Vulnerebility Vulnerebility Calendar Top 40 in years Top Vulnerebility List of Attack EVCatalog | 2025 2024
| DATE | NAME |
CATEGORY |
SUB | |
| 13.11.25 | CVE-2025-62215 | Microsoft Windows Race Condition Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 13.11.25 | CVE-2025-12480 | Gladinet Triofox Improper Access Control Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 13.11.25 | CVE-2025-9242 | WatchGuard Firebox Out-of-Bounds Write Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2024-25621 | containerd affected by a local privilege escalation via wide permissions on CRI directory | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-10966 | missing SFTP host verification with wolfSSH | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-12863 | Libxml2: namespace use-after-free in xmlsettreedoc() function of libxml2 | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-12875 | mruby array.c ary_fill_exec out-of-bounds write | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-30398 | Nuance PowerScribe 360 Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-31133 | runc container escape via "masked path" abuse due to mount race conditions | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-40107 | can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-40109 | crypto: rng - Ensure set_ent is always present | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-47179 | Configuration Manager Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-52565 | container escape due to /dev/console mount and related races | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-52881 | runc: LSM labels can be bypassed with malicious config using dummy procfs files | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59240 | Microsoft Excel Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59499 | Microsoft SQL Server Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59504 | Azure Monitor Agent Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59505 | Windows Smart Card Reader Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59506 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59507 | Windows Speech Runtime Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59508 | Windows Speech Recognition Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59509 | Windows Speech Recognition Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59510 | Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59511 | Windows WLAN Service Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59512 | Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59513 | Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59514 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-59515 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60703 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60704 | Windows Kerberos Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60705 | Windows Client-Side Caching Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60706 | Windows Hyper-V Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60707 | Multimedia Class Scheduler Service (MMCSS) Driver Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60708 | Storvsp.sys Driver Denial of Service Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60709 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60710 | Host Process for Windows Tasks Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60713 | Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60714 | Windows OLE Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60715 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60716 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60717 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60718 | Windows Administrator Protection Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60719 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60720 | Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60721 | Windows Administrator Protection Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60722 | Microsoft OneDrive for Android Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60723 | DirectX Graphics Kernel Denial of Service Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60724 | GDI+ Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60726 | Microsoft Excel Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60727 | Microsoft Excel Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60728 | Microsoft Excel Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-60753 | An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62199 | Microsoft Office Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62200 | Microsoft Excel Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62201 | Microsoft Excel Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62202 | Microsoft Excel Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62203 | Microsoft Excel Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62204 | Microsoft SharePoint Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62205 | Microsoft Office Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62206 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62208 | Windows License Manager Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62209 | Windows License Manager Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62210 | Dynamics 365 Field Service (online) Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62211 | Dynamics 365 Field Service (online) Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62213 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62214 | Visual Studio Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62215 | Windows Kernel Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62216 | Microsoft Office Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62217 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62218 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62219 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62220 | Windows Subsystem for Linux GUI Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62222 | Agentic AI and Visual Studio Code Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62449 | Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62452 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-62453 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64329 | containerd CRI server: Host memory exhaustion through Attach goroutine leak | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64432 | KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64433 | KubeVirt Arbitrary Container File Read | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64434 | KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64435 | KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64436 | KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes | VULNEREBILITY | VULNEREBILITY |
| 12.11.2025 | CVE-2025-64437 | KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes | VULNEREBILITY | VULNEREBILITY |
| 12.11.25 | CVE-2025-60716 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
VULNEREBILITY |
|
| 12.11.25 | CVE-2025-62215 | This vulnerability is already being exploited. It is a privilege escalation vulnerability in the Windows Kernel. These types of vulnerabilities are often exploited as part of a more complex attack chain; however, exploiting this specific vulnerability is likely to be relatively straightforward, given the existence of prior similar vulnerabilities. |
VULNEREBILITY |
|
| 12.11.25 | CVE-2025-60274 | A critical GDI+ remote execution vulnerability. GDI+ parses various graphics files. The attack surface is likely huge, as anything in Windows (Browsers, email, and Office Documents) will use this library at some point to display images. We also have a critical vulnerability in Direct-X CVE-2025-60716. Microsoft classifies this as a privilege escalation issue, yet still rates it as critical. |
VULNEREBILITY |
|
| 12.11.25 | CVE-2025-62199 | A code execution vulnerability in Microsoft Office. Another component with a huge attack surface that is often exploited. |
VULNEREBILITY |
|
| 12.11.25 | CVE-2025-5777 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server |
VULNEREBILITY |
|
| 12.11.25 | CVE-2025-20337 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. |
VULNEREBILITY |
|
| 11.11.25 | CVE-2025-12480 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. |
VULNEREBILITY |
|
| 9.11.25 | CVE-2025-20363 | Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.11.25 | CVE-2025-20358 | A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. |
VULNEREBILITY |
|
| 9.11.25 | CVE-2024-20359 | Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.11.25 | CVE-2024-20353 | Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability |
VULNEREBILITY |
|
| 8.11.25 | CVE-2025-59287 | Windows Server Update Service (WSUS) Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 8.11.25 | CVE-2017-17562 | Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c |
VULNEREBILITY |
|
| 8.11.25 | CVE-2017-9805 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. |
VULNEREBILITY |
|
| 8.11.25 | CVE-2021-44228 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints |
VULNEREBILITY |
|
| 8.11.25 | CVE-2022-26134 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. |
VULNEREBILITY |
|
| 7.11.25 | CVE-2025-20362 | Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability |
VULNEREBILITY |
|
| 7.11.25 | CVE-2025-20333 | Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 5.11.25 | CVE-2025-11371 | (CVSS score: 7.5) - A vulnerability in files or directories accessible to external parties in Gladinet CentreStack and Triofox that could result in unintended disclosure of system files. |
VULNEREBILITY |
|
| 5.11.25 | CVE-2025-48703 | (CVSS score: 9.0) - An operating system command injection vulnerability in Control Web Panel (formerly CentOS Web Panel) that results in unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-11953 | Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk |
VULNEREBILITY |
|
| 4.11.25 | CVE-2024-38197 | Microsoft Teams for iOS Spoofing Vulnerability |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-43429 | A buffer overflow vulnerability that may lead to an unexpected process crash when processing maliciously crafted web content (addressed through improved bounds checking) |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-43430 | An unspecified vulnerability that could result in an unexpected process crash when processing maliciously crafted web content (addressed through improved state management) |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-43431 | Two unspecified vulnerabilities that may lead to memory corruption when processing maliciously crafted web content (addressed through improved memory handling) |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-43433 | Two unspecified vulnerabilities that may lead to memory corruption when processing maliciously crafted web content (addressed through improved memory handling) |
VULNEREBILITY |
|
| 4.11.25 | CVE-2025-43434 | A use-after-free vulnerability that may lead to an unexpected Safari crash when processing maliciously crafted web content (addressed through improved state management) |
VULNEREBILITY |
|
| 3.11.25 | CVE-2025-61932 | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. |
VULNEREBILITY |
|
| 3.11.25 | CVE-2023-20273 | Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature |
VULNEREBILITY |
|
| 3.11.25 | CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability |
VULNEREBILITY |
|
| 3.11.25 | CVE-2024-1086 | Linux Kernel Use-After-Free Vulnerability |
VULNEREBILITY |
|
| 3.11.25 | CVE-2024-1086 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. |
VULNEREBILITY |
|
| 3.11.25 | CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read – POC |
VULNEREBILITY |
|
| 2.11.25 | CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed. |
VULNEREBILITY |
|
| 2.11.25 | CVE-2024-9707 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. |
VULNEREBILITY |
|
| 2.11.25 | CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. |
VULNEREBILITY |
|
| 1.11.25 | CVE-2025-61932 | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. |
VULNEREBILITY |
|
| 1.11.25 | CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability |
VULNEREBILITY |
|
| 1.11.25 | CVE-2025-24893 | XWiki Platform Eval Injection Vulnerability |
VULNEREBILITY |
|
| 30.10.25 | CVE-2025-40778 | October 24 Advisory: BIND 9 Resolver Enables Cache Poisoning Via Unsolicited Answers [CVE-2025-40778] |
VULNEREBILITY |
|
| 30.10.25 | CVE-2017-9841 | A Remote code execution vulnerability in PHPUnit |
VULNEREBILITY |
|
| 30.10.25 | CVE-2021-3129 | A Remote code execution vulnerability in Laravel |
VULNEREBILITY |
|
| 30.10.25 | CVE-2022-47945 | A Remote code execution vulnerability in ThinkPHP Framework |
VULNEREBILITY |
|
| 29.10.25 | CVE-2025-6204 | (CVSS score: 8.0) - A code injection vulnerability in Dassault Systèmes DELMIA Apriso that could allow an attacker to execute arbitrary code. |
VULNEREBILITY |
|
| 29.10.25 | CVE-2025-6205 | (CVSS score: 9.1) - A missing authorization vulnerability in Dassault Systèmes DELMIA Apriso that could allow an attacker to gain privileged access to the application. |
VULNEREBILITY |
|
