vulnerability

CVE-2025-56383 exposes Notepad++ v8.8.3 and earlier to DLL hijacking attacks, allowing local code execution via malicious plugins like NppExport.dll. PoC shows persistence risks—update now and monitor for infections until patched.

SolarWinds patches CVE-2025-26399 (CVSS 9.8), a deserialization flaw in Web Help Desk allowing unauthenticated RCE; it's a bypass of CVE-2024-28988. Affects versions up to 12.8.7—upgrade to HF1. Discovered by Trend Micro ZDI; Qualys QID 733223 for detection.

A zero-click flaw in ChatGPT’s Deep Research agent allowed attackers to exfiltrate sensitive Gmail data via hidden email prompts. OpenAI patched the service-side vulnerability in 2025 to prevent stealthy data leaks from its cloud infrastructure.

A severe vulnerability in LG WebOS smart TVs enables attackers on the local network to bypass authentication, gain root access, and fully compromise the device. Update your firmware immediately to protect your TV.

Two medium-severity vulnerabilities in Spring Framework and Spring Security enable authorization bypass via flawed annotation detection on generic superclasses. Upgrade to fixed versions immediately to secure your applications.

Apple’s latest iOS 26 and iPadOS 26 update patches 27 security vulnerabilities across key components like WebKit, Kernel, and Apple Neural Engine. Users are urged to update immediately to protect against crashes, data exposure, and privacy risks.

Ivanti’s September 2025 security bulletin addresses 13 vulnerabilities in Endpoint Manager, Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access. No known exploitation reported.

A deserialization of untrusted data vulnerability in Dassault Systèmes DELMIA Apriso could allow remote code execution. Learn recommended actions to protect your systems.

A remote code execution flaw in Cursor AI Code Editor allows malicious code to run automatically when opening a project. Learn how disabling Workspace Trust exposes developers and how to protect your environment.

Microsoft’s September 2025 Patch Tuesday addresses 81 security flaws, including two publicly disclosed zero-day vulnerabilities in SMB Server and Microsoft SQL Server. Learn about critical updates and other vendor patches.