Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,045 results · page 10 of 61
Dec 18, 2025Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious CVE-2023-53937 · Other software · Hubstaff · reported by VulnCheckHigh 8.5
Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup.
- Product
- Hubstaff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhubstaff.comexploit-db.com
Dec 18, 2025WP Gravity Forms HubSpot: Deserialization of Untrusted DataCVE-2025-60178 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025HealthHub: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58898 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes HealthHub healthhub allows PHP Local File Inclusion.This issue affects HealthHub: from n/a through <= 1.3.0.
- Product
- HealthHub
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update HealthHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows atCVE-2025-13352 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3
Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation tokenCVE-2025-68267 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025Hub Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68065 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.
- Product
- Hub Core
- Fixed in
- 6.0.2
- What to do
- Update Hub Core to 6.0.2 or newer.
Dec 14, 2025A vulnerability has been found in MartialBE one-hub up to 0.14.27.CVE-2025-14651 · Other software · MartialBE · reported by VulDBLow 2.9
A vulnerability has been found in MartialBE one-hub up to 0.14.27. This vulnerability affects unknown code of the file docker-compose.yml. The manipulation of the argument SESSION_SECRET leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The code maintainer recommends (translated from Chinese): "The default docker-compose example file is not recommended for production use. If you intend to use it in production, please carefully check and modify every configuration and environment variable yourself!"
- Product
- one-hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows.CVE-2025-67750 · Other software · Flow-Scanner · reported by GitHubHigh 8.4
Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machines, CI runners, or editor environments. This issue is fixed in version 6.10.6.
- Product
- lightning-flow-scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs thaCVE-2025-14046 · Other software · GitHub · reported by product-cna@github.comHigh 8.6
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 11, 2025In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataCVE-2025-67740 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive informatioCVE-2025-65297 · Other software · Aqara · reported by MITREHigh 7.5
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-serCVE-2025-65296 · Other software · Aqara · reported by MITREMedium 6.5
NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackersCVE-2025-65295 · Other software · Aqara · reported by MITREHigh 8.1
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestriCVE-2025-65294 · Other software · Aqara · reported by MITRECritical 9.8
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codeCVE-2025-65293 · Other software · Aqara · reported by MITREMedium 6.6
Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.
- Product
- Camera HUB G3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arCVE-2025-65292 · Other software · Aqara · reported by MITREHigh 7.3
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discoveryCVE-2025-65291 · Other software · Aqara · reported by MITREHigh 7.4
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloCVE-2025-65290 · Other software · Aqara · reported by MITREHigh 7.4
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation.CVE-2025-67506 · Other software · pipeshub-ai · reported by GitHubCritical 9.8
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
- Product
- pipeshub-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization.CVE-2025-13743 · Other software · Docker · reported by security@docker.comLow 2.4
Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensitive information in exported diagnostics, especially when access denied errors occurred.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths.CVE-2025-11531 · Other software · HP Inc · reported by hp-security-alert@hp.comMedium 4.8
HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0.
- Product
- HP System Event Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.CVE-2025-64671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
- Product
- GitHub Copilot Plugin for JetBrains IDEs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Rehub: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
- Product
- Rehub
- Affected
- up to 19.9.9.1
- What to do
- Affects up to 19.9.9.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025REHub Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.
- Product
- REHub Framework
- What to do
- Update REHub Framework to the newest version.
Dec 8, 2025A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the jobCVE-2025-14262 · Other software · KNIME · reported by security@knime.comMedium 5.3
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.CVE-2025-53704 · Other software · MAXHUB · reported by ics-cert@hq.dhs.govHigh 8.7
The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.
- Product
- Pivot client application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline cCVE-2025-65637 · Other software · Turbopuffer · reported by MITREHigh 7.5
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
- Product
- Logrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to accCVE-2025-13510 · Other software · Iskra · reported by ics-cert@hq.dhs.govCritical 9.3
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
- Product
- iHUB and iHUB Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.CVE-2025-64772 · Other software · Sony Corporation · reported by vultures@jpcert.or.jpHigh 8.4
The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
- Product
- INZONE Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025AIS-catcher is a multi-platform AIS receiver.CVE-2025-66217 · Other software · jvde-github · reported by GitHubHigh 8.8
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.
- Product
- AIS-catcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025AIS-catcher is a multi-platform AIS receiver.CVE-2025-66216 · Other software · jvde-github · reported by GitHubCritical 9.3
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been patched in version 0.64.
- Product
- AIS-catcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaCVE-2025-65276 · Other software · Henzljw · reported by MITRECritical 9.8
An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.
- Product
- Hashtech
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 25, 2025Files is a module for managing files inside spaces and user profiles.CVE-2025-65963 · Other software · humhub · reported by GitHubMedium 5.4
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
- Product
- cfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.CVE-2025-64660 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.CVE-2025-61138 · Other software · Qlik · reported by MITREHigh 7.5
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
- Product
- Qlik Sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567.CVE-2025-13433 · Other software · Muse Group · reported by VulDBHigh 7.3
A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. The attack is only possible with local access. A high complexity level is associated with this attack. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MuseHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.CVE-2025-63878 · Other software · Hackerwhale · reported by MITREMedium 6.5
Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.
- Product
- Restaurant Website Restoran
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Nov 19, 2025A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8.CVE-2025-13395 · Other software · codehub666 · reported by VulDBMedium 5.5
A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file /function.php. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- 94list
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability.CVE-2025-54321 · Other software · Ascertia · reported by MITRECritical 9.8
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comascertia.com
Nov 18, 2025In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability.CVE-2025-54320 · Other software · Ascertia · reported by MITREMedium 4.3
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comascertia.com
Nov 11, 2025Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2025-62453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025GitHub Gist Shortcode: Stored Cross-Site ScriptingCVE-2025-12667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GitHub Gist Shortcode
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update GitHub Gist Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 10, 2025An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label CVE-2025-11892 · Other software · GitHub · reported by product-cna@github.comHigh 8.6
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a user, while operating in sudo mode, to click on a crafted malicious link to perform actions that require elevated privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.1, 3.17.7, 3.16.10, 3.15.14, 3.14.19.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Nov 10, 2025A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the apCVE-2025-11578 · Other software · GitHub · reported by product-cna@github.comHigh 7.5
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Nov 10, 2025In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users APICVE-2025-64683 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limitCVE-2025-64682 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitationsCVE-2025-64681 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025HumHub is an Open Source Enterprise Social Network.CVE-2025-64442 · Other software · humhub · reported by GitHubHigh 7.1
HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025MeetingHub: Insertion of Sensitive Information Into Sent DataCVE-2025-62038 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects MeetingHub: from n/a through <= 1.23.9.
- Product
- MeetingHub
- Affected
- up to 1.23.9
- What to do
- Affects up to 1.23.9. Update MeetingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Hubbub Lite – Fast, free social sharing and follow buttons: Reflected Cross-Site ScriptingCVE-2025-12471 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attention_search' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Hubbub Lite – Fast, free social sharing and follow buttons
- Affected
- up to 1.36.0
- What to do
- Affects up to 1.36.0. Update Hubbub Lite – Fast, free social sharing and follow buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.