VulnHub

A serious security vulnerability has been identified in legacy D-Link DSL gateway routers, specifically affecting the 'dnscfg.cgi' endpoint. This flaw, known as CVE-2026-0625, has a high severity score of 9.3 and allows unauthenticated remote attackers to execute commands through improper handling of user-provided DNS configuration inputs. Current reports indicate that this vulnerability is actively being exploited in the wild, putting users of these older routers at risk. It is crucial for individuals and organizations using these devices to be aware of the potential for unauthorized access and control. The situation underscores the need for users to assess their network security and consider upgrading their hardware to mitigate these risks.

CERT/CC has issued a warning about a serious vulnerability in the TOTOLINK EX200 Wi-Fi range extender, identified as CVE-2025-65606. This flaw allows a remote authenticated attacker to take complete control of the device, posing a significant risk to users. As this vulnerability remains unpatched, anyone using the TOTOLINK EX200 is advised to take immediate action to secure their networks. The potential for exploitation means that attackers could manipulate settings, access sensitive data, or use the device as a foothold into larger networks. Users need to be aware of this threat and consider alternative security measures while awaiting a fix.

A serious vulnerability in Dolby's software for Android devices has been identified, tracked as CVE-2025-54957. Discovered by Google researchers in October 2025, this flaw could potentially allow attackers to exploit the Dolby audio processing capabilities on affected devices. Users of Android devices utilizing Dolby technology should be particularly cautious, as the vulnerability poses risks to their audio functionality and overall device security. Immediate action is recommended to ensure that devices are updated to the latest software versions that include the necessary patches to fix this issue. This discovery emphasizes the need for regular updates and vigilance among users and security teams alike.

A serious vulnerability has been found in n8n, an open-source workflow automation platform, which could allow authenticated users to run arbitrary system commands on the server. This vulnerability, identified as CVE-2025-68668, has a high severity score of 9.9 according to the CVSS system, indicating a significant risk. It stems from a failure in the protection mechanisms that should keep the system secure. Users of n8n should be particularly concerned as this issue could lead to unauthorized control over their systems. The affected versions include all versions prior to the patch that addresses this vulnerability, making it crucial for users to update their installations promptly to prevent potential exploitation.

The RondoDox botnet has been identified exploiting a serious vulnerability known as React2Shell (CVE-2025-55182) to compromise Next.js servers. This flaw allows attackers to inject malware and cryptominers into systems that have not been properly secured. Organizations using Next.js frameworks are particularly at risk, as the botnet targets these servers directly. This incident underscores the necessity for companies to regularly update their software and apply security patches to prevent such attacks. The ongoing exploitation of this vulnerability poses significant risks to data integrity and can lead to unauthorized resource usage, impacting both performance and costs for affected users.

IBM has identified a serious vulnerability in its API Connect software, classified as CVE-2025-13915. Rated 9.8 out of 10 on the CVSS scale, this flaw allows remote attackers to bypass authentication, potentially granting them unauthorized access to the application. This issue poses a significant risk to organizations using API Connect, as it could lead to data breaches and other malicious activities. Users of the software are advised to take immediate action to protect their systems. With this vulnerability being so critical, it is essential for companies to stay informed and apply any necessary updates or patches as soon as they become available.

A serious vulnerability known as MongoBleed (CVE-2025-14847) was disclosed shortly after Christmas 2023, allowing attackers to remotely access and leak memory from unpatched MongoDB servers using zlib compression, without requiring any authentication. This flaw primarily affects deployments of MongoDB Server that utilize zlib network compression, a common feature in many setups. The vulnerability is significant because it exposes sensitive data stored in these databases, potentially impacting organizations across the U.S., China, and the EU. Cybersecurity experts are urging companies that use MongoDB to assess their systems for this vulnerability and apply necessary updates or patches to protect against exploitation. The situation highlights ongoing security challenges in the management of popular open-source database systems.

