Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,112 results · page 64 of 163
Aug 20, 2025A vulnerability was found in the Cryostat HTTP API.CVE-2025-8415 · Other software · Cryostat · reported by Red HatMedium 5.9
A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
- Product
- Cryostat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2025Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.CVE-2024-57157 · Other software · reported by MITRECritical 9.8
Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disCVE-2011-10030 · Other software · Foxit Software · reported by VulnCheckHigh 8.4
Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.
- Product
- Foxit PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscarybeastsecurity.blogspot.comraw.githubusercontent.com
Aug 20, 2025Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality.CVE-2011-10026 · Websites & servers · Spreecommerce · reported by VulnCheckCritical 9.3
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
- Product
- Spreecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Aug 20, 2025Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token viaCVE-2024-57491 · Other software · reported by MITREHigh 8.8
Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token via the preHandle function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, atCVE-2025-9074 · Other software · Docker · reported by security@docker.comCritical 9.3
A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the "Expose daemon on tcp://localhost:2375 without TLS" option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comblog.qwertysecurity.com
Aug 20, 2025A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110.CVE-2025-32010 · Network & remote access · Tenda · reported by talos-cna@cisco.comHigh 8.1
A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.
- Product
- AC6 V5.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 20, 2025Custom API for WP: Incorrect Privilege AssignmentCVE-2025-54049 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.
- Product
- Custom API for WP
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Custom API for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Custom API for WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54048 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.
- Product
- Custom API for WP
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Custom API for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials.CVE-2025-57788 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Medium 6.9
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
- Product
- CommCell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.comlabs.watchtowr.com
Aug 19, 2025In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP CVE-2025-38570 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test. The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(), NAPI has been freed. Looks like the device failed to open earlier, and we lack clearing the NAPI pointer from the queue.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 19, 2025A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to supeCVE-2025-4690 · Computers, phones & browsers · Google · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.3
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
- Product
- AngularJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodepen.ioherodevs.com
Aug 18, 2025An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8.CVE-2025-4962 · Other software · lunary-ai · reported by security@huntr.devHigh 7.7
An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the `projectId` query parameter. The root cause of this issue is the absence of server-side validation to ensure that the authenticated user owns the specified `projectId`. The vulnerability has been addressed in version 1.9.23.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.CVE-2025-27847 · Other software · reported by MITREMedium 4.3
In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret.CVE-2025-27845 · Other software · reported by MITRECritical 9.8
In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token.CVE-2025-9036 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
- Product
- FactoryTalk® Action Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2025When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload.CVE-2025-55673 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 14, 2025The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd.CVE-2024-53945 · Other software · reported by MITREHigh 8.8
The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges via shell metacharacters in parameters such as pincode and cmds. Exploitation can lead to full system compromise, including enabling remote access (e.g., enabling telnet).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025SMM API: Missing AuthorizationCVE-2025-52785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.
- Product
- SMM API
- Affected
- up to 6.0.31
- What to do
- Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application dCVE-2025-48861 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 5.3
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.
- Product
- ctrlX OS - Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data,CVE-2025-43988 · Other software · reported by MITREHigh 7.5
KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Aug 12, 2025Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.CVE-2025-53789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.1 may allow an authenticated user to potentially enable escaCVE-2025-20627 · Other software · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of priCVE-2025-20099 · Other software · reported by secure@intel.comMedium 5.4
Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Incorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticated user to potentially enable escalation oCVE-2025-20087 · Other software · reported by secure@intel.comMedium 5.4
Incorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially enable escalation of CVE-2025-20017 · Other software · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint.CVE-2025-8866 · Other software · YugabyteDB Inc · reported by security@yugabyte.comMedium 5.1
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
- Product
- YugabyteDB Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4.CVE-2025-55013 · Other software · CybercentreCanada · reported by GitHubMedium 4.2
The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138.
- Product
- assemblyline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to extrCVE-2025-8749 · Other software · Mobile Industrial Robots · reported by 1b7e193f-2525-49a1-b171-84af8827c9ebMedium 6.5
Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to extract files from the robot file system via a crafted API request.
- Product
- MiR Robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmobile-industrial-robots.comsupportportal.mobile-industrial-robots.com
Aug 7, 2025An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.CVE-2025-44779 · Other software · Ollama · reported by MITREMedium 6.6
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
- Product
- Ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorda1batr0ss.topa1batr0ss.top
Aug 6, 2025Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API.CVE-2025-7770 · Other software · Tigo Energy · reported by ics-cert@hq.dhs.govHigh 8.7
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.
- Product
- Cloud Connect Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remoteCVE-2025-7769 · Other software · Tigo Energy · reported by ics-cert@hq.dhs.govHigh 8.7
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
- Product
- Cloud Connect Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authCVE-2025-51058 · Other software · Vedo Suite Project · reported by MITREMedium 6.5
Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter.
- Product
- Vedo Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17.CVE-2025-51055 · Other software · Vedo Suite Project · reported by MITREHigh 8.6
Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
- Product
- Vedo Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and pCVE-2025-51053 · Other software · Vedo Suite Project · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser.
- Product
- Vedo Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allCVE-2025-51308 · Other software · Gatling · reported by MITREMedium 5.3
In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks.
- Product
- Gatling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.CVE-2025-50234 · Other software · Chshcms · reported by MITREMedium 6.5
MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting t
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function.CVE-2025-7771 · Other software · TechPowerUp · reported by vulnerability@kaspersky.comHigh 8.7
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
- Product
- ThrottleStop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurelist.com
Aug 5, 2025Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`.CVE-2012-10029 · Other software · Nagios Enterprises · reported by VulnCheckHigh 8.6
Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.
- Product
- Nagios XI Graph Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsraw.githubusercontent.com
Aug 4, 2025EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.CVE-2025-52892 · Other software · espocrm · reported by GitHubMedium 4.5
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries aCVE-2025-54554 · Other software · Tera Insights · reported by MITREMedium 5.3
tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.
- Product
- tiCrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.CVE-2025-44960 · Other software · RUCKUS · reported by MITREHigh 8.5
RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.
- Product
- SmartZone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comkb.cert.org
Aug 4, 2025Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.CVE-2025-44957 · Other software · RUCKUS · reported by MITREHigh 8.5
Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.
- Product
- SmartZone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comkb.cert.org
Aug 1, 2025Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScCVE-2025-51501 · Other software · Microweber · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issCVE-2025-29557 · Other software · reported by MITREMedium 5.4
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear textCVE-2025-7738 · Other software · Ansible · reported by Red HatMedium 4.4
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
- Product
- django-ansible-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54768 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
- Product
- LPAR2RRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comlpar2rrd.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54766 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54765 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 28, 2025There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs.CVE-2025-8194 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7.5
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.