Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
912 results · page 5 of 19
Oct 16, 2025SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arbiCVE-2025-56699 · Other software · reported by MITREMedium 5.4
SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arbitrary SQL commands via the sender parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasedigitale.comgithub.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information.CVE-2025-31998 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR).CVE-2025-31997 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 11, 2025HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF).CVE-2025-31993 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.
- Product
- Unica Centralized Offer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 7, 2025The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64CVE-2025-8291 · Other software · Python Software Foundation · reported by cna@python.orgMedium 4.3
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3.CVE-2025-11284 · Other software · Zytec Dalian Zhuoyun Technology · reported by VulDBMedium 5.5
A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality of the file /index.php/auth/Ops/git of the component HTTP Header Handler. The manipulation of the argument Authorization leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Central Authentication Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record101.200.76.102vuldb.com
Oct 3, 2025An SQL injection vulnerability has been reported to affect Qsync Central.CVE-2025-54153 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An SQL injection vulnerability has been reported to affect Qsync Central.CVE-2025-53595 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.CVE-2025-52867 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-47210 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An out-of-bounds write vulnerability has been reported to affect Qsync Central.CVE-2025-44014 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-44012 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-44011 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-44010 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-44009 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-44008 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-44007 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-44006 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-33040 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-33039 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-33034 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability.CVE-2025-59668 · Other software · NIHON KOHDEN CORPORATION · reported by vultures@jpcert.or.jpHigh 8.7
Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packet, the affected device may abnormally terminate.
- Product
- Central Monitor CNS-6201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup.CVE-2025-5494 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Low 3.9
ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to CVE-2025-10231 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 7
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Sep 9, 2025Infrahub offers a central hub to manage data, templates, and playbooks.CVE-2025-59036 · Other software · opsmill · reported by GitHubMedium 5.5
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Product
- infrahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-33038 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-33037 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-33036 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-33033 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An improper certificate validation vulnerability has been reported to affect Qsync Central.CVE-2025-30278 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.3
An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An improper certificate validation vulnerability has been reported to affect Qsync Central.CVE-2025-30277 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.3
An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-30275 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-30263 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-30262 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-30261 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-30260 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.CVE-2025-29898 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An SQL injection vulnerability has been reported to affect Qsync Central.CVE-2025-29894 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An SQL injection vulnerability has been reported to affect Qsync Central.CVE-2025-29893 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025There is an Access Control Vulnerability in some HikCentral Professional versions.CVE-2025-39247 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 8.6
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.
- Product
- HikCentral Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions.CVE-2025-39246 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 5.3
There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- HikCentral FocSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025There is a CSV Injection Vulnerability in some HikCentral Master Lite versions.CVE-2025-39245 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 4.7
There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.
- Product
- HikCentral Master Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025RingCentral Communications: Authentication BypassCVE-2025-7955 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
- Product
- RingCentral Communications
- Affected
- 1.5 to 1.6.8
- What to do
- Affects 1.5 to 1.6.8. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2025On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server.CVE-2025-7051 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 8.3
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.com
Aug 20, 2025OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida.CVE-2025-55751 · Other software · HackUCF · reported by GitHubMedium 5.1
OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements jwt signing for the redirect url parameter.
- Product
- OnboardLite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victiCVE-2024-12223 · Other software · Nutanix · reported by vdp@themissinglink.com.auCritical 9.3
Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
- Product
- Prism Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025N-able N-Central Command Injection VulnerabilityCVE-2025-8876 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
- Product
- N-Central
- On CISA’s list since
- Aug 13, 2025 (federal fix deadline Aug 20, 2025)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstatus.n-able.comcisa.gov
Aug 14, 2025N-able N-Central Insecure Deserialization VulnerabilityCVE-2025-8875 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
- Product
- N-Central
- On CISA’s list since
- Aug 13, 2025 (federal fix deadline Aug 20, 2025)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstatus.n-able.comcisa.gov
Jul 24, 2025Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own.CVE-2025-53940 · Other software · TryQuiet · reported by GitHubHigh 8.5
Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.
- Product
- quiet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.CVE-2025-7433 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 8.8
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.
- Product
- Sophos Intercept X for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.