PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

MongoBleed (CVE-2025-14847) exploited in the wild: everything you need to know

wiz.io | vulnerability | CVE-2025-14847 | #cloud | #memory-safety | #information-disclosure | #vulnerability | #patching | #mongodb | #cve-2025-14847 | #mongobleed
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

MongoBleed (CVE-2025-14847): a pre-auth zlib flaw leaks heap memory from unpatched MongoDB; Wiz finds vulnerable versions in 42% of cloud environments; exploitation is live in the wild.
CVE
CVE-2025-14847
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · wiz.io
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
vulnerability · wiz.io
React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability
React2Shell (CVE-2025-55182) is a critical unauthenticated RCE in React Server Components, exploitable in default Next.js deployments. Wiz confirms active exploitation and urges immediate patching.
vulnerability · wiz.io
RCE vulnerability in OpenSSH: everything you need to know
CVE-2024-6387 (regreSSHion) is an unauthenticated root RCE in OpenSSH's server—a signal handler race on glibc-based Linux; mass exploitation is deemed unlikely, but prompt patching is advised.
vulnerability · wiz.io
Critical RCE vulnerability in PHP CGI: everything you need to know
Wiz explains CVE-2024-4577, a critical argument-injection RCE in Windows PHP CGI, and reports TellYouThePass ransomware exploiting it within days; patched versions and mitigations are covered.
vulnerability · wiz.io
CVE-2024-4040 exploited in the wild: everything you need to know
Wiz covers CVE-2024-4040, a critical CrushFTP sandbox escape scored 9.8 and exploited in the wild, escalating to unauthenticated RCE; patch guidance covers versions before 10.7.1 and 11.1.0.
Back