Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

indusface

CVE-2025-10573: Critical Unauthenticated Stored XSS in Ivanti Endpoint Manager

Dec 11, 2025 By Bhargavi Pallati In Indusface
A newly disclosed vulnerability in Ivanti Endpoint Manager (EPM) tracked as CVE-2025-10573 allows unauthenticated attackers to inject persistent JavaScript into the EPM administrative dashboard. Assigned a CVSS score of 9.6, this vulnerability presents a critical security risk because it enables attackers to hijack administrator sessions and gain full control over managed endpoints.
Read Post
The Security Blind Spots Most Operators Miss - According to Igor Finkelshtein

The Security Blind Spots Most Operators Miss - According to Igor Finkelshtein

Dec 11, 2025 By SecuritySenses In SecuritySenses
In the cybersecurity world, it's easy to focus on the latest breach or high-profile vulnerability. But according to multi-industry operator Igor Finkelshtein, most security incidents don't begin with sophisticated attacks - they begin with overlooked operational weaknesses. From transportation to real estate to SaaS platforms, Finkelshtein's experience shows that cybersecurity is ultimately an operational discipline. The vulnerabilities that quietly accumulate inside a business often pose a greater risk than anything happening outside it.
Read Post
Zenity

The OWASP Top 10 for Agentic Applications: A Milestone for the Future of AI Security

Dec 10, 2025 By Kayla Underkoffler In Zenity
The OWASP GenAI Security Project has officially released its Top 10 for Agentic Applications, the first industry-standard framework focused on the operational risks created by autonomous and semi-autonomous AI systems. AI has evolved in a way that directly changes how enterprises need to think about security. We started with machine learning systems designed to classify and predict.
Read Post
salt security

React2Shell: The Frontend Vulnerability That Unlocks Your Internal APIs

Dec 10, 2025 By Eric Schwake In Salt Security
The cybersecurity world is currently buzzing about React2Shell (CVE-2025-55182), a critical remote code execution (RCE) vulnerability affecting React and Next.js. The scale of the threat is massive: researchers have already identified over 77,000 vulnerable IP addresses exposed to the internet, and confirmed that state-sponsored actors and opportunistic crypto miners have already breached at least 30 organizations. But if you look closely, this isn't really a story about React.
Read Post
Arctic Wolf

CVE-2025-59718 and CVE-2025-59719: FortiCloud SSO Login Authentication Bypass

Dec 10, 2025 By Julian Tuin In Arctic Wolf
On December 9, 2025, Fortinet released an advisory detailing two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Designated CVE-2025-59718 and CVE-2025-59719, these vulnerabilities allow an unauthenticated threat actor to bypass FortiCloud SSO login authentication via a crafted SAML message if the feature is enabled on the device. Fortinet states that FortiCloud SSO login is disabled by default in factory settings.
Read Post
aikido

OWASP Top 10 for Agentic Applications (2026): What Developers and Security Teams Need to Know

Dec 10, 2025 By Sooraj Shah In Aikido
Agentic AI is moving into production in CI/CD pipelines, internal copilots, customer support workflows, and infrastructure automation. These systems no longer just call a model. They plan, decide, delegate, and take actions on behalf of users and other systems. This creates new attack surfaces that do not map cleanly to traditional application security or even the OWASP Top 10 2025.
Read Post

CVE-2025-66516: Critical XXE Vulnerability Exposes Apache Tika Deployments

Dec 10, 2025 By Indusface In Indusface
A critical XXE vulnerability, CVE-2025-66516, has been discovered in Apache Tika, putting any workflow that processes PDFs at serious risk. A malicious PDF can trigger the exploit through any Tika workflow, silently giving attackers access to sensitive files, internal URLs, cloud metadata, and your internal network. AppTrana blocks these malicious PDFs at the edge, keeping your data and internal systems secure.
View Video
outpost 24

Outpost24 Acquires Infinipoint to Power Its Entry into the Zero Trust Workforce Access Market

Dec 9, 2025 By Outpost 24 In Outpost 24
The strategic acquisition strengthens market leadership by unifying user identity with device trust, eliminating security blind spots. STOCKHOLM / PHILADELPHIA (December 9, 2025) – Outpost24, a leader in exposure management and identity security, today announced the acquisition of Infinipoint, a specialist in device identity, posture validation, and secure workforce access.
Read Post
seemplicity

Insights Agent: From Data to Decisions

Dec 9, 2025 By Kevin Swan In Seemplicity
Vulnerability and exposure data is only as valuable as the insights you can extract from it. Seemplicity’s Insights Agent changes the game by turning dense vulnerability information into actionable insights, surfacing meaningful trends and generating visual insights. No configuration or guesswork–just fast, contextual analysis that helps security teams focus on what matters most.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.