The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it.
The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek.
Critical SmarterMail Vulnerability Exploited in Ransomware Attacks
The security defect allows unauthenticated attackers to execute arbitrary code remotely via malicious HTTP requests.
The post Critical SmarterMail Vulnerability Exploited in Ransomware Attacks appeared first on SecurityWeek.
Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks.
The post Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog appeared first on SecurityWeek.
VS Code Configs Expose GitHub Codespaces to Attacks
VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request.
The post VS Code Configs Expose GitHub Codespaces to Attacks appeared first on SecurityWeek.
Critical N8n Sandbox Escape Could Lead to Server Compromise
The vulnerability could allow attackers to execute arbitrary commands and steal credentials and other secrets.
The post Critical N8n Sandbox Escape Could Lead to Server Compromise appeared first on SecurityWeek.
Cisco, F5 Patch High-Severity Vulnerabilities
The security defects can lead to DoS conditions, arbitrary command execution, and privilege escalation.
The post Cisco, F5 Patch High-Severity Vulnerabilities appeared first on SecurityWeek.
Vulnerabilities Allowed Full Compromise of Google Looker Instances
The flaws dubbed LookOut can be exploited for remote code execution and data exfiltration.
The post Vulnerabilities Allowed Full Compromise of Google Looker Instances appeared first on SecurityWeek.
DockerDash Flaw in Docker AI Assistant Leads to RCE, Data Theft
The critical vulnerability exists in the contextual trust in MCP Gateway architecture, as instructions are passed without validation.
The post DockerDash Flaw in Docker AI Assistant Leads to RCE, Data Theft appeared first on SecurityWeek.
Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks
Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week.
The post Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks appeared first on SecurityWeek.
Fresh SolarWinds Vulnerability Exploited in Attacks
The critical-severity SolarWinds Web Help Desk flaw could lead to unauthenticated remote code execution.
The post Fresh SolarWinds Vulnerability Exploited in Attacks appeared first on SecurityWeek.
