Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,274 results · page 7 of 26
Nov 18, 2025joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.CVE-2025-65015 · Other software · authlib · reported by GitHubCritical 9.2
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.
- Product
- joserfc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library fuCVE-2025-57812 · Other software · OpenPrinting · reported by GitHubLow 3.7
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and
- Product
- libcupsfilters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The ParseAddress function constructs domain-literal address components through repeated string concatenation.CVE-2025-61725 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
- Product
- net/mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines.CVE-2025-61724 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
- Product
- net/textproto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.CVE-2025-61723 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
- Product
- encoding/pem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escapeCVE-2025-58189 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
- Product
- crypto/tls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.CVE-2025-58188 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
- Product
- crypto/x509
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.CVE-2025-58187 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
- Product
- crypto/x509
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit.CVE-2025-58186 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.CVE-2025-58185 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
- Product
- encoding/asn1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.CVE-2025-58183 · Other software · Go standard library · reported by security@golang.orgMedium 4.3
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
- Product
- archive/tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL.CVE-2025-47912 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025FastMCP is the standard framework for building MCP applications.CVE-2025-62801 · Other software · jlowin · reported by GitHubMedium 5.4
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.
- Product
- fastmcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025FastMCP is the standard framework for building MCP applications.CVE-2025-62800 · Other software · jlowin · reported by GitHubMedium 5.3
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
- Product
- fastmcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025ETERNUS SF provided by Fsas Technologies Inc.CVE-2025-62577 · Other software · Fsas Technologies Inc. · reported by vultures@jpcert.or.jpHigh 8.4
ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management server may obtain database credentials, potentially allowing execution of OS commands with administrator privileges.
- Product
- ETERNUS SF AdvancedCopy Manager Standard Edition (for Solaris 10/ 11)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejCVE-2025-62491 · Other software · QuickJS · reported by cve-coordination@google.comHigh 8.8
A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop. * The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp->reason). * If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process. * The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed. * Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list. * Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition.
- Product
- QuickJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbellard.orgissuetracker.google.com
Oct 14, 2025An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.CVE-2025-25255 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 6, 2025IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization.CVE-2023-49886 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
- Product
- Transformation Extender Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard liCVE-2025-11233 · Other software · Rust Project · reported by 986d4109-89ea-491f-99fd-a8e4803919bdMedium 6.3
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.
- Product
- std
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Sep 26, 2025PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScripCVE-2025-57692 · Other software · Dotnetfoundation · reported by MITREMedium 6.8
PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
- Product
- Piranha CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers.CVE-2025-58354 · Other software · kata-containers · reported by GitHubMedium 6.9
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.
- Product
- kata-containers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended.CVE-2025-47910 · Other software · Go standard library · reported by security@golang.orgMedium 5.4
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means.CVE-2025-30519 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govdoverfuelingsolutions.com
Sep 18, 2025If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), cCVE-2025-47906 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
- Product
- os/exec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., wheCVE-2025-9818 · Other software · OMRON SOCIAL SOLUTIONS CO., Ltd. · reported by bba440f9-ef23-4224-aa62-7ac0935d18d1Medium 6.7
A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.
- Product
- PowerAttendant Standard Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consCVE-2025-42930 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity.
- Product
- SAP Business Planning and Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow.CVE-2025-26416 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 14, 2025@std/toml is the Deno Standard Library.CVE-2025-55195 · Other software · denoland · reported by GitHubHigh 7.3
@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9.
- Product
- std
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX mayCVE-2025-32086 · Other software · reported by secure@intel.comMedium 4.5
Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 12, 2025Out-of-bounds read in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosurCVE-2025-22392 · Other software · reported by secure@intel.comMedium 5.9
Out-of-bounds read in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via network access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard.CVE-2025-54887 · Other software · jwt · reported by GitHubCritical 9.1
jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
- Product
- ruby-jwe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025Cancelling a query (e.g.CVE-2025-47907 · Other software · Go standard library · reported by security@golang.orgHigh 7
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
- Product
- database/sql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/tCVE-2024-8244 · Other software · Go standard library · reported by security@golang.orgLow 3.7
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53012 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.
- Product
- MaterialX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53011 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file. This is fixed in version 1.39.3.
- Product
- MaterialX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53010 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
- Product
- MaterialX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53009 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
- Product
- MaterialX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versiCVE-2024-55599 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comcert-portal.siemens.com
Jun 23, 2025Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.CVE-2025-6513 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6Critical 9.3
Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
- Product
- BRAIN2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink.CVE-2025-0913 · Other software · Go standard library · reported by security@golang.orgMedium 5.5
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
- Product
- syscall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-4673 · Other software · Go standard library · reported by security@golang.orgMedium 6.8
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation.CVE-2025-22874 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
- Product
- crypto/x509
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.CVE-2025-33068 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2012 R2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025SignXML is an implementation of the W3C XML Signature standard in Python.CVE-2025-48995 · Other software · XML-Security · reported by GitHubMedium 6.9
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.
- Product
- signxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025SignXML is an implementation of the W3C XML Signature standard in Python.CVE-2025-48994 · Other software · XML-Security · reported by GitHubMedium 6.9
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.
- Product
- signxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certCVE-2025-43010 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.3
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.
- Product
- SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use oCVE-2025-1331 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.
- Product
- CICS TX Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS CVE-2025-1330 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyname function.
- Product
- CICS TX Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS rCVE-2025-1329 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyaddr function.
- Product
- CICS TX Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.CVE-2025-22871 · Other software · Go standard library · reported by security@golang.orgCritical 9.1
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
- Product
- net/http/internal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.