| 29.10.25 | CVE-2025-24893 | (CVSS score: 9.8) - An improper neutralization of input in a dynamic evaluation call (aka eval injection) in XWiki that could allow any guest user to perform arbitrary remote code execution through a request to the "/bin/get/Main/SolrSearch" endpoint. |
VULNEREBILITY |
|
| 29.10.25 | CVE-2025-2783 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) |
VULNEREBILITY |
|
| 27.10.25 | CVE-2025-62518 | astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. |
VULNEREBILITY |
|
| 26.10.25 | CVE-2025-7656 | Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
VULNEREBILITY |
|
| 26.10.25 | CVE-2025-48561 | In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. |
VULNEREBILITY |
|
| 26.10.25 | CVE-2025-11493 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. |
VULNEREBILITY |
|
| 26.10.25 | CVE-2025-11492 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. |
VULNEREBILITY |
|
| 26.10.25 | CVE-2025-55315 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
VULNEREBILITY |
|
| 25.10.25 | CVE-2025-59287 | Windows Server Update Service (WSUS) Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 25.10.25 | CVE-2025-54236 | SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236) |
VULNEREBILITY |
|
| 25.10.25 | CVE-2025-61932 | Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability |
VULNEREBILITY |
|
| 22.10.25 | CVE-2025-6541 | (CVSS score: 8.6) - An operating system command injection vulnerability that could be exploited by an attacker who can log in to the web management interface to run arbitrary commands |
VULNEREBILITY |
|
| 22.10.25 | CVE-2025-6542 | (CVSS score: 9.3) - An operating system command injection vulnerability that could be exploited by a remote unauthenticated attacker to run arbitrary commands |
VULNEREBILITY |
|
| 22.10.25 | CVE-2025-7850 | (CVSS score: 9.3) - An operating system command injection vulnerability that could be exploited by an attacker in possession of an administrator password of the web portal to run arbitrary commands |
VULNEREBILITY |
|
| 22.10.25 | CVE-2025-7851 | (CVSS score: 8.7) - An improper privilege management vulnerability that could be exploited by an attacker to obtain the root shell on the underlying operating system under restricted conditions |
VULNEREBILITY |
|
| 22.10.25 | ToolShell | ToolShell Used to Compromise Telecoms Company in Middle East |
VULNEREBILITY |
|
| 22.10.25 | TARmageddon | TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware |
VULNEREBILITY |
|
| 21.10.25 | CVE-2022-48503 | Apple Multiple Products Unspecified Vulnerability |
VULNEREBILITY |
|
| 21.10.25 | CVE-2025-2746 | Kentico Xperience Staging Sync Server Digest Password Authentication Bypass Vulnerability |
VULNEREBILITY |
|
| 21.10.25 | CVE-2025-2747 | Kentico Xperience Staging Sync Server None Password Type Authentication Bypass Vulnerability |
VULNEREBILITY |
|
| 21.10.25 | CVE-2025-33073 | Microsoft Windows SMB Client Improper Access Control Vulnerability |
VULNEREBILITY |
|
| 21.10.25 | CVE-2025-61884 | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability |
VULNEREBILITY |
|
| 17.10.25 | CVE-2025-9242 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2025-54253 | CVE-2025-54253: Pre-Auth RCE – Adobe AEM Forms on JEE Critical OGNL Injection | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2025-24990 | (CVSS score: 7.8) - Windows Agere Modem Driver ("ltmdm64.sys") Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2025-59230 | (CVSS score: 7.8) - Windows Remote Access Connection Manager (RasMan) Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2023-40151 | When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge. | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2023-42770 | Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge. | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2025-2611 | ICTBroadcast Command Injection Actively Exploited (CVE-2025-2611) | VULNEREBILITY | VULNEREBILITY |
| 16.10.25 | CVE-2025-42937 | SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application. | VULNEREBILITY | VULNEREBILITY |
|
13.10.25 |
CVE-2025-61884 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. | VULNEREBILITY | VULNEREBILITY |
|
11.10.25 |
CVE-2025-59489 | Unity Gaming Engine Editor vulnerability | VULNEREBILITY | VULNEREBILITY |
|
11.10.25 |
CVE-2025-10035 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. | VULNEREBILITY | VULNEREBILITY |
|
11.10.25 |
CVE-2025-30406 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. | VULNEREBILITY | VULNEREBILITY |
|
11.10.25 |
CVE-2025-11371 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. | VULNEREBILITY | VULNEREBILITY |
|
10.10.25 |
CVE-2025-5947 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. | VULNEREBILITY | VULNEREBILITY |
|
8.10.25 |
CVE-2025-53967 | figma-developer-mcp vulnerable to command injection in get_figma_data tool | VULNEREBILITY | VULNEREBILITY |
|
7.10.25 |
CVE-2025-61882 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. | VULNEREBILITY | VULNEREBILITY |
|
7.10.25 |
CVE-2025-49844 | Lua Use-After-Free may lead to remote code execution | VULNEREBILITY | VULNEREBILITY |
|
7.10.25 |
CVE-2025-61882 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. | VULNEREBILITY | VULNEREBILITY |
|
7.10.25 |
CVE-2025-27915 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-10547 | On July 22, a security vulnerability was identified in DrayOS routers. The vulnerability can be triggered when unauthenticated remote attackers send crafted HTTP or HTTPS requests to the device's Web User Interface (WebUI). | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-41244 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-32463 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-30247 | An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST. | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-41251 | VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. | VULNEREBILITY | VULNEREBILITY |
|
5.10.25 |
CVE-2025-41252 | Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorized access. | VULNEREBILITY | VULNEREBILITY |
| 4.10.25 | CVE-2025-52905 | An argument injection flaw that attackers can use to trigger a denial of service (DoS), crashing the router or overwhelming remote servers. | VULNEREBILITY | VULNEREBILITY |
| 4.10.25 | CVE-2025-52906 | An unauthenticated command injection vulnerability that allows attackers to remotely execute arbitrary commands on the device. | VULNEREBILITY | VULNEREBILITY |
| 4.10.25 | CVE-2025-52907 | A security bypass that attackers can exploit to corrupt system files, cause a persistent denial-of-service, or achieve arbitrary file writes. Chaining attacks could lead to remote code execution (RCE). | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2014-6278 | GNU Bash OS Command Injection Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2015-7755 | Juniper ScreenOS Improper Authentication Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2017-1000353 | Jenkins Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2025-4008 | Smartbedded Meteobridge Command Injection Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2025-21043 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2025-10725 | A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. | VULNEREBILITY | VULNEREBILITY |
| 3.10.25 | CVE-2025-59363 | In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created), | VULNEREBILITY | VULNEREBILITY |
| 28.9.25 | CVE-2024-10237 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process | VULNEREBILITY | VULNEREBILITY |
| 28.9.25 | CVE-2025-10184 | CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (NOT FIXED) | VULNEREBILITY | VULNEREBILITY |
| 27.9.25 | CVE-2024-36401 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. | VULNEREBILITY | VULNEREBILITY |
| 26.9.25 | CVE-2025-10035 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. | VULNEREBILITY | VULNEREBILITY |
| 26.9.25 | CVE-2025-20333 | (CVSS score: 9.9) - An improper validation of user-supplied input in HTTP(S) requests vulnerability that could allow an authenticated, remote attacker with valid VPN user credentials to execute arbitrary code as root on an affected device by sending crafted HTTP requests | VULNEREBILITY | VULNEREBILITY |
| 26.9.25 | CVE-2025-20362 | (CVSS score: 6.5) - An improper validation of user-supplied input in HTTP(S) requests vulnerability that could allow an unauthenticated, remote attacker to access restricted URL endpoints without authentication by sending crafted HTTP requests | VULNEREBILITY | VULNEREBILITY |
| 25.9.25 | CVE-2025-20352 | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-10643 | (CVSS score: 9.1) - An authentication bypass vulnerability that exists within the permissions granted to a storage account token | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-10644 | (CVSS score: 9.4) - An authentication bypass vulnerability that exists within the permissions granted to an SAS token | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-51591 | A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-59689 | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7. | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-6198 | (CVSS score: 6.4) - A crafted firmware image can bypass the Supermicro BMC firmware verification logic of the Signing Table to update the system firmware by redirecting the program to a fake signing table ("sig_table") in the unsigned region | VULNEREBILITY | VULNEREBILITY |
| 24.9.25 | CVE-2025-7937 | (CVSS score: 6.6) - A crafted firmware image can bypass the Supermicro BMC firmware verification logic of Root of Trust (RoT) 1.0 to update the system firmware by redirecting the program to a fake "fwmap" table in the unsigned region | VULNEREBILITY | VULNEREBILITY |
| 23.9.25 | CVE-2025-26399 | SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. | VULNEREBILITY | VULNEREBILITY |
| 22.9.25 | CVE-2025-55241 | Azure Entra Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 20.9.25 | CVE-2025-10035 | Deserialization Vulnerability in GoAnywhere MFT's License Servlet | VULNEREBILITY | VULNEREBILITY |
| 19.9.25 | CVE-2025-4428 | Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. | VULNEREBILITY | VULNEREBILITY |
| 19.9.25 | CVE-2025-4427 | An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-6202 | Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. This issue affects DDR5: DIMMs produced from 2021-1 until 2024-12. | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-43300 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12. | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-59358 | (CVSS score: 7.5) - The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial-of-service | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-59359 | (CVSS score: 9.8) - The cleanTcs mutation in Chaos Controller Manager is vulnerable to operating system command injection | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-59360 | (CVSS score: 9.8) - The killProcesses mutation in Chaos Controller Manager is vulnerable to operating system command injection | VULNEREBILITY | VULNEREBILITY |
| 16.9.25 | CVE-2025-59361 | (CVSS score: 9.8) - The cleanIptables mutation in Chaos Controller Manager is vulnerable to operating system command injection | VULNEREBILITY | VULNEREBILITY |
| 13.9.25 | CVE-2025-55190 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1 | VULNEREBILITY | VULNEREBILITY |
| 12.9.25 | CVE-2025-5086 | Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 12.9.25 | CVE-2018-0802 | Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". | VULNEREBILITY | VULNEREBILITY |
| 11.9.25 | CVE-2024-40766 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-48003 | (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability via WinRE Apps Scheduled Operation | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-48800 | (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting ReAgent.xml Parsing | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-48804 | (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting Boot.sdi Parsing | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-48818 | (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting Boot Configuration Data (BCD) Parsing | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-54236 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-42944 | (CVSS score: 10.0) - A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a malicious payload to an open port through the RMI-P4 module, resulting in operating system command execution | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-42922 | (CVSS score: 9.9) - An insecure file operations vulnerability in SAP NetWeaver AS Java that could allow an attacker authenticated as a non-administrative user to upload an arbitrary file | VULNEREBILITY | VULNEREBILITY |
| 10.9.25 | CVE-2025-42958 | (CVSS score: 9.1) - A missing authentication check vulnerability in the SAP NetWeaver application on IBM i-series that could allow highly privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities | VULNEREBILITY | VULNEREBILITY |
| 7.9.25 | CVE-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 7.9.25 | CVE-2025-38352 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() | VULNEREBILITY | VULNEREBILITY |
| 7.9.25 | CVE-2025-55177 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78 | VULNEREBILITY | VULNEREBILITY |
| 7.9.25 | CVE-2025-50173 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. | VULNEREBILITY | VULNEREBILITY |
