Skip to content
Threat Feed
Subscribe

Vendor

Notepad++

4 briefs RSS
critical threat

TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.

PoC Zimbra Collaboration Suite +10 TA488 +2 espionage xss zimbra apt state-sponsored half-click cve-2025-66376
2r 9t 3c 7i updated
high advisory

Notepad++ Vulnerability Allows Code Execution

A remote, anonymous attacker can exploit a vulnerability in Notepad++ to execute arbitrary program code, potentially leading to system compromise.

Notepad++ code-execution vulnerability windows
2r 1t
medium threat

Notepad++ Vulnerability in Version 8.9.3 and Prior

A vulnerability exists in Notepad++ version 8.9.3 and prior, prompting a security advisory and the release of version 8.9.4 to address the issue.

exploited Notepad++ 8.9.3 vulnerability notepad++ patch
2r 1t
medium advisory

Notepad++ Updater Querying Uncommon Domains

The Notepad++ updater, gup.exe, makes DNS queries to domains not part of the legitimate update infrastructure, potentially indicating updater mechanism exploitation or suspicious network activity.

Notepad++ supply-chain dns
2r 2t