Fortinet has issued a warning about ongoing attacks that exploit an old vulnerability in its FortiOS software, identified as CVE-2020-12812. This flaw allows attackers to bypass two-factor authentication, which can significantly compromise the security of affected systems. Organizations using FortiOS should be particularly vigilant, as this vulnerability has resurfaced in active attacks. The potential for unauthorized access puts sensitive data at risk, making it critical for users to address this issue promptly. Cybersecurity teams are urged to review their systems and implement necessary updates to safeguard against these threats.

Researchers have identified a critical unpatched vulnerability, designated CVE-2025-54322, in XSpeeder networking devices, which are widely used in industrial and branch environments. Approximately 70,000 devices are affected, leaving them open to potential exploitation. The flaw was discovered by AI agents, but the vendor has not addressed the alert, raising concerns about the security of these devices. This situation poses a significant risk, as attackers could exploit the vulnerability to gain unauthorized access or disrupt operations. Companies using XSpeeder devices should take immediate action to assess their security posture and implement necessary safeguards to protect their networks.

A serious vulnerability in MongoDB, designated as CVE-2025-14847 and known as MongoBleed, is currently being exploited globally. This flaw, which has a CVSS score of 8.7, allows attackers to access sensitive data stored in the server's memory without needing authentication. Researchers have identified over 87,000 instances of MongoDB that could be affected by this issue. The potential for data leakage poses a significant risk to organizations using this database technology, making it critical for them to address the vulnerability promptly. Companies should assess their systems and implement necessary security measures to safeguard against this ongoing threat.

A serious vulnerability known as MongoBleed (CVE-2025-14847) is currently being exploited, exposing over 80,000 MongoDB servers on the public internet. This flaw affects multiple versions of MongoDB, allowing attackers to potentially access sensitive information stored on these servers. The scale of the exposure raises significant security concerns, as many organizations may not be aware that their databases are at risk. Companies using affected MongoDB versions should take immediate action to secure their data and prevent unauthorized access. Failure to address this vulnerability could lead to severe data breaches and loss of sensitive information.

A serious vulnerability has been found in LangChain Core, a key Python package used for developing applications that utilize large language models (LLMs). This flaw, identified as CVE-2025-68664 and assigned a CVSS score of 9.3, could enable attackers to perform prompt injection attacks, which may lead to the theft of sensitive data and manipulation of LLM responses. Organizations using LangChain Core for their applications are at risk, as this vulnerability allows malicious actors to exploit the package to access confidential information. It's critical for developers and companies utilizing this software to take immediate action to secure their systems and protect user data from potential breaches.

Fortinet has alerted users about the active exploitation of a five-year-old vulnerability in its FortiOS SSL VPN, identified as CVE-2020-12812. This flaw, which has a CVSS score of 5.2, involves improper authentication and is particularly dangerous under specific configurations. Researchers have recently observed this vulnerability being abused in real-world attacks, which means organizations using affected versions of FortiOS SSL VPN should take immediate action to secure their systems. The ongoing exploitation of such an outdated vulnerability underscores the need for companies to regularly update their security measures and ensure proper configuration to protect against potential attacks.

Fortinet has reported that a five-year-old vulnerability in its FortiOS SSL VPN is being actively exploited. This flaw, identified as CVE-2020-12812, allows attackers to bypass two-factor authentication under specific configurations, enabling unauthorized access to systems. Organizations using affected versions of FortiOS SSL VPN should be particularly vigilant, as this vulnerability could lead to significant security breaches. The issue emphasizes the need for users to ensure their VPN configurations are secure and up-to-date. Fortinet's warning serves as a critical reminder of the importance of addressing known vulnerabilities, even those that have been around for several years.

A serious vulnerability has been found in the n8n workflow automation platform that could allow attackers to execute arbitrary code on affected systems. This flaw, known as CVE-2025-68613, has a CVSS score of 9.9, indicating a critical risk level. Discovered by security researcher Fatih Çelik, the vulnerability impacts numerous instances of n8n, potentially exposing sensitive workflows and data to exploitation. Organizations using n8n need to take immediate action to secure their systems, as such vulnerabilities can lead to significant data breaches and operational disruptions. Users are urged to monitor for updates and apply necessary patches to mitigate the risk of attack.