Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,721 results · page 14 of 55
Sep 16, 2025A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections.CVE-2025-37124 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.6
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate priviCVE-2025-37123 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2025-47967 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42914 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP HCM (My Timesheet Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42913 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP HCM (My Timesheet Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-53791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and executeCVE-2025-7388 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.4
It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property with inadequate input validation leading to OS command injection.
- Product
- OpenEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Aug 29, 2025gnark is a zero-knowledge proof system framework.CVE-2025-58157 · Other software · Consensys · reported by GitHubHigh 7.5
gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.
- Product
- gnark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025gnark is a zero-knowledge proof system framework.CVE-2025-57801 · Other software · Consensys · reported by GitHubHigh 8.6
gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from R and S, this enables signature malleability and may allow double spending. This issue has been addressed in version 0.14.0.
- Product
- gnark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch aCVE-2025-48978 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network. Affected Products: EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) Mitigation: Update the EdgeMAX EdgeSwitch to Version 1.11.1 or later.
- Product
- EdgeMAX EdgeSwitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF).CVE-2025-1142 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Edge Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permissCVE-2025-1139 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment.
- Product
- Edge Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Edge CPT: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49889 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT edge-cpt allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through <= 1.4.
- Product
- Edge CPT
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Edge CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2025The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin forCVE-2025-7499 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_response function in all versions up to and including 4.1.1. This makes it possible for unauthenticated attackers to retrieve passwords for password-protected documents as well as the metadata of private and draft documents.
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability.CVE-2025-36581 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- PowerEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the lCVE-2025-48500 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2025-49755 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2025-49736 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via CVE-2025-32004 · Other software · reported by secure@intel.comLow 1.8
Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may aCVE-2025-27707 · Other software · reported by secure@intel.comLow 2.1
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated uCVE-2025-27576 · Other software · reported by secure@intel.comLow 2.1
Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable denial of service via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potCVE-2025-27537 · Other software · reported by secure@intel.comMedium 5.1
Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated useCVE-2025-27250 · Other software · reported by secure@intel.comMedium 5.1
Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated useCVE-2025-26472 · Other software · reported by secure@intel.comMedium 5.9
Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potCVE-2025-24921 · Other software · reported by secure@intel.comMedium 6.9
Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potCVE-2025-24840 · Other software · reported by secure@intel.comLow 2.3
Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to CVE-2025-24523 · Other software · reported by secure@intel.comMedium 5.1
Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication.CVE-2025-54885 · Other software · simbo1905 · reported by GitHubMedium 6.9
Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. This is fixed in version 2.0.1.
- Product
- thinbus-srp-npm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture.CVE-2025-54873 · Other software · risc0 · reported by GitHubLow 2.7
RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.
- Product
- risc0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.CVE-2025-53544 · Other software · TriliumNext · reported by GitHubHigh 7.5
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch aCVE-2025-27211 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.
- Product
- EdgeMAX EdgeSwitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2025OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account tCVE-2025-54955 · Other software · OpenNebula · reported by MITREHigh 8.1
OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.
- Product
- OpenNebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opennebula.iogithub.com
Aug 2, 2025Magic Edge – Lite: Stored Cross-Site ScriptingCVE-2025-8391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magic Edge – Lite
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Magic Edge – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Jul 25, 2025In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix taking invalid lock on wedge If device wedges on e.g.CVE-2025-38353 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix taking invalid lock on wedge If device wedges on e.g. GuC upload, the submission is not yet enabled and the state is not even initialized. Protect the wedge call so it does nothing in this case. It fixes the following splat: [] xe 0000:bf:00.0: [drm] device wedged, needs recovery [] ------------[ cut here ]------------ [] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60 ... [] RIP: 0010:__mutex_lock+0x8a1/0xe60 [] mutex_lock_nested+0x1b/0x30 [] xe_guc_submit_wedge+0x80/0x2b0 [xe]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 25, 2025Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge noCVE-2025-54568 · Other software · Akamai · reported by MITRELow 3.7
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.
- Product
- Rate Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdocs.akamai.comgithub.com
Jul 24, 2025LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices.CVE-2025-54379 · Other software · lf-edge · reported by GitHubHigh 8.9
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
- Product
- ekuiper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2025-46732 · Other software · OpenCTI-Platform · reported by GitHubMedium 5.4
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Knowledge Base: Stored Cross-Site ScriptingCVE-2025-7431 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Knowledge Base
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2025Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-47964 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2025-47963 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.CVE-2025-47182 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum perCVE-2025-53506 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 8, 2025Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authenticatioCVE-2025-37103 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system.
- Product
- HPE Networking Instant On
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5).CVE-2025-40741 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted CFG files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 8, 2025A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5).CVE-2025-40740 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 8, 2025A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5).CVE-2025-40739 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 4, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28983 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
- Product
- Click & Pledge Connect
- What to do
- Update Click & Pledge Connect to the newest version.
Jul 2, 2025Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-49713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2025-49741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration.CVE-2025-52884 · Other software · risc0 · reported by GitHubLow 1.7
RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contracts, Steel EVM view call library, and supporting code. Prior to versions 2.1.1 and 2.2.0, the `Steel.validateCommitment` Solidity library function will return `true` for a crafted commitment with a digest value of zero. This violates the semantics of `validateCommitment`, as this does not commitment to a block that is in the current chain. Because the digest is zero, it does not correspond to any block and there exist no known openings. As a result, this commitment will never be produced by a correct zkVM guest using Steel and leveraging this bug to compromise the soundness of a program using Steel would require a separate bug or misuse of the Steel library, which is expected to be used to validate the root of state opening proofs. A fix has been released as part of `risc0-ethereum` 2.1.1 and 2.2.0. Users for the `Steel` Solidity library versions 2.1.0 or earlier should ensure they are using `Steel.validateCommitment` in tandem with zkVM proof verification of a Steel program, as shown in the ERC-20 counter example, and docume
- Product
- risc0-ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.beboundless.xyzgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.