Attackers to Bypass FortiCloud-SSO Authentication;Patches Released for FortiOS, FortiProxy, FortiWeb
Fortinet Patches Released for FortiOS, FortiProxy, FortiWeb
Continue ReadingSecurity Advisory
SAP Dec 2025 Security Patch Released, Critical RCE Fixed & DoS Vulnerabilities
Critical and High severity flaws in SAP business software, includes remote code execution, code injection, DoS and other vulnerabilities
Continue Reading
Cisco Splunk Enterprise Security Patch Fixed Windows Permissions Misconfiguration
2 critical vulnerabilities affecting Splunk Enterprise and Splunk Universal Forwarder on Windows platforms were disclosed, both involving incorrect permission assignments during installation or upgrade. The vulnerabilities addressed may enable attackers to exploit issues such as privilege escalation, information disclosure, or remote code execution.
Continue Reading
Critical Vulnerabilities Identified in React Server Components & Next.js; Due to the high severity Patching is Required
Critical React & Next.js RCE Vulnerabilities identified; Patches released .Attackers can craft malicious requests to trigger arbitrary server-side code execution in unpatched environments using default configurations.
Continue Reading
Chrome 143 Update Released, Fixes RCE & Multiple High Severity Vulnerabilities
Summary : Several high severity vulnerabilities were recently identified in Google Chrome, impacting core components such as the V8 JavaScript engine, Chrome Updater, DevTools and Digital Credentials module.
The primary high-severity vulnerability, a Type Confusion bug in the V8 engine (CVE-2025-13630), could allow attackers to achieve memory corruption that may lead to remote code execution via malicious web content. Google says that that it handed out $11,000 for the V8 vulnerability and $3,000 for the Google Updater bug.
| Severity | High |
| CVSS Score | Not Published |
| CVEs | CVE-2025-13630, CVE-2025-13631, CVE-2025-13632, CVE-2025-13633 & 9 other CVEs. |
| POC Available | No public PoC at release time |
| Actively Exploited | No confirmed exploitation |
| Exploited in Wild | Not confirmed for Chrome 143 |
| Advisory Version | 1.0 |
Overview
Other vulnerabilities like privilege escalation, unauthorized actions or browser misuse have been patched in the latest Chrome update. Administrator and users are strongly urged to update to the chrome 143 release immediately.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Type-Confusion Vulnerability in V8 JavaScript Engine | CVE-2025-13630 | Chrome | High | v143.0.7499.40/41 |
| Inappropriate Implementation in Google Updater | CVE-2025-13631 | Chrome | High | v143.0.7499.40/41 |
| Inappropriate Implementation in DevTools | CVE-2025-13632 | Chrome | High | v143.0.7499.40/41 |
| Use-After-Free Vulnerability in Digital Credentials | CVE-2025-13633 | Chrome | High | v143.0.7499.40/41 |
Technical Summary
Several high-severity vulnerabilities were addressed in Google Chrome versions prior to 143.0.7499.40/41. The most critical involves a type of confusion flaw in the V8 JavaScript engine, which permits remote attackers to exploit improper object type handling, causing heap corruption when a user accesses a specially crafted webpage and potentially leading to remote code execution under certain conditions.
Other significant issues include a flawed update mechanism that may trigger unintended actions during updates, a logic error within DevTools that could result in tool misuse or unintended execution paths, and a use-after-free vulnerability in the digital credential processing components that may cause memory corruption and browser instability.
Together, these flaws can be exploited to bypass update protections, escalate privileges, disrupt developer tools, or compromise sensitive credential operations.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-13630 | Chrome 142 and prior | Type Confusion in V8 engine allows crafted JavaScript to trigger memory corruption leading to possible arbitrary code execution | Remote Code Execution |
| CVE-2025-13631 | Chrome 142 and prior | Inappropriate implementation in Chrome Updater may allow unauthorized update-related actions | Privilege Escalation |
| CVE-2025-13632 | Chrome 142 and prior | Inappropriate implementation in DevTools may allow unintended function execution | Unauthorized Code Paths / Sandbox Interaction |
| CVE-2025-13633 | Chrome 142 and prior | Use-after-free in Digital Credentials processing leads to memory corruption | Memory Corruption / Crash |
Remediation:
- Upgrade Chrome to the latest version: 143.0.7499.40/41 (Windows, Mac, Linux).
Here are some recommendations below
- Manual Update Check: Navigate to
Settings → Help → About Google Chrome to trigger the update.
