Oct 20, 2025
4 new incidents, 2 with updates.
Started
- ClosedCriticalPatched
Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)
CVE-2025-2746: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. CVE-2025-2747: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. Added to CISA KEV on 2025-10-20.
Kentico Xperience CMSClosed Oct 20, 2025
- ClosedCriticalPatched
Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Added to CISA KEV on 2025-10-20.
Oracle E-Business SuiteClosed Oct 20, 2025
- ClosedHighPatched
Apple Multiple Products: Multiple Products Unspecified Vulnerability
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-20.
Apple Multiple ProductsClosed Oct 20, 2025
- ClosedHighPatched
Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. Added to CISA KEV on 2025-10-20.
Microsoft WindowsClosed Oct 20, 2025
Updated
- ClosedHighPatched
GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
VS Code extensions on OpenVSX and the VS Code MarketplaceClosed Oct 31, 2025
- ClosedCriticalPatched
Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)
Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.
Oracle E-Business SuiteClosed Oct 20, 2025