| 6.9.25 | CVE-2025-53690 | Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability: Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 5.9.25 | CVE-2025-42957 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. | VULNEREBILITY | VULNEREBILITY |
| 4.9.25 | CVE-2025-38352 | A privilege escalation flaw in the Linux Kernel component | VULNEREBILITY | VULNEREBILITY |
| 4.9.25 | CVE-2025-48543 | A privilege escalation flaw in the Android Runtime component | VULNEREBILITY | VULNEREBILITY |
| 4.9.25 | CVE-2020-24363 | TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 4.9.25 | CVE-2025-55177 | Meta Platforms WhatsApp Incorrect Authorization Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-34511 | Post-authenticated remote code execution via Sitecore PowerShell Extension | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-34510 | Post-authenticated remote code execution via path traversal | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-34509 | Use of hard-coded credentials | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-53694 | Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-53691 | Remote code execution (RCE) through insecure deserialization | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-53693 | HTML cache poisoning through unsafe reflections | VULNEREBILITY | VULNEREBILITY |
| 30.8.25 | CVE-2025-55177 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device | VULNEREBILITY | VULNEREBILITY |
| 29.8.25 | CVE-2025-57819 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data | VULNEREBILITY | VULNEREBILITY |
| 27.8.25 | CVE-2025-8424 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access | VULNEREBILITY | VULNEREBILITY |
| 27.8.25 | CVE-2025-7776 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) with PCoIP Profile bounded to it | VULNEREBILITY | VULNEREBILITY |
| 27.8.25 | CVE-2025-7775 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC | VULNEREBILITY | VULNEREBILITY |
| 26.8.25 | CVE-2025-48384 | Git Link Following Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 26.8.25 | CVE-2024-8068 | Citrix Session Recording Improper Privilege Management Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 26.8.25 | CVE-2024-8069 | Citrix Session Recording Deserialization of Untrusted Data Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 26.8.25 | CVE-2025-9074 | A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. | VULNEREBILITY | VULNEREBILITY |
| 24.8.25 | CVE-2025-52970 | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request. | VULNEREBILITY | VULNEREBILITY |
| 22.8.25 | CVE-2025-57788 | (CVSS score: 6.9) - A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials | VULNEREBILITY | VULNEREBILITY |
| 22.8.25 | CVE-2025-57789 | (CVSS score: 5.3) - A vulnerability during the setup phase between installation and the first administrator login that allows remote attackers to exploit the default credentials to gain admin control | VULNEREBILITY | VULNEREBILITY |
| 22.8.25 | CVE-2025-57790 | (CVSS score: 8.7) - A path traversal vulnerability that allows remote attackers to perform unauthorized file system access through a path traversal issue, resulting in remote code execution | VULNEREBILITY | VULNEREBILITY |
| 22.8.25 | CVE-2025-57791 | (CVSS score: 6.9) - A vulnerability that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation, resulting in a valid user session for a low-privilege role | VULNEREBILITY | VULNEREBILITY |
| 21.8.25 | CVE-2025-43300 | About the security content of iOS 18.6.2 and iPadOS 18.6.2 | VULNEREBILITY | VULNEREBILITY |
| 21.8.25 | CVE-2018-0171 | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device | VULNEREBILITY | VULNEREBILITY |
| 20.8.25 | CVE-2023-46604 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. | VULNEREBILITY | VULNEREBILITY |
| 19.8.25 | CVE-2025-31324 | (CVSS score: 10.0) - Missing Authorization check in SAP NetWeaver's Visual Composer development server | VULNEREBILITY | VULNEREBILITY |
| 19.8.25 | CVE-2025-42999 |
SAP NetWeaver Visual
Composer Metadata Uploader is vulnerable when a privileged user can
upload untrusted or malicious content which, when deserialized, could
potentially lead to a compromise of confidentiality, integrity, and availability of the host system. |
VULNEREBILITY | VULNEREBILITY |
| 17.8.25 | CVE-2025-26633 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. | VULNEREBILITY | VULNEREBILITY |
| 15.8.25 | CVE-2025-20265 | Cisco Secure Firewall Management Center Software RADIUS Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-8876 | N-able N-central Command Injection Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-8875 | N-able N-central Insecure Deserialization Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-49457 | Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-25256 | Remote unauthenticated command injection | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-53767 | (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-53766 | (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-50165 | (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-53792 | (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-53787 | (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-50177 | (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | CVE-2025-50176 | (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | Earth Baxia | New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises | VULNEREBILITY | VULNEREBILITY |
| 14.8.25 | XZ Utils | Persistent Risk: XZ Utils Backdoor Still Lurking in Docker Images | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2025-6543 | Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2024-40766 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2025-53786 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | 2TETRA:2BURST | Midnight Blue presents new research on the security of TETRA, including on the elusive TETRA End-to-End (E2EE) encryption mechanisms that are commonly encountered in the most sensitive of use cases. | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2024-42009 | (CVSS score: 9.3) - A cross-site scripting (XSS) vulnerability in RoundCube Webmail that could allow a remote attacker to steal and send emails of a victim via a crafted email message by | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2025-32433 | (CVSS score: 10.0) - A missing authentication for a critical function vulnerability in the Erlang/OTP SSH server that could allow an attacker to execute arbitrary commands without valid credentials, | VULNEREBILITY | VULNEREBILITY |
| 12.8.25 | CVE-2025-8088 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2024-40766 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-30023 | The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-30024 | The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-30025 | The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-30026 | The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-53786 | Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2020-25078 | (CVSS score: 7.5) - An unspecified vulnerability in D-Link DCS-2530L and DCS-2670L devices that could allow for remote administrator password disclosure | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2020-25079 | (CVSS score: 8.8) - An authenticated command injection vulnerability in the cgi-bin/ddns_enc.cgi component affecting D-Link DCS-2530L and DCS-2670L devices | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2020-40799 | (CVSS score: 8.8) - A download of code without an integrity check vulnerability in D-Link DNR-322L that could allow an authenticated attacker to execute operating system-level commands on the device | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-54948 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. | VULNEREBILITY | VULNEREBILITY |
| 9.08.25 | CVE-2025-54987 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-23319 | (CVSS score: 8.1) - A vulnerability in the Python backend, where an attacker could cause an out-of-bounds write by sending a request | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-23320 | (CVSS score: 7.5) - A vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-23334 | (CVSS score: 5.9) - A vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-21479 | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-21480 | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 5.08.25 | CVE-2025-27038 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2025-20282 | Critical unauthenticated arbitrary file upload and execution vulnerability in Cisco ISE and ISE-PIC Release 3.4. Lack of file validation allows attackers to upload malicious files into privileged directories and execute them as root. Fixed in ISE 3.4 Patch 2. | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | MISA-2025-0009 | MX-ONE Authentication Bypass Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | Fire Ant | Fire Ant: A Deep-Dive into Hypervisor-Level Espionage | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2023-34048 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2025-6704 | (CVSS score: 9.8) - An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2025-7624 | (CVSS score: 9.8) - An SQL injection vulnerability in the legacy (transparent) SMTP proxy can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2024-13974 | (CVSS score: 8.1) - A business logic vulnerability in the Up2Date component can lead to attackers controlling the firewall's DNS environment to achieve remote code execution | VULNEREBILITY | VULNEREBILITY |
| 25.7.25 | CVE-2024-13973 | (CVSS score: 6.8) - A post-auth SQL injection vulnerability in WebAdmin can potentially lead to administrators achieving arbitrary code execution | VULNEREBILITY | VULNEREBILITY |
| 22.7.25 | CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 22.7.25 | CVE-2025-53770 | Microsoft SharePoint Server Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 22.7.25 | CVE-2025-37103 | Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-49706 | Microsoft SharePoint Server Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-53770 | Microsoft SharePoint Server Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-54309 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-54309 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-48927 | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-41236 | VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Nguyen Hoang Thach of STARLabs SG used this flaw at Pwn2Own. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-41237 | VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. This flaw was used by Corentin BAYET of REverse Tactics at Pwn2Own. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-41238 | VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2023-20273 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2023-20198 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2018-0171 | A critical flaw in Cisco IOS and IOS XE Smart Install that allows remote code execution via specially crafted TCP packets. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2023-20198 | A zero-day affecting Cisco IOS XE web UI that permits unauthenticated remote access to devices. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2023-20273 | A privilege escalation flaw also targeting IOS XE that allows hackers to execute commands as root. This flaw has been seen chained with CVE-2023-20198 to maintain persistence. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2024-3400 | A command injection vulnerability in Palo Alto Networks' PAN-OS GlobalProtect, which allows unauthenticated attackers to execute commands on devices. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2021-20038 | A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2024-38475 | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2021-20035 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2021-20039 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. | VULNEREBILITY | VULNEREBILITY |
| 20.7.25 | CVE-2025-32819 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. | VULNEREBILITY | VULNEREBILITY |
|
18.7.25 |
CVE-2025-7029 | bug in an SMI handler (OverClockSmiHandler) that can lead to SMM privilege escalation | VULNEREBILITY | VULNEREBILITY |
|
18.7.25 |
CVE-2025-7028 | bug in an SMI handler (SmiFlash) gives read/write access to the System Management RAM (SMRAM), which can lead to malware installation | VULNEREBILITY | VULNEREBILITY |
|
18.7.25 |
CVE-2025-7027 | can lead to SMM privilege escalation and modifying the firmware by writing arbitrary content to SMRAM | VULNEREBILITY | VULNEREBILITY |
|
18.7.25 |
CVE-2025-7026 | allows arbitrary writes to SMRAM and can lead to privilege escalation to SMM and persistent firmware compromise | VULNEREBILITY | VULNEREBILITY |
| 17.7.25 | CVE-2025-20337 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. | VULNEREBILITY | VULNEREBILITY |
| 17.7.25 | CVE-2025-20281 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root | VULNEREBILITY | VULNEREBILITY |
| 17.7.25 | CVE-2025-6558 | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | VULNEREBILITY | VULNEREBILITY |
| 17.7.25 | CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. | VULNEREBILITY | VULNEREBILITY |
| 13.7.25 | Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability | VULNEREBILITY | VULNEREBILITY | |
