Commvault has released a security advisory to address a critical vulnerability in its Command Center Platform. Command Center is Commvault’s all-in-one solution for managing Commvault services within a corporate environment.
CVE-2025-34028 is a path traversal vulnerability with a CVSSv3 base score of 10.0, and if exploited could allow an unauthenticated attacker to upload ZIP files. The ZIP files may then be expanded by the target server which could then result in remote code execution (RCE). Remediation advice Affected organisations are encouraged to review the Commvault security advisory CV_2025_04_1 and apply the relevant updates as soon as practicable.
Read more…
Source:NHS Digital
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- A 16-year-old bug could be putting millions of routers at risk — despite Broadcom saying it patched the issue years ago
October 26, 2026
A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password. Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete. Changing your Wi-Fi password won’t help, and disabling WPS may not either; firmware updates or ...
- Experts reveal another major PHP2Shell bug — and it’s not getting an emergency patch this time
October 26, 2026
PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup. Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch. Researchers say php2shell attacks remain limited so far, though widespread patching is still urgently needed. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The ...
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
October 22, 2026
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no ...
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
October 16, 2026
On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user. The advisory states that CVE-2026-97229 affects GitLab CE and EE ...
- Eiliko robot companion exposes private chats and can be hijacked
October 16, 2026
The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 ...