Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,686 results · page 254 of 774
May 9, 2025The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attaCVE-2025-3714 · Other software · ATEN · reported by twcert@cert.org.twCritical 9.3
The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
- Product
- CL5708IM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 9, 2025The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attaCVE-2025-3711 · Other software · ATEN · reported by twcert@cert.org.twCritical 9.3
The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
- Product
- CL5708IM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 9, 2025The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attaCVE-2025-3710 · Other software · ATEN · reported by twcert@cert.org.twCritical 9.3
The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
- Product
- CL5708IM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 8, 2025WPBookit: Privilege escalationCVE-2025-3811 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 8, 2025WPBookit: Privilege escalationCVE-2025-3810 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 8, 2025Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a networkCVE-2025-47733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
- Product
- Microsoft Power Pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.CVE-2025-29972 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.
- Product
- Azure Storage Resource Provider (SRP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.CVE-2025-29827 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.CVE-2025-29813 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure DevOps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.CVE-2025-27720 · Other software · Pixmeo · reported by ics-cert@hq.dhs.govCritical 9.3
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
- Product
- OsiriX MD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govosirix-viewer.com
May 8, 2025Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.CVE-2023-31585 · Other software · reported by MITRECritical 9.8
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 8, 2025A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112.CVE-2025-45798 · Other software · Totolink · reported by MITRECritical 9.8
A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library, specifically in the processing of the IpTo parameter.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.CVE-2025-45797 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl parameter in the setNoticeCfg interface of /lib/cste_modules/system.so.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so.CVE-2025-45790 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.CVE-2025-45789 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.CVE-2025-45788 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.CVE-2025-45787 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision systCVE-2025-0505 · Other software · Arista Networks · reported by psirt@arista.comCritical 10
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.
- Product
- CloudVision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tuCVE-2024-12378 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.1
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
- Product
- CloudVision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS deviCVE-2024-11186 · Other software · Arista Networks · reported by psirt@arista.comCritical 10
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service.
- Product
- CloudVision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025An Eval Injection issue was discovered in Znuny through 7.1.3.CVE-2025-26845 · Other software · Znuny · reported by MITRECritical 9.8
An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script.
- Product
- Znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.CVE-2025-45841 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 8, 2025An issue was discovered in Znuny through 7.1.3.CVE-2025-26844 · Other software · Znuny · reported by MITRECritical 9.8
An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
- Product
- Znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; accesCVE-2025-36546 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability they must obtain the root user's SSH private key. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- F5OS - Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager.CVE-2025-3476 · Other software · OpenText™ · reported by security@opentext.comCritical 9.4
Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This issue affects Operations Bridge Manager: 2023.05, 23.4, 24.2, 24.4.
- Product
- Operations Bridge Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-46828 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the endpoint `/html/socio/sistema/get_socios.php`, specifically in the query parameter. This issue allows attackers to inject and execute arbitrary SQL statements against the application's underlying database. As a result, it may lead to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE SofCVE-2025-20188 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 10
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comhorizon3.ai
May 7, 2025Productive Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47657 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.
- Product
- Productive Commerce
- Affected
- up to 1.1.40
- What to do
- Affects up to 1.1.40. Update Productive Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025BEAF: Unrestricted Upload of File with Dangerous TypeCVE-2025-47549 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.
- Product
- BEAF
- Affected
- up to 4.6.10
- What to do
- Affects up to 4.6.10. Update BEAF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing CVE-2025-2777 · Other software · SysAid · reported by VulnCheckCritical 9.3
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
- Product
- SysAid On-Prem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.sysaid.comlabs.watchtowr.com
May 7, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2776 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
- Product
- SysAid On-Prem
- On CISA’s list since
- Jul 22, 2025 (federal fix deadline Aug 12, 2025)
- What to do
- Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.sysaid.comlabs.watchtowr.com
May 7, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2775 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
- Product
- SysAid On-Prem
- On CISA’s list since
- Jul 22, 2025 (federal fix deadline Aug 12, 2025)
- What to do
- Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.sysaid.comlabs.watchtowr.com
May 7, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4104 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
- Product
- Frontend Dashboard
- Affected
- 1.0 to 2.2.6
- What to do
- Affects 1.0 to 2.2.6. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BCVE-2025-0668 · Other software · BOINC · reported by vulnerability@ncsc.chCritical 9.3
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: before 1.4.5.
- Product
- BOINC Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompass-security.comcompass-security.com
May 6, 2025PeproDev Ultimate Profile Solutions: Authentication BypassCVE-2025-3844 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due to handel_ajax_req() function not having proper restrictions on the change_user_meta functionality that makes it possible to set a OTP code and subsequently log in with that OTP code. This makes it possible for unauthenticated attackers to login as other users on the site, including administrators.
- Product
- PeproDev Ultimate Profile Solutions
- Affected
- 1.9.1 to 7.5.2
- What to do
- Affects 1.9.1 to 7.5.2. Update PeproDev Ultimate Profile Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 6, 2025PGS Core: PHP Object InjectionCVE-2025-0855 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- PGS Core
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update PGS Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.potenzaglobalsolutions.comwordfence.com
May 6, 2025Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic.CVE-2025-47419 · Other software · Crestron · reported by 25b0b659-c4b4-483f-aecb-067757d23ef3Critical 10
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
- Product
- Automate VX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.crestron.comcrestron.com
May 6, 2025passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.CVE-2025-46572 · Other software · auth0 · reported by GitHubCritical 9.3
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. Users are affected specifically when the service provider is using passport-wsfed-saml2 and a valid SAML document signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.
- Product
- passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiGuestSet, the manipulCVE-2025-44899 · Network & remote access · Tenda · reported by MITRECritical 9.8
There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiGuestSet, the manipulation of the parameter shareSpeed leads to stack overflow.
- Product
- Rx3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.CVE-2025-44073 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability was found in Quarkus in the quarkus-security-webauthn module.CVE-2024-12225 · Other software · Red Hat · reported by Red HatCritical 9.1
A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default endpoints remain accessible, potentially allowing attackers to obtain a login cookie that has no corresponding user in the Quarkus application or, depending on how the application is written, could correspond to an existing user that has no relation with the current attacker, allowing anyone to log in as an existing user by just knowing that user's user name.
- Product
- Red Hat build of Quarkus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
May 6, 2025goshs is a SimpleHTTPServer written in Go.CVE-2025-46816 · Other software · patrickhener · reported by GitHubCritical 9.4
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.CVE-2025-25014 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components toCVE-2025-4041 · Other software · Optigo Networks · reported by ics-cert@hq.dhs.govCritical 9.3
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
- Product
- ONS NC600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.CVE-2025-45492 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.
- Product
- Ex8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter.CVE-2025-45491 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.CVE-2025-45490 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.CVE-2025-45489 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter.CVE-2025-45488 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.CVE-2025-45487 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.