Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,645 results · page 41 of 113
Oct 22, 2025Addison: Deserialization of Untrusted DataCVE-2025-60216 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8.
- Product
- Addison
- What to do
- Update Addison to the newest version.
Oct 22, 2025Kriya: Deserialization of Untrusted DataCVE-2025-60215 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
- Product
- Kriya
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Kriya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Goldenblatt: Deserialization of Untrusted DataCVE-2025-60214 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through < 1.3.0.
- Product
- Goldenblatt
- What to do
- Update Goldenblatt to the newest version.
Oct 22, 2025Scape: Deserialization of Untrusted DataCVE-2025-60213 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.
- Product
- Scape
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update Scape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025VEDA: Deserialization of Untrusted DataCVE-2025-60212 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
- Product
- VEDA
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update VEDA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Everest Forms - Frontend Listing: Deserialization of Untrusted DataCVE-2025-60210 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
- Product
- Everest Forms - Frontend Listing
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Everest Forms - Frontend Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Connector for Gravity Forms and Google Sheets: Deserialization of Untrusted DataCVE-2025-60209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.
- Product
- Connector for Gravity Forms and Google Sheets
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Gravity Forms HubSpot: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-60151 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Noisa: Deserialization of Untrusted DataCVE-2025-60039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
- Product
- Noisa
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Noisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025TF Woo Product Grid Addon For Elementor: Deserialization of Untrusted DataCVE-2025-59007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue affects TF Woo Product Grid Addon For Elementor: from n/a through <= 1.0.1.
- Product
- TF Woo Product Grid Addon For Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TF Woo Product Grid Addon For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Boldermail: Deserialization of Untrusted DataCVE-2025-52740 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.
- Product
- Boldermail
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Boldermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Store Locator: Deserialization of Untrusted DataCVE-2025-52737 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.
- Product
- WP Store Locator
- Affected
- up to 2.2.260
- What to do
- Affects up to 2.2.260. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Deserialization of Untrusted DataCVE-2025-49380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Solar Energy: Deserialization of Untrusted DataCVE-2025-32283 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
- Product
- Solar Energy
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Solar Energy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Insurance: Deserialization of Untrusted DataCVE-2025-31634 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.
- Product
- Insurance
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Insurance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2025astral-tokio-tar is a tar archive reading/writing library for async Rust.CVE-2025-62518 · Other software · astral-sh · reported by GitHubHigh 8.1
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
- Product
- tokio-tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because CVE-2024-31573 · Other software · XMLUnit · reported by MITREMedium 4
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Product
- XMLUnit for Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously upCVE-2025-49655 · Other software · Keras · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9.8
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
- Product
- Keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhiddenlayer.com
Oct 16, 2025FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme.CVE-2025-61536 · Other software · reported by MITREHigh 8.2
FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.CVE-2025-54539 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions. In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases. Mitigation and Recommendations: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.
- Product
- Apache ActiveMQ NMS AMQP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 15, 2025In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom.CVE-2025-62410 · Other software · capricorn86 · reported by GitHubCritical 9.4
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
- Product
- happy-dom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Alloy Core libraries at the root of the Rust Ethereum ecosystem.CVE-2025-62370 · Other software · alloy-rs · reported by GitHubHigh 7.5
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2025-54196 · Other software · Adobe · reported by AdobeMedium 4.3
Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction in that a victim must click on a crafted link.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityCVE-2025-59287 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
- Product
- Windows
- On CISA’s list since
- Oct 24, 2025 (federal fix deadline Nov 14, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comhawktrace.com
Oct 14, 2025Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.CVE-2025-59285 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
- Product
- Azure Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-59237 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-59207 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-55677 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges lCVE-2025-53717 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensurCVE-2025-37147 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.1
A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability to run modified or custom firmware on affected Access Points.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Microsoft Windows Untrusted Pointer Dereference VulnerabilityCVE-2025-24990 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
- Product
- Windows
- On CISA’s list since
- Oct 14, 2025 (federal fix deadline Nov 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comvicarius.io
Oct 14, 2025An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 aCVE-2025-47890 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.6
An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comcert-portal.siemens.com
Oct 13, 2025When tlsInsecure=False appears in a connection string, certificate validation is disabled.CVE-2025-11695 · Other software · MongoDB · reported by cna@mongodb.comHigh 8
When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
- Product
- Rust Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025cel-rust is a Common Expression Language interpreter written in Rust.CVE-2025-62162 · Other software · cel-rust · reported by GitHubHigh 7.5
cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.
- Product
- cel-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.CVE-2025-52635 · Other software · HCL · reported by psirt@hcl.comLow 3.7
A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 10, 2025Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics.CVE-2025-52655 · Other software · HCL · reported by psirt@hcl.comLow 3.1
Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure.
- Product
- HCL MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 10, 2025Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.CVE-2025-21044 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.7
Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 9, 2025Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them.CVE-2025-61779 · Other software · confidential-containers · reported by GitHubHigh 8.7
Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.
- Product
- trustee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.CVE-2023-37401 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.
- Product
- Aspera Faspex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: CVE-2025-39962 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket() warn: untrusted unsigned subtract. 'ticket_len - 10 * 4' by prechecking the length of what we're trying to extract in two places in the token and decoding for a response packet. Also use sizeof() on the struct we're extracting rather specifying the size numerically to be consistent with the other related statements.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2025ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution CVE-2025-61984 · Other software · OpenBSD · reported by MITRELow 3.6
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at leasCVE-2025-10363 · Other software · Topal Solutions AG · reported by vulnerability@ncsc.chCritical 10
Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at least Topal Finanzbuchhaltung: 10.1.5.20 and is fixed in version 11.2.12.00
- Product
- Topal Finanzbuchhaltung
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfo.topal.chlabs.infoguard.ch
Oct 6, 2025URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc.CVE-2025-0608 · Other software · Logo Software Inc. · reported by iletisim@usom.gov.trMedium 5.5
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo Cloud: before 2025.R6.
- Product
- Logo Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 4, 2025In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't trust firmware n_channels If the firmware sends us a corrupted MCVE-2023-53589 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't trust firmware n_channels If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response. Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 1, 2025Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard liCVE-2025-11233 · Other software · Rust Project · reported by 986d4109-89ea-491f-99fd-a8e4803919bdMedium 6.3
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.
- Product
- std
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Oct 1, 2025Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary CVE-2025-61622 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 27, 2025Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms: Cross-Site Request ForgeryCVE-2025-9899 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc admCVE-2025-58384 · Other software · reported by MITRECritical 10
In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoc.doxense.comupdate.doxense.com
Sep 24, 2025Memory corruption while performing private key encryption in trusted application.CVE-2025-21481 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while performing private key encryption in trusted application.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.CVE-2025-21476 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.