Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 1 of 6
Oct 13, 2026Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2026-83679 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.CVE-2026-70264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.
- Product
- Windows Defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.CVE-2026-105726 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.
- Product
- Microsoft Defender for Endpoint for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2026-70568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.CVE-2026-68831 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Defender Security: Does not restrict a network-wide setting to network administratorsCVE-2026-19225 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Defender Security
- Fixed in
- 6.2.0
- What to do
- Update Defender Security to 6.2.0 or newer.
Aug 14, 2026Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".CVE-2026-69414 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Aug 11, 2026Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.CVE-2026-61936 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.CVE-2026-54123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address.CVE-2026-46415 · Other software · JasonLovesDoggo · reported by GitHubHigh 8.2
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for
- Product
- caddy-defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaddyserver.comcaddyserver.com
Jul 14, 2026Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.CVE-2026-56178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.CVE-2026-50658 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.CVE-2026-50657 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.CVE-2026-55012 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.CVE-2026-55011 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet SCVE-2026-6851 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 7
An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".CVE-2026-50656 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Jun 9, 2026Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.CVE-2026-45647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.cCVE-2026-10047 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.5
The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer by 65,519 bytes. The IRET frame push can therefore write past the end of the buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
- Product
- Napoca bare-metal hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/gueCVE-2026-10046 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.5
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
- Product
- Napoca bare-metal hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.CVE-2026-45584 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Microsoft Defender Denial of Service VulnerabilityCVE-2026-45498 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
- Product
- Defender
- On CISA’s list since
- May 20, 2026 (federal fix deadline Jun 3, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
May 20, 2026Microsoft Defender Link Following VulnerabilityCVE-2026-41091 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
- Product
- Defender
- On CISA’s list since
- May 20, 2026 (federal fix deadline Jun 3, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Apr 14, 2026Microsoft Defender Insufficient Granularity of Access Control VulnerabilityCVE-2026-33825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
- Product
- Defender
- On CISA’s list since
- Apr 22, 2026 (federal fix deadline May 6, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Apr 8, 2026Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.CVE-2026-5082 · Other software · TOKUHIROM · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Amon2::Plugin::Web::CSRFDefender versions before 7.00 were part of Amon2, which was vulnerable to insecure session ids due to CVE-2025-15604. Note that the author has deprecated this module.
- Product
- Amon2::Plugin::Web::CSRFDefender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Feb 10, 2026Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent netwoCVE-2026-21537 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges.CVE-2025-7073 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.8
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.CVE-2025-62468 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
- Product
- Windows 11 version 22H3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.CVE-2025-64650 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Microsoft Defender Portal Spoofing VulnerabilityCVE-2025-62459 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Defender Portal Spoofing Vulnerability
- Product
- Microsoft 365 Defender Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative prCVE-2025-5317 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.8
An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.
- Product
- Endpoint Security Tools for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.CVE-2025-59497 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs.CVE-2025-4234 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 2.4
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
- Product
- Cortex XDR Microsoft 365 Defender Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-54915 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-54109 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-54104 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-54094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-53810 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2025-53808 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy.CVE-2025-59033 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.4
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlearn.microsoft.comlearn.microsoft.com
Sep 6, 2025Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentiaCVE-2025-0011 · Other software · AMD · reported by psirt@amd.comLow 3.3
Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality.
- Product
- AMD Ryzen™ 8000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss oCVE-2025-0009 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availability.
- Product
- AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure.CVE-2025-55740 · Other software · Anipaleja · reported by GitHubMedium 6.5
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
- Product
- nginx-defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.CVE-2025-47161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows deCVE-2025-0131 · Other software · OPSWAT · reported by psirt@paloaltonetworks.comHigh 7.1
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.
- Product
- MetaDefender Endpoint Security SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comopswat.com
May 13, 2025Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2025-26685 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network.
- Product
- Microsoft Defender for Identity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.CVE-2025-26684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highlyCVE-2024-22314 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.CVE-2025-26678 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode.CVE-2025-2245 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.9
A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
- Product
- GravityZone Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.