and malware installation if not properly secured. This underscores the critical need for robust security controls to mitigate these risks.

The article highlights a recent outage experienced by Cloudflare, a leading service provider, which serves as a critical reminder of the vulnerabilities inherent in even the most advanced digital systems. Dr. David Utzke emphasizes that this incident could have significant implications for enterprises relying on such services, potentially disrupting the global digital economy.

Grafana has issued security updates to fix a critical vulnerability, CVE-2025-41115, with a CVSS score of 10.0. This flaw in the SCIM component can lead to privilege escalation and user impersonation under specific configurations.

SonicWall has addressed high-severity vulnerabilities in its firewalls and email security appliances that could lead to denial-of-service attacks, arbitrary code execution, or unauthorized file access. The urgency of these patches highlights the critical nature of securing network infrastructure against potential exploitation.

The Opto 22 GRV-EPIC and groov RIO products are vulnerable to an OS Command Injection flaw that could allow remote attackers to execute arbitrary shell commands with root privileges. This vulnerability, identified as CVE-2025-13087, has a CVSS v4 score of 7.5, indicating a significant risk to affected systems.