| 12.7.25 | CVE-2025-5959 | (high-severity, 8.8 score) – type confusion bug in the V8 JavaScript and WebAssembly engine allows remote code execution inside a sandbox via a crafted HTML page | VULNEREBILITY | VULNEREBILITY |
| 12.7.25 | CVE-2025-6554 | (high-severity, 8.1 score) – type confusion in V8 enables attackers to perform arbitrary memory read/write through a malicious HTML page | VULNEREBILITY | VULNEREBILITY |
| 12.7.25 | CVE-2025-6191 | (high-severity, 8.8 score) – integer overflow in V8 allows out-of-bounds memory access, potentially leading to code execution | VULNEREBILITY | VULNEREBILITY |
| 12.7.25 | CVE-2025-6192 | (high-severity, 8.8 score) – use-after-free vulnerability in Chrome's Metrics component could cause heap corruption exploitable via crafted HTML | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2025-25257 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2024-45434 | Use-After-Free in AVRCP service | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2024-45431 | Improper validation of an L2CAP channel's remote CID | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2024-45433 | Incorrect function termination in RFCOMM | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2024-45432 | Function call with incorrect parameter in RFCOMM | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2025-47812 | In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2025-5777 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | VULNEREBILITY | VULNEREBILITY |
| 11.7.25 | CVE-2025-6514 | Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients | VULNEREBILITY | VULNEREBILITY |
| 10.7.25 | CVE-2024-36349 | (CVSS score: 3.8) - A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage | VULNEREBILITY | VULNEREBILITY |
| 10.7.25 | CVE-2024-36348 | (CVSS score: 3.8) - A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP[3] feature is enabled, potentially resulting in information leakage | VULNEREBILITY | VULNEREBILITY |
| 10.7.25 | CVE-2024-36357 | (CVSS score: 5.6) - A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries | VULNEREBILITY | VULNEREBILITY |
| 10.7.25 | CVE-2024-36350 | (CVSS score: 5.6) - A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information | VULNEREBILITY | VULNEREBILITY |
| 10.7.25 | CVE-2025-3648 | CVE-2025-3648 - Data Inference in Now Platform via Conditional ACLs | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2024-12856 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2024-3721 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2019-9621 | (CVSS score: 7.5) - A Server-Side Request Forgery (SSRF) vulnerability in the Zimbra Collaboration Suite that could result in unauthorized access to internal resources and remote code execution | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2019-5418 | (CVSS score: 7.5) - A path traversal vulnerability in Ruby on Rails' Action View that could cause contents of arbitrary files on the target system's file system to be exposed | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2016-10033 | (CVSS score: 9.8) - A command injection vulnerability in PHPMailer that could allow an attacker to execute arbitrary code within the context of the application or result in a denial-of-service (DoS) condition | VULNEREBILITY | VULNEREBILITY |
| 8.7.25 | CVE-2014-3931 | (CVSS score: 9.8) - A buffer overflow vulnerability in Multi-Router Looking Glass (MRLG) that could allow remote attackers to cause an arbitrary memory write and memory corruption | VULNEREBILITY | VULNEREBILITY |
| 5.7.25 | CVE-2025-32462 | (CVSS score: 2.8) - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines | VULNEREBILITY | VULNEREBILITY |
| 5.7.25 | CVE-2025-32463 | (CVSS score: 9.3) - Sudo before 1.9.17p1 allows local users to obtain root access because "/etc/nsswitch.conf" from a user-controlled directory is used with the --chroot option | VULNEREBILITY | VULNEREBILITY |
| 3.7.25 | CVE-2025-20309 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. | VULNEREBILITY | VULNEREBILITY |
| 2.7.25 | CVE-2025-49596 | The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio | VULNEREBILITY | VULNEREBILITY |
| 1.7.25 | CVE-2025-6554 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) | VULNEREBILITY | VULNEREBILITY |
| 30.6.25 | CVE-2025-20702 | CVE-2025-20702 is a critical vulnerability with a CVSS score of 9.6/10, though its risk level is disputed between Airoha and the discoverer. | VULNEREBILITY | VULNEREBILITY |
| 30.6.25 | CVE-2025-20701 | CVE-2025-20701 is a high-risk vulnerability with a CVSS score of 8.8/10, characterized by missing authentication, which could allow unauthorized access. | VULNEREBILITY | VULNEREBILITY |
| 30.6.25 | CVE-2025-20700 | CVE-2025-20700 is a high-risk vulnerability with a CVSS score of 8.8/10, characterized by missing authentication, which could allow unauthorized access. | VULNEREBILITY | VULNEREBILITY |
| 29.6.25 | CVE-2024-51978 | An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request. | VULNEREBILITY | VULNEREBILITY |
| 29.6.25 | CVE-2024-51977 | An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. | VULNEREBILITY | VULNEREBILITY |
| 29.6.25 | CVE-2024-51979 | An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631). | VULNEREBILITY | VULNEREBILITY |
| 29.6.25 | CVE-2024-51984 | An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If an existing password is present for an external service, the attacker can force the target device to authenticate to an attacker controlled device using the existing credentials for that external service. | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-20282 | An unauthenticated remote code execution vulnerability affecting Cisco ISE and ISE-PIC release 3.4 that could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and execute those files on the underlying operating system as root | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-20281 | An unauthenticated remote code execution vulnerability affecting Cisco ISE and ISE-PIC releases 3.3 and later that could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2024-54085 | (CVSS score: 10.0) - An authentication bypass by spoofing vulnerability in the Redfish Host Interface of AMI MegaRAC SPx that could allow a remote attacker to take control | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2024-0769 | (CVSS score: 5.3) - A path traversal vulnerability in D-Link DIR-859 routers that allows for privilege escalation and unauthorized control (Unpatched) | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2019-6693 | (CVSS score: 4.2) - A hard-coded cryptographic key vulnerability in FortiOS, FortiManager and FortiAnalyzer that's used to encrypt password data in CLI configuration, potentially allowing an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-6543 | A vulnerability has been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Refer below for further details. | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-5777 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-0056 | SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victims user directory on the Operating System level would be able to read this data. | VULNEREBILITY | VULNEREBILITY |
| 26.6.25 | CVE-2025-0055 | SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victims user directory on the Operating System level would be able to read this data. | VULNEREBILITY | VULNEREBILITY |
| 24.6.25 | CVE-2023-20198 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. | VULNEREBILITY | VULNEREBILITY |
| 23.6.25 | CVE-2025-4322 | The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. | VULNEREBILITY | VULNEREBILITY |
| 22.6.25 | CVE-2023-0386 | Linux Kernel Improper Ownership Management Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 22.6.25 | CVE-2025-5309 | The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 21.6.25 | CVE-2025-3464 | A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. | VULNEREBILITY | VULNEREBILITY |
| 20.6.25 | CVE-2025-6018 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). | VULNEREBILITY | VULNEREBILITY |
| 20.6.25 | CVE-2025-6019 | A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. | VULNEREBILITY | VULNEREBILITY |
| 18.6.25 | CVE-2023-0386 | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. | VULNEREBILITY | VULNEREBILITY |
| 18.6.25 | CVE-2025-23121 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. | VULNEREBILITY | VULNEREBILITY |
| 18.6.25 | CVE-2025-2783 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) | VULNEREBILITY | VULNEREBILITY |
| 18.6.25 | CVE-2025-3248 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. | VULNEREBILITY | VULNEREBILITY |
| 18.6.25 | CVE-2023-33538 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm . | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49220 | A pre-auth RCE in Apex Central in the ConvertFromJson method. Improper input validation during deserialization lets attackers execute arbitrary code remotely without authentication. (CVSS 9.8) | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49219 | A pre-authentication RCE flaw in the GetReportDetailView method of Apex Central caused by insecure deserialization. Exploiting this allows unauthenticated attackers to execute code in the context of NETWORK SERVICE. (CVSS 9.8) | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49217 | A pre-authentication RCE vulnerability in the ValidateToken method, triggered by unsafe deserialization. While slightly harder to exploit, it still allows unauthenticated attackers to run code as SYSTEM | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49216 | An authentication bypass flaw in the DbAppDomain service due to a broken auth implementation. Remote attackers can fully bypass login and perform admin-level actions without credentials | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49213 | A pre-authentication remote code execution vulnerability in the PolicyServerWindowsService class, stemming from deserialization of untrusted data. Attackers can run arbitrary code as SYSTEM with no authentication required | VULNEREBILITY | VULNEREBILITY |
| 15.6.25 | CVE-2025-49212 | A pre-authentication remote code execution flaw caused by insecure deserialization in the PolicyValueTableSerializationBinder class. Remote attackers can exploit it to execute arbitrary code as SYSTEM without requiring login | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-33073 | Windows SMB Client Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-33053 | External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network. | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | DanaBleed | DanaBleed: DanaBot C2 Server Memory Leak Bug | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-3052 | CVE-2025-3052 InsydeH2O Secure Boot Bypass | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-24054 | NTLM Hash Disclosure Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-22455 | A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-5353 | A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2025-49113 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. | VULNEREBILITY | VULNEREBILITY |
| 14.6.25 | CVE-2024-3721 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. | VULNEREBILITY | VULNEREBILITY |
| 13.6.25 | CVE-2024-57727 | SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. | VULNEREBILITY | VULNEREBILITY |
| 13.6.25 | CVE-2025-43200 | iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1. | VULNEREBILITY | VULNEREBILITY |
| 13.6.25 | CVE-2025-32711 | M365 Copilot Information Disclosure Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 11.6.25 | SinoTrack GPS Receiver | Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface. | VULNEREBILITY | VULNEREBILITY |
| 11.6.25 | Microsft June 2025 Security Updates | This release consists of the following 68 Microsoft CVEs: | VULNEREBILITY | VULNEREBILITY |
| 11.6.25 | Adobe Security Bulletin June | Security updates available for Adobe Experience Manager | VULNEREBILITY | VULNEREBILITY |
| 10.6.25 | CVE-2025-32433 | (CVSS score: 10.0) - A missing authentication for a critical function vulnerability in the Erlang/OTP SSH server that could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution. |
VULNEREBILITY |
|
| 10.6.25 | CVE-2024-42009 | (CVSS score: 9.3) - A cross-site scripting (XSS) vulnerability in RoundCube Webmail that could allow a remote attacker to steal and send emails of a victim via a crafted email message by taking advantage of a desanitization issue in program/actions/mail/show.php. |
VULNEREBILITY |
|
| 10.6.25 | CVE-2025-24016 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). |
VULNEREBILITY |
|
| 8.6.25 | CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. |
VULNEREBILITY |
|
| 8.6.25 | CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. |
VULNEREBILITY |
|
| 5.6.25 | CVE-2025-20286 | A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. |
VULNEREBILITY |
|
| 4.6.25 | CVE-2025-37093 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2025-49113 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2025-5419 | Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
VULNEREBILITY |
|
