Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,333 results · page 44 of 147
Nov 18, 2025In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free.CVE-2025-48593 · Computers, phones & browsers · Google · reported by security@android.comHigh 8
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Nov 14, 2025The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.CVE-2025-64308 · Other software · Brightpick AI · reported by ics-cert@hq.dhs.govHigh 7.1
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.
- Product
- Brightpick Mission Control / Internal Logic Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrightpick.aigithub.com
Nov 14, 2025Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002.CVE-2021-4467 · Other software · Positive Technologies · reported by VulnCheckHigh 8.7
Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The service generates a new session identifier for each incoming connection without adequately limiting concurrent requests. An unauthenticated remote attacker can repeatedly issue HTTPS requests to the service, causing excessive allocation of session identifiers. Under load, session identifier collisions may occur, forcing active client sessions to disconnect and resulting in service disruption.
- Product
- MaxPatrol 8 (Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvulners.com
Nov 13, 2025SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-47913 · Other software · golang.org/x/crypto · reported by security@golang.orgHigh 7.5
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
- Product
- golang.org/x/crypto/ssh/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of CVE-2025-62484 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalaCVE-2025-64740 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.5
Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2025-64739 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of informationCVE-2025-62483 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5.3
Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.CVE-2025-30669 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.8
Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allCVE-2025-12818 · Other software · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.9
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code executiCVE-2025-12048 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.7
An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system.
- Product
- Scanner Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certaiCVE-2025-10495 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.7
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the CVE-2025-63666 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released afCVE-2025-54983 · Other software · Zscaler · reported by cve@zscaler.comMedium 5.2
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.
- Product
- Zscaler Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2025-60705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision CVE-2025-10161 · Other software · Turkguven Software Technologies Inc. · reported by iletisim@usom.gov.trHigh 7.3
Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This issue affects Perfektive: before Version: 12574 Build: 2701.
- Product
- Perfektive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 10, 2025Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted paraCVE-2025-42895 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.9
Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability of the application.
- Product
- SAP HANA JDBC Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtimeCVE-2025-42888 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability.
- Product
- SAP GUI for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2025New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend CVE-2025-12868 · Other software · CyberTutor · reported by twcert@cert.org.twCritical 9.3
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
- Product
- New Site Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 7, 2025An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.CVE-2025-63784 · Other software · Onlook · reported by MITREMedium 6.5
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.
- Product
- Onlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.soohyun.techtossbank.notion.site
Nov 6, 2025Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authentiCVE-2025-34245 · Other software · Advantech · reported by VulnCheckMedium 5.3
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- Product
- WebAccess/VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordicr.advantech.comicr.advantech.com
Nov 6, 2025Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileActioCVE-2025-34238 · Other software · Advantech · reported by VulnCheckMedium 6.9
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.
- Product
- WebAccess/VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordicr.advantech.comicr.advantech.com
Nov 6, 2025Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnCliCVE-2025-34237 · Other software · Advantech · reported by VulnCheckMedium 6.3
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- WebAccess/VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordicr.advantech.comicr.advantech.com
Nov 5, 2025Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token forCVE-2025-12779 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.8
Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract another local user's authentication token from the shared client machine and access their WorkSpace. To mitigate this issue, users should upgrade to the Amazon WorkSpaces client for Linux version 2025.0 or later.
- Product
- Amazon WorkSpaces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comdocs.aws.amazon.com
Nov 5, 2025A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenCVE-2025-20343 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 4, 2025CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12.CVE-2025-59596 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Information disclosure while processing message from client with invalid payload.CVE-2025-47362 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure while processing message from client with invalid payload.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Memory corruption while processing client message during device management.CVE-2025-47360 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing client message during device management.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Information disclosure while registering commands from clients with diag through diagHal.CVE-2025-27064 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure while registering commands from clients with diag through diagHal.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during theCVE-2025-11761 · Other software · HP Inc · reported by hp-security-alert@hp.comHigh 8.5
A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.
- Product
- HP Client Management Script Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025On a client with an admin user, a Global_Shipping script can be implemented.CVE-2025-12509 · Other software · Bizerba · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6High 8.4
On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights.
- Product
- BRAIN2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues rCVE-2025-40103 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 30, 2025A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup.CVE-2025-62230 · Other software · X.Org · reported by Red HatHigh 7.3
A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.
- Product
- Xwayland
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 29, 2025When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escapeCVE-2025-58189 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
- Product
- crypto/tls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perfCVE-2025-54547 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.3
On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
- Product
- DANZ Monitoring Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACVE-2025-56558 · Other software · Dyson · reported by MITRELow 3
The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.
- Product
- MQTT server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.orgsupport.dyson.com.au
Oct 29, 2025A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevaCVE-2025-1549 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.3
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5
- Product
- Mobile VPN with SSL Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Oct 29, 2025A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field.CVE-2024-45162 · Other software · reported by MITRECritical 9.8
A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblu-castle.comgruppotim.it
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2025In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterliCVE-2025-40052 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf() for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests) or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn'
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 27, 2025Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6.CVE-2025-11955 · Other software · TheGreenBow · reported by cve-coordination@incibe.esHigh 8.2
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
- Product
- TheGreenBow VPN Client Windows Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esthegreenbow.com
Oct 27, 2025An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.CVE-2025-59462 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.
- Product
- TLOC100-100 all Firmware versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing CVE-2025-41402 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 5.5
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
- Product
- Command Centre Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Oct 22, 2025Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted CVE-2025-60340 · Network & remote access · Tenda · reported by MITREHigh 7.5
Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the limitSpeed, deviceId, and limitSpeedUp parameters.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function.CVE-2025-60338 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.CVE-2025-11625 · Other software · wolfSSL · reported by facts@wolfssl.comCritical 9.4
Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.
- Product
- wolfSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text.CVE-2025-10641 · Other software · EfficientLab · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.1
All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit their data to the server using the unencrypted FTP. Clients connect to the FTP server on port 12304 and transmit the data unencrypted. In addition, all traffic between the console client and the server at port 12306 is unencrypted.
- Product
- WorkExaminer Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Oct 21, 2025The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304.CVE-2025-10639 · Other software · EfficientLab · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
- Product
- WorkExaminer Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Oct 20, 2025In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the seCVE-2025-55086 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.
- Product
- NextX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.CVE-2025-62650 · Other software · Restaurant Brands International · reported by MITREHigh 8.3
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
- Product
- assistant platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.todaybobdahacker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.