Vulnerability
The latest Vulnerability coverage — news, analysis, and updates from the WindowsNews.AI desk.
CVE-2025-10200: Chrome 140 Patches ServiceWorker Use-After-Free, Edge Users Must Update Immediately
Google has shipped a critical patch for a use-after-free vulnerability in the ServiceWorker component of Chromium, tracked as CVE-2025-10200, with the release of Chrome version 140.0.7339.80/81 and...
Siemens, Schneider, Daikin ICS Flaws Could Let Attackers Remotely Cripple Operations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on September 11, 2025, released eleven industrial control systems (ICS) advisories detailing urgent security defects in Siemens,...
Vendor Won't Fix Daikin Gateway Pre-Auth Password Reset Bug—Public Exploit Code Heightens Risk for Energy Sector
A critical pre-authentication password reset vulnerability in Daikin Security Gateways, tracked as CVE-2025-10127, has entered a dangerous phase: public proof-of-concept exploit code is circulating,...
Windows OT Security Alert: Siemens Flaw CVE-2025-40757 Leaks Device Databases Over BACnet
A newly disclosed vulnerability in Siemens APOGEE PXC and TALON TC building automation controllers allows unauthenticated attackers to pull encrypted database files directly over the BACnet protocol,...
Siemens SIMOTION Flaw: Unpatched NSIS Installer Bug Grants Attackers SYSTEM Access on Windows
Siemens and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued a coordinated advisory warning that several SIMOTION engineering tools contain a local privilege-escalation...
Critical Siemens SIVaaS Bug Exposes Windows-Hosted Automation VMs to Remote Tampering Without Logins
A critical vulnerability in Siemens’ SIMATIC Virtualization as a Service (SIVaaS) has been assigned CVE-2025-40804, carrying a CVSS v3.1 base score of 9.1 and a CVSS v4 score of 9.3. The flaw—an...
SAP NetWeaver 10.0-Rated Exploits Eclipse Microsoft's Patch Tuesday as Enterprises Race to Patch
September’s Patch Tuesday delivered a predictable mix of Windows security updates and the usual Office headaches, but for enterprise security teams, the real fire alarm is ringing over SAP...
80 Fixes in September 2025 Patch Tuesday: SMB Audit Tool, NTFS RCE, and NTLM EoP Patched
Microsoft’s September 2025 Patch Tuesday landed with 80 security fixes, including a novel SMB hardening advisory that provides audit capabilities rather than a traditional vulnerability patch,...
Microsoft Ships Fixed Newtonsoft.Json in SQL Server CU to Address High-Severity DoS Flaw CVE-2024-21907
Microsoft has confirmed that a high-severity vulnerability in Newtonsoft.Json, the ubiquitous JSON library for .NET, is being addressed through cumulative updates for SQL Server and other products....
CVE-2025-55224: Windows Win32K Race Condition Allows Hyper-V Escape and SYSTEM Access
A recently patched vulnerability in the Windows Win32K graphics subsystem allows an authenticated attacker—or a low-privileged process inside a Hyper-V virtual machine—to exploit a race condition...
Microsoft Patches Critical Type-Confusion Bug in Windows Defender Firewall Service (CVE-2025-54915)
Microsoft has released a patch for CVE-2025-54915, a local privilege escalation vulnerability in the Windows Defender Firewall Service that exploits a type-confusion error. The flaw, described by...
Microsoft Fixes High-Impact BitLocker Use-After-Free Vulnerability (CVE-2025-54911)
Microsoft has disclosed a high-severity use-after-free vulnerability in Windows BitLocker, tracked as CVE-2025-54911, that could allow a local attacker to elevate privileges from a standard user...