| 3.6.25 | CVE-2024-13917 | (CVSS score: 8.3) - A pre-installed "com.pri.applock" application on Kruger&Matz smartphones exposed an "com.pri.applock.LockUI" activity that allows any other malicious application, with no granted Android system permissions, to inject an arbitrary intent with system-level privileges to a protected application. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2024-13916 | (CVSS score: 6.9) - A pre-installed "com.pri.applock" application on Kruger&Matz smartphones allows a user to encrypt any application using user-provided PIN code or by using biometric data. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2024-13915 | (CVSS score: 6.9) - A pre-installed "com.pri.factorytest" application on Ulefone and Krüger&Matz smartphones exposes a "com.pri.factorytest.emmc.FactoryResetService" service that allows any installed application to perform a factory reset of the device. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2025-27038 | Memory corruption while rendering graphics using Adreno GPU drivers in Chrome. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2025-21480 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
VULNEREBILITY |
|
| 3.6.25 | CVE-2025-21479 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
VULNEREBILITY |
|
| 1.6.25 | CVE-2023-39780 | On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. |
VULNEREBILITY |
|
| 1.6.25 | CVE-2025-5054 | (CVSS score: 4.7) - A race condition in Canonical apport package up to and including 2.32.0 that allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces |
VULNEREBILITY |
|
| 1.6.25 | CVE-2025-4598 | (CVSS score: 4.7) - A race condition in systemd-coredump that allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process |
VULNEREBILITY |
|
| 30.5.25 | CVE-2025-3935 | ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. |
VULNEREBILITY |
|
| 29.5.25 | CVE-2025-47577 | Unrestricted Upload of File with Dangerous Type vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through 2.9.2. |
VULNEREBILITY |
|
| 28.5.25 | CVE-2024-58136 | (CVSS score: 9.0) - An improper protection of alternate path flaw in the Yii PHP framework used by Craft CMS that could be exploited to access restricted functionality or resources (A regression of CVE-2024-4990) |
VULNEREBILITY |
|
| 28.5.25 | CVE-2025-32432 | (CVSS score: 10.0) - A remote code execution (RCE) vulnerability in Craft CMS (Patched in versions 3.9.15, 4.14.15, and 5.6.17) |
VULNEREBILITY |
|
| 28.5.25 | CVE-2025-32432 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. |
VULNEREBILITY |
|
| 25.5.25 | CVE-2020-12641 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. |
VULNEREBILITY |
|
| 25.5.25 | CVE-2020-35730 | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php. |
VULNEREBILITY |
|
| 25.5.25 | CVE-2021-44026 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. |
VULNEREBILITY |
|
| 25.5.25 | CVE-2023-38831 | Exploiting WinRAR vulnerability |
VULNEREBILITY |
|
| 25.5.25 | CVE-2023-23397 | Exploiting the Outlook NTLM vulnerability |
VULNEREBILITY |
|
| 25.5.25 | CVE-2025-47949 | samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue. |
VULNEREBILITY |
|
| 25.5.25 | CVE-2025-4322 | The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. |
VULNEREBILITY |
|
| 23.5.25 | CVE-2023-20118 | A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. |
VULNEREBILITY |
|
| 23.5.25 | CVE-2025-3928 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells. |
VULNEREBILITY |
|
| 22.5.25 | CVE-2025-0994 | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server. |
VULNEREBILITY |
|
| 22.5.25 | CVE-2025-4428 | Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. |
VULNEREBILITY |
|
| 22.5.25 | BadSuccessor | BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory |
VULNEREBILITY |
|
| 22.5.25 | CVE-2025-34027 | (CVSS score: 10.0) - An authentication bypass vulnerability in the Traefik reverse proxy configuration that allows an attacker to access administrative endpoints, which could then be exploited to achieve remote code execution by exploiting an endpoint related to package uploads ("/portalapi/v1/package/spack/upload") via arbitrary file writes |
VULNEREBILITY |
|
| 22.5.25 | CVE-2025-34026 | (CVSS score: 9.2) - An authentication bypass vulnerability in the Traefik reverse proxy configuration that allows an attacker to access administrative endpoints, which could then be exploited to access heap dumps and trace logs by exploiting an internal Spring Boot Actuator endpoint via |
VULNEREBILITY |
|
| 22.5.25 | CVE-2025-34025 | (CVSS score: 8.6) - A privilege escalation and Docker container escape vulnerability that's caused by unsafe default mounting of host binary paths and could be exploited to gain code execution on the underlying host machine |
VULNEREBILITY |
|
| 20.5.25 | CVE-2025-4918 | An out-of-bounds access vulnerability when resolving Promise objects that could allow an attacker to perform read or write on a JavaScript Promise object |
VULNEREBILITY |
|
| 20.5.25 | CVE-2025-4919 | An out-of-bounds access vulnerability when optimizing linear sums that could allow an attacker to perform read or write on a JavaScript object by confusing array index sizes |
VULNEREBILITY |
|
| 18.5.25 | CVE-2025-4664 | Google Chromium Loader Insufficient Policy Enforcement Vulnerability |
VULNEREBILITY |
|
| 18.5.25 | CVE-2024-12987 | DrayTek Vigor Routers OS Command Injection Vulnerability |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-32756 | Stack-based buffer overflow vulnerability in API |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-22462 | An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system. |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-3462 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. |
VULNEREBILITY |
|
| 17.5.25 | CVE-2025-3463 | vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests |
VULNEREBILITY |
|
| 16.5.25 | CVE-2024-43420 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Atom® processors may allow an authenticated user to potentially enable information disclosure via local access. |
VULNEREBILITY |
|
| 16.5.25 | CVE-2025-20623 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel® Core™ processors (10th Generation) may allow an authenticated user to potentially enable information disclosure via local access. |
VULNEREBILITY |
|
| 16.5.25 | CVE-2024-45332 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
VULNEREBILITY |
|
| 16.5.25 | CVE-2024-28956 | (CVSS v4 score: 5.7) - Indirect Target Selection (ITS), which affects Intel Core 9th-11th, and Intel Xeon 2nd-3rd, among others. |
VULNEREBILITY |
|
| 16.5.25 | CVE-2025-24495 | (CVSS v4 score: 6.8) - Lion Cove BPU issue, which affects Intel CPUs with Lion Cove core |
VULNEREBILITY |
|
| 15.5.25 | CVE-2025-4664 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
VULNEREBILITY |
|
| 15.5.25 | CVE-2025-4632 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority. |
VULNEREBILITY |
|
| 15.5.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-30397 | (CVSS score: 7.5) - Scripting Engine Memory Corruption Vulnerability |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-30400 | (CVSS score: 7.8) - Microsoft Desktop Window Manager (DWM) Core Library Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-32701 | (CVSS score: 7.8) - Windows Common Log File System (CLFS) Driver Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-32706 | (CVSS score: 7.8) - Windows Common Log File System Driver Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-32709 | (CVSS score: 7.8) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-32756 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-4428 | (CVSS score: 7.2) - A remote code execution vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to execute arbitrary code on the target system |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-4427 | (CVSS score: 5.3) - An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials |
VULNEREBILITY |
|
| 14.5.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. |
VULNEREBILITY |
|
| 13.5.25 | CVE-2025-27920 | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. |
VULNEREBILITY |
|
| 13.5.25 | CVE-2025-3462 | (CVSS score: 8.4) - An origin validation error vulnerability that may allow unauthorized sources to interact with the software's features via crafted HTTP requests |
VULNEREBILITY |
|
| 13.5.25 | CVE-2025-3463 | (CVSS score: 9.4) - An improper certificate validation vulnerability that may allow untrusted sources to affect system behavior via crafted HTTP requests |
VULNEREBILITY |
|
| 12.5.25 | CVE-2025-27007 | Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82. |
VULNEREBILITY |
|
| 12.5.25 | CVE-2025-29824 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 12.5.25 | CVE-2019-3568 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. |
VULNEREBILITY |
|
| 12.5.25 | CVE-2025-26647 | Windows Kerberos Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 12.5.25 | CVE-2025-30065 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. |
VULNEREBILITY |
|
| 12.5.25 | CVE-2024-7399 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. |
VULNEREBILITY |
|
| 12.5.25 | CVE-2025-3248 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. |
VULNEREBILITY |
|
| 9.5.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. |
VULNEREBILITY |
|
| 8.5.25 | CVE-2025-27363 | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. |
VULNEREBILITY |
|
| 8.5.25 | CVE-2025-32819 | (CVSS score: 8.8) - A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. |
VULNEREBILITY |
|
| 8.5.25 | CVE-2025-32820 | (CVSS score: 8.3) - A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable |
VULNEREBILITY |
|
| 8.5.25 | CVE-2025-32821 | (CVSS score: 6.7) - A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-29824 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-3102 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-27007 | Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-2777 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-2776 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2025-2775 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2019-3568 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2024-11120 | Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports. |
VULNEREBILITY |
|
| 7.5.25 | CVE-2024-6047 | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. |
VULNEREBILITY |
|
| 6.5.25 | CVE-2025-27363 | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. |
VULNEREBILITY |
|
| 6.5.25 | CVE-2025-3248 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. |
VULNEREBILITY |
|
| 6.5.25 | CVE-2025-34028 | Commvault Command Center Path Traversal Vulnerability |
VULNEREBILITY |
|
| 6.5.25 | CVE-2024-58136 | Yiiframework Yii Improper Protection of Alternate Path Vulnerability |
VULNEREBILITY |
|
| 6.5.25 | CVE-2025-23242 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, or information disclosure. |
VULNEREBILITY |
|
| 4.5.25 | CVE-2025-23243 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service. |
VULNEREBILITY |
|
| 4.5.25 | CVE-2025-31191 | Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape |
VULNEREBILITY |
|
|
4.5.25 |
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. |
VULNEREBILITY |
||
|
4.5.25 |
Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. |
VULNEREBILITY |
||
| 4.5.25 | CVE-2025-3928 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells. |
VULNEREBILITY |
|
| 3.5.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. |
VULNEREBILITY |
|
| 1.5.25 | CVE-2025-3928 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells. |
VULNEREBILITY |
|
| 1.5.25 | CVE-2023-44221 | (CVSS score: 7.2) - Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability |
VULNEREBILITY |
|
| 1.5.25 | CVE-2024-38475 | (CVSS score: 9.8) - Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to file system locations that are permitted to be served by the server |
VULNEREBILITY |
|
| 29.4.25 | CVE-2025-3928 | (CVSS score: 8.7) - An unspecified flaw in the Commvault Web Server that allows a remote, authenticated attacker to create and execute web shells |
VULNEREBILITY |
|
| 29.4.25 | CVE-2025-1976 | (CVSS score: 8.6) - A code injection flaw affecting Broadcom Brocade Fabric OS that allows a local user with administrative privileges to execute arbitrary code with full root privileges |
VULNEREBILITY |
|
| 29.4.25 | CVE-2025-32432 | (CVSS score: 10.0) - A remote code execution (RCE) vulnerability in Craft CMS (Patched in versions 3.9.15, 4.14.15, and 5.6.17) |
VULNEREBILITY |
|
| 29.4.25 | CVE-2024-58136 | (CVSS score: 9.0) - An improper protection of alternate path flaw in the Yii PHP framework used by Craft CMS that could be exploited to access restricted functionality or resources |
VULNEREBILITY |
|
| 27.4.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. |
VULNEREBILITY |
|
| 27.4.25 | CVE-2025-32432 | A remote code execution (RCE) vulnerability in Craft CMS. |
VULNEREBILITY |
|
| 27.4.25 | CVE-2024-58136 | An input validation flaw in the Yii framework used by Craft CMS. |
VULNEREBILITY |
|
| 26.4.25 | CVE-2024-54084 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution. |
VULNEREBILITY |
|
| 26.4.25 | CVE-2024-54085 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-42599 | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. |
VULNEREBILITY |
|
