Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,203 results · page 10 of 45
Nov 12, 2025A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certaiCVE-2025-10495 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.7
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability.CVE-2025-12489 · Other software · evernote-mcp-server · reported by zdi-disclosures@trendmicro.comHigh 7.8
evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913.
- Product
- evernote-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Nov 3, 2025An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.CVE-2025-45663 · Other software · Netsurf-browser · reported by MITREMedium 6.5
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.
- Product
- Netsurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnetsurf-browser.org
Nov 3, 2025NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.CVE-2025-29699 · Other software · Netsurf-browser · reported by MITREMedium 6.5
NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.
- Product
- Netsurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnetsurf-browser.org
Nov 3, 2025An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize functionCVE-2024-51317 · Other software · Netsurf-browser · reported by MITREMedium 6.5
An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function
- Product
- Netsurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnetsurf-browser.org
Oct 30, 2025In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect theCVE-2025-48980 · Other software · Brave · reported by support@hackerone.comMedium 6.5
In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.
- Product
- Desktop Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers.CVE-2024-13993 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC caCVE-2025-12380 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 23, 2025A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crCVE-2025-60837 · Other software · Mingsoft · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Oct 22, 2025Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browserCVE-2025-11844 · Other software · huggingface · reported by security@huntr.devMedium 5.4
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.
- Product
- huggingface/smolagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-55072 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-54859 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.6
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-54760 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.CVE-2025-52583 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 5.1
Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-24833 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.CVE-2025-62585 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-62584 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.CVE-2025-62583 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control.CVE-2025-9063 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7
An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more.
- Product
- PanelView Plus 7 Performance Series B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 14, 2025A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a CVE-2025-11712 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 14, 2025A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised procesCVE-2025-11710 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2025SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when acCVE-2025-42901 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.
- Product
- SAP Application Server for ABAP (BAPI Browser)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.CVE-2025-61927 · Other software · capricorn86 · reported by GitHubHigh 7.2
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.
- Product
- happy-dom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackCVE-2025-9868 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.7
Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials CVE-2025-48464 · Other software · DuckDuckGo · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 4.7
Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.
- Product
- DuckDuckGo Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuxplorer.comcsa.gov.sg
Sep 24, 2025A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key proCVE-2025-57354 · Other software · reported by MITREMedium 6.5
A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying maliciously crafted keys containing prototype chain elements (e.g., __proto__ ), leading to prototype pollution. This weakness enables adversaries to inject arbitrary properties into the JavaScript Object prototype through the first parameter of the translate method when combined with specific separator configurations, potentially resulting in denial-of-service conditions or remote code execution in vulnerable applications. The issue arises from the library's failure to properly validate or neutralize special characters in translation key inputs before processing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2025Browser Sniff: Cross-Site Request ForgeryCVE-2025-9883 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Browser Sniff
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Browser Sniff to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 11, 2025Axios is a promise based HTTP client for the browser and Node.js.CVE-2025-58754 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code wiCVE-2025-9201 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code with elevated privileges.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.CVE-2025-9288 · Other software · Browserify · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158Critical 9.1
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
- Product
- Sha.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.CVE-2025-9287 · Other software · Browserify · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158Critical 9.1
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
- Product
- Cipher-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2.CVE-2017-20199 · Other software · Buttercup · reported by VulDBLow 1.3
A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 1.0.1 addresses this issue. The patch is identified as 89. Upgrading the affected component is recommended. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- buttercup-browser-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A security issue exists within the FactoryTalk Linx Network Browser.CVE-2025-7972 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.4
A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
- Product
- FactoryTalk® Linx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 13, 2025A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the lCVE-2025-48500 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication.CVE-2025-54885 · Other software · simbo1905 · reported by GitHubMedium 6.9
Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. This is fixed in version 2.0.1.
- Product
- thinbus-srp-npm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass AutheCVE-2025-8616 · Other software · OpenText · reported by security@opentext.comMedium 6.1
A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0.
- Product
- Advanced Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstaging.docs.microfocus.com
Aug 6, 2025CWE-284: Improper Access ControlCVE-2025-46391 · Other software · Emby · reported by cna@cyber.gov.ilMedium 6.5
CWE-284: Improper Access Control
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-204: Observable Response DiscrepancyCVE-2025-46390 · Other software · Emby · reported by cna@cyber.gov.ilHigh 7.5
CWE-204: Observable Response Discrepancy
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-620: Unverified Password ChangeCVE-2025-46389 · Other software · Emby · reported by cna@cyber.gov.ilMedium 6.5
CWE-620: Unverified Password Change
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-200 Exposure of Sensitive Information to an Unauthorized ActorCVE-2025-46388 · Other software · Emby · reported by cna@cyber.gov.ilMedium 4.3
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-639 Authorization Bypass Through User-Controlled KeyCVE-2025-46387 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.8
CWE-639 Authorization Bypass Through User-Controlled Key
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-639 Authorization Bypass Through User-Controlled KeyCVE-2025-46386 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.8
CWE-639 Authorization Bypass Through User-Controlled Key
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page.CVE-2012-10032 · Other software · Maxthon International Ltd. · reported by VulnCheckHigh 8.7
Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection.
- Product
- Maxthon3 Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.malerisch.netraw.githubusercontent.com
Aug 1, 2025webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments.CVE-2025-54590 · Other software · silverbucket · reported by GitHubMedium 6.9
webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1.
- Product
- webfinger.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025ViewVC is a browser interface for CVS and Subversion version control repositories.CVE-2025-54141 · Other software · viewvc · reported by GitHubHigh 7.5
ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.
- Product
- viewvc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitteCVE-2025-51464 · Other software · Aimstack · reported by MITREHigh 8.8
Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().
- Product
- AIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a weCVE-2025-6248 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.1
A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a web page with specially crafted content.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and LenCVE-2025-4657 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.4
A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local attacker with elevated privileges to execute arbitrary code.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.CVE-2025-53893 · Other software · filebrowser · reported by GitHubHigh 7.7
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint `Filebrowser-Server-IP:PORT/files/{file-name}` . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive. As of time of publication, no known patches are available.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.CVE-2025-53826 · Other software · filebrowser · reported by GitHubHigh 7.7
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.