Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 32 of 83
Dec 26, 2025ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2025-68474 · Other software · espressif · reported by GitHubMedium 6.1
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2025-68473 · Other software · espressif · reported by GitHubNone
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Basticom Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67629 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Stored XSS.This issue affects Basticom Framework: from n/a through <= 1.5.2.
- Product
- Basticom Framework
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Basticom Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025LangChain is a framework for building LLM-powered applications.CVE-2025-68665 · Other software · langchain-ai · reported by GitHubHigh 8.6
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3
- Product
- langchainjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025LangChain is a framework for building agents and LLM-powered applications.CVE-2025-68664 · Other software · langchain-ai · reported by GitHubCritical 9.3
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
- Product
- langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2025-67289 · Other software · Frappe · reported by MITRECritical 9.6
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem.CVE-2025-66905 · Other software · Takes · reported by MITREHigh 7.5
The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system.
- Product
- Tkfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2025-68434 · Other software · opensourcepos · reported by GitHubHigh 8.8
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection lin
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2025-68147 · Other software · opensourcepos · reported by GitHubHigh 8.1
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts. An attacker with access to the "Store Configuration" (such as a rogue administrator or an account compromised via the separate CSRF vulnerability) can inject malicious JavaScript payloads into this field. These payloads are executed in the browser of any user (including other administrators and sales staff) whenever they view a receipt or complete a transaction. This can lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim. The vulnerability has been patched in version 3.4.2 by ensuring the output is escaped using the `esc()` function in the receipt template. As a temporary mitigation, administrators should ensure the "Return Policy" field contains only plain text and strictly avoid entering any HTML tags. There is no code-based worka
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Capstone is a disassembly framework.CVE-2025-68114 · Other software · capstone-engine · reported by GitHubMedium 4.8
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
- Product
- capstone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Capstone is a disassembly framework.CVE-2025-67873 · Other software · capstone-engine · reported by GitHubMedium 4.8
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
- Product
- capstone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2.CVE-2025-65581 · Other software · Volosoft · reported by MITREMedium 5.3
An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.
- Product
- ABP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection.CVE-2025-33226 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Dec 16, 2025NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a maliciouslCVE-2025-33212 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.3
NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Dec 15, 2025Netty is an asynchronous, event-driven network application framework.CVE-2025-67735 · Other software · netty · reported by GitHubMedium 6.5
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.CVE-2025-67722 · Other software · FreePBX · reported by GitHubMedium 5.7
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsa
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full seCVE-2025-9122 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.3
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
- Product
- Pentaho Data Integration and Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumptiCVE-2025-14503 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.6
An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.
- Product
- Harmonix on AWS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Dec 13, 2025Redux Framework: Stored Cross-Site ScriptingCVE-2025-9488 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Redux Framework
- Affected
- up to 4.5.8
- What to do
- Affects up to 4.5.8. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025Tornado is a Python web framework and asynchronous networking library.CVE-2025-67726 · Other software · tornadoweb · reported by GitHubHigh 7.5
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Tornado is a Python web framework and asynchronous networking library.CVE-2025-67725 · Other software · tornadoweb · reported by GitHubHigh 7.5
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Tornado is a Python web framework and asynchronous networking library.CVE-2025-67724 · Other software · tornadoweb · reported by GitHubMedium 5.4
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Pyrofork is a modern, asynchronous MTProto API framework.CVE-2025-67720 · Other software · Mayuri-Chan · reported by GitHubMedium 6.5
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender. This issue is fixed in version 2.3.69.
- Product
- pyrofork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation.CVE-2025-67511 · Other software · aliasrobotics · reported by GitHubCritical 9.6
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.
- Product
- cai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Neuron is a PHP framework for creating and orchestrating AI Agents.CVE-2025-67510 · Other software · neuron-core · reported by GitHubCritical 9.4
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
- Product
- neuron-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Neuron is a PHP framework for creating and orchestrating AI Agents.CVE-2025-67509 · Other software · neuron-core · reported by GitHubHigh 8.2
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
- Product
- neuron-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025NiceGUI is a Python-based UI framework.CVE-2025-66645 · Other software · zauberzeug · reported by GitHubHigh 7.5
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems.CVE-2025-66039 · Other software · FreePBX · reported by GitHubCritical 9.3
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66457 · Other software · elysiajs · reported by GitHubHigh 7.5
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66456 · Other software · elysiajs · reported by GitHubCritical 9.1
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications.CVE-2025-66631 · Other software · MarimerLLC · reported by GitHubHigh 7.2
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
- Product
- csla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025REHub Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.
- Product
- REHub Framework
- What to do
- Update REHub Framework to the newest version.
Dec 9, 2025The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse autCVE-2025-42875 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.6
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
- Product
- SAP NetWeaver Internet Communication Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities.CVE-2025-42873 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
- Product
- SAPUI5 framework (Markdown-it component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025NiceGUI is a Python-based UI framework.CVE-2025-66470 · Other software · zauberzeug · reported by GitHubMedium 6.1
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025NiceGUI is a Python-based UI framework.CVE-2025-66469 · Other software · zauberzeug · reported by GitHubMedium 6.1
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Astro is a web framework.CVE-2025-66202 · Other software · withastro · reported by GitHubMedium 6.5
Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Android Framework Information Disclosure VulnerabilityCVE-2025-48633 · Computers, phones & browsers · Android · reported by security@android.comExploitedMedium 5.5
Android Framework contains an unspecified vulnerability that allows for information disclosure.
- Product
- Framework
- On CISA’s list since
- Dec 2, 2025 (federal fix deadline Dec 23, 2025)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogandroid.googlesource.comsource.android.com
Dec 8, 2025Android Framework Privilege Escalation VulnerabilityCVE-2025-48572 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Framework
- On CISA’s list since
- Dec 2, 2025 (federal fix deadline Dec 23, 2025)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogandroid.googlesource.comsource.android.com
Dec 8, 2025Multi-thread race condition vulnerability in the camera framework module.CVE-2025-66322 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Multi-thread race condition vulnerability in the camera framework module.CVE-2025-66321 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Multi-thread race condition vulnerability in the camera framework module.CVE-2025-66320 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology UnifCVE-2024-45538 · Network & remote access · Synology · reported by security@synology.comCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript.CVE-2025-65267 · Other software · Frappe · reported by MITRECritical 9
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2025-66409 · Other software · espressif · reported by GitHubLow 2.7
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Cacti is an open source performance and fault management framework.CVE-2025-66399 · Other software · Cacti · reported by GitHubHigh 7.4
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66206 · Other software · frappe · reported by GitHubMedium 6.8
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66205 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025UAF vulnerability in the screen recording framework module.CVE-2025-58307 · Other software · Huawei · reported by psirt@huawei.comMedium 6.4
UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025UAF vulnerability in the screen recording framework module.CVE-2025-58303 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.