Tuesday, July 15, 2025 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

This curated brief highlights 19 critical vulnerabilities and 70 high-priority updates requiring immediate attention.

  • Perfect 10 CVSS severity: LaRecipe Server-Side Template Injection vulnerability allows complete system compromise through malicious Markdown
  • Critical VMware VM escape vulnerabilities in ESXi, Workstation, and Fusion enable attackers to break out of guest VMs and compromise hypervisor hosts
  • Multiple WordPress plugin critical flaws: HT Contact Form Widget allows unauthenticated file upload, deletion, and arbitrary file moving attacks
  • Enterprise risks: Oracle Application Express Strategic Planner vulnerability and pyload download manager RCE expose organizational infrastructure
  • 89 total vulnerabilities with 12 CISA Known Exploited Vulnerabilities requiring immediate federal remediation and 80+ AI analyst assessments
How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation