Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 41 of 99
Oct 29, 2025Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe aCVE-2025-64145 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins ByteGuard Build Actions Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 29, 2025Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users witCVE-2025-64144 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
- Product
- Jenkins ByteGuard Build Actions Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 29, 2025Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can beCVE-2025-64143 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
- Product
- Jenkins OpenShift Pipeline Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 27, 2025Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackCVE-2025-60425 · Other software · Nagios · reported by MITREHigh 8.6
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.CVE-2025-52268 · Other software · reported by MITREHigh 7.5
StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstarcharge.com
Oct 23, 2025Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (CVE-2025-54808 · Other software · Oxford Nanopore Technologies · reported by ics-cert@hq.dhs.govHigh 7.3
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms.
- Product
- MinKNOW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnanoporetech.com
Oct 23, 2025Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, befCVE-2025-10937 · Other software · Oxford Nano Technologies · reported by ics-cert@hq.dhs.govMedium 6.8
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.
- Product
- MinKNOW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnanoporetech.com
Oct 22, 2025Connection desynchronization between an HTTP proxy and the model backend.CVE-2025-11915 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cMedium 6.9
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
- Product
- Vertex AI: Partner Models for MaaS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.CVE-2025-62774 · Other software · Mercku · reported by MITRELow 3.1
On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.
- Product
- M6a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nullvoid.meseclists.org
Oct 22, 2025On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.CVE-2025-62772 · Other software · Mercku · reported by MITRELow 3.1
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.
- Product
- M6a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nullvoid.meseclists.org
Oct 21, 2025LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI andCVE-2025-60427 · Other software · reported by MITREMedium 6.5
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeafn28.gitbook.iogithub.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative priCVE-2025-62645 · Other software · Restaurant Brands International · reported by MITRECritical 9.9
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
- Product
- assistant platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.todaybobdahacker.com
Oct 16, 2025Strapi uses JSON Web Tokens (JWT) for authentication.CVE-2025-3930 · Other software · Strapi · reported by cvd@cert.plMedium 6.3
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.CVE-2025-56749 · Other software · Creativeitem · reported by MITRECritical 9.4
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing bruteCVE-2025-56748 · Other software · Creativeitem · reported by MITREMedium 6.4
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing logic contains a stack-based buffer overflow vulnerability.The tokenizer function `nexttoken` copieCVE-2017-20205 · Other software · Valve Software · reported by VulnCheckCritical 9.2
Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing logic contains a stack-based buffer overflow vulnerability.The tokenizer function `nexttoken` copies characters from an input string into a fixed-size stack buffer without performing bounds checks. When `ParseKeyValue` processes a collisionpair rule longer than the destination buffer (256 bytes), an overflow of the stack buffer `szToken` can occur and overwrite the function return address. A remote attacker can trigger the vulnerable code by supplying a specially crafted ragdoll model which causes the oversized collisionpair rule to be parsed, resulting in remote code execution on affected clients or servers. Valve has addressed this issue in many of their Source games, but independently-developed games must manually apply patch.
- Product
- Source SDK (source-sdk-2013)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comoneupsecurity.com
Oct 14, 2025Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app.CVE-2025-62374 · Other software · parse-community · reported by GitHubMedium 6.4
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
- Product
- Parse-SDK-JS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally.CVE-2025-55696 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Multiple Broken Authentication security issues exist in the affected product.CVE-2025-7328 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.9
Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able to communicate through NATR as a result of denial-of-service or NAT rule modifications. NAT rule modification could also result in device communication to incorrect endpoints. Admin account takeover could allow modification of configuration and require physical access to restore.
