Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
941 results · page 6 of 19
Jul 30, 2025GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tCVE-2025-53008 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package.CVE-2025-52897 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-52567 · Other software · glpi-project · reported by GitHubLow 3.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-27514 · Other software · glpi-project · reported by GitHubMedium 4.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet: Cross-Site Request ForgeryCVE-2025-5937 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose inCVE-2025-49715 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
- Product
- Dynamics 365 FastTrack Implementation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6120 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6119 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below.CVE-2025-2500 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comCritical 9.1
A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded.
- Product
- Asset Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
May 30, 2025A vulnerability exists in the media upload component of the Asset Suite versions listed below.CVE-2025-1484 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.3
A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application.
- Product
- Asset Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
May 28, 2025Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.CVE-2025-31500 · Other software · bestpractical · reported by MITREHigh 7.2
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.
- Product
- RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
May 26, 2025A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5204 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_MDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5203 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function SkipSpaces in the library assimp/include/assimp/ParsingUtils.h. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5202 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5201 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAndFacesLWO2 of the file assimp/code/AssetLib/LWO/LWOLoader.cpp. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5200 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDLImporter::InternReadFile_Quake1 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5169 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5168 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5167 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5166 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5165 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-47226 · Other software · snipeitapp · reported by MITREMedium 5
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management.CVE-2024-12706 · Other software · OpenText™ · reported by security@opentext.comLow 2.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability could allow an authenticated user to run arbitrary SQL commands on the underlying database. This issue affects Digital Asset Management.: through 24.4.
- Product
- Digital Asset Management.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting.CVE-2025-2986 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF).CVE-2025-2987 · Other software · IBM · reported by psirt@us.ibm.comLow 3.8
IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3549 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-3548 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3196 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-3160 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3159 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3158 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files upCVE-2025-22931 · Other software · Os4ed · reported by MITREHigh 7.5
An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer.CVE-2025-27244 · Other software · Hammock Corporation · reported by vultures@jpcert.or.jpMedium 5.9
AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be obtained by a remote unauthenticated attacker.
- Product
- AssetView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD.CVE-2025-25060 · Other software · Hammock Corporation · reported by vultures@jpcert.or.jpHigh 8.2
Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server where the product is running may be obtained and/or deleted by a remote unauthenticated attacker.
- Product
- AssetView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3016 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3015 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing.CVE-2025-1449 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.5
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
- Product
- Verve Asset Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Mar 25, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2757 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2756 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2755 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2754 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2753 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-2752 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-2751 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2750 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2592 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2591 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-24801 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-24799 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-21619 · Other software · glpi-project · reported by GitHubHigh 8.2
GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.