<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
<title>IntelligenceX Cybersecurity Blog &#45; Latest Cyber News, AI &amp;amp; Security Updates &#45; : CVE&amp;apos;s</title>
<link>https://blog.intelligencex.org/rss/category/cves</link>
<description>IntelligenceX Cybersecurity Blog &#45; Latest Cyber News, AI &amp;amp; Security Updates &#45; : CVE&amp;apos;s</description>
<dc:language>en</dc:language>
<dc:rights>© 2026 IntelligenceX Blog. All rights reserved.</dc:rights>

<item>
<title>CVE&#45;2025&#45;14847 (MongoBleed): The Critical MongoDB Memory Leak Affecting 87,000+ Servers</title>
<link>https://blog.intelligencex.org/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability</link>
<guid>https://blog.intelligencex.org/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability</guid>
<description><![CDATA[ Comprehensive analysis of CVE-2025-14847 (MongoBleed), a critical unauthenticated memory leak in MongoDB affecting 87,000+ internet-exposed servers. Explore technical mechanics, exploitation techniques, detection strategies, and search dorks for identifying vulnerable instances. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202512/image_870x580_6952bb5ee9b04.webp" length="32292" type="image/jpeg"/>
<pubDate>Mon, 29 Dec 2025 23:03:34 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-14847, MongoBleed, MongoDB vulnerability, zlib vulnerability, memory leak, unauthenticated disclosure, heap memory leak, MongoDB security, database vulnerability, CVSS 8.7, information disclosure</media:keywords>
</item>

<item>
<title>CVE&#45;2025&#45;68613: Critical RCE in n8n Workflow Automation Platform</title>
<link>https://blog.intelligencex.org/cve-2025-68613-n8n-critical-rce-vulnerability</link>
<guid>https://blog.intelligencex.org/cve-2025-68613-n8n-critical-rce-vulnerability</guid>
<description><![CDATA[ A critical remote code execution vulnerability in n8n workflow automation (CVSS 9.9) allows authenticated attackers to execute arbitrary code, potentially compromising over 103,000 exposed instances worldwide. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202512/image_870x580_694b10742cc47.webp" length="28234" type="image/jpeg"/>
<pubDate>Wed, 24 Dec 2025 03:28:39 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-68613, n8n vulnerability, remote code execution, RCE, workflow automation security, expression injection, CVSS 9.9, security vulnerability, patch management, n8n security</media:keywords>
</item>

<item>
<title>After React2Shell: New DoS &amp;amp; Source Code Leaks Hit React Server Components</title>
<link>https://blog.intelligencex.org/react-cve-2025-55184-67779-55183-dos-source-code-exposure</link>
<guid>https://blog.intelligencex.org/react-cve-2025-55184-67779-55183-dos-source-code-exposure</guid>
<description><![CDATA[ Just days after React2Shell (CVE-2025-55182), three new vulnerabilities emerged in React Server Components: CVE-2025-55184 and CVE-2025-67779 (CVSS 7.5) enable denial-of-service attacks via infinite loops, while CVE-2025-55183 (CVSS 5.3) leaks server-side source code. The initial patches were incomplete organizations must upgrade again to versions 19.0.3, 19.1.4, or 19.2.3. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202512/image_870x580_6943184049deb.webp" length="31212" type="image/jpeg"/>
<pubDate>Thu, 18 Dec 2025 02:24:41 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-55184, CVE-2025-67779, CVE-2025-55183, React denial of service, React source code exposure, React Server Components, incomplete patch, Next.js vulnerability, React 19 security, RSC vulnerabilities</media:keywords>
</item>

<item>
<title>CVE&#45;2025&#45;66516: Critical XXE in Apache Tika (CVSS 10.0) Enables RCE via Malicious PDFs</title>
<link>https://blog.intelligencex.org/cve-2025-66516-apache-tika-xxe-vulnerability-pdf-rce</link>
<guid>https://blog.intelligencex.org/cve-2025-66516-apache-tika-xxe-vulnerability-pdf-rce</guid>
<description><![CDATA[ CVE-2025-66516 is a maximum-severity (CVSS 10.0) XML External Entity (XXE) vulnerability in Apache Tika that allows unauthenticated attackers to achieve file disclosure, SSRF, and remote code execution by embedding malicious XFA content inside PDF files, affecting millions of document processing systems worldwide. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202512/image_870x580_69372b59bef77.webp" length="26428" type="image/jpeg"/>
<pubDate>Tue, 09 Dec 2025 01:18:41 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-66516, Apache Tika XXE, XML External Entity, CVSS 10.0, Tika vulnerability, PDF exploit, XFA attack, Apache Tika security, file disclosure, SSRF vulnerability, tika-core exploit</media:keywords>
</item>

