Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,689 results · page 170 of 354
Sep 10, 2025If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server.CVE-2025-8696 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0.
- Product
- Stork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.isc.orgopenwall.com
Sep 10, 2025A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a CVE-2025-20340 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affected device. This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities. A successful exploit could result in degraded device performance, loss of management connectivity, and complete unresponsiveness of the system, leading to a DoS condition.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 10, 2025A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attackeCVE-2025-20159 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 10, 2025An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE proCVE-2025-56405 · Other software · Litmus · reported by MITREHigh 7.5
An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol.
- Product
- MCP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 onCVE-2025-10222 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Medium 4.8
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such as timestamps, license states, and registry values via reading diagnostic export files created by the built-in troubleshooting tool.
- Product
- AxxonOne C-Werk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025NitroPack: Unauthorized modification of dataCVE-2025-8778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.
- Product
- NitroPack
- Affected
- up to 1.18.4
- What to do
- Affects up to 1.18.4. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of dataCVE-2025-10040 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials.
- Product
- WP Import – Ultimate CSV XML Importer for
- Affected
- up to 7.27
- What to do
- Affects up to 7.27. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2025Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network aCVE-2025-58135 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-49461 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-49460 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands.CVE-2025-57633 · Other software · reported by MITRECritical 9.8
A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html endpoint's "Upload File" action constructs a shell command from the ftp_file parameter and executes it using os.system() without sanitization or escaping.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 9, 2025Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.CVE-2025-7635 · Other software · Calix · reported by help@fluidattacks.comHigh 8.7
Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
- Product
- GigaCenter ONT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comrevers3everything.com
Sep 9, 2025CWE-200 Exposure of Sensitive Information to an Unauthorized ActorCVE-2025-55052 · Other software · Baicells · reported by cna@cyber.gov.ilMedium 4.3
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Product
- NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.CVE-2025-55243 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft OfficePLUS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.CVE-2025-55232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft HPC Pack 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-55225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-54917 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-54910 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-54908 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.CVE-2025-54907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-54906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2025-54905 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54904 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54902 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-54901 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54898 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.CVE-2025-54113 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-54107 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.CVE-2025-54106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012 R2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.CVE-2025-54103 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-54097 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-54096 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-54095 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-53806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.CVE-2025-53805 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-53804 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.CVE-2025-53799 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-53798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-53797 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-53796 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote codeCVE-2025-9872 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote codeCVE-2025-9712 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary CVE-2025-10183 · Other software · TecCom · reported by cves@blacklanternsecurity.comCritical 9.1
A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.
- Product
- TecConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blacklanternsecurity.com
Sep 9, 2025The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with netwoCVE-2025-9994 · Other software · Amped RF · reported by cret@cert.orgCritical 9.8
The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access.
- Product
- BT-AP 111
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordampedrftech.comkb.cert.org
Sep 9, 2025APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an UnauthorCVE-2025-33045 · Other software · AMI · reported by biossecurity@ami.comHigh 8.2
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to information disclosure, arbitrary data writing, and impact Confidentiality, Integrity, and Availability.
- Product
- AptioV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineeCVE-2025-41701 · Other software · Beckhoff · reported by info@cert.vde.comHigh 7.8
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
- Product
- TE1000 | TwinCAT 3 Enineering
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.