| 25.4.25 | CVE-2017-9844 | SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-27610 | (CVSS score: 7.5) - A path traversal vulnerability that could be used to gain access to all files under the specified root: directory, assuming an attacker can determine the paths to those files |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-27111 | (CVSS score: 6.9) - An improper neutralization of carriage return line feeds (CRLF) sequences and improper output neutralization for logs vulnerability that could be used to manipulate log entries and distort log files |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-25184 | (CVSS score: 5.7) - An improper neutralization of carriage return line feeds (CRLF) sequences and improper output neutralization for logs vulnerability that could be used to manipulate log entries and inject malicious data |
VULNEREBILITY |
|
| 25.4.25 | CVE-2025-0282 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. |
VULNEREBILITY |
|
| 24.4.25 | CVE-2025-34028 | A critical security vulnerability has been identified in the Command Center installation, allowing remote attackers to execute arbitrary code without authentication. |
VULNEREBILITY |
|
|
21.4.25 |
CVE-2021-20035 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS. |
VULNEREBILITY |
|
| 21.4.25 | CVE-2025-24054 | NTLM Hash Disclosure Spoofing Vulnerability |
VULNEREBILITY |
|
|
21.4.25 |
CVE-2025-20150 | Cisco Nexus Dashboard LDAP Username Enumeration Vulnerability |
VULNEREBILITY |
|
| 21.4.25 | CVE-2025-20178 | Cisco Secure Network Analytics Privilege Escalation Vulnerability |
VULNEREBILITY |
|
| 19.4.25 | CVE-2025-2492 | An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information. |
VULNEREBILITY |
|
| 18.4.25 | CVE-2025-24054 | NTLM Hash Disclosure Spoofing Vulnerability |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-32433 | Unauthenticated Remote Code Execution in Erlang/OTP SSH |
VULNEREBILITY |
|
| 17.4.25 | CVE-2021-20035 | SonicWall SMA100 Appliances OS Command Injection Vulnerability |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-24201 | (CVSS score: 7.1) - An out-of-bounds write issue in the WebKit component that could be exploited to break out of the Web Content sandbox using maliciously crafted web content |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-24200 | (CVSS score: 4.6) - An authorization issue in the Accessibility component that could enable an attacker to disable USB Restricted Mode on a locked device as part of a cyber-physical attack |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-24085 | (CVSS score: 7.8) - A use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate privileges |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-31201 | (CVSS score: 6.8) - A vulnerability in the RPAC component that could be used by an attacker with arbitrary read and write capability to bypass Pointer Authentication |
VULNEREBILITY |
|
| 17.4.25 | CVE-2025-31200 | (CVSS score: 7.5) - A memory corruption vulnerability in the Core Audio framework that could allow code execution when processing an audio stream in a maliciously crafted media file |
VULNEREBILITY |
|
| 17.4.25 | New Vulnerabilities for schtasks.exe | Task Scheduler– New Vulnerabilities for schtasks.exe |
VULNEREBILITY |
|
| 16.4.25 | CVE-2025-24859 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. |
VULNEREBILITY |
|
| 15.4.25 | CVE-2025-30406 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. |
VULNEREBILITY |
|
| 12.4.25 | CVE-2025-30401 | A spoofing issue in WhatsApp for Windows prior to version 2.2550.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. |
VULNEREBILITY |
|
| 12.4.25 | CVE-2024-21762 | A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests |
VULNEREBILITY |
|
| 12.4.25 | CVE-2023-27997 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. |
VULNEREBILITY |
|
| 12.4.25 | CVE-2022-42475 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. |
VULNEREBILITY |
|
| 11.4.25 | CVE-2025-3102 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. |
VULNEREBILITY |
|
| 10.4.25 | CVE-2024-0132 | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27491 | Windows Hyper-V Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-26686 | Windows TCP/IP Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27752 | Microsoft Excel Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27745 | Microsoft Office Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27748 | Microsoft Office Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27749 | Microsoft Office Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-29791 | Microsoft Excel Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-26670 | Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-26663 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27482 | Windows Remote Desktop Services Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-27480 | Windows Remote Desktop Services Remote Code Execution Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-29809 | Windows Kerberos Security Feature Bypass Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-29824 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-30406 | Gladinet CentreStack Use of Hard-coded Cryptographic Key Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-29824 | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability |
VULNEREBILITY |
|
| 9.4.25 | CVE-2025-29824 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
VULNEREBILITY |
|
| 9.4.25 | CVE-2024-48887 | Unverified password change via set_password endpoint |
VULNEREBILITY |
|
| 9.4.25 | AWS SSM Agent's Plugin ID Validation | Path Traversal Vulnerability in AWS SSM Agent's Plugin ID Validation |
VULNEREBILITY |
|
| 8.4.25 | CVE-2025-31161 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." |
VULNEREBILITY |
|
| 8.4.25 | CVE-2024-53150 | (CVSS score: 7.8) - An out-of-bounds flaw in the USB sub-component of Kernel that could result in information disclosure |
VULNEREBILITY |
|
| 8.4.25 | CVE-2024-53197 | (CVSS score: 7.8) - A privilege escalation flaw in the USB sub-component of Kernel |
VULNEREBILITY |
|
|
6.4.25 |
Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed. |
VULNEREBILITY |
||
|
6.4.25 |
(CVSS score: 7.8) - Microsoft Windows Mark-of-the-Web (MotW) Security Feature Bypass Vulnerability |
VULNEREBILITY |
||
|
6.4.25 |
(CVSS score: 6.5) - Microsoft Windows File Explorer Spoofing Vulnerability |
VULNEREBILITY |
||
| 5.4.25 | GRUB2 vulnerabilities | [SECURITY PATCH 00/73] GRUB2 vulnerabilities - 2025/02/18 |
VULNEREBILITY |
|
| 4.4.25 | CVE-2025-22457 | April Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-22457) |
VULNEREBILITY |
|
| 4.4.25 | CVE-2025-30065 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. |
VULNEREBILITY |
|
| 3.4.25 | CVE-2024-10668 | There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder. |
VULNEREBILITY |
|
| 3.4.25 | ImageRunner | ImageRunner: A Privilege Escalation Vulnerability Impacting GCP Cloud Run |
VULNEREBILITY |
|
|
1.4.25 |
(CVSS score: 7.3) - A use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate privileges |
VULNEREBILITY |
||
|
1.4.25 |
(CVSS score: 4.6) - An authorization issue in the Accessibility component that could make it possible for a malicious actor to disable USB Restricted Mode on a locked device as part of a cyber physical attack |
VULNEREBILITY |
||
|
1.4.25 |
(CVSS score: 8.8) - An out-of-bounds write issue in the WebKit component that could allow an attacker to craft malicious web content such that it can break out of the Web Content sandbox |
VULNEREBILITY |
||
|
31.3.25 |
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. |
VULNEREBILITY |
||
|
29.3.25 |
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access. |
VULNEREBILITY |
||
|
29.3.25 |
NTLM Hash Disclosure Spoofing Vulnerability |
VULNEREBILITY |
||
|
29.3.25 |
Windows Themes Spoofing Vulnerability |
VULNEREBILITY |
||
|
28.3.25 |
CVE-2025-2783 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) |
VULNEREBILITY |
|
|
28.3.25 |
CVE-2025-2857 | Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2020-8515 | (CVSS score: 9.8) — An operating system command injection vulnerability in multiple DrayTek router models that could allow remote code execution as root via shell metacharacters to the cgi-bin/mainfunction.cgi URI |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2021-20123 | (CVSS score: 7.5) — A local file inclusion vulnerability in DrayTek VigorConnect that could allow an unauthenticated attacker to download arbitrary files from the underlying operating system with root privileges via the DownloadFileServlet endpoint |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2021-20124 | (CVSS score: 7.5) — A local file inclusion vulnerability in DrayTek VigorConnect that could allow an unauthenticated attacker to download arbitrary files from the underlying operating system with root privileges via the WebServlet endpoint |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2019-9874 | (CVSS score: 9.8) - A deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2019-9875 | (CVSS score: 8.8) - A deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN |
VULNEREBILITY |
|
|
27.3.25 |
CVE-2025-26512 | CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter |
VULNEREBILITY |
|
|
26.3.25 |
CVE-2025-2663 | Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. |
VULNEREBILITY |
|
|
26.3.25 |
CVE-2025-26633 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
VULNEREBILITY |
|
|
26.3.25 |
CVE-2025-2783 | The Stable channel has been updated to 134.0.6998.177/.178 for Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. |
VULNEREBILITY |
|
|
26.3.25 |
CVE-2025-22230 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM. |
VULNEREBILITY |
|
|
25.3.25 |
CVE-2025-24513 | (CVSS score: 4.8) – An improper input validation vulnerability that could result in directory traversal within the container, leading to denial-of-service (DoS) or limited disclosure of secret objects from the cluster when combined with other vulnerabilities |
VULNEREBILITY |
|
|
25.3.25 |
CVE-2025-24514 | (CVSS score: 8.8) – The auth-url Ingress annotation can be used to inject configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller |
VULNEREBILITY |
|
|
25.3.25 |
CVE-2025-1097 | (CVSS score: 8.8) – The auth-tls-match-cn Ingress annotation can be used to inject configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller |
VULNEREBILITY |
|
|
25.3.25 |
CVE-2025-1098 | (CVSS score: 8.8) – The mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller |
VULNEREBILITY |
|
|
25.3.25 |
CVE-2025-1974 | (CVSS score: 9.8) – An unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller under certain conditions |
VULNEREBILITY |
|
|
24.3.25 |
CVE-2025-29927 | Next.js is a React framework for building full-stack web applications. Prior to 14.2.25 and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. |
VULNEREBILITY |
|
|
23.3.25 |
CVE-2024-48248 | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials). |
VULNEREBILITY |
|
|
23.3.25 |
CVE-2024-20439 | Cisco Smart Licensing Utility Static Credential Vulnerability |
VULNEREBILITY |
|
|
23.3.25 |
CVE-2024-20440 | Cisco Smart Licensing Utility Information Disclosure Vulnerability |
VULNEREBILITY |
|
|
23.3.25 |
CVE-2025-30154 | reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs |
VULNEREBILITY |
|
|
23.3.25 |
CVE-2025-30066 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.) |
VULNEREBILITY |
|
|
21.3.25 |
CVE-2024-20439 | (CVSS score: 9.8) - The presence of an undocumented static user credential for an administrative account that an attacker could exploit to log in to an affected system |
VULNEREBILITY |
|
|
21.3.25 |
CVE-2024-20440 | (CVSS score: 9.8) - A vulnerability arising due to an excessively verbose debug log file that an attacker could exploit to access such files by means of a crafted HTTP request and obtain credentials that can be used to access the API |
VULNEREBILITY |
|
|
21.3.25 |
CVE-2024-56347 | (CVSS score: 9.6) - An improper access control vulnerability that could permit a remote attacker to execute arbitrary commands via the AIX nimsh service SSL/TLS protection mechanism |
VULNEREBILITY |
|
|
21.3.25 |
CVE-2024-56346 | (CVSS score: 10.0) - An improper access control vulnerability that could permit a remote attacker to execute arbitrary commands via the AIX nimesis NIM master service |
VULNEREBILITY |
|
|
21.3.25 |
CVE-2025-23120 | A vulnerability allowing remote code execution (RCE) by authenticated domain users. |
VULNEREBILITY |
|
|
20.3.25 |
CVE-2025-1316 | (CVSS score: 9.3) - Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests (Unpatched due to the device reaching end-of-life) |
VULNEREBILITY |
|
|
20.3.25 |
CVE-2017-12637 | (CVSS score: 7.5) - SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string |
VULNEREBILITY |
|
|
20.3.25 |
CVE-2024-4577 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. |
VULNEREBILITY |
|
|
19.3.25 |
CVE-2025-20061 | An operating system command injection vulnerability that could permit an attacker to execute arbitrary commands on the affected system via specially crafted POST requests containing an email parameter |
VULNEREBILITY |
|
|
19.3.25 |
CVE-2025-20014 | An operating system command injection vulnerability that could permit an attacker to execute arbitrary commands on the affected system via specially crafted POST requests containing a version parameter |
VULNEREBILITY |
|
|
19.3.25 |
CVE-2025-30066 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.) |
VULNEREBILITY |
|
|
19.3.25 |
CVE-2024-54085 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. |
