Vulnerabilities are weaknesses or flaws in systems, software, hardware, configurations, or processes that adversaries can exploit to compromise confidentiality, integrity, or availability. The concept underpins vulnerability management, regulatory compliance, risk assessment, and security investment decisions across enterprise IT, cloud, and operational technology environments.
623 articles about Vulnerabilities
Decision Insights Threat Desk • December 2, 2025
Longwatch versions 6.309–6.334 have a code-injection flaw allowing unauthenticated HTTP GET requests to execute SYSTEM-level code.
Decision Insights Threat Desk • December 2, 2025
CISA published five ICS advisories on Longwatch, Iskra iHUB and iHUB Lite, Mirion NMIS BioDose, and Mitsubishi Electric series.
Decision Insights Threat Desk • December 2, 2025
Mirion Medical NMIS BioDose versions prior to 23.0 have multiple vulnerabilities that can allow code execution and unauthorized access.
Decision Insights Threat Desk • December 1, 2025
CISA adds Samsung mobile device out-of-bounds write flaw CVE-2025-21042 to Known Exploited Vulnerabilities Catalog.
Decision Insights Threat Desk • December 1, 2025
Retell AI's API permits excessive agent permissions enabling large-scale phishing and manipulation via automated voice calls.
Decision Insights Threat Desk • December 1, 2025
Fluent Bit vulnerabilities allow authentication bypass, remote code execution, and denial of service; fixed in versions 4.0.12, 4.1.1, and 4.2.0.
Decision Insights Threat Desk • December 1, 2025
nopCommerce's session cookie flaw allows reuse after logout, enabling unauthorized access until patched in version 4.90.3.
Decision Insights Research • December 1, 2025
Weekly roundup covering CISA exploited-vulnerability additions, industrial control system advisories, and 5G contract extensions.
Decision Insights Threat Desk • November 28, 2025
A vulnerability in expr-eval JavaScript library enables arbitrary code execution via crafted input.
Decision Insights Threat Desk • November 28, 2025
CISA updated its alert to include two vulnerabilities, CVE-2025-64446 and CVE-2025-58034, affecting Fortinet FortiWeb web application firewalls. Exploitation of these could lead to unauthenticated remote code execution. Fortinet recommends upgrading to specified versions or disabling HTTP/HTTPS access for internet-facing interfaces.
Decision Insights Threat Desk • November 28, 2025
CISA added a new vulnerability, CVE-2025-61757, involving missing authentication in Oracle Fusion Middleware, to its Known Exploited Vulnerabilities Catalog due to active exploitation. Federal agencies must remediate it per Binding Operational Directive 22-01. CISA urges all organizations to prioritize addressing such vulnerabilities.
Decision Insights Threat Desk • November 28, 2025
CISA includes CVE-2021-26829 OpenPLC ScadaBR XSS vulnerability in its Known Exploited Vulnerabilities Catalog following reports of active exploitation.