Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,721 results · page 13 of 55
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-66220 · Other software · envoyproxy · reported by GitHubMedium 5
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-64763 · Other software · envoyproxy · reported by GitHubLow 3.7
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-64527 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new CVE-2025-13762 · Other software · CyberArk · reported by cve_disclosure@tech.gov.sgMedium 4.8
Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305.
- Product
- CyberArk Secure Web Sessions Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromewebstore.google.commicrosoftedge.microsoft.com
Nov 25, 2025NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform.CVE-2025-65953 · Other software · nanomq · reported by GitHubMedium 6
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in src/sp/transport/mqtt/broker_tcp.c). The vulnerability is due to improper resource management and premature cleanup of message and pipe structures under specific malformed MQTTV5 retain message traffic conditions. This issue has been patched in version 0.22.5.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.CVE-2025-10571 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.4
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
- Product
- ABB Ability Edgenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0.CVE-2025-13469 · Other software · Public Knowledge Project · reported by VulDBMedium 4.8
A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument manualInstructions leads to cross site scripting. The attack can be initiated remotely. You should upgrade the affected component.
- Product
- omp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' apCVE-2025-9317 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.3
The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64714 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64711 · Other software · PrivateBin · reported by GitHubLow 3.9
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session (self-XSS). This allows an attacker who can entice a victim to drag or otherwise attach such a file to exfiltrate plaintext, encryption keys, or stored pastes before they are encrypted or sent. Certain conditions must exist for the vulnerability to be exploitable. Only macOS or Linux users are affected, due to the way the `>` character is treated in a file name on Windows. The PrivateBin instance needs to have file upload enabled. An attacker needs to have access to the local file system or somehow convince the user to create (or download) a malicious file (name). An attacker needs to convince the user to attach that malicious file to PrivateBin. Any Mac / Linux user who can be tricked into dragging a maliciously named file into the editor is impacted; code runs in the origin of the PrivateBin instance they are using. Attackers
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10).CVE-2025-40827 · Other software · Siemens · reported by productcert@siemens.comHigh 8.5
A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected application is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system.
- Product
- Siemens Software Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Nov 11, 2025A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11).CVE-2025-40744 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
- Product
- Solid Edge SE2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Nov 11, 2025The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges.CVE-2025-9055 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.4
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Document Pro Elementor – Documentation & Knowledge Base: Information ExposureCVE-2025-11997 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service.
- Product
- Document Pro Elementor – Documentation & Knowledge Base
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Document Pro Elementor – Documentation & Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulaCVE-2025-64302 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.
- Product
- DeviceOn/iEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 6, 2025Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution withCVE-2025-62630 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
- Product
- DeviceOn/iEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 6, 2025Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution withCVE-2025-59171 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
- Product
- DeviceOn/iEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 6, 2025Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, CVE-2025-58423 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.
- Product
- DeviceOn/iEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Oct 31, 2025Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-60711 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-62796 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Constellation is the first Confidential Kubernetes.CVE-2025-58356 · Other software · edgelesssys · reported by GitHubHigh 8.3
Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.
- Product
- constellation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025Edge CPT: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62868 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.
- Product
- Edge CPT
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Edge CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2025Captive Portal can expose sensitive informationCVE-2025-6980 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
Captive Portal can expose sensitive information
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Captive Portal can allow authentication bypassCVE-2025-6979 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Captive Portal can allow authentication bypass
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Diagnostics command injection vulnerabilityCVE-2025-6978 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.2
Diagnostics command injection vulnerability
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions,CVE-2025-62255 · Other software · Liferay · reported by security@liferay.comLow 2
Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Knowledge Base: Deserialization of Untrusted DataCVE-2025-60228 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.
- Product
- Knowledge Base
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2025The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should CVE-2025-11757 · Other software · CloudEdge · reported by ics-cert@hq.dhs.govHigh 8.7
The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key information to connect to the cameras from peer to peer.
- Product
- CloudEdge App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Envoy is an open source edge and service proxy.CVE-2025-62504 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Envoy is a cloud-native, open source edge and service proxy.CVE-2025-62409 · Other software · envoyproxy · reported by GitHubMedium 6.6
Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6).CVE-2025-40812 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
- Product
- Solid Edge SE2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 14, 2025A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6).CVE-2025-40811 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
- Product
- Solid Edge SE2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 14, 2025A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6).CVE-2025-40810 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
- Product
- Solid Edge SE2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 14, 2025A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6).CVE-2025-40809 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
- Product
- Solid Edge SE2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 2, 2025The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI CoCVE-2025-59406 · Other software · Flocksafety · reported by MITREMedium 6.2
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
- Product
- Flock Safety
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Oct 1, 2025RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture.CVE-2025-61588 · Other software · risc0 · reported by GitHubCritical 9.3
RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9, risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3.
- Product
- risc0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled.CVE-2025-59408 · Other software · Flocksafety · reported by MITREHigh 7.3
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modified firmware with no cryptographic protections.
- Product
- Bravo Compute BOX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Sep 25, 2025Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked.CVE-2025-59404 · Other software · Flocksafety · reported by MITREHigh 7.5
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked. This permits bypass of Android Verified Boot (AVB) and allows direct modification of partitions.
- Product
- Bravo Compute BOX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Sep 25, 2025Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode.CVE-2025-59402 · Other software · Flocksafety · reported by MITREMedium 5.4
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.
- Product
- Bravo Compute BOX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Sep 25, 2025Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability.CVE-2025-26482 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
- Product
- PowerEdge R770
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2025-59251 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to byCVE-2025-20339 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
- Product
- Cisco SD-WAN vEdge Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 22, 2025AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices.CVE-2025-57601 · Other software · reported by MITRECritical 9.8
AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files.CVE-2025-37131 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system.CVE-2025-37130 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilitiesCVE-2025-37129 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.7
A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running pCVE-2025-37128 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell aCVE-2025-37127 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary coCVE-2025-37126 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS).CVE-2025-37125 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.