Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,689 results · page 30 of 114
Nov 26, 2025Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community.CVE-2025-64334 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, compressed HTTP data can lead to unbounded memory growth during decompression. This issue has been patched in version 8.0.2. A workaround involves disabling LZMA decompression or limiting response-body-limit size.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community.CVE-2025-64333 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a large HTTP content type, when logged can cause a stack overflow crashing Suricata. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves limiting stream.reassembly.depth to less then half the stack size. Increasing the process stack size makes it less likely the bug will trigger.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community.CVE-2025-64332 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling SWF decompression (swf-decompression in suricata.yaml), it is disabled by default; set decompress-depth to lower than half your stack size if swf-decompression must be enabled.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community.CVE-2025-64331 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow can occur on large HTTP file transfers if the user has increased the HTTP response body limit and enabled the logging of printable http bodies. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves using default HTTP response body limits and/or disabling http-body-printable logging; body logging is disabled by default.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community.CVE-2025-64330 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025AI Engine for WordPress: ChatGPT, GPT Content Generator: Arbitrary File ReadCVE-2025-13380 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- AI Engine for WordPress: ChatGPT, GPT Content Generator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update AI Engine for WordPress: ChatGPT, GPT Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 24, 2025Inside Track / Entropy Derby is a research-grade horse-racing betting engine.CVE-2025-65951 · Other software · mescuwa · reported by GitHubHigh 8.7
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.
- Product
- entropy-derby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows anCVE-2025-10555 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- DELMIA Service Process Engineer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Langfuse is an open source large language model engineering platform.CVE-2025-65107 · Other software · langfuse · reported by GitHubMedium 6.5
Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.
- Product
- langfuse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.CVE-2025-64751 · Other software · openfga · reported by GitHubMedium 5.8
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-62426 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests. This issue has been patched in version 0.11.1.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-62372 · Other software · vllm-project · reported by GitHubHigh 8.3
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-62164 · Other software · vllm-project · reported by GitHubHigh 8.8
vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM. This issue has been patched in version 0.11.1.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary contentCVE-2025-35029 · Other software · Medical Informatics Engineering · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.
- Product
- Enterprise Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Nov 19, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry TradCVE-2025-10437 · Other software · Eksagate Electronic Engineering and Computer Industry Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.
- Product
- Webpack Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 18, 2025AI Engine: Server-Side Request ForgeryCVE-2025-8084 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.
- Product
- AI Engine
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2025The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' apCVE-2025-9317 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.3
The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025AI Engine: PHP Object InjectionCVE-2025-12844 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- AI Engine
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2025A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0).CVE-2025-40763 · Other software · Siemens · reported by productcert@siemens.comHigh 8.5
A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.
- Product
- Altair Grid Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Nov 11, 2025A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0).CVE-2025-40760 · Other software · Siemens · reported by productcert@siemens.comMedium 6.8
A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.
- Product
- Altair Grid Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Nov 11, 2025JIT miscompilation in the JavaScript Engine: JIT component.CVE-2025-13024 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 11, 2025Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.CVE-2025-9227 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.5
Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuCVE-2025-9223 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.CVE-2025-8324 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.8
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
- Product
- ManageEngine Analytics Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.CVE-2025-7633 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.CVE-2025-7632 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.CVE-2025-7430 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.CVE-2025-7429 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php.CVE-2025-64519 · Other software · torrentpier · reported by GitHubHigh 8.8
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In versions up to and including 2.8.8, an authenticated SQL injection vulnerability exists in the moderator control panel (`modcp.php`). Users with moderator permissions can exploit this vulnerability by supplying a malicious `topic_id` (`t`) parameter. This allows an authenticated moderator to execute arbitrary SQL queries, leading to the potential disclosure, modification, or deletion of any data in the database. Although it requires moderator privileges, it is still severe. A malicious or compromised moderator account can leverage this vulnerability to read, modify, or delete data. A patch is available at commit 6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80.
- Product
- torrentpier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Langfuse is an open source large language model engineering platform.CVE-2025-64504 · Other software · langfuse · reported by GitHubMedium 5
Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, in certain project membership APIs, the server trusted a user‑controlled orgId and used it in authorization checks. As a result, any authenticated user on the same Langfuse instance could enumerate names and email addresses of users in another organization if they knew the target organization’s ID. Disclosure is limited to names and email addresses of members/invitees. No customer data such as traces, prompts, or evaluations is exposed or accessible. For Langfuse Cloud, the maintainers ran a thorough investigation of access logs of the last 30 days and could not find any evidence that this vulnerability was exploited. For most self-hosting deployments, the attack surface is significantly reduced given an SSO provider is configured and email/password sign-up is disabled. In these cases, only users who authenticate via the Enterprise SSO IdP (e.g. Okta) would be able to exploit this vulnerability to access the member list, i.e. internal users getting access to a list of other internal users. In order to exploit the vulnerability, the actor must h
- Product
- langfuse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authCVE-2025-12815 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate this issue, users should upgrade to version 2025.09 or above.
- Product
- Research and Engineering Studio (RES)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 6, 2025VikBooking Hotel Booking Engine & PMS: Missing AuthorizationCVE-2025-5803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2025An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator enginesCVE-2025-11093 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.4
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.
- Product
- WSO2 Micro Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Nov 5, 2025A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenCVE-2025-20343 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 5, 2025A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affecteCVE-2025-20305 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user. A successful exploit could allow the attacker to view passwords that are normally not visible to read-only administrators.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 5, 2025Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflectCVE-2025-20304 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 5, 2025Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflectCVE-2025-20303 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 5, 2025Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflectCVE-2025-20289 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 5, 2025AI Engine: Sensitive Information ExposureCVE-2025-11749 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
- Product
- AI Engine
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.CVE-2025-5347 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.CVE-2025-5343 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.CVE-2025-5342 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 4.3
Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.CVE-2025-60595 · Other software · reported by MITREHigh 8.2
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsphengineering.com
Oct 27, 2025ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue.CVE-2025-11248 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Low 3.2
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized modification of dataCVE-2025-11888 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.
- Product
- JetEngine
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2025Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.CVE-2025-6239 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.5
Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.CVE-2025-10020 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.5
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
- Product
- ManageEngine ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.CVE-2025-9428 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
- Product
- Analytics Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.CVE-2025-7473 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.2
Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.