VULNEREBILITY |
|
|
18.3.25 |
CVE-2025-24813 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. |
VULNEREBILITY |
|
|
17.3.25 |
CVE-2025-1316 | Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device |
VULNEREBILITY |
|
|
17.3.25 |
CVE-2025-30066 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.) |
VULNEREBILITY |
|
|
16.3.25 |
CVE-2025-20115 | A vulnerability in confederation implementation for the Border Gateway Protocol (BGP) in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. |
VULNEREBILITY |
|
|
16.3.25 |
CVE-2025-21590 | An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. |
VULNEREBILITY |
|
| 13.3.25 | CVE-2025-25292 | Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) |
VULNEREBILITY |
|
| 13.3.25 | CVE-2025-25291 | Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) |
VULNEREBILITY |
|
| 13.3.25 | CVE-2025-27363 | n out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. |
VULNEREBILITY |
|
| 12.3.25 | CVE-2017-0929 | (CVSS score: 7.5) - DotNetNuke |
VULNEREBILITY |
|
| 12.3.25 | CVE-2020-7796 | (CVSS score: 9.8) - Zimbra Collaboration Suite |
VULNEREBILITY |
|
| 12.3.25 | CVE-2021-21973 | (CVSS score: 5.3) - VMware vCenter |
VULNEREBILITY |
|
| 12.3.25 | CVE-2021-22054 | (CVSS score: 7.5) - VMware Workspace ONE UEM |
VULNEREBILITY |
|
| 12.3.25 | CVE-2021-22175 | (CVSS score: 9.8) - GitLab CE/EE |
VULNEREBILITY |
|
| 12.3.25 | CVE-2021-22214 | CVSS score: 8.6) - GitLab CE/EE |
VULNEREBILITY |
|
| 12.3.25 | CVE-2021-39935 | (CVSS score: 7.5) - GitLab CE/EE |
VULNEREBILITY |
|
| 12.3.25 | CVE-2023-5830 | (CVSS score: 9.8) - ColumbiaSoft DocumentLocator |
VULNEREBILITY |
|
| 12.3.25 | CVE-2024-6587 | (CVSS score: 7.5) - BerriAI LiteLLM |
VULNEREBILITY |
|
| 12.3.25 | CVE-2024-21893 | (CVSS score: 8.2) - Ivanti Connect Secure |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-24983 | (CVSS score: 7.0) - A Windows Win32 Kernel Subsystem use-after-free (UAF) vulnerability that allows an authorized attacker to elevate privileges locally |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-24984 | (CVSS score: 4.6) - A Windows NTFS information disclosure vulnerability that allows an attacker with physical access to a target device and the ability to plug in a malicious USB drive to potentially read portions of heap memory |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-24985 |
(CVSS score: 7.8) - An integer overflow vulnerability in Windows Fast FAT File System Driver that allows an unauthorized attacker to execute code locally |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-24991 | (CVSS score: 5.5) - An out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker to disclose information locally |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-24993 | (CVSS score: 7.8) - A heap-based buffer overflow vulnerability in Windows NTFS that allows an unauthorized attacker to execute code locally |
VULNEREBILITY |
|
| 12.3.25 | CVE-2025-26633 | (CVSS score: 7.0) - An improper neutralization vulnerability in Microsoft Management Console that allows an unauthorized attacker to bypass a security feature locally |
VULNEREBILITY |
|
| 12.3.25 | Apple security releases | This document lists security updates and Rapid Security Responses for Apple software. | VULNEREBILITY | Update |
| 11.3.25 | CVE-2024-57968 | An unrestricted file upload vulnerability in Advantive VeraCore that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx |
VULNEREBILITY |
|
| 11.3.25 | CVE-2025-25181 | An SQL injection vulnerability in Advantive VeraCore that allows a remote attacker to execute arbitrary SQL commands |
VULNEREBILITY |
|
| 11.3.25 | CVE-2024-13159 | An absolute path traversal vulnerability in Ivanti EPM that allows a remote unauthenticated attacker to leak sensitive information |
VULNEREBILITY |
|
| 11.3.25 | CVE-2024-13160 | An absolute path traversal vulnerability in Ivanti EPM that allows a remote unauthenticated attacker to leak sensitive information |
VULNEREBILITY |
|
| 11.3.25 | CVE-2024-13161 | An absolute path traversal vulnerability in Ivanti EPM that allows a remote unauthenticated attacker to leak sensitive information |
VULNEREBILITY |
|
| 11.3.25 | CVE-2024-12297 | Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. |
VULNEREBILITY |
|
| 9.3.25 | CVE-2025-27840 | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). |
VULNEREBILITY |
|
| 9.3.25 | CVE-2025-1316 | Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device |
VULNEREBILITY |
|
| 7.3.25 | CVE-2024-4577 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions |
VULNEREBILITY |
|
| 7.3.25 | CVE-2025-25012 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role |
VULNEREBILITY |
|
| 5.3.25 | CVE-2025-22224 | (CVSS score: 9.3) - A Time-of-Check Time-of-Use (TOCTOU) vulnerability that leads to an out-of-bounds write, which a malicious actor with local administrative privileges on a virtual machine could exploit to execute code as the virtual machine's VMX process running on the host |
VULNEREBILITY |
|
| 5.3.25 | CVE-2025-22225 | (CVSS score: 8.2) - An arbitrary write vulnerability that a malicious actor with privileges within the VMX process could exploit to result in a sandbox escape |
VULNEREBILITY |
|
| 5.3.25 | CVE-2025-22226 | (CVSS score: 7.1) - An information disclosure vulnerability due to an out-of-bounds read in HGFS that a malicious actor with administrative privileges to a virtual machine could exploit to leak memory from the vmx process |
VULNEREBILITY |
|
| 4.3.25 | CVE-2023-20118 | (CVSS score: 6.5) - A command injection vulnerability in the web-based management interface of Cisco Small Business RV Series routers that allows an authenticated, remote attacker to gain root-level privileges and access unauthorized data (Unpatched due to the routers reaching end-of-life status) |
VULNEREBILITY |
|
| 4.3.25 | CVE-2022-43939 | (CVSS score: 8.6) - An authorization bypass vulnerability in Hitachi Vantara Pentaho BA Server that stems from the use of non-canonical URL paths for authorization decisions (Fixed in August 2024 with versions 9.3.0.2 and 9.4.0.1) |
VULNEREBILITY |
|
| 4.3.25 | CVE-2022-43769 | (CVSS score: 7.8) - An improper resource shutdown or release vulnerability in Microsoft Windows Win32k that allows for local, authenticated privilege escalation, and running arbitrary code in kernel mode (Fixed in December 2018) |
VULNEREBILITY |
|
| 4.3.25 | CVE-2018-8639 | (CVSS score: 7.8) - An improper resource shutdown or release vulnerability in Microsoft Windows Win32k that allows for local, authenticated privilege escalation, and running arbitrary code in kernel mode (Fixed in December 2018) |
VULNEREBILITY |
|
| 4.3.25 | CVE-2024-4885 | (CVSS score: 9.8) - A path traversal vulnerability in Progress WhatsUp Gold that allows an unauthenticated attacker to achieve remote code execution (Fixed in version 2023.1.3 in June 2024) |
VULNEREBILITY |
|
| 4.3.25 | CVE-2024-43093 | A privilege escalation flaw in the Framework component that could result in unauthorized access to "Android/data," "Android/obb," and "Android/sandbox" directories, and their respective sub-directories. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2024-50302 | A privilege escalation flaw in the HID USB component of the Linux kernel that could lead to a leak of uninitialized kernel memory to a local attacker through specially crafted HID reports. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2025-0285 | An arbitrary kernel memory mapping vulnerability in version 7.9.1 caused by a failure to validate user-supplied data lengths. Attackers can exploit this flaw to escalate privileges. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2025-0286 | An arbitrary kernel memory write vulnerability in version 7.9.1 due to improper validation of user-supplied data lengths. This flaw can allow attackers to execute arbitrary code on the victim's machine. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2025-0287 | A null pointer dereference vulnerability in version 7.9.1 caused by the absence of a valid MasterLrp structure in the input buffer. This allows an attacker to execute arbitrary kernel code, enabling privilege escalation. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2025-0288 |
An arbitrary kernel memory vulnerability in version 7.9.1 caused by the memmove function, which fails to sanitize user-controlled input. This allows an attacker to write arbitrary kernel memory and achieve privilege escalation. |
VULNEREBILITY |
|
| 4.3.25 | CVE-2025-0289 | An insecure kernel resource access vulnerability in version 17 caused by failure to validate the MappedSystemVa pointer before passing it to HalReturnToFirmware. This allows attackers to compromise the affected service. |
VULNEREBILITY |
|
| 1.3.25 | CVE-2024-53197 | (CVSS score: N/A) - An out-of-bounds access vulnerability for Extigy and Mbox devices |
VULNEREBILITY |
|
| 1.3.25 | CVE-2024-50302 | (CVSS score: 5.5) - A use of an uninitialized resource vulnerability that could be used to leak kernel memory |
VULNEREBILITY |
|
| 26.2.25 | CVE-2023-34192 | (CVSS score: 9.0) - A cross-site scripting (XSS) vulnerability in Synacor ZCS that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. (Fixed in July 2023 with version 8.8.15 Patch 40) |
VULNEREBILITY |
|
| 26.2.25 | CVE-2024-49035 | (CVSS score: 8.7) - An improper access control vulnerability in Microsoft Partner Center that allows an attacker to escalate privileges. (Fixed in November 2024) |
VULNEREBILITY |
|
| 22.2.25 | CVE-2025-26465 | (CVSS score: 6.8) - The OpenSSH client contains a logic error between versions 6.8p1 to 9.9p1 (inclusive) that makes it vulnerable to an active MitM attack if the VerifyHostKeyDNS option is enabled, allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it (Introduced in December 2014) | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2025-26465 | (CVSS score: 5.9) - The OpenSSH client and server are vulnerable to a pre-authentication DoS attack between versions 9.5p1 to 9.9p1 (inclusive) that causes memory and CPU consumption (Introduced in August 2023) | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2025-0108 | (CVSS score: 7.8) - An authentication bypass vulnerability in the Palo Alto Networks PAN-OS management web interface that allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2024-53704 | (CVSS score: 8.2) - An improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2018-0171 | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2024-24919 | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. | VULNEREBILITY | VULNEREBILITY |
| 22.2.25 | CVE-2025-23209 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. | VULNEREBILITY | VULNEREBILITY |
| 20.2.25 | CVE-2024-12284 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. | VULNEREBILITY | VULNEREBILITY |
| 20.2.25 | CVE-2025-21355 | (CVSS score: 8.6) - Microsoft Bing Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 20.2.25 | CVE-2025-24989 | (CVSS score: 8.2) - Microsoft Power Pages Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 18.2.25 | CVE-2025-21589 | CVE-2025-21589 | VULNEREBILITY | VULNEREBILITY |
| 18.2.25 | CVE-2024-12510 | (CVSS score: 6.7) - Pass-back attack via LDAP | VULNEREBILITY | VULNEREBILITY |
| 18.2.25 | CVE-2024-12511 | (CVSS score: 7.6) - Pass-back attack via user's address book | VULNEREBILITY | VULNEREBILITY |
| 15.2.25 | CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | VULNEREBILITY | VULNEREBILITY |
| 15.2.25 | CVE-2025-0108 | CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-23359 | NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-21391 | (CVSS score: 7.1) - Windows Storage Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-21418 | (CVSS score: 7.8) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-38657 | (CVSS score: 9.1) - External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-22467 | (CVSS score: 9.9) - A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-10644 | (CVSS score: 9.1) - Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-47908 | (CVSS score: 9.1) - Operating system command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-56131 | (CVSS scores: 8.4) - A set of improper input validation vulnerabilities that allows remote malicious actors who gain access to the management interface of LoadMaster and successfully authenticate to execute arbitrary system commands via a carefully crafted HTTP request | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-56132 | (CVSS scores: 8.4) - A set of improper input validation vulnerabilities that allows remote malicious actors who gain access to the management interface of LoadMaster and successfully authenticate to execute arbitrary system commands via a carefully crafted HTTP request | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-56133 | (CVSS scores: 8.4) - A set of improper input validation vulnerabilities that allows remote malicious actors who gain access to the management interface of LoadMaster and successfully authenticate to execute arbitrary system commands via a carefully crafted HTTP request | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-56135 | (CVSS scores: 8.4) - A set of improper input validation vulnerabilities that allows remote malicious actors who gain access to the management interface of LoadMaster and successfully authenticate to execute arbitrary system commands via a carefully crafted HTTP request | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-56134 | (CVSS score: 8.4) - An improper input validation vulnerability that allows remote malicious actors who gain access to the management interface of LoadMaster and successfully authenticate to download the content of any file on the system via a carefully crafted HTTP request | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-24200 | An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-25064 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2024-57968 | (CVSS score: 9.9) - An unrestricted upload of files with a dangerous type vulnerability that allows remote authenticated users to upload files to unintended folders (Fixed in VeraCore version 2024.4.2.1) | VULNEREBILITY | VULNEREBILITY |