- Enforce Chrome auto-updates through enterprise patch management policies.
- Enable endpoint exploit protection such as browser sandboxing to strengthen environment security.
- Continuously monitor logs for unusual crashes, script anomalies, or signs of exploitation attempts.
Conclusion:
Chrome 143 patches critical flaws in the JavaScript engine, updater, DevTools, and credentials, preventing remote code execution and memory corruption.
Users and administrators are strongly advised to promptly upgrade to the latest Chrome version and implement security best practices such as enforcing automatic updates, enabling endpoint exploit protections and monitoring for any signs of exploitation to maintain a strong defense against potential attacks.
Additionally, Google announced that the browser’s Extended Stable channel has been updated to version 142.0.7499.226 for Windows and macOS.
References:
Android Security Patch December 2025 Fixed 100+ Vulnerabilities Including Zero-Days
Android security Patch: Google has released the Android Security update for December 2025 addressing over 100 vulnerabilities and two actively exploited zero-day vulnerabilities across Framework, System, Kernel, and vendor components like Qualcomm, MediaTek, and Unisoc.
The most severe issues include a critical remote denial-of-service flaw in Framework and multiple zero-day elevation-of-privilege vulnerabilities actively exploited.
| OEM | Google Android |
| Severity | Critical |
| CVSS Score | 9.8 |
| CVEs | CVE-2025-48631, CVE-2025-48633, CVE-2025-48572 & 104 more CVEs |
| POC Available | No |
| Actively Exploited | Yes |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
These flaws could enable attackers to crash devices remotely, escalate privileges locally, or disclose sensitive data without additional execution privileges. Android users are urged to immediate updates as soon as available.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Remote Denial-of-Service Vulnerability | CVE-2025-48631 | Android Framework | Critical | Dec 2025 Android Security Update |
| Information Disclosure Zero-Day Vulnerability | CVE-2025-48633 | Android Framework | High | Dec 2025 Android Security Update |
| Elevation of Privilege Zero-Day Vulnerability | CVE-2025-48572 | Android Framework | High | Dec 2025 Android Security Update |
Technical Summary
The December 2025 Android vulnerabilities primarily impact Framework (remote DoS, EoP, ID), System (local privilege escalation), and Kernel (pKVM/IOMMU flaws), with additional high-severity issues in vendor components from Qualcomm, MediaTek, Arm and Unisoc. Critical zero-days like the Framework remote DoS enable attacker-initiated crashes without privileges, while EoP flaws allow local escalation for background activity launch or data access.
Organizations and users should treat these vulnerabilities as critical due to active exploitation. Updating all devices to the 2025 December, security patch level is strongly recommended to stay protected.
| CVE ID | Vulnerability Details | Impact |
| CVE-2025-48631 | Framework vulnerability that allows a remote attacker to cause a device crash, reboot loop, or render it unresponsive without requiring additional privileges or user interaction. | Remote device crash, Denial of service |
| CVE-2025-48633 | This exploiting framework information disclosure flaw that exposes sensitive internal system data, enabling attacker reconnaissance or exploit chaining | Data leakage, privacy violation |
| CVE-2025-48572 | This exploiting elevation of privilege vulnerability within the Framework that allows attackers to gain higher system privileges, enabling unauthorized operations | Privilege escalation, arbitrary code execution |
These additional vulnerabilities include 104 other Critical and High-severity issues that could allow data exposure, system instability, or service disruptions. Applying the latest update is important as these vulnerabilities still have significant security risks if left unpatched.
Remediation:
- Update all Android devices to the latest Security Patch when it’s available.
Conclusion:
These vulnerabilities, including actively exploited zero-days, pose severe risks to Android devices enabling remote crashes, privilege escalation, and data exposure. It is recommended to update to the both personal and enterprise Android devices to the latest security patch for December, 2025.
References:
NVIDIA DGX Spark Security Update Fixed 14 Vulnerabilities
Summary : NVIDIA DGX Spark GB10 firmware vulnerabilities including CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs can Execute Malicious Code and DoS Attacks. Systems running DGX OS versions prior to OTA0 are affected. Immediate upgrade to OTA0 is strongly advised.
| OEM | NVIDIA |
| Severity | Critical |
| CVSS Score | 7.5 |
| CVEs | CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs |
| POC Available | No |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
NVIDIA has released a security update addressing 14 vulnerabilities in the NVIDIA DGX Spark firmware, a high-performance AI workstation for machine learning and model training.
