cve 2025 54100

A newly disclosed command-injection flaw in Windows PowerShell can allow specially crafted web content to cause unintended code execution when fetched with common cmdlets such as Invoke-WebRequest, prompting urgent remediation and an immediate re-evaluation of PowerShell automation in production...

Microsoft has issued KB5074204, a targeted security update for Windows PowerShell that ships as a hotpatch for devices on the 24H2 and 25H2 code families (OS Builds 26100.7456 and 26200.7456). The patch introduces a notable behavior change: the legacy PowerShell 5.1 cmdlet Invoke‑WebRequest now...

An attacker who successfully exploits CVE-2025-59499 can inherit the privileges of the process that runs the vulnerable query — in other words, exploitation can grant whatever SQL Server-level or OS-level rights the targeted process holds; if the vulnerable query executes under a principal that...

Microsoft has assigned CVE-2025-59259 to a newly disclosed denial-of-service flaw in the Windows Local Session Manager (LSM) that allows an authorized attacker to crash or otherwise deny service over a network; the issue carries a CVSS v3.1 base score of 6.5 (Medium) and was posted to...