Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 43 of 99
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8648 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26271.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8647 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26270.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8646 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26269.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8645 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26268.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8644 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26267.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8643 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26266.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8642 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26265.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8641 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26264.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8640 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26263.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8639 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26262.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8638 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26261.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8637 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26260.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8636 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26259.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8635 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26258.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8634 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26257.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8633 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26256.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8632 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26255.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8631 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26254.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8630 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26253.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8629 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26252.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Kenwood DMX958XR Firmware Update Command Injection Vulnerability.CVE-2025-8628 · Other software · Kenwood · reported by zdi-disclosures@trendmicro.comMedium 6.8
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26064.
- Product
- DMX958XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.CVE-2025-52892 · Other software · espocrm · reported by GitHubMedium 4.5
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.CVE-2025-51387 · Other software · Axosoft · reported by MITRECritical 9.8
The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.
- Product
- Gitkraken Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstorm.news
Aug 1, 2025Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused.CVE-2025-6015 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.7
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to VaulCVE-2025-5999 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.2
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilCVE-2025-52289 · Other software · Magnussolution · reported by MITREHigh 8
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval.
- Product
- Magnusbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend.CVE-2025-8264 · Other software · reported by report@snyk.ioHigh 7.9
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM', ''); or php define('IMAP_DEFAULTFROM', 'ldap');
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language.CVE-2025-54428 · Other software · musombi123 · reported by GitHubCritical 9.8
RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.
- Product
- RevelaCode-Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsCVE-2025-54535 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections.CVE-2025-6250 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891High 7.1
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
- Product
- Privilege Management for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character.CVE-2025-38484 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND. Add a check that the given buffer is smaller then the buffer to prevent.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 26, 2025HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.CVE-2025-54378 · Other software · haxtheweb · reported by GitHubHigh 8.3
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025HCL IEM is affected by an authorization token sent in cookie vulnerability.CVE-2025-0250 · Other software · HCL Software · reported by psirt@hcl.comLow 2.2
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 24, 2025HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.CVE-2025-0249 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 24, 2025Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text withCVE-2025-40680 · Other software · Capillary io · reported by cve-coordination@incibe.esMedium 6.9
Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values.
- Product
- CapillaryScope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Unauthenticated login token generationCVE-2025-6441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.
- Product
- Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 4.03.32
- What to do
- Affects up to 4.03.32. Update Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2025HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.CVE-2025-54139 · Other software · haxtheweb · reported by GitHubMedium 4.3
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend.CVE-2025-54137 · Other software · haxtheweb · reported by GitHubHigh 7.3
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controCVE-2025-51471 · Other software · Ollama · reported by MITREMedium 6.9
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
- Product
- Ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54134 · Other software · haxtheweb · reported by GitHubHigh 7.1
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54128 · Other software · haxtheweb · reported by GitHubHigh 7.2
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.CVE-2025-54127 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability.CVE-2025-30477 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URLCVE-2025-50708 · Other software · reported by MITREHigh 7.5
An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite CVE-2025-6227 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.2
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files.CVE-2025-6391 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.1
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
- Product
- Brocade ASCG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere OneCVE-2025-3871 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.3
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-53640 · Other software · indico · reported by GitHubMedium 5.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.getindico.iodocs.getindico.io
Jul 11, 2025haxcms-nodejs and haxcms-php are backends for HAXcms.CVE-2025-53642 · Other software · haxtheweb · reported by GitHubMedium 4.8
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Broken Link Notifier: Server-Side Request ForgeryCVE-2025-6851 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Broken Link Notifier
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Broken Link Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.