- Product
- Comms - 1783-NATR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 13, 2025A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state cCVE-2025-9265 · Other software · Kiloview · reported by vulnerability@ncsc.chCritical 10
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246
- Product
- NDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification.CVE-2025-61152 · Other software · reported by MITREMedium 6.5
python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can craft a forged token with arbitrary claims (e.g., is_admin=true) and bypass authentication checks, leading to privilege escalation or unauthorized access in applications that rely on python-jose for token validation. This issue is exploitable unless developers explicitly reject 'alg=none' tokens, which is not enforced by the library. NOTE: all parties agree that the issue is not relevant because it only occurs in a "verify_signature": False situation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application.CVE-2025-21062 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application. User interaction is required for triggering this vulnerability.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 9, 2025An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticaCVE-2025-4614 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 4.8
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Oct 7, 2025In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong sizeof config in slave_config Fix broken slave_config functCVE-2022-50540 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong sizeof config in slave_config Fix broken slave_config function that uncorrectly compare the peripheral_size with the size of the config pointer instead of the size of the config struct. This cause the crci value to be ignored and cause a kernel panic on any slave that use adm driver. To fix this, compare to the size of the struct and NOT the size of the pointer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2025The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes.CVE-2025-59451 · Other software · YoSmart · reported by MITRELow 3.5
The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes.
- Product
- YoLink application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Oct 6, 2025The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control imCVE-2025-57247 · Other software · reported by MITRECritical 9.1
The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination.CVE-2025-10695 · Other software · OpenSupports · reported by help@fluidattacks.comMedium 6.9
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.
- Product
- OpenSupports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 1, 2025A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplyingCVE-2025-46205 · Other software · Podofo Project · reported by MITREHigh 8.1
A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file. NOTE: this is disputed by the Supplier because there is no available file to reproduce the issue.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-CVE-2025-56675 · Other software · EKEN · reported by MITRELow 3.5
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.
- Product
- video doorbell T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com
Sep 30, 2025A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) pCVE-2025-56207 · Other software · reported by MITREMedium 6.5
A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows users or attackers to transfer NFTs to the zero address, leading to permanent asset loss and non-compliance with the ERC721 standard. The eth address is 0x41d3d86a84c8507a7bc14f2491ec4d188fa944e7, contract name is MoneyMakingOpportunity, and compiler version is v0.8.17+commit.8df45f5f.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output.CVE-2025-35031 · Other software · Medical Informatics Engineering · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.6
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.
- Product
- Enterprise Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Sep 25, 2025glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines.CVE-2025-60019 · Other software · Red Hat · reported by Red HatLow 3.7
glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2025glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read.CVE-2025-60018 · Other software · Red Hat · reported by Red HatMedium 4.8
glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2025Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, wherebCVE-2025-36857 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management. This vulnerability was remediated in version 7.5.021 of the product.
- Product
- Appspider Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC.CVE-2025-59484 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.7
The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 22, 2025SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc.CVE-2025-42907 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.
- Product
- SAP BI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025Epeken All Kurir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57906 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.
- Product
- Epeken All Kurir
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Epeken All Kurir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability.CVE-2025-57438 · Other software · 2wcom · reported by MITREMedium 6.8
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admin explicitly grants access to a manager-level account. However, a manager-level user can bypass these controls by intercepting and modifying requests.
- Product
- Ip-4c Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025The secret used for validating authentication tokens is hardcoded in device firmware for affected versions.CVE-2025-54807 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by maCVE-2025-23316 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9.8
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by manipulating the model name parameter in the model control APIs. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, and data tampering.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue.CVE-2025-23268 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. A successful exploit of this vulnerability may lead to code execution.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability.CVE-2025-10644 · Other software · Wondershare · reported by zdi-disclosures@trendmicro.comCritical 9.4
Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892.
- Product
- Repairit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025CISA Thorium does not properly invalidate previously used tokens when resetting passwords.CVE-2025-35433 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS).CVE-2025-37125 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizerCVE-2025-6638 · Other software · huggingface · reported by security@huntr.devHigh 7.5
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
- Product
- huggingface/transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Under heavy system utilization a random race condition can occur during authentication or token refresh operation.CVE-2025-26499 · Other software · Wind River Studio Developer · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 6
Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user’s system rights and data access.
- Product
- Wind River Studio Developer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.comwindriver.com
Sep 10, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-59035 · Other software · indico · reported by GitHubMedium 4.6
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-59034 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allowCVE-2025-10226 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Critical 9.3
Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4.
- Product
- AxxonOne C-Werk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxxonsoft.compostgresql.org
Sep 9, 2025IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies.CVE-2025-36011 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Jazz for Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.