Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,513 results · page 28 of 91
May 14, 2025Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration BackupCVE-2024-57273 · Other software · Netgate · reported by MITREMedium 5.4
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.
- Product
- Pfsense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.brillantit.comdocs.netgate.com
May 13, 2025Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged user to potentially enCVE-2025-20100 · Other software · reported by secure@intel.comHigh 8.7
Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated acCVE-2025-22248 · Other software · VMware · reported by security@vmware.comCritical 9.4
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.
- Product
- Bitnami
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data CVE-2025-43004 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data when they access these dashboards. Since no mechanisms exist to enforce authentication, malicious unauthenticated users can view non-sensitive customer information. However, this does not affect data integrity or availability.
- Product
- SAP Digital Manufacturing (Production Operator Dashboard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings.CVE-2025-31329 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.2
SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as user credentials is exposed. These credentials may then be used to gain unauthorized access to local or adjacent systems. This results in high impact to Confidentiality, with no significant effect on Integrity or Availability.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application.CVE-2025-46737 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.4
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources.
- Product
- SEL-5037 Grid Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutCVE-2025-1137 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
- Product
- Storage Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.CVE-2025-46392 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Product
- Apache Commons Configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgcve.org
May 8, 2025Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication.CVE-2025-3759 · Other software · Netis Systems · reported by cvd@cert.plHigh 8.7
Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WF2220
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users.CVE-2025-3758 · Other software · Netis Systems · reported by cvd@cert.plHigh 8.7
WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WF2220
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controCVE-2025-26169 · Other software · IXON · reported by MITREHigh 8.1
IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.
- Product
- VPN Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordixon-cloud.my.salesforce.comsupport.ixon.cloud
May 7, 2025IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be CVE-2025-26168 · Other software · IXON · reported by MITREHigh 8.1
IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.
- Product
- VPN Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordixon-cloud.my.salesforce.comsupport.ixon.cloud
May 7, 2025A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unautCVE-2025-20214 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists because a subtle change in inner API call behavior causes results to be filtered incorrectly. An attacker could exploit this vulnerability by using either NETCONF, RESTCONF, or gRPC Network Management Interface (gNMI) protocols and query data on paths that may have been denied by the NACM configuration. A successful exploit could allow the attacker to access data that should have been restricted according to the NACM configuration. Note: This vulnerability requires that the attacker obtain the credentials from a valid user with privileges lower than 15, and that NACM was configured to provide restricted read access for that user.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 7, 2025Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration.CVE-2025-20972 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration.
- Product
- Samsung Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 6, 2025IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in CVE-2025-2898 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in Role-Based Access Control (RBAC) configurations.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.CVE-2025-21470 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Memory corruption may occur during IO configuration processing when the IO port count is invalid.CVE-2024-45570 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage withCVE-2025-3020 · Other software · Wiesemann & Theis · reported by info@cert.vde.comMedium 5.4
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
- Product
- ERP-Gateway 12x Digital Input, 6x Digital Relais
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow CVE-2025-0915 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow an authenticated user to cause a denial of service due to insufficient release of allocated memory resources.
- Product
- Db2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurity.netapp.com
May 5, 2025Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resoluCVE-2025-2905 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9.1
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Apr 30, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45721 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of othCVE-2025-24340 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 6.5
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users.
- Product
- ctrlX OS - Device Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.CVE-2025-32980 · Other software · reported by MITRECritical 9.8
NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameteCVE-2025-46617 · Other software · Quantum · reported by MITREHigh 7.2
Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.
- Product
- StorNext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is setCVE-2025-46599 · Other software · K3s · reported by MITREMedium 6.8
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
- Product
- K3s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud.google.comgithub.com
Apr 24, 2025Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issueCVE-2025-26382 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9.3
Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue
- Product
- iSTAR Configuration Utility (ICU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Apr 24, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45720 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
- Product
- HCL Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 24, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) alCVE-2025-3872 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 7.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its payload. This issue affects Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Apr 24, 2025Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd.CVE-2025-32730 · Other software · i-PRO Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.8
Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance cameras and recorders. This vulnerability allows a local authenticated attacker to use the authentication information from the last connected surveillance cameras and recorders.
- Product
- i-PRO Configuration Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module.CVE-2025-29621 · Other software · reported by MITREHigh 7.3
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comgetastra.com
Apr 21, 2025The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM.CVE-2025-43922 · Other software · FileWave · reported by MITREHigh 8.1
The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM.
- Product
- FileWave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commanCVE-2025-43920 · Other software · GNU · reported by MITREMedium 5.4
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.launchpad.netgithub.com
Apr 17, 2025A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicationCVE-2025-3113 · Other software · Perforce · reported by security@puppet.comCritical 9
A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows the user to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets.
- Product
- Delphix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to injCVE-2025-1568 · Computers, phones & browsers · Google · reported by 7f6e188d-c52a-4a19-8674-3c3fa7d1fc7fHigh 8.8
Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.
- Product
- ChromeOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.chromium.orgissuetracker.google.com
Apr 16, 2025Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching cCVE-2025-27571 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-30512 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration).CVE-2025-30735 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- PeopleSoft Enterprise CC Common Application Objects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration).CVE-2025-30731 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.6
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected are 12.2.3-12.2.14. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Applications Technology Stack executes to compromise Oracle Applications Technology Stack. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Technology Stack accessible data as well as unauthorized read access to a subset of Oracle Applications Technology Stack accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
- Product
- Oracle Applications Technology Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from oldCVE-2025-1688 · Other software · Milestone Systems · reported by cf45122d-9d50-442a-9b23-e05cde9943d8Medium 5.5
Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the Management Server. To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedure. Any system upgraded with 2024 R1 or 2024 R2 release installer is vulnerable to this issue. Systems upgraded from 2023 R3 or older with version 2025 R1 and newer are not affected.
- Product
- XProtect VMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportcommunity.milestonesys.com
Apr 8, 2025HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of CVE-2025-32464 · Other software · HAProxy · reported by MITREMedium 6.8
HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
- Product
- HAProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 8, 2025During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowedCVE-2025-0361 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.3
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.CVE-2024-45556 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.CVE-2024-43067 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by loggeCVE-2024-58133 · Other software · ChainMaker · reported by MITREMedium 4
In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic.
- Product
- chainmaker-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and wrCVE-2024-58132 · Other software · ChainMaker · reported by MITREMedium 4
In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and write operations on a map, leading to a panic.
- Product
- chainmaker-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure.CVE-2025-31484 · Other software · conda-forge · reported by GitHubCritical 9.3
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process. The security logs on anaconda.org were check for any packages that were not copied from the cf-staging to the conda-forge channel and none were found.
- Product
- infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for CVE-2025-31728 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.5
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins AsakusaSatellite Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.CVE-2025-26054 · Other software · reported by MITREMedium 5.4
Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023.CVE-2025-0416 · Other software · Valmet · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.9
Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.
- Product
- Valmet DNA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A configuration issue was addressed with additional restrictions.CVE-2025-24241 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to trick a user into copying sensitive data to the pasteboard.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.