Vulnerabilities and Exploits

Explore the latest Rapid7 articles and research about Vulnerabilities and Exploits.

Latest articles about Vulnerabilities and Exploits

CVE-2025-20333, CVE-2025-20362, CVE-2025-20363 - Multiple critical vulnerabilities affecting Cisco products

CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (FIXED as of October 11, 2025)

CVE-2025-10035 - Critical unauthenticated RCE in GoAnywhere MFT

Flashrom to Hexedit to Root: DEF CON 33 IoT Village Exercise

CVE-2025-7775: Critical NetScaler vulnerability exploited in-the-wild

Securden Unified PAM: Multiple Critical Vulnerabilities (FIXED)

Aaron Herndon, Marcus Chang

PenTales: Weak passwords, Weaker MFA Protocols, and One Absent-Minded Professor

Philip Giattino

CVE-2025-53770 - Zero-day exploitation in the wild of Microsoft SharePoint servers

Rapid7 Named a Strong Performer in the 2025 Forrester Wave for Unified Vulnerability Management

CVE-2025-54309: CrushFTP Zero-Day Exploited in the Wild

Critical Veeam Backup & Replication CVE-2025-23121

CVE-2025-4365/CVE-2024-12284: NetScaler Console/SDX Authenticated Arbitrary File Read/Write (FIXED)

Konica Minolta bizhub Multifunction Printer: Pass-Back Attack Vulnerability (NOT FIXED)

CVE-2025-6543: Zero Day Exploitation of NetScaler ADC and NetScaler Gateway

CVE-2025-6759: Citrix Virtual Apps and Desktops - Local Privilege Escalation (FIXED)

Coverage Plus Context Equals Intelligent Exposure Management

Multiple Brother Devices: Multiple Vulnerabilities (FIXED)

BlackSuit Continues Social Engineering Attacks in Wake of Black Basta’s Internal Conflict

CVE-2025-48045, CVE-2025-48046, CVE-2025-48047: MICI NetFax Server Product Vulnerabilities (NOT FIXED)

Anna Katarina Quinn

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

Anna Širokova, Ivan Feigl

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes