Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,645 results · page 44 of 113
Aug 8, 2025If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.CVE-2025-48913 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 7, 2025uv is a Python package and project manager written in Rust.CVE-2025-54368 · Other software · astral-sh · reported by GitHubMedium 6.8
uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordastral.shblog.pypi.org
Aug 6, 2025Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bCVE-2025-8582 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 5, 2025Deserialization vulnerability of untrusted data in the ability module.CVE-2025-54620 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Russh is a Rust SSH client & server library.CVE-2025-54804 · Other software · Eugeny · reported by GitHubMedium 6.5
Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security.CVE-2025-21120 · Other software · Dell · reported by security_alert@emc.comHigh 8.3
Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- Avamar Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` fuCVE-2025-50472 · Other software · reported by MITRECritical 9.8
The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` function of the `ModelFileSystemCache()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized `.mdl` payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine. Note that the payload file is a hidden file, making it difficult for the victim to detect tampering. More importantly, during the model training process, after the `.mdl` file is loaded and executes arbitrary code, the normal training process remains unaffected'meaning the user remains unaware of the arbitrary code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade.CVE-2025-53022 · Other software · reported by MITREHigh 8.6
TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.trustedfirmware.orgtrustedfirmware-m.readthedocs.io
Jul 29, 2025The go command may execute unexpected commands when operating in untrusted VCS repositories.CVE-2025-4674 · Other software · Go toolchain · reported by security@golang.orgHigh 8.6
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to systemCVE-2025-53078 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 8
Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 28, 2025Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections.CVE-2025-6250 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891High 7.1
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
- Product
- Privilege Management for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user rCVE-2025-2297 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891High 7.2
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
- Product
- Privilege Management for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.CVE-2023-53161 · Other software · sequoia-pgp · reported by MITRELow 2.9
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
- Product
- buffered-reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.CVE-2023-53160 · Other software · sequoia-pgp · reported by MITRELow 2.9
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
- Product
- sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.CVE-2023-53159 · Other software · sfackler · reported by MITREMedium 4.5
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.
- Product
- openssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack.CVE-2022-50237 · Other software · dalek-cryptography · reported by MITREMedium 5.9
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
- Product
- ed25519-dalek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring.CVE-2023-53158 · Other software · GitoxideLabs · reported by MITREMedium 4.1
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Product
- gix-transport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.CVE-2023-53157 · Other software · rosenpass · reported by MITREMedium 5.3
The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.
- Product
- rosenpass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.CVE-2024-58266 · Other software · comex · reported by MITRELow 3.2
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
- Product
- shlex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.CVE-2024-58265 · Other software · mcginty · reported by MITRELow 3.1
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
- Product
- snow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.CVE-2024-58264 · Other software · CosmWasm · reported by MITRELow 3.2
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
- Product
- serde-json-wasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.CVE-2023-53156 · Other software · ejmahler · reported by MITREMedium 4.5
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Product
- transpose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.CVE-2024-58263 · Other software · CosmWasm · reported by MITRELow 3.7
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
- Product
- cosmwasm-std
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.CVE-2024-58262 · Other software · dalek-cryptography · reported by MITRELow 2.9
The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.
- Product
- curve25519-dalek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParCVE-2024-58261 · Other software · sequoia-pgp · reported by MITRELow 2.9
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
- Product
- sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12.CVE-2025-36727 · Other software · Simplehelp · reported by vulnreport@tenable.comHigh 8.3
Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12.
- Product
- Simplehelp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own.CVE-2025-53940 · Other software · TryQuiet · reported by GitHubHigh 8.5
Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.
- Product
- quiet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability.CVE-2025-26397 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.8
SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.
- Product
- SolarWinds Observability Self-Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jul 23, 2025Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.CVE-2025-32019 · Other software · goharbor · reported by GitHubMedium 4.1
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Product
- harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.CVE-2025-4296 · Other software · HotelRunner · reported by iletisim@usom.gov.trMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing. This issue affects B2B: before 04.06.2025.
- Product
- B2B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 23, 2025A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sentCVE-2025-53882 · Other software · SUSE · reported by meissner@suse.deMedium 4.8
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
- Product
- openSUSE Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers.CVE-2025-2301 · Other software · Akbim Software · reported by iletisim@usom.gov.trMedium 4.4
Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.
- Product
- Online Exam Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 21, 2025Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers.CVE-2025-5681 · Other software · Turtek Software · reported by iletisim@usom.gov.trMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.
- Product
- Eyotek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 21, 2025Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers.CVE-2025-1469 · Other software · Turtek Software · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025.
- Product
- Eyotek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 19, 2025Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVE-2025-53770 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
- Product
- SharePoint
- On CISA’s list since
- Jul 20, 2025 (federal fix deadline Jul 21, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comarstechnica.com
Jul 18, 2025In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.CVE-2025-52924 · Other software · One Identity · reported by MITREMedium 4
In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.
- Product
- OneLogin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoneidentity.comonelogin.service-now.com
Jul 18, 2025IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an exCVE-2025-33014 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.
- Product
- Sterling B2B Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Visual Art | Gallery: Deserialization of Untrusted DataCVE-2025-31422 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through <= 2.4.
- Product
- Visual Art | Gallery
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Visual Art | Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025CoSchool LMS: Deserialization of Untrusted DataCVE-2025-30973 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
- Product
- CoSchool LMS
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Site Chat on Telegram: Deserialization of Untrusted DataCVE-2025-30949 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat on Telegram: from n/a through <= 1.0.4.
- Product
- Site Chat on Telegram
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Site Chat on Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025URL Shortener: Deserialization of Untrusted DataCVE-2025-28961 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Object Injection.This issue affects URL Shortener: from n/a through <= 3.0.7.
- Product
- URL Shortener
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Yogi: Deserialization of Untrusted DataCVE-2025-24779 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3.
- Product
- Yogi
- What to do
- Update Yogi to the newest version.
Jul 16, 2025Hillter: Deserialization of Untrusted DataCVE-2025-24777 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7.
- Product
- Hillter
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Hillter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025JetFormBuilder: Deserialization of Untrusted DataCVE-2025-53990 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.
- Product
- JetFormBuilder
- Affected
- up to 3.5.1.2
- What to do
- Affects up to 3.5.1.2. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2025The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust.CVE-2025-53549 · Other software · matrix-org · reported by GitHubMedium 5.2
The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients cCVE-2025-49630 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jul 10, 2025In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resCVE-2025-23048 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jul 10, 2025Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters iCVE-2024-47252 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jul 9, 2025mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URLCVE-2025-6514 · Other software · reported by reefs@jfrog.comCritical 9.6
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code CVE-2025-49533 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
- Product
- Adobe Experience Manager (MS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.