Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 17 of 52
Apr 8, 2025Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-27198 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2025-26671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced iCVE-2025-32365 · Other software · freedesktop · reported by MITREMedium 4
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
- Product
- Poppler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.orggitlab.freedesktop.org
Apr 5, 2025A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated wCVE-2025-32364 · Other software · freedesktop · reported by MITREMedium 4
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Product
- Poppler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.orggitlab.freedesktop.org
Apr 5, 2025A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler baseCVE-2025-30401 · Other software · Facebook · reported by cve-assign@fb.comMedium 6.7
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
- Product
- WhatsApp Desktop for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comwhatsapp.com
Apr 4, 2025Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UICVE-2025-2159 · Other software · M-Files Corporation · reported by security@m-files.comMedium 5.1
Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI
- Product
- M-Files Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Mar 26, 2025Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variCVE-2025-2600 · Other software · Devolutions · reported by security@devolutions.netMedium 6.8
Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without geCVE-2025-2562 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration diffCVE-2025-2528 · Other software · Devolutions · reported by security@devolutions.netLow 3.6
Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows.CVE-2025-2499 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default.CVE-2024-8196 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.8
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, CVE-2025-1398 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.3
Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2025Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.CVE-2025-30074 · Other software · Parallels · reported by MITREHigh 7.8
Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.
- Product
- Parallels Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows aCVE-2025-1636 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exportiCVE-2025-1635 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level acCVE-2025-1984 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fMedium 5.2
Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
- Product
- Xerox® Desktop Print Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2025-27179 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-27178 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-27177 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2025-27176 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-27175 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-27171 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-27166 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-24453 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-24452 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2025-26645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2025-24045 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2025-24035 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs.CVE-2025-1696 · Other software · Docker · reported by security@docker.comMedium 5.2
A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Mar 1, 2025ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build servCVE-2025-27554 · Other software · ToDesktop · reported by MITRECritical 9.9
ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred.
- Product
- ToDesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkibty.townnews.ycombinator.com
Feb 28, 2025GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memorCVE-2025-26263 · Other software · reported by MITREMedium 5.1
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgeovision.com.tw
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24889 · Other software · freedomofpress · reported by GitHubMedium 4.5
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a virtual machine on the SecureDrop Workstation could gain code execution in the `sd-log` virtual machine by sending a specially crafted log entry. The vulnerability is not exploitable remotely and requires an attacker to already have code execution on one of the other virtual machines (VMs) of the system. Due to the Workstation's underlying usage of Qubes for strong isolation, the vulnerability would have allowed lateral movement between any log-enabled VM and the `sd-log` VM, but no further. The SecureDrop workstation collects logs centrally in an isolated virtual machine named `sd-log` for easy export for support and debugging purposes. The `sd-log` VM is completely isolated from the internet and ingests logs via a narrow Qubes RPC policy that allows for specific inter-VM communication via the Xen vchan protocol used by Qubes's qrexec mechanism. A path traversal bug was found in the logic used to choose where to write the log file for a specific
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24888 · Other software · freedomofpress · reported by GitHubHigh 8.1
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine (`sd-app`). SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. The SecureDrop Client runs in a dedicated Qubes virtual machine, named `sd-app`, as part of the SecureDrop Workstation. The private OpenPGP key used to decrypt submissions and replies is stored in a separate virtual machine and never accessed directly. The vulnerability lies in the code responsible for downloading replies. The filename of the reply is obtained from the `Content-Disposition` HTTP header and used to write the encrypted reply on disk. Note that filenames are generated and sanitized server-side, and files are downloaded in an encry
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operaCVE-2024-21971 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading to denial of service.
- Product
- AMD Ryzen™ 5000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption CVE-2023-31331 · Other software · AMD · reported by psirt@amd.comLow 3
Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption that could potentially lead to loss of integrity or availability.
- Product
- AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integritCVE-2023-20515 · Other software · AMD · reported by psirt@amd.comMedium 5.7
Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integrity, confidentiality, or availability.
- Product
- AMD Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbCVE-2024-0179 · Other software · AMD · reported by psirt@amd.comHigh 8.2
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.
- Product
- AMD Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data integrity.CVE-2023-20507 · Other software · AMD · reported by psirt@amd.comLow 2.3
An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data integrity.
- Product
- AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Windows Remote Desktop Configuration Service Tampering VulnerabilityCVE-2025-21349 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Windows Remote Desktop Configuration Service Tampering Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary coCVE-2025-21158 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-21157 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-CVE-2025-21126 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service condition. An attacker could exploit this vulnerability to cause the application to crash, resulting in a denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2025-21125 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-21124 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-21123 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2025-21121 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker toCVE-2025-1193 · Other software · Devolutions · reported by security@devolutions.netHigh 8.1
Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack by presenting a certificate for a different host.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communicCVE-2024-11621 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager Linux 2024.3.2.5 and earlier Remote Desktop Manager Android 2024.3.3.7 and earlier Remote Desktop Manager iOS 2024.3.3.0 and earlier Remote Desktop Manager Powershell 2024.3.6.0 and earlier
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability.CVE-2025-0413 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 7.8
Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Jan 30, 2025Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.CVE-2022-1736 · Other software · Canonical Ltd. · reported by security@ubuntu.comCritical 9.8
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
- Product
- Ubuntu's gnome-control-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.