Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,435 results · page 23 of 69
Jan 13, 2026The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a CVE-2025-12052 · Other software · Insyde Software · reported by 8338d8cb-57f7-4252-abc0-96fd13e98d21High 7.8
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- Product
- InsydeH2O tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a CVE-2025-12051 · Other software · Insyde Software · reported by 8338d8cb-57f7-4252-abc0-96fd13e98d21High 7.8
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- Product
- InsydeH2O tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a CVE-2025-12050 · Other software · Insyde Software · reported by 8338d8cb-57f7-4252-abc0-96fd13e98d21High 7.8
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- Product
- InsydeH2O tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the contexCVE-2026-21280 · Other software · Adobe · reported by AdobeHigh 8.6
Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.CVE-2026-21226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
- Product
- Azure Core shared client library for Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVE-2026-20963 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
- Product
- SharePoint
- On CISA’s list since
- Mar 18, 2026 (federal fix deadline Mar 21, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Jan 13, 2026Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-20956 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-20955 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-20948 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-20943 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Office 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.CVE-2026-20938 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.CVE-2026-20935 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-20857 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2026-20849 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.CVE-2026-20819 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: CVE-2025-69276 · Other software · Broadcom · reported by vuln@ca.comLow 2.3
Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier.
- Product
- DX NetOps Spectrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Newsletters: Deserialization of Untrusted DataCVE-2025-67911 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
- Product
- Newsletters
- Affected
- up to 4.11
- What to do
- Affects up to 4.11. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
- Product
- DZS Video Gallery
- Affected
- up to 12.37
- What to do
- Affects up to 12.37. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47553 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.
- Product
- DZS Video Gallery
- Affected
- up to 12.25
- What to do
- Affects up to 12.25. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Themify Edmin: Deserialization of Untrusted DataCVE-2025-31047 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
- Product
- Themify Edmin
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Themify Edmin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15276 · Other software · FontForge · reported by zdi-disclosures@trendmicro.comHigh 7.8
FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28198.
- Product
- FontForge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checksCVE-2025-69277 · Other software · libsodium · reported by MITREMedium 4.5
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
- Product
- libsodium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.CVE-2025-68120 · Other software · github.com/golang/vscode-go · reported by security@golang.orgMedium 5.4
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
- Product
- github.com/golang/vscode-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comnvd.nist.gov
Dec 29, 2025CWE-601 URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-55060 · Other software · Priority · reported by cna@cyber.gov.ilMedium 6.1
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Accept Donations with PayPal & Stripe: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-68602 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.
- Product
- Accept Donations with PayPal & Stripe
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Accept Donations with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025User Submitted Posts: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-68509 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.
- Product
- User Submitted Posts
- Affected
- up to 20251121
- What to do
- Affects up to 20251121. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Icegram Express Pro: Deserialization of Untrusted DataCVE-2025-68038 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through < 5.9.14.
- Product
- Icegram Express Pro
- What to do
- Update Icegram Express Pro to the newest version.
Dec 23, 2025Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13716 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent MimicMotion. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the create_pipeline function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27208.
- Product
- MimicMotion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13715 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent FaceDetection-DSFD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resnet endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27197.
- Product
- FaceDetection-DSFD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13714 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent MedicalNet. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the generate_model function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27192.
- Product
- MedicalNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13713 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent Hunyuan3D-1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_pretrained function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27191.
- Product
- Hunyuan3D-1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13712 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the merge endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27190.
- Product
- HunyuanDiT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13711 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the eval endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27187.
- Product
- TFace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13710 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanVideo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_vae function.The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27186.
- Product
- HunyuanVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13709 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the restore_checkpoint function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27185.
- Product
- TFace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13708 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent NeuralNLP-NeuralClassifier. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the _load_checkpoint function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27184.
- Product
- NeuralNLP-NeuralClassifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13707 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the model_resume function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27183.
- Product
- HunyuanDiT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-13706 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comHigh 7.8
Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent PatrickStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the merge_checkpoint endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27182.
- Product
- PatrickStar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2025Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14931 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comCritical 10
Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of pickle data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28312.
- Product
- smolagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14930 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of weights. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28309.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14929 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14925 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27985.
- Product
- Accelerate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14924 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27984.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14922 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Diffusers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27424.
- Product
- Diffusers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14921 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25424.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-14920 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 7.8
Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25423.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc.CVE-2025-1885 · Other software · Restajet Information Technologies Inc. · reported by iletisim@usom.gov.trMedium 5.4
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forceful Browsing. This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Online Food Delivery System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 18, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-64266 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
- Product
- Booking and Rental Manager
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Codiqa: Deserialization of Untrusted DataCVE-2025-64233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
- Product
- Codiqa
- What to do
- Update Codiqa to the newest version.
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.