Vulnerability (CVE)
A critical remote code execution flaw in React Server Components, CVE-2025-55182 (CVSS 10.0) and tracked as React2Shell, came under extensive exploitation within hours of disclosure, with Amazon observing attempts from infrastructure tied to Chinese...
Apache Tika carries a maximum-severity XXE flaw, CVE-2025-66516, rated 10.0 on the CVSS scale, affecting tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5), where a crafted XFA file inside a PDF lets an attacker trigger...
Fortinet confirmed fresh exploitation of an incomplete patch for CVE-2025-59718 and CVE-2025-59719, an authentication bypass via crafted SAML messages that hit devices fully upgraded to the latest release when FortiCloud SSO was enabled. The same recap...