Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,210 results · page 6 of 45
Oct 27, 2025Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order.CVE-2025-9164 · Other software · Docker · reported by security@docker.comHigh 8.8
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.CVE-2025-11411 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 5.7
NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnlnetlabs.nlopenwall.com
Oct 15, 2025A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated usCVE-2025-10581 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.CVE-2025-10228 · Other software · Rolantis Information Technologies · reported by iletisim@usom.gov.trHigh 8.8
Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking. This issue affects Agentis: before 4.44.
- Product
- Agentis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 6, 2025JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.CVE-2025-9913 · Other software · SICK AG · reported by psirt@sick.deMedium 4.5
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions CVE-2025-54289 · Other software · Canonical · reported by security@ubuntu.comHigh 7.4
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack.CVE-2025-23355 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and denial of service.
- Product
- Nsight Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Oct 1, 2025DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.CVE-2025-59684 · Other software · Digisign · reported by MITREHigh 8.8
DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.
- Product
- Digisigner ONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-11178 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Sep 26, 2025Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code.CVE-2025-56383 · Other software · reported by MITREHigh 8.4
Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273.CVE-2025-10973 · Other software · JackieDYH · reported by VulDBMedium 5.5
A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionality of the file /admin/show.php. This manipulation of the argument userid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Resume-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple DLLs.CVE-2025-57624 · Other software · reported by MITREHigh 7.8
A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple DLLs.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsry1.gitbook.ioyoutu.be
Sep 15, 2025A Clickjacking vulnerability exists in Rems' Employee Management System 1.0.CVE-2025-57117 · Other software · Remyandrade · reported by MITREMedium 5.4
A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the department.php page by injecting a malicious payload into the Department Name field under Add Department.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Sep 11, 2025A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code wiCVE-2025-9201 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code with elevated privileges.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.CVE-2025-9059 · Other software · Broadcom · reported by secure@symantec.comHigh 8.8
The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.
- Product
- 8.6.IT Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8.CVE-2025-40979 · Other software · Grandstream Networks · reported by cve-coordination@incibe.esHigh 7
DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users<user>\AppData\Local\Temp' directory, which could lead to arbitrary code execution and persistence. This vulnerability is only replicable in versions of Windows 11 and does not affect earlier versions.
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by pCVE-2025-10215 · Other software · UPDF · reported by cve-coordination@incibe.esHigh 7
DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence.
- Product
- UPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by pCVE-2025-10214 · Other software · UPDF · reported by cve-coordination@incibe.esHigh 7
DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence.
- Product
- UPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by pCVE-2025-10213 · Other software · UPDF · reported by cve-coordination@incibe.esHigh 7
DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\' directory, which could lead to arbitrary code execution and persistence.
- Product
- UPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeaCVE-2025-10198 · Other software · LizardByte · reported by cret@cert.orgHigh 7.8
Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.
- Product
- Sunshine for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.CVE-2025-58782 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
- Product
- Apache Jackrabbit Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 4, 2025In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking.CVE-2025-48558 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack.CVE-2025-48528 · Computers, phones & browsers · Google · reported by security@android.comMedium 4
In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack.CVE-2025-32350 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack.CVE-2025-32349 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Sep 4, 2025In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code.CVE-2025-0089 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Sep 3, 2025Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking.CVE-2024-13066 · Other software · Akinsoft · reported by iletisim@usom.gov.trMedium 4.3
Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects LimonDesk: from s1.02.14 before v1.02.17.
- Product
- LimonDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 3, 2025PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withoutCVE-2023-21466 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider without proper permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Sep 2, 2025In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack.CVE-2025-22419 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 2, 2025In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack.CVE-2025-22417 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 26, 2025In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack.CVE-2025-0080 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 26, 2025IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim.CVE-2025-1494 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- Cognos Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings.CVE-2025-55622 · Other software · Reolink · reported by MITREMedium 6.5
Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience.
- Product
- Reolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrelieved-knuckle-264.notion.site
Aug 19, 2025Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victiCVE-2024-12223 · Other software · Nutanix · reported by vdp@themissinglink.com.auCritical 9.3
Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
- Product
- Prism Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking.CVE-2025-50891 · Other software · Adform · reported by MITREHigh 7.2
The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a customer does not need to take any action to update locally installed software (such as Adform Site Tracking 1.1).
- Product
- server-side backend for Site Tracking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025The affected setup component is vulnerable to DLL hijacking.CVE-2025-30033 · Other software · Siemens · reported by productcert@siemens.comHigh 8.5
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
- Product
- Automation License Manager V6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 28, 2025DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture.CVE-2025-7676 · Computers, phones & browsers · Microsoft, Inc · reported by ot-cert@dragos.comMedium 5.4
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.
- Product
- Windows 11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jul 23, 2025IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability.CVE-2025-36116 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.
- Product
- Db2 Mirror for i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts throuCVE-2025-51864 · Other software · reported by MITREMedium 6.5
A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack.CVE-2025-7427 · Computers, phones & browsers · Arm · reported by arm-security@arm.comMedium 5.9
Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio.
- Product
- Development Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privilegesCVE-2025-1729 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.4
A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privileges.
- Product
- TrackPoint Quick Menu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate priCVE-2025-1700 · Other software · Motorola · reported by psirt@lenovo.comHigh 7.1
A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.
- Product
- Software Fix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comsupport.lenovo.com
Jul 16, 2025A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI CVE-2025-6983 · Network & remote access · TP-Link System Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 5.1
A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.This issue affects Archer C1200 <= 1.1.5.
- Product
- Archer C1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privilCVE-2025-53689 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Product
- Apache Jackrabbit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 10, 2025In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack CVE-2025-49812 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.4
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jul 3, 2025The web application is vulnerable to clickjacking attacks.CVE-2025-27455 · Other software · Endress+Hauser · reported by psirt@sick.deMedium 4.3
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects.
- Product
- Endress+Hauser MEAC300-FNADE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.CVE-2025-36027 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- Datacap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.CVE-2024-39730 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- Datacap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.CVE-2025-52999 · Other software · FasterXML · reported by GitHubHigh 8.7
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
- Product
- jackson-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter.CVE-2025-53021 · Other software · Moodle · reported by MITREMedium 4.2
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commoodledev.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.