These vulnerabilities enable attackers with local access to bypass protections and manipulate firmware and hardware controls. Exploitation could lead to unauthorized code execution, data tampering, system disruption, and exposure of sensitive AI data.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS | Fixed Version |
| SoC Access Bypass Vulnerability via SROOT | CVE-2025-33187 | NVIDIA DGX Spark | Critical | 9.3 | OTAO |
| Hardware Control Tampering Vulnerability | CVE-2025-33188 | NVIDIA DGX Spark | High | 8.0 | OTAO |
| Out-of-Bounds Write Vulnerability in SROOT | CVE-2025-33189 | NVIDIA DGX Spark | High | 7.8 | OTAO |
Technical Summary
The NVIDIA DGX Spark GB10 firmware vulnerabilities primarily affect SROOT, OSROOT and hardware controls, enabling local attackers to bypass SoC protections for code execution, data tampering, information disclosure, denial of service and privilege escalation.
Critical flaws like out-of-bounds writes and hardware tampering allow memory corruption and system manipulation, while medium/low issues involve improper input handling, memory reads and resource reuse that risk data leaks or crashes.
All versions prior to OTA0 are vulnerable and security patch released fully addresses these risks.
| CVE ID | Vulnerability Details | Impact |
| CVE-2025-33187 | SROOT vulnerability allows attackers to access SoC-protected memory regions using privileged access | Code execution, privilege escalation |
| CVE-2025-33188 | Hardware controls can be tampered with due to improper authorization enforcement | Information disclosure, DoS |
| CVE-2025-33189 | Out-of-bounds writing in SROOT firmware enables memory corruption | Code execution, privilege escalation |
Other Vulnerabilities:
These other vulnerabilities are medium & low severity issues that may cause data leaks, system errors or minor disruptions.
| Vulnerability Name | CVE ID | Description | Severity | CVSS | Impact |
| Out-of-Bounds Write Vulnerability | CVE-2025-33190 | This vulnerability may allow unintended modification of system data | Medium | 6.7 | Code execution, Privilege escalation |
| Invalid Memory Read vulnerability in OSROOT | CVE-2025-33191 | Error in memory handling can crash system | Medium | 5.7 | Denial of service |
| Arbitrary Memory Read vulnerability | CVE-2025-33192 | Unauthorized access to stored information | Medium | 5.7 | Info disclosure, DoS |
| Integrity Validation Failure vulnerability | CVE-2025-33193 | Firmware integrity checks can be bypassed | Medium | 5.7 | Code execution, info leak |
| Input Processing Issue | CVE-2025-33194 | Faulty input handling reveals internal data | Medium | 5.7 | Info disclosure, DoS |
| Unexpected Buffer Operations | CVE-2025-33195 | Memory mishandling leads to data modification | Medium | 4.4 | Data tampering, DoS |
| Resource Reuse Exposure | CVE-2025-33196 | Reused firmware resources reveal sensitive data | Medium | 4.4 | Information disclosure |
| NULL Pointer Dereference | CVE-2025-33197 | System crashes due to improper pointer handling | Medium | 4.3 | DoS, possible code execution |
| Resource Reuse vulnerability | CVE-2025-33198 | Unintended reuse of resources leaks data | Low | 3.3 | Information disclosure |
| Incorrect Control vulnerability | CVE-2025-33199 | System behavior can be manipulated | Low | 3.2 | Data tampering |
| Resource Reuse vulnerability | CVE-2025-33200 | Data exposure due to resource reuse | Low | 2.3 | Information disclosure |
Remediation:
- Upgrade all NVIDIA DGX Spark systems to DGX OS OTA0 or the latest fixed version.
Conclusion:
The discovery of 14 critical vulnerabilities in the NVIDIA DGX Spark firmware provides a stark reminder that advanced hardware requires strict security practices round the clock.
These vulnerabilities pose a significant security risk to organizations using NVIDIA DGX Spark for AI or ML workloads. If exploited, attackers could gain deep hardware-level access, risk confidential AI datasets, system stability and training integrity. Immediate upgrading to OTA0 to mitigate all the vulnerabilities.
