Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,704 results · page 263 of 775
Mar 31, 2025The issue was addressed with improved bounds checks.CVE-2025-24256 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to disclose kernel memory.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed with improved handling of symlinks.CVE-2025-24253 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed with improved access restrictions.CVE-2025-24250 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app acting as a HTTPS proxy could get access to sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A permissions issue was addressed with additional sandbox restrictions.CVE-2025-24249 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to check the existence of an arbitrary path on the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A type confusion issue was addressed with improved checks.CVE-2025-24247 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker may be able to cause unexpected app termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025An injection issue was addressed with improved validation.CVE-2025-24246 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed by adding a delay between verification code attempts.CVE-2025-24245 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed by adding a delay between verification code attempts. This issue is fixed in macOS Sequoia 15.4. A malicious app may be able to access a user's saved passwords.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025A configuration issue was addressed with additional restrictions.CVE-2025-24241 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to trick a user into copying sensitive data to the pasteboard.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A logic issue was addressed with improved checks.CVE-2025-24238 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to gain elevated privileges.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A buffer overflow was addressed with improved bounds checking.CVE-2025-24237 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected system termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A permissions issue was addressed with additional restrictions.CVE-2025-24233 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to read or write to protected files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-24232 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access arbitrary files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025The issue was addressed with improved checks.CVE-2025-24231 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025An out-of-bounds read issue was addressed with improved input validation.CVE-2025-24230 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. Playing a malicious audio file may lead to an unexpected app termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed with improved memory handling.CVE-2025-24211 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A permissions issue was addressed with additional restrictions.CVE-2025-24207 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to enable iCloud storage features without user consent.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025The issue was addressed with improved checks.CVE-2025-24204 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025An integer overflow was addressed with improved input validation.CVE-2025-24195 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user may be able to elevate privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025The issue was addressed with improved memory handling.CVE-2025-24190 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A permissions issue was addressed with additional restrictions.CVE-2025-24181 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-24178 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to break out of its sandbox.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A permissions issue was addressed with additional sandbox restrictions.CVE-2025-24172 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. "Block All Remote Content" may not apply for all mail previews.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-24167 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.CVE-2025-31691 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
- Product
- OAuth2 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeCVE-2025-31685 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.CVE-2025-31681 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
- Product
- Authenticator Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header paCVE-2024-54809 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header parameter in a strncpy where size is determined based on the input specified. By sending a specially crafted packet, an attacker can take control of the program counter and hijack control flow of the program to execute arbitrary system commands.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained uCVE-2024-54808 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained use of sscanf. The vulnerability allows for control of the program counter and can be utilized to achieve arbitrary code execution.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parCVE-2024-54807 · Network & remote access · Netgear · reported by MITRECritical 9.8
In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request for AddPortMapping via the router's WANIPConn1 service to achieve arbitrary command execution.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web inteCVE-2024-54806 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.CVE-2024-54805 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can visit the send_log.cgi endpoint which uses the parameter in a system call to achieve command execution.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.CVE-2024-54804 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter wan_hostname and forcing a reboot. This will result in command injection.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.CVE-2024-54803 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header.CVE-2024-54802 · Network & remote access · Netgear · reported by MITRECritical 9.8
In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header.
- Product
- Wnr854t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025scratch-coding-hut.github.io is the website for Coding Hut.CVE-2025-31122 · Other software · Scratch-Coding-Hut · reported by GitHubCritical 9
scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.
- Product
- Scratch-Coding-Hut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Beego is an open-source web framework for the Go programming language.CVE-2025-30223 · Other software · beego · reported by GitHubCritical 9.3
Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.
- Product
- beego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across diCVE-2025-30095 · Other software · VyOS · reported by MITRECritical 9
VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run "rm -f /etc/dropbear/*key*" and/or "rm -f /etc/dropbear-initramfs/*key*" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.
- Product
- VyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.vyos.ioblog.vyos.io
Mar 31, 2025A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary coCVE-2025-22941 · Other software · Adtran · reported by MITRECritical 9.8
A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 31, 2025Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password.CVE-2025-22940 · Other software · Adtran · reported by MITRECritical 9.1
Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 31, 2025A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary cCVE-2025-22939 · Other software · Adtran · reported by MITRECritical 9.8
A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 31, 2025Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.CVE-2025-22938 · Other software · Adtran · reported by MITRECritical 9.8
Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 31, 2025An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.CVE-2025-22937 · Other software · Adtran · reported by MITRECritical 9.8
An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 31, 2025Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host netwoCVE-2025-29266 · Other software · Unraid · reported by MITRECritical 9.6
Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.
- Product
- Unraid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unraid.netedac.dev
Mar 31, 2025Os command injection vulnerability in e-solutions e-management.CVE-2025-3022 · Other software · e-solutions · reported by cve-coordination@incibe.esCritical 9.3
Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘client’ parameter in the /data/apache/e-management/api/api3.php endpoint.
- Product
- e-management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating sCVE-2025-2071 · Other software · FAST LTA · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 10
A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level commands without adequate sanitization or validation. Successful exploitation could allow attackers to execute arbitrary commands on the affected system, potentially resulting in unauthorized access, data leakage, or full system compromise. Affected WebUI parameters are "hd" and "pi".
- Product
- FAST LTA Silent Brick WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.CVE-2025-26689 · Other software · Inaba Denki Sangyo Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.
- Product
- CHOCO TEI WATCHER mini (IB-MCT001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.CVE-2025-25211 · Other software · Inaba Denki Sangyo Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.
- Product
- CHOCO TEI WATCHER mini (IB-MCT001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and deletCVE-2025-3011 · Other software · PiExtract · reported by twcert@cert.org.twCritical 9.8
SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- Product
- SOOP-CLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 30, 2025Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer DriveCVE-2025-1268 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.4
Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
- Product
- Generic Plus PCL6 Printer Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2025Unauthenticated RCE in HPE Insight Cluster Management UtilityCVE-2024-13804 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.8
Unauthenticated RCE in HPE Insight Cluster Management Utility
- Product
- HPE Insight Cluster Management Utility (CMU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordred.0xbad53c.comred.0xbad53c.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.