Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

17,689 results · page 169 of 354

Sep 22, 2025The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaCVE-2025-57440 · Other software · reported by MITREHigh 7.5
The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage devices, and system reboot. This interface, referred to as the "ATEM Ethernet Protocol 1.0", provides complete device control without requiring credentials or encryption. An attacker on the same network (or with remote access to the exposed port) can exploit this interface to execute arbitrary streaming commands, erase disks, or shut down the device - effectively gaining full remote control.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com blackmagicdesign.com
Sep 22, 2025The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977.CVE-2025-57437 · Other software · Blackmagicdesign · reported by MITRECritical 9.8
The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC, DNS - Current stream platform, stream key, and streaming URL - Audio/video configuration This data can be used to hijack live streams or perform network reconnaissance.
Product
Web Presenter HD Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com blackmagicdesign.com
Sep 22, 2025Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands.CVE-2025-57432 · Other software · Blackmagicdesign · reported by MITRECritical 9.8
Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication mechanisms are required to interact with the Telnet interface.
Product
Web Presenter HD Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com blackmagicdesign.com
Sep 20, 2025SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more: Unauthorized creation of formsCVE-2025-10489 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creation of forms due to a missing capability check on the register_post_types() function in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to create forms when the user interface specifically prohibits it.
Product
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2025Secure Passkeys: Unauthorized accessCVE-2025-10305 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_passkey() and passkeys_list() function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and delete passkeys.
Product
Secure Passkeys
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Secure Passkeys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 19, 2025Kubio AI Page Builder: Unauthorized plugin installationCVE-2025-8487 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin.
Product
Kubio AI Page Builder
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2025Goza - Nonprofit Charity: Unauthorized arbitrary file uploadsCVE-2025-10690 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
Product
Goza - Nonprofit Charity
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net cve.org
Sep 18, 2025H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials.CVE-2025-57295 · Other software · H3c · reported by MITREHigh 8
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
Product
Magic Nx15 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com h3c.com
Sep 18, 2025SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorCVE-2025-10650 · Other software · SoftIron · reported by 0a72a055-908d-47f5-a16a-1f09049c16c6Low 1.8
SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds created between versions 2.5.0 and 2.6.3. No generally available (GA) or customer-released production builds were affected. There is no evidence that this issue was exposed in customer environments or production deployments.
Product
HyperCloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.softiron.cloud
Sep 18, 2025An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary fCVE-2025-55912 · Other software · Oxygenz · reported by MITREHigh 7.3
An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler
Product
Clipbucket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 18, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized access of functionalityCVE-2025-8565 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2025A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected CCVE-2025-37122 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.1
A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.
Product
HPE Aruba Networking ClearPass Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 17, 2025Sydney: Unauthorized modification of dataCVE-2025-8999 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate various theme modules.
Product
Sydney
Affected
up to 2.56
What to do
Affects up to 2.56. Update Sydney to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Sep 17, 2025Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackeCVE-2025-9972 · Other software · Planet Technology · reported by twcert@cert.org.twCritical 9.3
Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device.
Product
ICG-2510WG-LTE (EU/US)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record planet.com.tw twcert.org.tw
Sep 17, 2025Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackCVE-2025-9971 · Other software · Planet Technology · reported by twcert@cert.org.twCritical 9.3
Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to manipulate the device via a specific functionality.
Product
ICG-2510WG-LTE (EU/US)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record planet.com.tw twcert.org.tw
Sep 16, 2025A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files.CVE-2025-37131 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
Product
HPE Aruba Networking EdgeConnect SD-WAN Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 16, 2025A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections.CVE-2025-37124 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.6
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.
Product
HPE Aruba Networking EdgeConnect SD-WAN Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 16, 2025Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script.CVE-2025-34184 · Other software · Ilevia Srl. · reported by VulnCheckCritical 9.3
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.
Product
EVE X1 Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news ilevia.com
Sep 16, 2025Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retriCVE-2025-34183 · Other software · Ilevia Srl. · reported by VulnCheckCritical 9.3
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse.
Product
EVE X1 Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news ilevia.com
Sep 16, 2025Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.CVE-2025-49728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4
Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.
Product
Microsoft PC Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Sep 16, 2025Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2025-47967 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Sep 16, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor vulCVE-2024-13149 · Computers, phones & browsers · Arma Store · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arma Store Armalife allows SQL Injection. This issue affects Armalife: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Product
Armalife
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Sep 16, 2025In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_CVE-2025-39808 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 16, 2025Blaze Demo Importer: Unauthorized limited plugin installCVE-2025-8446 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.
Product
Blaze Demo Importer
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Blaze Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 16, 2025There is an unauthorized access vulnerability in ZTE T5400.CVE-2025-26711 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.7
There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface.
Product
T5400
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn
Sep 16, 2025Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing.CVE-2024-12367 · Other software · Vegagrup Software · reported by iletisim@usom.gov.trHigh 8.6
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Product
Vega Master
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Sep 15, 2025This issue was addressed with improved checks to prevent unauthorized actions.CVE-2025-43307 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Sep 15, 2025hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants.CVE-2025-59155 · Other software · yuna0x0 · reported by GitHubMedium 6.9
hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery (SSRF) vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl values supplied via the Hackmd-Api-Url HTTP header or a base64-encoded JSON query parameter are accepted without validation, allowing attackers to redirect outbound API requests to internal network services, access internal endpoints, perform network reconnaissance, and bypass network access controls. The stdio transport mode is not affected because it only accepts stdio requests. The issue is fixed in version 1.5.0, which enforces allowed endpoints and supports the ALLOWED_HACKMD_API_URLS environment variable. Users should update to 1.5.0 or later or apply documented mitigations such as switching to stdio mode, restricting outbound network access, or filtering the Hackmd-Api-Url header and related query parameter via a reverse proxy.
