ScanForge Security Digest 2617-01
This week brought 25 critical vulnerabilities requiring immediate attention, including SQL injection flaws in OpenProject and privilege escalation risks in Percona PMM and Quest KACE systems, though no actively exploited zero-days were added to CISA's catalog. Notable threat activity includes Chinese APT groups targeting financial institutions in Asia and attackers increasingly leveraging identity-based attacks to bypass traditional security controls. Organizations should prioritize patching Quest KACE and OpenProject instances, conducting access reviews for privileged accounts, and reinforcing identity verification practices given the prevalence of credential-based compromise techniques. The 49 security articles this period highlight continued targeting of unpatched infrastructure, underscoring the importance of timely vulnerability remediation across all systems.
Critical
25High Severity
90+57 more products affected
Security News
10Things are improving, but a researcher has still identified over 1,500 Perforce P4 instances allowing attackers to read
CISA has given U.S. government agencies four days to secure their systems against another Catalyst SD-WAN Manager vulne
The security defects could be exploited for remote code execution, OS command injection, and WAF detection bypass. The p
China is spying on India's financial sector, for some reason, and it's not putting much effort into it, judging by some
The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain c
CISA expanded the KEV catalog with eight flaws, but five of them have been flagged as exploited before. The post Organiz
Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable
Grupo Seguritech is a Mexican surveillance company that is expanding into the US.