<item>
<title>CVE&#45;2025&#45;55182 (React2Shell): The CVSS 10.0 RCE That Broke React Server Components</title>
<link>https://blog.intelligencex.org/cve-2025-55182-react2shell-rce-exploit-poc</link>
<guid>https://blog.intelligencex.org/cve-2025-55182-react2shell-rce-exploit-poc</guid>
<description><![CDATA[ CVE-2025-55182 is a critical maximum-severity (CVSS 10.0) unauthenticated remote code execution vulnerability in React Server Components affecting React 19.x and Next.js 15-16.x, with working POCs published within 24 hours, it&#039;s now actively exploited by China-nexus APT groups with 39% of cloud environments exposed. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202512/image_870x580_69333d939226a.webp" length="28080" type="image/jpeg"/>
<pubDate>Sat, 06 Dec 2025 01:02:26 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-55182, React2Shell, React RCE vulnerability, Next.js CVE-2025-66478, React Server Components exploit, CVSS 10.0, unauthenticated RCE, React vulnerability POC, unsafe deserialization, Flight protocol exploit</media:keywords>
</item>

<item>
<title>Critical Wing FTP Server Vulnerability (CVE&#45;2025&#45;47812) Actively Being Exploited in the Wild</title>
<link>https://blog.intelligencex.org/critical-wing-ftp-server-vulnerability-cve-2025-47812-exploited</link>
<guid>https://blog.intelligencex.org/critical-wing-ftp-server-vulnerability-cve-2025-47812-exploited</guid>
<description><![CDATA[ CVE-2025-47812 is a maximum-severity remote code execution vulnerability in Wing FTP Server versions before 7.4.4, allowing unauthenticated attackers to execute arbitrary Lua code via null byte injection—resulting in full system compromise. Actively exploited since early July, this critical flaw underscores the urgent need for patching and monitoring. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202510/image_870x580_68e6463d0dbb5.webp" length="10354" type="image/jpeg"/>
<pubDate>Wed, 27 Aug 2025 17:50:47 +0530</pubDate>
<dc:creator>Root</dc:creator>
<media:keywords>CVE-2025-47812, Wing FTP Server, remote code execution, RCE, null byte injection, Lua injection, active exploitation, patch now</media:keywords>
</item>

<item>
<title>WinRAR Releases Emergency Patch for CVE&#45;2025&#45;8088 Zero&#45;Day Exploit</title>
<link>https://blog.intelligencex.org/cve-2025-8088-winrar-zero-day-exploit</link>
<guid>https://blog.intelligencex.org/cve-2025-8088-winrar-zero-day-exploit</guid>
<description><![CDATA[ WinRAR has patched a critical zero-day vulnerability (CVE-2025-8088) in its Windows versions, actively exploited in spear-phishing attacks. The flaw allowed attackers to drop hidden payloads into auto-run locations, granting persistence and remote code execution.CVE-2025-8088, discovered by ESET researchers, leveraged path traversal through alternate data streams (ADSes). From mid-July 2025, threat actors RomCom and Paper Werewolf used the flaw in targeted campaigns against defense, finance, and manufacturing sectors. The vulnerability was patched in WinRAR 7.13 on July 30, 2025. As WinRAR does not auto-update, all users must manually install the latest version to stay secure. ]]></description>
<enclosure url="https://blog.intelligencex.org/uploads/images/202510/image_870x580_68e642bb86d96.webp" length="53282" type="image/jpeg"/>
<pubDate>Wed, 27 Aug 2025 17:24:15 +0530</pubDate>
<dc:creator>sbow</dc:creator>
<media:keywords>CVE-2025-8088, WinRAR zero-day exploit. path traversal vulnerability, alternate data streams (ADS), RomCom WinRAR exploit, Paper Werewolf cyberattack, WinRAR 7.13 update, spear-phishing malware campaigns</media:keywords>
</item>

</channel>
</rss>