Product
hackmd-mcp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2025On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthCVE-2025-57176 · Other software · Ceragon Networks / Siklu Communication · reported by MITREMedium 6.5
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.
Product
EtherHaul and MultiHaul Series microwave antennas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Sep 15, 2025In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no lCVE-2023-53232 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability"). This could result in potential invalid memory access. To fix the kernel panic issue in mt7921, it is necessary to avoid accessing unallocated eeprom.data which can lead to invalid memory access. Furthermore, it is possible to entirely eliminate the mt7921_mcu_parse_eeprom function and solely depend on mt7921_mcu_parse_response to divide the RxD header. [2.702735] BUG: kernel NULL pointer dereference, address: 0000000000000550 [2.702740] #PF: supervisor write access in kernel mode [2.702741] #PF: error_code(0x0002) - not-present page [2.702743] PGD 0 P4D 0 [2.702747] Oops: 0002 [#1] PREEMPT SMP NOPTI [2.702755] RIP: 0010:mt7921_mcu_parse_response+0x147/0x170 [mt7921_common] [2.702758] RSP: 0018:ffffae7c00fef828 EFLAGS: 00010286 [2.702760] RAX: ffffa367f57be024 RBX: ffffa367cc7bf500 RCX: 0000000000000000 [2.702762] RDX: 0000000000000550 RSI: 0000000000000000 RDI: ffffa367c
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 15, 2025During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating iCVE-2025-41713 · Other software · WAGO · reported by info@cert.vde.comMedium 6.5
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
Product
CC100 0751-9301
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com wago.csaf-tp.certvde.com
Sep 15, 2025O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this CVE-2025-10453 · Other software · PilotGaea Technologies · reported by twcert@cert.org.twMedium 6.9
O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.
Product
O'View MapServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 14, 2025Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and deleteCVE-2025-10452 · Other software · Gotac · reported by twcert@cert.org.twCritical 9.3
Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges.
Product
Statistical Database System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 14, 2025IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files dueCVE-2025-0164 · Other software · IBM · reported by psirt@us.ibm.comLow 2.3
IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment.
Product
QRadar SIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Sep 12, 2025Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards.CVE-2025-8699 · Other software · KioSoft · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.1
Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the card (up to $655,35) to pay for goods.
Product
Stored Value Unattended Payment Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com seclists.org
Sep 12, 2025NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files.CVE-2025-10267 · Other software · NewType Infortech · reported by twcert@cert.org.twMedium 6.9
NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side.
Product
NUP Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 12, 2025NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, moCVE-2025-10266 · Other software · NewType Infortech · reported by twcert@cert.org.twCritical 9.3
NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
NUP Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 12, 2025Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the sysCVE-2025-10264 · Other software · Digiever · reported by twcert@cert.org.twCritical 10
Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.
Product
DS-1200
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 12, 2025A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09.CVE-2025-10278 · Other software · YunaiV · reported by VulDBLow 2.1
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. You should upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."
Product
ruoyi-vue-pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Sep 11, 2025A vulnerability was detected in YunaiV yudao-cloud up to 2025.09.CVE-2025-10277 · Other software · YunaiV · reported by VulDBLow 2.1
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue. The vendor confirms: "[W]e have now added the missing per-record CRM WRITE permission check to submitReceivable, the path reported as CVE-2025-10277, in both Boot and Cloud master-jdk17. Possession of a functional submit permission alone no longer permits submission of a record for which the caller lacks CRM write access."
Product
yudao-cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitee.com vuldb.com
Sep 11, 2025A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09.CVE-2025-10276 · Other software · YunaiV · reported by VulDBLow 2.1
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading the affected component is advised. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."
Product
ruoyi-vue-pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Sep 11, 2025Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2025-55319 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
Product
Visual Studio Code
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Sep 11, 2025A weakness has been identified in YunaiV yudao-cloud up to 2025.09.CVE-2025-10275 · Other software · YunaiV · reported by VulDBLow 2.1
A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."
Product
yudao-cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Sep 11, 2025DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocatiCVE-2025-10193 · Other software · neo4j · reported by 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6High 7.4
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Product
neo4j-cypher MCP server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 11, 2025Time Tracker: Unauthorized modification and loss of dataCVE-2025-9018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
Product
Time Tracker
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Time Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Unauthorized modification of dataCVE-2025-8492 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads.
Product
Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
Affected
up to 10.22
What to do
Affects up to 10.22. Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025My WP Translate: Unauthorized modification of data that can lead to privilege escalationCVE-2025-8425 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_import_strings() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
My WP Translate
Affected
up to 1.1
What to do
Affects up to 1.1. Update My WP Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025My WP Translate: Unauthorized modification of dataCVE-2025-8423 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service.
Product
My WP Translate
Affected
up to 1.1
What to do
Affects up to 1.1. Update My WP Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Ultimate Classified Listings: Unauthorized modification of dataCVE-2025-0763 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_fields function in all versions up to, and including, 1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin custom fields.
Product
Ultimate Classified Listings
Affected
up to 1.7
What to do
Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2025In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversCVE-2025-6088 · Other software · danny-avila · reported by security@huntr.devLow 3.1
In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.
Product
danny-avila/librechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.