- Cyber Threat Intelligence, Notificação de Vulnerabilidades OT/ICS
Monthly NDV – November/2025
See November’s most critical vulnerabilities and the urgent actions needed to reduce risk.
- Cyber Threat Intelligence, SEK Security Advisory
New Sha1-Hulud Wave Hits Over 25,000 Repositories via NPM Supply Chain
The new malware variant compromises thousands of npm repositories, stealing credentials and wiping directories if exfiltration fails.
- Cyber Threat Intelligence, SEK Security Advisory
Privilege Escalation Vulnerability in Cisco Catalyst Center Virtual Appliance
CVE-2025-20341 (CVSS 8.8) allows low-privileged authenticated users to escalate to Administrator through crafted HTTP requests. No workarounds exist, and Cisco urges immediate upgrade to version 2.3.7.10-VA.
- Cyber Threat Intelligence, SEK Security Advisory
Critical Vulnerability in Fortinet FortiWeb
CVE-2025-64446 (CVSS 9.1) allows unauthenticated attackers to run administrative commands through a path traversal flaw, is actively exploited in the wild, and requires urgent patching of vulnerable FortiWeb appliances.
- Cyber Threat Intelligence, SEK Security Advisory
Denial-of-service vulnerability in Palo Alto Networks PAN-OS
CVE-2025-4619 allows remote firewall reboot through crafted packets, leading to downtime and requiring immediate patching.
- Cyber Threat Intelligence, SEK Security Advisory
Microsoft fixes 63 vulnerabilities in the Patch Tuesday, including an actively exploited zero-day
The November 2025 update addresses severe Windows flaws, including a kernel zero-day already used in real-world attacks
- Cyber Threat Intelligence, SEK Security Advisory
SAP fixes critical vulnerabilities in the November Patch Day
The November 2025 update addresses severe flaws enabling remote code execution and full system compromise
- Cyber Threat Intelligence, SEK Security Advisory
Critical Vulnerability in React Native CLI
A critical flaw (CVE-2025-11953) in the @react-native-community/cli package allows remote code execution via the Metro server. Immediate update to version 20.0.0 is required.
- Cyber Threat Intelligence, SEK Security Advisory
Critical Vulnerability in WordPress Post SMTP Plugin
A critical flaw (CVE-2025-11833) allows unauthenticated attackers to access email logs and hijack admin accounts. Immediate update to version 3.6.1 is strongly advised.
