Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,689 results · page 34 of 114
Jun 6, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49308 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.5.1.
- Product
- WP Travel Engine
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2025A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) cCVE-2025-20286 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 4, 2025A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacCVE-2025-20130 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 3, 2025In engineermode service, there is a possible command injection due to improper input validation.CVE-2025-31710 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.9
In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SC9863A/T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-48866 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-48944 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. Version 0.9.0 fixes the issue.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-48943 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-48942 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entryCVE-2025-48887 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and nested regular expression for tool call detection, which can be exploited by an attacker to cause severe performance degradation or make the service unavailable. The pattern contains multiple nested quantifiers, optional groups, and inner repetitions which make it vulnerable to catastrophic backtracking. Version 0.9.0 contains a patch for the issue.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through ReleasCVE-2025-4992 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- Service Process Engineer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x througCVE-2025-4988 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- Multidisciplinary Optimization Engineer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-46722 · Other software · vllm-project · reported by GitHubMedium 4.2
vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes(), which returns only the raw pixel data, without including metadata such as the image’s shape (width, height, mode). As a result, two images of different sizes (e.g., 30x100 and 100x30) with the same pixel byte sequence could generate the same hash value. This may lead to hash collisions, incorrect cache hits, and even data leakage or security risks. This issue has been patched in version 0.9.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025vLLM is an inference and serving engine for large language models (LLMs).CVE-2025-46570 · Other software · vllm-project · reported by GitHubLow 2.6
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has been patched in version 0.9.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.CVE-2025-48828 · Other software · vBulletin · reported by MITRECritical 9
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
- Product
- vBulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comkevintel.com
May 23, 2025Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.CVE-2025-41407 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.CVE-2025-36527 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025OpenFGA is an authorization/permission engine.CVE-2025-48371 · Other software · openfga · reported by GitHubMedium 5.8
OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.CVE-2025-41403 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.CVE-2025-3836 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin mCVE-2025-3444 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.5
Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
- Product
- ServiceDesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-47947 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-sitCVE-2025-20267 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 21, 2025A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a deniCVE-2025-20152 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a specific authentication request to a network access device (NAD) that uses Cisco ISE for authentication, authorization, and accounting (AAA). A successful exploit could allow the attacker to cause Cisco ISE to reload.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function.CVE-2025-44885 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PCVE-2025-47277 · Other software · vllm-project · reported by GitHubCritical 9.8
vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cache transfer integration with the V0 engine. No other configurations are affected. vLLM supports the use of the `PyNcclPipe` class to establish a peer-to-peer communication domain for data transmission between distributed nodes. The GPU-side KV-Cache transmission is implemented through the `PyNcclCommunicator` class, while CPU-side control message passing is handled via the `send_obj` and `recv_obj` methods on the CPU side. The intention was that this interface should only be exposed to a private network using the IP address specified by the `--kv-ip` CLI parameter. The vLLM documentation covers how this must be limited to a secured network. The default and intentional behavior from PyTorch is that the `TCPStore` interface listens on ALL interfaces, regardless of what IP address is provided. The IP address given was only used as a client-side address to use. vLLM was fixed to use a workaround to force the `TCPStore` instance to bind its socket to a specified private interface. As of version 0.8.5, vLLM limit
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.vllm.aigithub.com
May 20, 2025An authenticated user can modify application state data.CVE-2025-48018 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.5
An authenticated user can modify application state data.
- Product
- SEL-5030 acSELerator QuickSet Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of filesCVE-2025-48017 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comCritical 9
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025OpenFlow discovery protocol can exhaust resources because it is not rate limitedCVE-2025-48016 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
OpenFlow discovery protocol can exhaust resources because it is not rate limited
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Failed login response could be different depending on whether the username was local or central.CVE-2025-48015 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comLow 3.7
Failed login response could be different depending on whether the username was local or central.
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Password guessing limits could be bypassed when using LDAP authentication.CVE-2025-48014 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.5
Password guessing limits could be bypassed when using LDAP authentication.
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering.CVE-2025-4876 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Medium 6
ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.
- Product
- Risk Assessment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows SCVE-2025-4211 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3High 7.3
Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile. This issue affects all version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1. It is fixed in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, 6.9.0
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.org
May 15, 2025ImageMagick Engine ImageMagick Engine: For WordPress is vulnerable to OS Command Injection via the "cli_path" parameterCVE-2024-6486 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
- Product
- ImageMagick Engine ImageMagick Engine
- Fixed in
- 1.7.11
- What to do
- Update ImageMagick Engine ImageMagick Engine to 1.7.11 or newer.
May 15, 2025VikBooking Hotel Booking Engine & PMS: Does not sanitise and escape some of its settingsCVE-2024-13616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.7.2
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.7.2 or newer.
May 14, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.CVE-2025-3834 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.CVE-2025-3833 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.
- Product
- ADSelfService Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine.CVE-2024-52290 · Other software · lf-edge · reported by GitHubMedium 6.3
LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.
- Product
- ekuiper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Microsoft Windows Scripting Engine Type Confusion VulnerabilityCVE-2025-30397 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
- Product
- Windows
- On CISA’s list since
- May 13, 2025 (federal fix deadline Jun 3, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comvicarius.io
May 13, 2025Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS).CVE-2025-47276 · Other software · ChewKeanHo · reported by GitHubHigh 7.5
Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment requires manual password changes against the alpha and root accounts. The change will deploy's Debian's yescript overriding the older SHA512 hash created by OpenSSL. As a workaround, users need to reset both `root` and "Alpha" users' passwords.
- Product
- Actualizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
May 13, 2025EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface.CVE-2025-44831 · Other software · Engineercms Project · reported by MITRECritical 9.8
EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface.
- Product
- Engineercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings bCVE-2025-46750 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.4
SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings by importing a BIOS settings file with no password set.
- Product
- SEL-3350-1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.CVE-2025-46749 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user attempting to change their password could do so without using the current password.CVE-2025-46748 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comLow 2.7
An authenticated user attempting to change their password could do so without using the current password.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user without user-management permissions could identify other user accounts.CVE-2025-46747 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 5.7
An authenticated user without user-management permissions could identify other user accounts.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An administrator could discover another account's credentials.CVE-2025-46746 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 5.8
An administrator could discover another account's credentials.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user without user-management permissions could view other users account information.CVE-2025-46745 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 6.5
An authenticated user without user-management permissions could view other users account information.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated administrator could modify the Created By username for a user accountCVE-2025-46744 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comLow 2.7
An authenticated administrator could modify the Created By username for a user account
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.CVE-2025-46743 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 6.3
An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025Users who were required to change their password could still access system information before changing their passwordCVE-2025-46742 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
Users who were required to change their password could still access system information before changing their password
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.CVE-2025-46741 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 5.7
A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.