Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,658 results · page 212 of 774
Nov 13, 2025IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improperCVE-2025-36251 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.6
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary coCVE-2025-36250 · Other software · IBM · reported by psirt@us.ibm.comCritical 10
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access bCVE-2025-36096 · Other software · IBM · reported by psirt@us.ibm.comCritical 9
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Typebot is an open-source chatbot builder.CVE-2025-64709 · Other software · baptisteArno · reported by GitHubCritical 9.6
Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAICVE-2025-12762 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 9.1
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affectCVE-2025-59367 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.3
An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the 'Security Update for DSL Series Router' section on the ASUS Security Advisory for more information.
- Product
- DSL-AC51
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webCVE-2021-4464 · Other software · FiberHome · reported by VulnCheckCritical 9.3
FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash or potential control of execution flow.
- Product
- AN5506-04-FA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Nov 12, 2025Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability.CVE-2025-46608 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with elevated privileges, compromising system integrity and customer data. Dell recommends customers upgrade to the latest version at the earliest opportunity.
- Product
- Data Lakehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint.CVE-2025-56385 · Other software · Wellsky · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.CVE-2025-64281 · Other software · Centralsquare · reported by MITRECritical 9.8
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 12, 2025A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.CVE-2025-64280 · Other software · Centralsquare · reported by MITRECritical 9.8
A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 12, 2025A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSIDCVE-2025-63353 · Other software · Fiberhome · reported by MITRECritical 9.8
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.
- Product
- Hg6145f1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart filCVE-2025-63289 · Other software · Sogexia · reported by MITRECritical 9.1
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file
- Product
- Sogexia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comlinkedin.com
Nov 12, 2025The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserializationCVE-2025-11367 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 10
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025N-central < 2025.4 is vulnerable to authentication bypass via path traversalCVE-2025-11366 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.4
N-central < 2025.4 is vulnerable to authentication bypass via path traversal
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the CVE-2025-63666 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls CVE-2025-40176 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption requests.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 12, 2025The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and useCVE-2025-12871 · Other software · aEnrich · reported by twcert@cert.org.twCritical 9.3
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 12, 2025The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administraCVE-2025-12870 · Other software · aEnrich · reported by twcert@cert.org.twCritical 9.3
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 11, 2025Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2025-60724 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.CVE-2025-13032 · Other software · Avast · reported by security@nortonlifelock.comCritical 9.9
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.
- Product
- (Free/Premiium/Ultimeat) Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component.CVE-2025-13026 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025JIT miscompilation in the JavaScript Engine: JIT component.CVE-2025-13024 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component.CVE-2025-13023 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025Incorrect boundary conditions in the Graphics: WebGPU component.CVE-2025-13022 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025Incorrect boundary conditions in the Graphics: WebGPU component.CVE-2025-13021 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.CVE-2025-8324 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.8
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
- Product
- ManageEngine Analytics Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025TNC Toolbox: Web Performance: Sensitive Information ExposureCVE-2025-12539 · WordPress plugins & themes · reported by WordfenceCritical 10
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
- Product
- TNC Toolbox: Web Performance
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Nov 11, 2025Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.CVE-2017-20210 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Holiday class post calendar: Remote Code ExecutionCVE-2025-12813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Holiday class post calendar
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update Holiday class post calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2025EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce: Privilege EscalationCVE-2025-11457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.
- Product
- EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce
- Affected
- 0.9.0-beta2 to 1.8.2
- What to do
- Affects 0.9.0-beta2 to 1.8.2. Update EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 10, 2025WP移行専用プラグイン for CPI: Arbitrary file uploadsCVE-2025-11170 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP移行専用プラグイン for CPI
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP移行専用プラグイン for CPI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 10, 2025SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possCVE-2025-42890 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 10
SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.
- Product
- SQL Anywhere Monitor (Non-Gui)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module.CVE-2025-42887 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.
- Product
- SAP Solution Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Soft Serve is a self-hostable Git server for the command line.CVE-2025-64522 · Other software · charmbracelet · reported by GitHubCritical 9.1
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files vCVE-2021-4462 · Other software · Employee Records System · reported by VulnCheckCritical 9.3
Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
- Product
- Employee Records System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsourcecodester.com
Nov 10, 2025Milvus is an open-source vector database built for generative AI applications.CVE-2025-64513 · Other software · milvus-io · reported by GitHubCritical 9.3
Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability to read, modify, or delete data, and to perform privileged administrative operations such as database or collection management. This issue has been fixed in Milvus 2.4.24, 2.5.21, and 2.6.5. If immediate upgrade is not possible, a temporary mitigation can be applied by removing the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy. This prevents attackers from exploiting the authentication bypass behavior.
- Product
- milvus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Gladinet Triofox Improper Access Control VulnerabilityCVE-2025-12480 · Other software · Gladinet · reported by mandiant-cve@google.comExploitedCritical 9.1
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
- Product
- Triofox
- On CISA’s list since
- Nov 12, 2025 (federal fix deadline Dec 3, 2025)
- What to do
- Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogaccess.triofox.comcloud.google.com
Nov 9, 2025New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend CVE-2025-12868 · Other software · CyberTutor · reported by twcert@cert.org.twCritical 9.3
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
- Product
- New Site Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 9, 2025EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the CVE-2025-12866 · Other software · Hundred Plus · reported by twcert@cert.org.twCritical 9.3
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
- Product
- EIP Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 7, 2025calibre is an e-book manager.CVE-2025-64486 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerability in the EWEB management system that CVE-2020-36870 · Other software · Beijing Star-Net Ruijie Network Technology Co., Ltd. · reported by VulnCheckCritical 9.2
Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerability in the EWEB management system that can be abused via front-end functionality. Attackers can exploit front-end code when features such as guest authentication, local server authentication, or screen mirroring are enabled to gain access or execute commands on affected devices. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-05 UTC.
- Product
- RG-EG1000C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnvd.org.cnruijie.com.cn
Nov 7, 2025A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escapCVE-2025-10230 · Other software · Red Hat · reported by Red HatCritical 10
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 7, 2025Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versCVE-2025-3222 · Other software · GE Vernova · reported by GEPowerCVD@ge.comCritical 9.3
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.
- Product
- Smallworld
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-tCVE-2025-63691 · Other software · Pig4cloud · reported by MITRECritical 9.6
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system.
- Product
- PIG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible tCVE-2025-63690 · Other software · Pig4cloud · reported by MITRECritical 9.1
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.
- Product
- PIG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attackerCVE-2025-63689 · Other software · Ycf1998 · reported by MITRECritical 10
Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the orderby parameter
- Product
- Money-pos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 7, 2025An SQL injection vulnerability has been reported to affect QuMagie.CVE-2025-52425 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.5
An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QuMagie 2.7.0 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads.CVE-2025-34299 · Other software · Monsta Limited of New Zealand · reported by VulnCheckCritical 9.3
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
- Product
- Monsta FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.watchtowr.commonstaftp.com
Nov 7, 2025SQL injection vulnerability in DIAL's CentrosNet v2.64.CVE-2025-10870 · Other software · DIAL · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'.
- Product
- CentrosNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.