Vulnerabilities are weaknesses or flaws in systems, software, hardware, configurations, or processes that adversaries can exploit to compromise confidentiality, integrity, or availability. The concept underpins vulnerability management, regulatory compliance, risk assessment, and security investment decisions across enterprise IT, cloud, and operational technology environments.
634 articles about Vulnerabilities
Decision Insights Threat Desk • November 26, 2025
CISA has updated its Known Exploited Vulnerabilities Catalog with three new vulnerabilities under active exploitation, urging organizations to prioritize timely remediation to reduce cyberattack risks. The updates relate to vulnerabilities in WatchGuard Firebox, Gladinet Triofox, and Microsoft Windows.
Decision Insights Threat Desk • November 26, 2025
CISA adds CVE-2025-11371 and CVE-2025-48703 to its catalog citing verified active exploitation vulnerabilities.
Decision Insights Threat Desk • November 26, 2025
CISA published five advisories for Industrial Control Systems outlining security issues and vulnerabilities in products from Fuji Electric, Survision, Delta Electronics, Radiometrics, and IDIS. Users and administrators are advised to review the advisories for technical details and mitigation steps.
Decision Insights Threat Desk • November 26, 2025
Cross-site scripting found in Lectora Desktop 21.0–21.3 and Lectora Online 7.1.6 and older requires patching and republishing.
Decision Insights Threat Desk • November 26, 2025
Draytek Vigor routers with DrayOS firmware have a remote code execution flaw in EasyVPN and LAN interfaces enabling attacker control.
Decision Insights Threat Desk • November 26, 2025
Kiwire Captive Portal vulnerabilities include SQL injection, open redirection, and XSS; vendor released fixes are available.
Decision Insights Threat Desk • November 26, 2025
Clevo's UEFI firmware leaked private Boot Guard keys, risking pre-boot firmware integrity on affected systems.
Decision Insights Threat Desk • November 26, 2025
A vulnerability in browsers allows DNS rebinding and CORS header manipulation to enable unauthorized data access.
Decision Insights Threat Desk • November 26, 2025
Password managers in browser extensions face DOM-based clickjacking risks that may expose stored credentials during autofill.
Decision Insights Threat Desk • November 26, 2025
Email header syntax allows spoofing of trusted senders by bypassing SPF, DKIM, and DMARC checks, affecting multiple providers.
Decision Insights Threat Desk • November 26, 2025
Lite XL text editor versions 2.1.8 and prior contain vulnerabilities allowing arbitrary code execution via Lua project modules and system.exec.
Decision Insights Threat Desk • November 26, 2025
Wolfram Cloud version 14.2 JVM access to shared /tmp/ temporary directories enables privilege escalation and code execution.