Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,305 results · page 12 of 47
Jul 11, 2025The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.CVE-2025-30023 · Other software · Axis Communications AB · reported by product-security@axis.comCritical 9
The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications.CVE-2025-2520 · Other software · Honeywell · reported by psirt@honeywell.comHigh 7.5
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service. Honeywell recommends updating to the most recent version of Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
- Product
- C300 PCNT02
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.CVE-2025-49464 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.
- Product
- Zoom Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of informatiCVE-2025-49463 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access.CVE-2025-49462 · Other software · Zoom Communications Inc. · reported by security@zoom.usLow 3.5
Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access.CVE-2025-46789 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access.
- Product
- Zoom Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via networCVE-2025-46788 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.4
Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.
- Product
- Zoom Workplace for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025All communication between the VNC server and client(s) is unencrypted.CVE-2025-27457 · Other software · Endress+Hauser · reported by psirt@sick.deMedium 6.5
All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data.
- Product
- Endress+Hauser MEAC300-FNADE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could CVE-2025-20309 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 10
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
- Product
- Cisco Unified Communications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 28, 2025The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mCVE-2023-29113 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 6.3
The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific porCVE-2025-5310 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordociocisa.sharepoint.comcisa.gov
Jun 24, 2025Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP.CVE-2025-5087 · Other software · Kaleris · reported by ics-cert@hq.dhs.govMedium 6
Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credentials.
- Product
- Navis N4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Perform early GT MMIO initialization to read GMDID VFs need to communicate withCVE-2025-38036 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Perform early GT MMIO initialization to read GMDID VFs need to communicate with the GuC to obtain the GMDID value and existing GuC functions used for that assume that the GT has it's MMIO members already setup. However, due to recent refactoring the gt->mmio is initialized later, and any attempt by the VF to use xe_mmio_read|write() from GuC functions will lead to NPD crash due to unset MMIO register address: [] xe 0000:00:02.1: [drm] Running in SR-IOV VF mode [] xe 0000:00:02.1: [drm] GT0: sending H2G MMIO 0x5507 [] BUG: unable to handle page fault for address: 0000000000190240 Since we are already tweaking the id and type of the primary GT to mimic it's a Media GT before initializing the GuC communication, we can also call xe_gt_mmio_init() to perform early setup of the gt->mmio which will make those GuC functions work again.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 12, 2025All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver.CVE-2025-49183 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to CVE-2025-35978 · Other software · Fujitsu Client Computing Limited · reported by vultures@jpcert.or.jpMedium 6.9
Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.
- Product
- UpdateNavi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordazby.fmworld.netjvn.jp
Jun 10, 2025An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all CVE-2025-22251 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.1
An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Jun 9, 2025Pion Interceptor is a framework for building RTP/RTCP communication software.CVE-2025-49140 · Other software · pion · reported by GitHubHigh 7.5
Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.
- Product
- interceptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the uCVE-2025-20278 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands on the CLI of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.
- Product
- Cisco Finesse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 2, 2025During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed CVE-2025-0358 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.8
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour confiCVE-2025-0325 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.3
A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.CVE-2025-0324 · Other software · Axis Communications AB · reported by product-security@axis.comCritical 9.4
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communicaCVE-2023-41591 · Other software · Opennetworking · reported by MITRECritical 9.8
An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comwiki.onosproject.org
May 21, 2025A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privilegeCVE-2025-20112 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.1
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
- Product
- Cisco Emergency Responder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 20, 2025IBM Security ReaQta EDR 3.12 could allow an attacker to spoof a trusted entity by interfering with the communication path between the host and client.CVE-2023-33861 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Security ReaQta EDR 3.12 could allow an attacker to spoof a trusted entity by interfering with the communication path between the host and client.
- Product
- Security ReaQta EDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.CVE-2025-46786 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-46785 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30668 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30667 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30666 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30665 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2025-30664 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2025-30663 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.8
Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus compCVE-2025-3931 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 7, 2025Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive informatioCVE-2025-20977 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability.
- Product
- Samsung Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 7, 2025Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-20959 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sensitive information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 7, 2025Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-20954 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 29, 2025CWE-250: Execution with Unnecessary PrivilegesCVE-2025-23181 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 8
CWE-250: Execution with Unnecessary Privileges
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-250: Execution with Unnecessary PrivilegesCVE-2025-23180 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 8
CWE-250: Execution with Unnecessary Privileges
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-798: Use of Hard-coded CredentialsCVE-2025-23179 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilMedium 5.5
CWE-798: Use of Hard-coded Credentials
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-923: Improper Restriction of Communication Channel to Intended EndpointsCVE-2025-23178 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 7.6
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-427: Uncontrolled Search Path ElementCVE-2025-23177 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 7.6
CWE-427: Uncontrolled Search Path Element
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between tCVE-2025-3200 · Other software · Wiesemann & Theis · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.
- Product
- Com-Server++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints.CVE-2025-31144 · Other software · SIOS Technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.
- Product
- Quick Agent V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmfp-support.sios.jp
Apr 23, 2025Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using.CVE-2025-1056 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.1
Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop CVE-2025-0926 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 5.9
Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commanCVE-2025-3651 · Other software · iManage · reported by 5d978718-751a-428d-ac8e-4f9445ebfd11Critical 9.3
Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commands via unauthorized access to the Agent service. This has been remediated in Work Desktop for Mac version 10.8.2.33.
- Product
- Work Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).CVE-2025-30729 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Order and Service Management. CVSS 3.1 Base Score 5.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).
- Product
- Oracle Communications Order and Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation.CVE-2024-42193 · Other software · HCL Software · reported by psirt@hcl.comLow 2.1
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized access.
- Product
- HCL BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 8, 2025Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30671 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30670 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.