Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,261 results · page 75 of 306
Sep 16, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection.CVE-2024-13174 · Other software · E1 Informatics · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection. This issue affects Web Application: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
- Product
- Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 16, 2025The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with.CVE-2025-10015 · Other software · Sparkle Project · reported by cvd@cert.plMedium 4.8
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2
- Product
- Sparkle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs.CVE-2025-4234 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 2.4
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
- Product
- Cortex XDR Microsoft 365 Defender Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Sep 12, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-59139 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the `Content-Length` header even when a `Transfer-Encoding: chunked` header was also included. According to the HTTP specification, `Content-Length` must be ignored in such cases. This discrepancy could allow oversized request bodies to bypass the configured limit. Most standards-compliant runtimes and reverse proxies may reject such malformed requests with `400 Bad Request`, so the practical impact depends on the runtime and deployment environment. If body size limits are used as a safeguard against large or malicious requests, this flaw could allow attackers to send oversized request bodies. The primary risk is denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests. The implementation has been updated to align with the HTTP specification, ensuring that `Transfer-Encoding` takes precedence over `Content-Length`. The issue is fixed in Hono v4.9.7,
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-10365 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
- Product
- 3080ipx-10G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-10364 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
- Product
- 3080ipx-10G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Flask-AppBuilder is an application development framework.CVE-2025-58065 · Other software · dpgaspar · reported by GitHubMedium 6.5
Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2025-59052 · Other software · angular · reported by GitHubHigh 7.1
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability.CVE-2025-43725 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025The upload endpoint insufficiently validates the 'Upload-Key' request header.CVE-2025-41714 · Other software · Welotec · reported by info@cert.vde.comHigh 8.8
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.
- Product
- SmartEMS Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025PyInstaller bundles a Python application and all its dependencies into a single package.CVE-2025-59042 · Other software · pyinstaller · reported by GitHubHigh 7
PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path` during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryption while this entry is still present in `sys.path`, an application built with PyInstaller < 6.0.0 may be tricked by an unprivileged attacker into executing arbitrary python code when **all** of the following conditions are met. First, the application is built with PyInstaller < 6.0.0; both onedir and onefile mode are affected. Second, the optional bytecode encryption code feature was not enabled during the application build. Third, the attacker can create files/directories in the same directory where the executable is located. Fourth, the filesystem supports creation of files/directories that contain `?` in their name (i.e., non-Windows systems). Fifth, the attacker is able to determine the offset at which the PYZ archive is embedded in the executable. The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's
- Product
- pyinstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM levCVE-2025-43491 · Other software · HP, Inc. · reported by hp-security-alert@hp.comHigh 7.3
A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
- Product
- Poly Lens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025TinyEnv is an environment variable loader for PHP applications.CVE-2025-58759 · Other software · datahihi1 · reported by GitHubMedium 5.1
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. The issue is fixed in v1.0.11. Users should upgrade to the latest patched version. As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
- Product
- tiny-env
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025TinyEnv is an environment variable loader for PHP applications.CVE-2025-58758 · Other software · datahihi1 · reported by GitHubMedium 5.1
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.
- Product
- tiny-env
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modifCVE-2025-42958 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities iCVE-2025-42927 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.4
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.
- Product
- SAP NetWeaver AS Java (Adobe Document Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.UpoCVE-2025-42926 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parametersCVE-2025-42918 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability
- Product
- SAP NetWeaver Application Server for ABAP (Background Processing)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilegeCVE-2025-42917 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.
- Product
- SAP HCM (Approve Timesheets Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42914 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP HCM (My Timesheet Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42913 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP HCM (My Timesheet Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2025-42912 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.
- Product
- SAP HCM (My Timesheet Fiori 2.0 application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database.CVE-2025-58450 · Other software · prest · reported by GitHubCritical 9.3
pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.
- Product
- prest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The XWiki blog application allows users of the XWiki platform to create and manage blog posts.CVE-2025-58365 · Other software · xwiki-contrib · reported by GitHubHigh 8.7
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type `Blog.BlogPostClass` to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available.
- Product
- application-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy.CVE-2025-59033 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.4
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlearn.microsoft.comlearn.microsoft.com
Sep 8, 2025A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the reCVE-2025-36854 · Computers, phones & browsers · Microsoft · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cHigh 8.1
A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html , Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.8, 9.0.0-preview.1.24081.5 <= 9.0.0.RC.1 as represented in CVE-2024-38229 https://www.cve.org/CVERecord . Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and rede
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comherodevs.com
Sep 6, 2025Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.CVE-2025-58445 · Other software · runatlantis · reported by GitHubMedium 6.9
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
- Product
- atlantis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA)CVE-2023-31322 · Other software · AMD · reported by psirt@amd.comHigh 8.7
Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA) potentially leading to a read or write to shared memory resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 7000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Frappe is a full-stack web application framework.CVE-2025-58375 · Other software · frappe · reported by GitHubHigh 8.1
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-58362 · Other software · honojs · reported by GitHubHigh 7.5
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2025-55305 · Other software · electron · reported by GitHubMedium 6.1
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications.CVE-2025-58361 · Other software · MarceloTessaro · reported by GitHubCritical 9.3
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips `javascript:` and a few patterns. `data:` URLs (for example data:image/svg+xml,…) still pass. If a sanitized value is used in href/src, an attacker can execute a script. There is currently no fix for this issue.
- Product
- promptcraft-forge-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications.CVE-2025-58353 · Other software · MarceloTessaro · reported by GitHubHigh 8.2
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character tokens and each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sanitized” value may still contain an executable payload when used in href/src (or injected into the DOM). There is currently no fix for this issue.
- Product
- promptcraft-forge-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation.CVE-2025-48538 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL BypasCVE-2025-26436 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Sep 4, 2025Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store.CVE-2024-34598 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.7
Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store.
- Product
- GoodLock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Sep 4, 2025Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2025-58057 · Other software · netty · reported by GitHubMedium 6.9
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.CVE-2025-58056 · Other software · netty · reported by GitHubLow 2.9
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55748 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55747 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original UCVE-2025-56139 · Other software · Linkedin · reported by MITREMedium 5.3
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different URL, which can be malicious. This UI misrepresentation enables attackers to deceive users by displaying trusted previews for harmful links, facilitating phishing attacks and user confusion.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhdhrmi.blogspot.comhdhrmi.blogspot.com
Sep 3, 2025SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.CVE-2025-9822 · Other software · Mautic · reported by security@mautic.orgMedium 5.5
SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.CVE-2023-21481 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.4
Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Sep 3, 2025Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs.CVE-2025-58176 · Other software · OpenAgentPlatform · reported by GitHubHigh 8.8
Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object. An attacker can exploit the vulnerability in the following two scenarios: a victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or a victim clicks on such a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes Dive's custom URL handler (dive:), which launches the Dive app and processes the crafted URL, leading to arbitrary code execution on the victim’s machine. This vulnerability is caused by improper processing of custom url. This is fixed in version 0.9.4.
- Product
- Dive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to CVE-2025-22442 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commandCVE-2025-55373 · Other software · Beakon · reported by MITREMedium 5.3
Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights.
- Product
- Beakon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeakon.com.aupacketstorm.news
Sep 2, 2025An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2025-55372 · Other software · Beakon · reported by MITREMedium 5.3
An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- Beakon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist butCVE-2025-52548 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 6.9
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication.CVE-2025-52543 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 5.3
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication.CVE-2025-44017 · Other software · Gunosy Inc. · reported by vultures@jpcert.or.jpMedium 5.1
"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token).
- Product
- "Gunosy" App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.