| 10.2.25 | CVE-2025-25181 | (CVSS score: 5.8) - An SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands (No patch available) | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | Trimble Cityworks | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server. | VULNEREBILITY | ICS |
| 5.2.25 | CVE-2025-20124 | (CVSS score: 9.9) - An insecure Java deserialization vulnerability in an API of Cisco ISE that could permit an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-20125 | (CVSS score: 9.1) - An authorization bypass vulnerability in an API of Cisco ISE could could permit an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-23114 | A vulnerability within the Veeam Updater component that allows an attacker to utilize a Man-in-the-Middle attack to execute arbitrary code on the affected appliance server with root-level permissions. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-0411 | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-45195 | (CVSS score: 7.5/9.8) - A forced browsing vulnerability in Apache OFBiz that allows a remote attacker to obtain unauthorized access and execute arbitrary code on the server (Fixed in September 2024) | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-29059 | (CVSS score: 7.5) - An information disclosure vulnerability in Microsoft .NET Framework that could expose the ObjRef URI and lead to remote code execution (Fixed in March 2024) | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2018-9276 | (CVSS score: 7.2) - An operating system command injection vulnerability in Paessler PRTG Network Monitor that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console (Fixed in April 2018) | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2018-19410 | (CVSS score: 9.8) - A local file inclusion vulnerability in Paessler PRTG Network Monitor that allows a remote, unauthenticated attacker to create users with read-write privileges (Fixed in April 2018) | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-56161 | Loss of the SEV-based protection of a confidential guest. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-21396 | (CVSS score: 7.5) - Microsoft Account Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-21415 | (CVSS score: 9.9) - Azure AI Face Service Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-53104 | (CVSS score: 7.8), which has been described as a case of privilege escalation in a kernel component known as the USB Video Class (UVC) driver. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-0626 | Contec Health CMS8000 Patient Monitor sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-12248 | (CVSS v4 score: 9.3) - An out-of-bounds write vulnerability that could allow an attacker to send specially formatted UDP requests in order to write arbitrary data, resulting in remote code execution | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-0683 | (CVSS v4 score: 8.2) - A privacy leakage vulnerability that causes plain-text patient data to be transmitted to a hard-coded public IP address when the patient is attached to the monitor | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-0626 | Contec Health CMS8000 Patient Monitor sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device. | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2024-12248 | (CVSS v4 score: 9.3) - An out-of-bounds write vulnerability that could allow an attacker to send specially formatted UDP requests in order to write arbitrary data, resulting in remote code execution | VULNEREBILITY | VULNEREBILITY |
| 5.2.25 | CVE-2025-0683 | (CVSS v4 score: 8.2) - A privacy leakage vulnerability that causes plain-text patient data to be transmitted to a hard-coded public IP address when the patient is attached to the monitor | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2024-50050 | Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead. | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2025-22218 | (CVSS score: 8.5) - A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2025-22219 | (CVSS score: 6.8) - A malicious actor with non-administrative privileges may be able to inject a malicious script that may lead to arbitrary operations as admin user via a stored cross-site scripting (XSS) attack | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2025-22220 | (CVSS score: 4.3) - A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2025-22221 | (CVSS score: 5.2) - A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent Configuration | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2025-22222 | (CVSS score: 7.7) - A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 |
Noma Research discovers RCE vulnerability in AI |
Noma Research discovers RCE vulnerability in AI-development platform, Lightning AI | VULNEREBILITY | AI |
| 28.1.25 | CVE-2024-55417 | An arbitrary file write vulnerability in the "/admin/media/upload" endpoint | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2024-55416 | A reflected cross-site scripting (XSS) vulnerability in the "/admin/compass" endpoint | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2024-55415 | An arbitrary file leak and deletion vulnerability | VULNEREBILITY | VULNEREBILITY |
| 28.1.25 | CVE-2024-41710 | (CVSS score: 6.8), a case of command injection in the boot process that could allow a malicious actor to execute arbitrary commands within the context of the phone. | VULNEREBILITY | VULNEREBILITY |
| 27.1.25 | CVE-2025-23040 | (CVSS score: 6.6) - Maliciously crafted remote URLs could lead to credential leaks in GitHub Desktop | VULNEREBILITY | VULNEREBILITY |
| 27.1.25 | CVE-2024-50338 | (CVSS score: 7.4) - Carriage-return character in remote URL allows the malicious repository to leak credentials in Git Credential Manager | VULNEREBILITY | VULNEREBILITY |
| 27.1.25 | CVE-2024-53263 | (CVSS score: 8.5) - Git LFS permits retrieval of credentials via crafted HTTP URLs | VULNEREBILITY | VULNEREBILITY |
| 27.1.25 | CVE-2024-53858 | (CVSS score: 6.5) - Recursive repository cloning in GitHub CLI can leak authentication tokens to non-GitHub submodule hosts | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2025-22604 | Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2024-40891 | Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2024-40890 | (CVSS score: 8.8) - A post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2024-40891 | (CVSS score: 8.8) - A post-authentication command injection vulnerability in the management commands component that could allow an authenticated attacker to execute OS commands on an affected device via Telnet | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2025-0890 | (CVSS score: 9.8) - The use of insecure default credentials for the Telnet function that could allow an attacker to log in to the management interface | VULNEREBILITY | VULNEREBILITY |
| 25.1.25 | CVE-2025-24085 | A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2024-7344 | Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344 | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | NTLMv1 | If you think you blocked NTLMv1 in your org, think again | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | SAP Security Patch Day – January 2025 | This post shares information on Security Notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape. | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | Rsync contains six vulnerabilities | Rsync, a versatile file-synchronizing tool, contains six vulnerabilities present within versions 3.3.0 and below. | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21311 | (CVSS score: 9.8) - Windows NTLM V1 Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21307 | (CVSS score: 9.8) - Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21298 | (CVSS score: 9.8) - Windows Object Linking and Embedding (OLE) Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21295 | (CVSS score: 8.1) - SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21294 | (CVSS score: 8.1) - Microsoft Digest Authentication Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21308 | Windows Themes Spoofing Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21275 | Windows App Package Installer Elevation of Privilege Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21395 | Microsoft Access Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21366 | Microsoft Access Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2025-21186 | Microsoft Access Remote Code Execution Vulnerability | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2024-57726 | A privilege escalation vulnerability that allows an attacker who gains access as a low-privilege technician to elevate their privileges to an admin by taking advantage of missing backend authorization checks | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2024-57728 | An arbitrary file upload vulnerability that allows an attacker with SimpleHelpAdmin privileges (or as a technician with admin privileges) to upload arbitrary files anywhere on the SimpleServer host, potentially leading to remote code execution | VULNEREBILITY | VULNEREBILITY |
|
16.1.25 | CVE-2024-57727 | An unauthenticated path traversal vulnerability that allows an attacker to download arbitrary files from the SimpleHelp server, including the serverconfig.xml file that contains hashed passwords for the SimpleHelpAdmin account and other local technician accounts | VULNEREBILITY | VULNEREBILITY |
|
14.1.25 |
Millions of Accounts Vulnerable due to Google’s OAuth Flaw |
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable. | VULNEREBILITY | VULNEREBILITY |
|
14.1.25 | CVE-2024-55591 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. | VULNEREBILITY | VULNEREBILITY |
|
14.1.25 | CVE-2024-44243 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2. An app may be able to modify protected parts of the file system. | VULNEREBILITY | VULNEREBILITY |
|
14.1.25 | CVE-2024-12686 | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user. | VULNEREBILITY | VULNEREBILITY |
|
14.1.25 | CVE-2024-50603 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | (CVSS score: 2.3) - An operating system (OS) command injection vulnerability that enables an authenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software | VULNEREBILITY | VULNEREBILITY | |
|
10.1.25 | (CVSS score: 2.7) - A wildcard expansion vulnerability that allows an unauthenticated attacker to enumerate files on the host file system | VULNEREBILITY | VULNEREBILITY | |
|
10.1.25 | (CVSS score: 2.7) - An arbitrary file deletion vulnerability that enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host file system | VULNEREBILITY | VULNEREBILITY | |
|
10.1.25 | (CVSS score: 4.7) - A reflected cross-site scripting (XSS) vulnerability that enables attackers to execute malicious JavaScript code in the context of an authenticated user's browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to browser-session theft | VULNEREBILITY | VULNEREBILITY | |
|
10.1.25 | CVE-2025-0103 | (CVSS score: 7.8) - An SQL injection vulnerability that enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys, as well as create and read arbitrary files | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2024-49415 | Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2024-52875 | refers to a carriage return line feed (CRLF) injection attack, paving the way for HTTP response splitting, which could then lead to a cross-site scripting (XSS) flaw. | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2025-0283 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges. | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2025-0282 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | DNA Sequencer's Vulnerable BIOS | Genetic Engineering Meets Reverse Engineering: DNA Sequencer's Vulnerable BIOS | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2024-41713 | (CVSS score: 9.1) - A path traversal vulnerability in Mitel MiCollab that could allow an attacker to gain unauthorized and unauthenticated access | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2024-55550 | (CVSS score: 4.4) - A path traversal vulnerability in Mitel MiCollab that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization | VULNEREBILITY | VULNEREBILITY |
|
10.1.25 | CVE-2020-2883 | (CVSS score: 9.8) - A security vulnerability in Oracle WebLogic Server that could be exploited by an unauthenticated attacker with network access via IIOP or T3 | VULNEREBILITY | VULNEREBILITY |
|
2.1.25 | Microsoft 365 Vulnerability | Discovery to Resolution: A Critical Microsoft 365 Vulnerability | VULNEREBILITY | VULNEREBILITY |