Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 43 of 93
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65780 · Other software · Wekan Project · reported by MITREHigh 8.8
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65779 · Other software · Wekan Project · reported by MITREHigh 7.5
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65778 · Other software · Wekan Project · reported by MITREHigh 8.1
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js.CVE-2025-67727 · Other software · parse-community · reported by GitHubMedium 6.9
Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2025-66492 · Other software · MasaCMS · reported by GitHubHigh 8.2
Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Miniflux 2 is an open source feed reader.CVE-2025-67713 · Other software · miniflux · reported by GitHubMedium 5.3
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
- Product
- v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Taguette is an open source qualitative research tool.CVE-2025-67502 · Other software · remram44 · reported by GitHubMedium 5.4
Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.
- Product
- taguette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-67501 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability in the /html/matPat/editar_categoria.php endpoint. The application fails to properly validate and sanitize user inputs in the id_categoria parameter, which allows attackers to inject malicious SQL payloads for direct execution. This issue is fixed in version 3.5.5.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-67496 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.3
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. This issue is fixed in version 3.5.5.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SiYuan is self-hosted, open source personal knowledge management software.CVE-2025-67488 · Other software · siyuan-note · reported by GitHubHigh 7.8
SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2025-66626 · Other software · argoproj · reported by GitHubHigh 8.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025n8n is an open source workflow automation platform.CVE-2025-65964 · Other software · n8n-io · reported by GitHubCritical 9.4
n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Tuleap is a free and open source suite for management of software development and collaboration.CVE-2025-65962 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Tuleap is a free and open source suite for management of software development and collaboration.CVE-2025-64760 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Tuleap is a free and open source suite for management of software development and collaboration.CVE-2025-64499 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Tuleap is an Open Source Suite for management of software development and collaboration.CVE-2025-64498 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Tuleap is an Open Source Suite for management of software development and collaboration.CVE-2025-64497 · Other software · Enalean · reported by GitHubMedium 6.5
Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2025-66629 · Other software · hedgedoc · reported by GitHubLow 3.7
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32643 · Other software · MasaCMS · reported by GitHubHigh 7.5
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32642 · Other software · MasaCMS · reported by GitHubHigh 8.8
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32641 · Other software · MasaCMS · reported by GitHubCritical 9.8
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Vim is an open source, command line text editor.CVE-2025-66476 · Other software · vim · reported by GitHubHigh 7.8
Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Cacti is an open source performance and fault management framework.CVE-2025-66399 · Other software · Cacti · reported by GitHubHigh 7.4
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Apptainer is an open source container platform.CVE-2025-65105 · Other software · apptainer · reported by GitHubMedium 4.5
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
- Product
- apptainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025SingularityCE and SingularityPRO are open source container platforms.CVE-2025-64750 · Other software · sylabs · reported by GitHubMedium 4.5
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.
- Product
- singularity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025JumpServer is an open source bastion host and an operation and maintenance security audit system.CVE-2025-58044 · Other software · jumpserver · reported by GitHubMedium 5.5
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.
- Product
- jumpserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems.CVE-2025-61915 · Other software · OpenPrinting · reported by GitHubMedium 6
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.
- Product
- cups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems.CVE-2025-58436 · Other software · OpenPrinting · reported by GitHubMedium 5.1
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.
- Product
- cups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025ClipBucket v5 is an open source video sharing platform.CVE-2025-65113 · Other software · MacWarrior · reported by GitHubMedium 6.5
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows any unauthenticated user to flag any content (users, videos, photos, collections) on the platform. This can lead to mass flagging attacks, content disruption, and moderation system abuse. This issue has been patched in version 5.5.2 - #164.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Core Bot Is an Open Source discord bot made for maple hospital servers.CVE-2025-65957 · Other software · Intercore-Productions · reported by GitHubHigh 8.8
Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using environment variables, but there are cases in code (error handling, summaries, webhooks) where configuration summaries may inadvertently leak sensitive data (e.g., by failing to redact data in summary embeds or logs). This issue has been patched via commit dffe050.
- Product
- Core-Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025GeoServer is an open source server that allows users to share and edit geospatial data.CVE-2025-21621 · Other software · geoserver · reported by GitHubMedium 6.1
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. This issue has been patched in version 2.25.0.
- Product
- geoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Contao is an Open Source CMS.CVE-2025-65961 · Other software · contao · reported by GitHubLow 3.3
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Contao is an Open Source CMS.CVE-2025-65960 · Other software · contao · reported by GitHubMedium 6.6
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025OpenBao is an open source identity-based secrets management system.CVE-2025-64761 · Other software · openbao · reported by GitHubHigh 7.5
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the root namespace has access to identity/groups endpoints and an operator does not have policy access. Otherwise, an operator with policy access could create or modify an existing policy to grant root-equivalent permissions through the sudo capability. This issue has been patched in version 2.4.4.
- Product
- openbao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2025-65111 · Other software · authzed · reported by GitHubLow 2.9
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Minder is an open source software supply chain security platform.CVE-2025-65109 · Other software · mindersec · reported by GitHubHigh 8.5
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
- Product
- minder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Langfuse is an open source large language model engineering platform.CVE-2025-65107 · Other software · langfuse · reported by GitHubMedium 6.5
Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.
- Product
- langfuse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025PJSIP is a free and open source multimedia communication library.CVE-2025-65102 · Other software · pjsip · reported by GitHubHigh 8.7
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Wazuh is a free and open source platform used for threat prevention, detection, and response.CVE-2025-64169 · Other software · wazuh · reported by GitHubMedium 5.1
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fim_alert() implementation does not check whether oldsum->md5 is NULL or not before dereferencing it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. This issue has been patched in version 4.12.0.
- Product
- wazuh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Wazuh is a free and open source platform used for threat prevention, detection, and response.CVE-2025-54866 · Other software · wazuh · reported by GitHubLow 1.8
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in version 4.13.0.
- Product
- wazuh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Wazuh is a free and open source platform used for threat prevention, detection, and response.CVE-2025-30201 · Other software · wazuh · reported by GitHubHigh 7.7
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
- Product
- wazuh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Wazuh is a security detection, visibility, and compliance open source project.CVE-2025-64483 · Other software · wazuh · reported by GitHubMedium 5.3
Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0.
- Product
- wazuh-dashboard-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Dataease is an open source data visualization analysis tool.CVE-2025-64428 · Other software · dataease · reported by GitHubHigh 8.9
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025ClipBucket v5 is an open source video sharing platform.CVE-2025-62709 · Other software · MacWarrior · reported by GitHubMedium 6.8
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because Host is a client-controlled header, an attacker can supply an arbitrary Host value. This allows an attacker to cause password-reset links (sent by forget.php) to be generated with the attacker’s domain. If a victim follows that link and enters their activation code on the attacker-controlled domain, the attacker can capture the code and use it to reset the victim’s password and take over the account. This issue has been patched in version 5.5.2#162.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2025-65103 · Other software · devcode-it · reported by GitHubHigh 8.8
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Piwigo is a full featured open source photo gallery application for the web.CVE-2025-62406 · Other software · Piwigo · reported by GitHubHigh 8.1
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validatCVE-2025-63800 · Other software · Opensourcepos · reported by MITREHigh 7.5
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to iCVE-2025-64758 · Other software · DependencyTrack · reported by GitHubMedium 4.8
@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6.
- Product
- frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-62519 · Other software · thorsten · reported by GitHubHigh 7.2
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Jitsi Meet is an open source video conferencing application.CVE-2025-64754 · Other software · jitsi · reported by GitHubLow 2.7
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.