Microsoft has released an emergency security patch for a critical vulnerability in Windows Server Update Services (WSUS) that is being actively exploited. The vulnerability, tracked as CVE-2025-59287, allows remote code execution and carries a severity score of 9.8 out of 10.

Microsoft has released an out-of-band security update for a critical vulnerability in Windows Server Update Services (WSUS), tracked as CVE-2025-59287. This flaw allows remote code execution by unauthenticated threat actors, and a new patch is necessary to fully mitigate the issue as the initial patch was incomplete.

Oracle has issued an emergency fix for a critical information disclosure vulnerability in its E-Business Suite, tracked as CVE-2025-61884. The flaw allows remote unauthenticated access to sensitive resources, raising concerns about potential exploitation by threat actors.

A critical vulnerability (CVE-2025-5947) in the Service Finder Bookings plugin for WordPress enables unauthenticated attackers to gain administrative access to affected sites. This flaw underscores the urgent need for prompt patching and highlights ongoing risks associated with insecure plugin design.