CVE-2025-8022 Rejected This CVE has been marked Rejected in the CVE List. These CVEs are stored in the NVD, but do not show up in search results by default. NVD Published Date: 07/23/2025 NVD Last Modified: 08/11/2025 Description Rejected reason: Bun Shell does not invoke /bin/
SonicWall has confirmed that recent attacks targeting its 7th-generation firewalls with SSL VPN enabled were the work of the Akira ransomware group exploiting an old vulnerability—CVE-2024-40766—rather than a suspected zero-day. Key Findings Following an investigation into 40 incidents, SonicWall determined that attackers leveraged CVE-2024-40766, a critical SSL VPN
Security analysts at Koi Security have uncovered a large-scale malicious campaign—dubbed "GreedyBear"—operating through the Mozilla Add-ons Store. The operation involved 150 malicious Firefox extensions that collectively stole more than $1 million in cryptocurrency from unsuspecting users. How the Scam Worked The extensions disguised themselves as legitimate
Firmware flaws in Dell ControlVault3 affect more than 100 Dell laptop models, enabling attackers to bypass Windows Login and install malware that can survive even after an operating system reinstall. What is Dell ControlVault? Dell ControlVault is a hardware-based security solution that stores passwords, biometric data, and security codes in
Adobe has released out-of-band security updates to address two critical vulnerabilities in Adobe Experience Manager (AEM) Forms (Java Enterprise Edition, JEE), both of which already have public proof-of-concept (PoC) exploits. The flaws—tracked as CVE-2025-54253 (CVSS score: 10.0, maximum severity) and CVE-2025-54254 (CVSS score: 8.6)—could allow attackers
WhatsApp has rolled out a new security feature designed to help users identify potential scammers when someone outside their contact list invites them to a group chat. The update introduces a "Safety Overview" warning that displays key details about the group—such as its creation date, total number
In an update to its June advisory, Google disclosed that it, too, fell victim to a similar attack. “In June, one of Google’s corporate Salesforce instances was compromised by UNC6040 activity,” the company stated. “The affected instance stored contact information and related notes about small and medium-sized businesses. Our
Several critical vulnerabilities have been patched in Cursor AI, a popular AI-powered code editor. The flaws allowed attackers to silently modify MCP (Model Context Protocol) configuration files and execute arbitrary code—without any user approval. 🔍 Key Findings CVE-2025-54136 ("MCPoison") — CVSS 7.2 Discovered by Check Point, this vulnerability
SonicWall has issued an urgent advisory to its customers, warning them to disable SSL VPN services on 7th-generation firewalls amid a wave of ransomware attacks potentially exploiting a zero-day vulnerability. Key Details According to Arctic Wolf researchers, multiple attacks involving Akira ransomware have been observed since July 15, 2025. These
Google has released the August 2025 Android security updates, addressing six vulnerabilities—two of which affect Qualcomm components and were actively exploited in targeted attacks. The exploited flaws, tracked as CVE-2025-21479 and CVE-2025-27038, were initially reported to the Android security team in January 2025. * CVE-2025-21479 – A graphics framework authorization flaw
Security analysts from Beazley Security and SentinelOne have uncovered a campaign distributing an updated version of PXA Stealer, a Python-based info-stealer. The malware has reportedly compromised more than 4,000 victims across 62 countries. Believed to be operated by Vietnamese-speaking hackers, PXA Stealer is monetized through Telegram, where the stolen
![Cisco User Data Stolen from Cisco[.]com](/content/images/size/w600/2025/08/photo_2025-08-07_07-46-56.jpg)
Cisco has confirmed that unknown attackers stole user data from Cisco[.]com in a vishing (voice phishing) attack that targeted one of its employees. The breach was first detected on July 24, 2025. According to Cisco’s internal investigation, the attacker gained unauthorized access to a third-party cloud-based customer relationship