Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,645 results · page 46 of 113
Jun 16, 2025Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messagCVE-2025-4565 · Other software · protocolbuffers · reported by cve-coordination@google.comHigh 8.2
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
- Product
- Python-Protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Untrusted Search Path vulnerability in Apache Tomcat installer for Windows.CVE-2025-49124 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.4
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jun 13, 2025A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 PluCVE-2025-24919 · Other software · Broadcom · reported by talos-cna@cisco.comHigh 8.1
A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
- Product
- BCM5820X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddell.comtalosintelligence.com
Jun 13, 2025RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-inCVE-2025-48825 · Other software · Ricoh Company, Ltd. · reported by vultures@jpcert.or.jpLow 2
RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-in-the-middle attack to eavesdrop upgrade requests and execute a malicious DLL with custom code.
- Product
- RICOH Streamline NX V3 PC Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2025-30399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software.CVE-2025-3052 · Other software · DT Research · reported by cret@cert.orgHigh 8.2
An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.
- Product
- BiosFlashShell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with CVE-2025-2884 · Other software · Trusted Computing Group · reported by cret@cert.orgMedium 6.6
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
- Product
- TPM2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrustedcomputinggroup.org
Jun 10, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47166 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47163 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025matrix-rust-sdk is an implementation of a Matrix client-server library in Rust.CVE-2025-48937 · Other software · matrix-org · reported by GitHubMedium 4.9
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized iCVE-2025-5335 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution.
- Product
- Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemsfs.autodesk.comautodesk.com
Jun 10, 2025CozyStay: Deserialization of Untrusted DataCVE-2025-49507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.
- Product
- CozyStay
- What to do
- Update CozyStay to the newest version.
Jun 9, 2025PressGrid - Frontend Publish Reaction & Multimedia: Deserialization of Untrusted DataCVE-2025-31429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
- Product
- PressGrid - Frontend Publish Reaction & Multimedia
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PressGrid - Frontend Publish Reaction & Multimedia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PIMP - Creative MultiPurpose: Deserialization of Untrusted DataCVE-2025-31398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
- Product
- PIMP - Creative MultiPurpose
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PIMP - Creative MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025FLAP - Business: Deserialization of Untrusted DataCVE-2025-31396 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.
- Product
- FLAP - Business
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update FLAP - Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025The Fashion - Model Agency One Page Beauty: Deserialization of Untrusted DataCVE-2025-31052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.
- Product
- The Fashion - Model Agency One Page Beauty
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update The Fashion - Model Agency One Page Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security.CVE-2025-25207 · Other software · Red Hat · reported by Red HatMedium 5.7
The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.
- Product
- Red Hat Connectivity Link 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 6, 2025Deserialization of Untrusted Data vulnerability in Apache InLong.CVE-2025-27531 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jun 6, 2025A flaw was found in the user's crate for Rust.CVE-2025-5791 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
- Product
- Red Hat OpenShift sandboxed containers 1.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 6, 2025Newspack Newsletters: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-49325 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.
- Product
- Newspack Newsletters
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sweet Dessert: Deserialization of Untrusted DataCVE-2025-49073 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13.
- Product
- Sweet Dessert
- Fixed in
- 1.1.13
- What to do
- Update Sweet Dessert to 1.1.13 or newer.
Jun 6, 2025Mr. Murphy: Deserialization of Untrusted DataCVE-2025-49072 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through < 1.2.12.1.
- Product
- Mr. Murphy
- What to do
- Update Mr. Murphy to the newest version.
Jun 6, 2025WP Gravity Forms Constant Contact: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30954 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.
- Product
- WP Gravity Forms Constant Contact
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Gravity Forms Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
- Product
- WP Gravity Forms Salesforce
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Photography: Deserialization of Untrusted DataCVE-2025-47584 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.
- Product
- Photography
- Affected
- up to 7.5.2
- What to do
- Affects up to 7.5.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Posts Carousel: Deserialization of Untrusted DataCVE-2025-39358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through <= 1.3.12.
- Product
- WP Posts Carousel
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408CVE-2025-48780 · Other software · Soar Cloud System CO., LTD. · reported by ART@zuso.aiCritical 9.9
A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a crafted serialized object.
- Product
- HRD Human Resource Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key.CVE-2025-20989 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.2
Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jun 4, 2025Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.CVE-2025-20988 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jun 4, 2025Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth_token.CVE-2025-20987 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.2
Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth_token.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jun 2, 2025Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data VulnerabilityCVE-2025-5086 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comExploitedCritical 9
Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
- Product
- DELMIA Apriso
- On CISA’s list since
- Sep 11, 2025 (federal fix deadline Oct 2, 2025)
- What to do
- Attackers are using this now. Install Dassault Systèmes’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalog3ds.comisc.sans.edu
Jun 2, 2025Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.CVE-2024-12168 · Other software · Yandex · reported by browser-security@yandex-team.ruHigh 8.4
Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
- Product
- Telemost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.9
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
- Product
- Webmail
- On CISA’s list since
- Feb 20, 2026 (federal fix deadline Mar 13, 2026)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfearsoff.orggithub.com
May 30, 2025An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-2501 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.CVE-2025-41235 · Other software · VMware · reported by security@vmware.comHigh 8.6
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
- Product
- Spring cloud Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a CVE-2024-12224 · Other software · servo · reported by security@mozilla.orgMedium 5.1
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
- Product
- rust-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgrustsec.org
May 29, 2025Course Builder: Deserialization of Untrusted DataCVE-2025-48336 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.
- Product
- Course Builder
- What to do
- Update Course Builder to the newest version.
May 28, 2025Deserialization of Untrusted Data vulnerability in Apache InLong.CVE-2025-27528 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 28, 2025Deserialization of Untrusted Data vulnerability in Apache InLong.CVE-2025-27526 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 28, 2025Deserialization of Untrusted Data vulnerability in Apache InLong.CVE-2025-27522 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 24, 2025A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical.CVE-2025-5129 · Other software · Sangfor · reported by VulDBHigh 7.3
A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 零信任访问控制系统 aTrust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 23, 2025In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for groupCVE-2025-48756 · Other software · maboroshinokiseki · reported by MITRELow 2.9
In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for group number.
- Product
- scsir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).CVE-2025-48755 · Other software · blyssprivacy · reported by MITRELow 2.9
In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).
- Product
- sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025In the memory_pages crate 0.1.0 for Rust, division by zero can occur.CVE-2025-48754 · Other software · FractalFir · reported by MITRELow 2.9
In the memory_pages crate 0.1.0 for Rust, division by zero can occur.
- Product
- memory_pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.CVE-2025-48753 · Other software · obsidiandynamics · reported by MITRELow 2.9
In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.
- Product
- anode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.CVE-2025-48752 · Other software · Forestryks · reported by MITRELow 2.9
In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.
- Product
- process-sync-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025The process_lock crate 0.1.0 for Rust allows data races in unlock.CVE-2025-48751 · Other software · tickbh · reported by MITRELow 2.9
The process_lock crate 0.1.0 for Rust allows data races in unlock.
- Product
- ProcessLock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Kids Planet: Deserialization of Untrusted DataCVE-2025-48289 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.
- Product
- Kids Planet
- Affected
- up to 2.2.14
- What to do
- Affects up to 2.2.14. Update Kids Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Pix 4x sem juros - Pagaleve: Deserialization of Untrusted DataCVE-2025-48287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.
- Product
- Pix 4x sem juros - Pagaleve
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Pix 4x sem juros - Pagaleve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WC Affiliate: Deserialization of Untrusted DataCVE-2025-47660 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through <= 2.16.
- Product
- WC Affiliate
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.