References:
Apache Syncope Patched Security Vulnerability that Affected Multiple Versions of the Identity & Access Management Platform
Apache Syncope Patched Security Vulnerability Exposes User Password via Hardcoded AES Key
Continue Reading
Shai-Hulud’s ‘Second Coming’ npm Malware Infects Popular Developer Packages
Shai-Hulud malware campaign, npm Packages
Continue Reading
Critical Fluent Bit Vulnerabilities Allow RCE & Cloud Infrastructure at Risk
Summary : Fluent Bit is a widely used opensource tool for collecting and forwarding logs in cloud and containers like Kubernetes environments. A chain of 5 critical vulnerabilities discovered by Oligo Security team and findings reveal that attackers can misuse via Remote code execution putting cloud and container at risk.
| Severity | Critical |
| CVSS Score | 9.1 |
| CVEs | CVE-2025-12969, CVE-2025-12970, CVE-2025-12972, CVE-2025-12977, CVE-2025-12978 |
| POC Available | No |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
These vulnerabilities are CVE-2025-12977 CVE-2025-12970, CVE-2025-12969, CVE-2025-12978 , CVE-2025-12972. The vulnerabilities allow attackers to bypass authentication, manipulate log routing, achieve remote code execution, potentially leading to full compromise of cloud and Kubernetes environments using Fluent Bit for logging and observability.
Organizations relying on Fluent Bit must upgrade to the fixed versions and harden configurations to prevent remote takeover and log tampering.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score | Fixed Version |
| Fluent Bit Tag_Key Input Validation Bypass | CVE-2025-12977 | Fluent Bit | Critical | 9.1 | v4.0.12+ , v4.1.1+ , v4.2.0+ |
| Fluent Bit Docker Input Stack Buffer Overflow | CVE-2025-12970 | Fluent Bit | High | 8.8 | v4.0.12+ , v4.1.1+ , v4.2.0+ |
| Fluent Bit Forward Input Authentication Bypass | CVE-2025-12969 | Fluent Bit | Medium | 6.5 | v4.0.12+ , v4.1.1+ , v4.2.0+ |
| Fluent Bit Tag Spoofing via Partial Tag_Key Match | CVE-2025-12978 | Fluent Bit | Medium | 5.4 | v4.0.12+ , v4.1.1+ , v4.2.0+ |
| Fluent Bit File Output Path Traversal | CVE-2025-12972 | Fluent Bit | Medium | 5.3 | v4.0.12+ , v4.1.1+ , v4.2.0+ |
Technical Summary
Fluent Bit vulnerabilities center around unsafe handling of tags and inputs, enabling attackers to manipulate routing, file paths and memory in ways that directly impact host systems and downstream security tooling.
These flaws can allow path traversal and arbitrary file writes, which in many real-world setups may escalate to remote code execution and persistent node compromise.
Additional vulnerabilities include stack buffer overflows and missing authentication checks that let attackers crash agents, execute code and inject false telemetry into trusted logging pipelines.
Source: Oligo.security
| CVE ID | Vulnerability Details | Impact |
| CVE-2025-12977 | Improper input validation allows injection of control chars, newlines, and path traversal sequences in tag values. | Log corruption and output injection. |
| CVE-2025-12970 | Stack buffer overflow on container name copy due to lack of length check. | Crash or RCE. |
| CVE-2025-12969 | Authentication bypass disables user-based auth, allowing unauthenticated log injection. | Unauthorized log injection. |
| CVE-2025-12978 | Partial string comparison on Tag_Key lets attacker spoof tags by guessing first char. | Manipulation of log routing and filtering. |
| CVE-2025-12972 | Path traversal via unsanitized tags causes arbitrary file write and possible remote code execution. | Arbitrary file write and RCE. |
Remediation:
- Upgrade all Fluent Bit deployments to v4.2.0 / v4.1.1 / v4.0.12 or latest version.
Here are some recommendations below
- Avoid using dynamic or untrusted tags in configuration for routing or file naming.
- Always set explicit fixed Path or File parameters in out_file outputs to prevent path traversal.
- Ensure forward inputs use both Shared_Key and Security.Users for proper authentication enforcement.
- Limit network access to Fluent Bit instances to trusted sources only.
- Run Fluent Bit with least privilege and restrict filesystem and configuration file write permissions.
- Monitor logs and telemetry for abnormal tag values or unexpected log routing changes.
Conclusion:
The Fluent Bit vulnerabilities enable attackers to hide activity, corrupt evidence and even gain direct control of cloud workloads.
This puts cloud systems at risk because security teams may not see the real activity happening inside their environment.
Organizations using Fluent Bit should patch immediately, restrict network access and enforcing strong authentication and least‑privilege deployment as urgent priorities to reduce the risk of remote takeover and systemic observability compromise.
References: