Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

17,708 results · page 189 of 355

Apr 10, 2025A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SCVE-2025-0122 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.1
A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.
Product
Prisma SD-WAN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.paloaltonetworks.com
Apr 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.CVE-2025-32700 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue affects AbuseFilter: from >= 1.43.0 before 1.43.1.
Product
MediaWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record phabricator.wikimedia.org
Apr 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.CVE-2025-32698 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.
Product
MediaWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record phabricator.wikimedia.org lists.debian.org
Apr 10, 2025IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.CVE-2023-43037 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.
Product
Maximo Application Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Apr 10, 2025Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.CVE-2025-1073 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.5
Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.
Product
IR Control Hub (IR Blaster)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lsin.panasonic.com
Apr 10, 2025Ai Image Alt Text Generator for WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Embedder: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3417 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_set_global_option() function in versions 1.3 to 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Embedder
Affected
1.3 to 1.3.5
What to do
Affects 1.3 to 1.3.5. Update Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2025A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthentCVE-2025-30658 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.7
A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX platforms with Anti-Virus enabled, if a server sends specific content in the HTTP body of a response to a client request, these packets are queued by Anti-Virus processing in Juniper Buffers (jbufs) which are never released. When these jbufs are exhausted, the device stops forwarding all transit traffic. A jbuf memory leak can be noticed from the following logs: (<node>.)<fpc> Warning: jbuf pool id <#> utilization level (<current level>%) is above <threshold>%! To recover from this issue, the affected device needs to be manually rebooted to free the leaked jbufs. This issue affects Junos OS on SRX Series: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R2.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, netwCVE-2025-30657 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.9
An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a device configured for flow-monitoring receives a specific BGP update message, it is correctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly which leads to a crash and momentary interruption of jflow processing until it automatically restarts. This issue does not affect traffic forwarding itself. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3, * 23.2 versions before 23.2R1-S2, 23.2R2. This issue does not affected Junos OS Evolved.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows CVE-2025-30654 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information. Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system. This issue affects Junos OS: * All versions before 21.4R3-S10, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3. Junos OS Evolved: * All versions before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S5-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S3-EVO.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacCVE-2025-30653 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6
An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, when an MPLS Label-Switched Path (LSP) is configured with node-link-protection and transport-class, and an LSP flaps, rpd crashes and restarts. Continuous flapping of LSP can cause a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: * All versions before 22.2R3-S4, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2. Junos OS Evolved: * All versions before 22.2R3-S4-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R2-EVO.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unautCVE-2025-30651 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.7
A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When an attacker sends a specific ICMPv6 packet to an interface with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause a sustained DoS condition. This issue only affects systems configured with IPv6. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S2, * from 23.4 before 23.4R2; and Junos OS Evolved: * All versions before 21.2R3-S9-EVO, * from 21.4-EVO before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S4-EVO, * from 23.2-EVO before 23.2R2-S2-EVO, * from 23.4-EVO before 23.4R2-EVO.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjaCVE-2025-30648 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause the jdhcpd process to crash resulting in a Denial of Service (DoS). When a specifically malformed DHCP packet is received from a DHCP client, the jdhcpd process crashes, which will lead to the unavailability of the DHCP service and thereby resulting in a sustained DoS. The DHCP process will restart automatically to recover the service. This issue will occur when dhcp-security is enabled. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2; Junos OS Evolved: * from 22.4 before 22.4R3-S6-EVO, * from 23.2 before 23.2R2-S3-EVO, * from 23.4 before 23.4R2-S4-EVO, * from 24.2 before 24.2R2-EVO. .
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows an unaCVE-2025-30647 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). In a subscriber management scenario, login/logout activity triggers a memory leak, and the leaked memory gradually increments and eventually results in a crash. user@host> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer 2 Online 36 10 0 9 8 9 32768 26 0 This issue affects Junos OS on MX Series: * All versions before 21.2R3-S9 * from 21.4 before 21.4R3-S10 * from 22.2 before 22.2R3-S6 * from 22.4 before 22.4R3-S5 * from 23.2 before 23.2R2-S3 * from 23.4 before 23.4R2-S3 * from 24.2 before 24.2R2.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthentiCVE-2025-21591 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition. Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS: * from 23.1 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2. This issue isn't applicable to any versions of Junos OS before 23.1R1. This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. This issue doesn't affect Junos OS Evolved. There are no indicators of compromise for this issue.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.
Product
Squeeze
Affected
up to 1.6
What to do
Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in thCVE-2025-2442 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.4
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode.
Product
Trio Q Licensed Data Radio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Apr 9, 2025CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a maliciousCVE-2025-2440 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.1
CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode.
Product
Trio Q Licensed Data Radio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-29823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.CVE-2025-29822 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-29820 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.CVE-2025-29819 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
Product
Windows Admin Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-29816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.CVE-2025-29805 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
Product
Microsoft Outlook for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-29791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27751 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27750 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27749 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27748 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-27747 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27746 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27745 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.CVE-2025-27742 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.CVE-2025-27741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.CVE-2025-27737 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Exposure of sensitive information to an unauthorized actor in Windows Power Dependency Coordinator allows an authorized attacker to disclose information locallyCVE-2025-27736 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows Power Dependency Coordinator allows an authorized attacker to disclose information locally.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.CVE-2025-27733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Windows Shell allows an unauthorized attacker to execute code locally.CVE-2025-27729 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Shell allows an unauthorized attacker to execute code locally.
Product
Windows 10 Version 21H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.CVE-2025-27486 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Product
Windows Server 2012 R2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.CVE-2025-27485 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Product
Windows Server 2012 R2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.CVE-2025-27483 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-27482 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Product
Windows Server 2016
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.CVE-2025-27481 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-27480 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Product
Windows Server 2012
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.CVE-2025-27479 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
Product
Windows Server 2012
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.CVE-2025-27477 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-27474 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Product
Windows Server 2008 R2 Service Pack 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.CVE-2025-27473 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Apr 8, 2025Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-27472 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.