Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
593 results · page 3 of 12
Jan 20, 2026Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App).CVE-2026-21931 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle APEX Sample Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2026Missing XML Validation vulnerability in Apache Struts, Apache Struts.CVE-2025-68493 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwiki.apache.orgopenwall.com
Jan 9, 2026A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.CVE-2025-60538 · Other software · Go-shiori · reported by MITREMedium 6.5
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.
- Product
- Shiori
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force tCVE-2025-14553 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.
- Product
- TP-Link Tapo App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.complay.google.com
Dec 10, 2025Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.CVE-2025-66675 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.orgcwiki.apache.org
Dec 9, 2025A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passworCVE-2025-41692 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.8
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks.CVE-2025-32898 · Other software · KDE · reported by MITREMedium 4.7
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
- Product
- KDE Connect verification-code protocol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkde.orgkdeconnect.kde.org
Dec 4, 2025ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.CVE-2025-29269 · Other software · Allnet · reported by MITRECritical 9.8
ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
- Product
- All-rut22gw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.CVE-2025-29268 · Other software · Allnet · reported by MITRECritical 9.8
ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
- Product
- All-rut22gw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid CVE-2025-12995 · Other software · Medtronic · reported by security@medtronic.comHigh 8.1
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
- Product
- CareLink Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.CVE-2025-64775 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwiki.apache.orgopenwall.com
Nov 24, 2025The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing themCVE-2025-12628 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
- What to do
- Update the plugin to the newest version.
Nov 18, 2025Windu CMS implements weak client-side brute-force protection by using parameter loginError.CVE-2025-59113 · Other software · JCD · reported by cvd@cert.plMedium 6.9
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
- Product
- Windu CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attaCVE-2025-55034 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govHigh 8.8
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2025EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the CVE-2025-12866 · Other software · Hundred Plus · reported by twcert@cert.org.twCritical 9.3
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
- Product
- EIP Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 29, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 befoCVE-2025-10928 · Websites & servers · reported by mlhess@drupal.orgMedium 6.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Anti-Malware Security and Brute-Force Firewall: Arbitrary File ReadCVE-2025-11705 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Affected
- up to 4.23.81
- What to do
- Affects up to 4.23.81. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 27, 2025A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attaCVE-2025-60424 · Other software · Nagios · reported by MITREHigh 7.6
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attackCVE-2025-62399 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 22, 2025Nautobot Single Source of Truth (SSoT) is an app for Nautobot.CVE-2025-62607 · Other software · nautobot · reported by GitHubMedium 5.3
Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0.
- Product
- nautobot-app-ssot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attacCVE-2025-56224 · Other software · Ascertia · reported by MITREHigh 8.1
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.CVE-2025-56221 · Other software · Ascertia · reported by MITRECritical 9.8
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing bruteCVE-2025-56748 · Other software · Creativeitem · reported by MITREMedium 6.4
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability.CVE-2025-46581 · Other software · ZTE · reported by psirt@zte.com.cnCritical 9.8
ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.
- Product
- ZXCDN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.CVE-2025-9551 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comdocs.herodevs.com
Oct 6, 2025A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gatheCVE-2025-58591 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-58590 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure.CVE-2025-8679 · Other software · Extreme Networks · reported by 1c053176-eef3-4d6a-ae0b-24728c86587bHigh 7.6
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
- Product
- ExtremeGuest Essentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextreme-networks.my.site.com
Sep 30, 2025PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout.CVE-2025-8118 · Other software · Polska Akademia Dostępności · reported by cvd@cert.plMedium 6.9
PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
- Product
- PAD CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, BruteCVE-2025-1740 · Other software · Akinsoft · reported by iletisim@usom.gov.trCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.
- Product
- MyRezzta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 13, 2025Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.CVE-2025-52392 · Other software · reported by MITREMedium 5.4
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeafn28.gitbook.iogithub.com
Jul 30, 2025** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.CVE-2025-54656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Struts Extras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 28, 2025IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2024-49342 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Informix Dynamic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcinCVE-2025-6523 · Other software · Devolutions · reported by security@devolutions.netCritical 9.5
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 beforeCVE-2025-7393 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
- Product
- Mail Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local aCVE-2025-41459 · Other software · Two App Studio · reported by a341c0d1-ebf7-493f-a84e-38cf86618674High 7.8
Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection.
- Product
- Journey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.CVE-2024-9342 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Product
- Eclipse Glassfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookiesCVE-2025-48461 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 5
Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords.
- Product
- Advantech Wireless Sensing and Equipment (WISE)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute forceCVE-2025-2171 · Other software · Aviatrix · reported by mandiant-cve@google.comHigh 7.8
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud.google.comgithub.com
Jun 23, 2025Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2.CVE-2025-52936 · Other software · yrutschle · reported by cve_disclosure@tech.gov.sgCritical 9.3
Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 21, 2025Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).CVE-2025-52916 · Other software · Yealink · reported by MITRELow 2.2
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
- Product
- RPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.CVE-2025-28389 · Other software · Openc3 · reported by MITRECritical 9.8
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
- Product
- Cosmos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenc3.comvisionspace.com
Jun 12, 2025The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the CVE-2025-49195 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-CVE-2025-49186 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- Product
- Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Nautobot is a Network Source of Truth and Network Automation Platform.CVE-2025-49143 · Other software · nautobot · reported by GitHubMedium 6.3
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Nautobot is a Network Source of Truth and Network Automation Platform.CVE-2025-49142 · Other software · nautobot · reported by GitHubMedium 6
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgithub.com
Jun 2, 2025A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.CVE-2025-46806 · Other software · https://github.com/yrutschle/sslh/releases/tag/v2.2.4 · reported by meissner@suse.deMedium 6.9
A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Jun 2, 2025A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimateCVE-2025-46807 · Other software · https://github.com/yrutschle/sslh/releases/tag/v2.2.4 · reported by meissner@suse.deHigh 8.7
A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
May 30, 2025Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modernCVE-2024-23589 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modern hardware such as GPUs or ASICs
- Product
- HCL Glovius Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 22, 2025Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis isCVE-2024-48848 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.