Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 16 of 52
Jun 10, 2025InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-43558 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2025-32715 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2025-32710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-serviceCVE-2025-30321 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-30317 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.CVE-2025-47966 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879).CVE-2025-31359 · Other software · Parallels · reported by talos-cna@cisco.comHigh 8.8
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
- Product
- Parallels Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 3, 2025A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).CVE-2024-54189 · Other software · Parallels · reported by talos-cna@cisco.comHigh 7.8
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
- Product
- Parallels Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 3, 2025A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).CVE-2024-52561 · Other software · Parallels · reported by talos-cna@cisco.comHigh 7.8
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
- Product
- Parallels Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 3, 2025A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740).CVE-2024-36486 · Other software · Parallels · reported by talos-cna@cisco.comHigh 7.8
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
- Product
- Parallels Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 2, 2025The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTMLCVE-2024-57783 · Other software · alexpinel · reported by MITREHigh 8.1
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.
- Product
- Dot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.CVE-2024-12168 · Other software · Yandex · reported by browser-security@yandex-team.ruHigh 8.4
Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
- Product
- Telemost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682CVE-2023-26226 · Other software · Yandex · reported by browser-security@yandex-team.ruHigh 7.4
A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated useCVE-2025-5334 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A flaw was found in gnome-remote-desktop.CVE-2025-5024 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 21, 2025GitHub Desktop is an open-source, Electron-based GitHub app designed for git development.CVE-2025-48064 · Other software · desktop · reported by GitHubLow 3.3
GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network share. This affects GitHub Desktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file diff in the history view GitHub Desktop will call `git log` or `git diff` with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. As a security precaution Git will attempt to fully resolve the old and new path via `realpath`, traversing symlinks, to ensure that the resolved paths reside within the repository working directory. This can lead to Git attempting to access a path that resides on a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information such as the computer name, the currently signed in (Windows) user name, and an NTLM hash. GitHub Desktop 3.4.20 and later fix this vulnerability. The beta channel includes the
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025Nextcloud Desktop is the desktop sync client for Nextcloud.CVE-2025-47792 · Other software · nextcloud · reported by GitHubMedium 5
Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - SmaCVE-2025-27525 · Other software · Hitachi · reported by hirt@hitachi.co.jpLow 3.9
Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
- Product
- JP1/IT Desktop Management 2 - Smart Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart DeCVE-2025-27524 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 5.3
Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
- Product
- JP1/IT Desktop Management 2 - Smart Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device ManagerCVE-2025-27523 · Other software · Hitachi · reported by hirt@hitachi.co.jpHigh 8.7
XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
- Product
- JP1/IT Desktop Management 2 - Smart Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 20255ire is a cross-platform desktop artificial intelligence assistant and model context protocol client.CVE-2025-47777 · Other software · nanbingxyz · reported by GitHubCritical 9.6
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electron protocol handling and exposed Electron APIs. All users of 5ire client versions prior to patched releases, particularly those interacting with untrusted chatbots or pasting external content, are affected. Version 0.11.1 contains a patch for the issue.
- Product
- 5ire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executCVE-2025-30326 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code executiCVE-2025-30325 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary codeCVE-2025-30324 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of CVE-2025-27197 · Other software · Adobe · reported by AdobeHigh 7.8
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Lightroom Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.CVE-2025-30394 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-serviceCVE-2025-30320 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-serviceCVE-2025-30319 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-30318 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Dreamweaver Desktop versions 21.4 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result iCVE-2025-30310 · Other software · Adobe · reported by AdobeHigh 7.8
Dreamweaver Desktop versions 21.4 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-29967 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.CVE-2025-29966 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-29831 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.CVE-2025-26677 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code.CVE-2025-1087 · Other software · Kong Inc. · reported by 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbCritical 9.3
Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.
- Product
- Insomnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtantosec.com
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriCVE-2025-3463 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allCVE-2025-3462 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Use-After-Free vulnerability exists in the SLDPRT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025.CVE-2025-1884 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 7.8
Use-After-Free vulnerability exists in the SLDPRT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.
- Product
- SOLIDWORKS eDrawings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Out-Of-Bounds Write vulnerability exists in the OBJ file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025.CVE-2025-1883 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 7.8
Out-Of-Bounds Write vulnerability exists in the OBJ file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted OBJÂ file.
- Product
- SOLIDWORKS eDrawings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.CVE-2025-21416 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Virtual Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries.CVE-2025-4095 · Other software · Docker · reported by security@docker.comMedium 4.3
Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS configuration profile is used to enforce organization sign-in, the RAM policies are not being applied, which would allow Docker Desktop users to pull down unapproved, and potentially malicious images from any registry.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive inCVE-2025-3911 · Other software · Docker · reported by security@docker.comMedium 5.2
Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. Starting with version 4.41.0, Docker Desktop no longer logs environment variables set by the user.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privilegesCVE-2025-3224 · Other software · Docker · reported by security@docker.comHigh 7.3
A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\ProgramData\Docker\config with high privileges. However, this directory often does not exist by default, and C:\ProgramData\ allows normal users to create new directories. By creating a malicious Docker\config folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.CVE-2025-43903 · Other software · freedesktop · reported by MITREMedium 4.3
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Product
- Poppler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Apr 17, 2025Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commanCVE-2025-3651 · Other software · iManage · reported by 5d978718-751a-428d-ac8e-4f9445ebfd11Critical 9.3
Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commands via unauthorized access to the Agent service. This has been remediated in Work Desktop for Mac version 10.8.2.33.
- Product
- Work Desktop for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.CVE-2025-29817 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub.CVE-2025-32428 · Other software · jupyterhub · reported by GitHubCritical 9
Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.
- Product
- jupyter-remote-desktop-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.CVE-2025-27487 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-27482 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2025-27480 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.