Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,942 results · page 7 of 59
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64421 · Other software · coollabsio · reported by GitHubHigh 8.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks the invite button a second time, it actually works. This way, a low privileged user can invite themselves as an administrator to the Coolify instance. After the high privileged user is invited, the attacker can initiate a password reset and log in with the new admin. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64420 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64419 · Other software · coollabsio · reported by GitHubCritical 9.6
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59955 · Other software · coollabsio · reported by GitHubMedium 5.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59158 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated resource, the payload automatically executes in the admin’s browser context. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59157 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59156 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface.CVE-2025-15017 · Other software · Moxa · reported by psirt@moxa.comHigh 7
A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access to internal debug functionality. Exploitation is low complexity and allows an attacker to execute privileged operations and access sensitive system resources, resulting in a high impact to the confidentiality, integrity, and availability of the affected device. No security impact to external or dependent systems has been identified.
- Product
- NPort 5000AI-M12 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outCVE-2025-14728 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.8
Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E". Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66213 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66212 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66211 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66210 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66209 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it dCVE-2025-68145 · Other software · modelcontextprotocol · reported by GitHubMedium 6.4
In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.17 upon release to remediate this issue.
- Product
- servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without saCVE-2025-68144 · Other software · modelcontextprotocol · reported by GitHubMedium 6.3
In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.
- Product
- servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP).CVE-2025-68143 · Other software · modelcontextprotocol · reported by GitHubMedium 6.5
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.
- Product
- servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling.CVE-2025-66373 · Other software · Akamai · reported by MITREMedium 4.8
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
- Product
- Akamaighost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orgakamai.com
Dec 3, 2025MCP Gateway allows easy and secure running and deployment of MCP servers.CVE-2025-64443 · Other software · docker · reported by GitHubHigh 7.3
MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.
- Product
- mcp-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Arcade MCP allows you to to create, deploy, and share MCP Servers.CVE-2025-66454 · Other software · ArcadeAI · reported by GitHubMedium 6.5
Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This grants remote access to all worker endpoints—including tool enumeration and tool invocation—without credentials. This vulnerability is fixed in 1.5.4.
- Product
- arcade-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.CVE-2025-66414 · Other software · modelcontextprotocol · reported by GitHubHigh 7.6
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.24.0.
- Product
- typescript-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers.CVE-2025-66401 · Other software · kapilduraphe · reported by GitHubCritical 9.8
MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via execSync without sanitization. This allows an attacker to execute arbitrary commands on the host machine by appending shell metacharacters to the URL.
- Product
- mcp-watch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux aCVE-2025-41739 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.9
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
- Product
- CODESYS PLCHandler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Core Bot Is an Open Source discord bot made for maple hospital servers.CVE-2025-65957 · Other software · Intercore-Productions · reported by GitHubHigh 8.8
Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using environment variables, but there are cases in code (error handling, summaries, webhooks) where configuration summaries may inadvertently leak sensitive data (e.g., by failing to redact data in summary embeds or logs). This issue has been patched via commit dffe050.
- Product
- Core-Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded meCVE-2025-58181 · Other software · golang.org/x/crypto · reported by security@golang.orgMedium 5.3
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed dCVE-2025-47914 · Other software · golang.org/x/crypto · reported by security@golang.orgMedium 5.3
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
- Product
- golang.org/x/crypto/ssh/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4CVE-2025-11546 · Other software · NEC Corporation · reported by psirt-info@cyber.jp.nec.comCritical 9.3
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
- Product
- CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages.CVE-2017-20209 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 29, 2025FluxCP is a web-based Control Panel for rAthena servers written in PHP.CVE-2025-62797 · Other software · rathena · reported by GitHubHigh 8.6
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.
- Product
- FluxCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2025-62706 · Other software · authlib · reported by GitHubMedium 6.5
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element.CVE-2025-62425 · Other software · element-hq · reported by GitHubHigh 8.3
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1.
- Product
- matrix-authentication-service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.CVE-2025-58724 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
- Product
- Arc Enabled Servers - Azure Connected Machine Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.CVE-2025-47989 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
- Product
- Arc Enabled Servers - Azure Connected Machine Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has conCVE-2025-58084 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2025-61920 · Other software · authlib · reported by GitHubHigh 7.5
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025TS3 Manager is modern web interface for maintaining Teamspeak3 servers.CVE-2025-61583 · Other software · joni1802 · reported by GitHubMedium 4.3
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.
- Product
- ts3-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025TS3 Manager is modern web interface for maintaining Teamspeak3 servers.CVE-2025-61582 · Other software · joni1802 · reported by GitHubHigh 7.5
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2.
- Product
- ts3-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-CVE-2025-56675 · Other software · EKEN · reported by MITRELow 3.5
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.
- Product
- video doorbell T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com
Sep 22, 2025Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2025-59420 · Other software · authlib · reported by GitHubHigh 7.5
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The MCP inspector is a developer tool for testing and debugging MCP servers.CVE-2025-58444 · Other software · modelcontextprotocol · reported by GitHubHigh 8.6
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.
- Product
- inspector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2025-58057 · Other software · netty · reported by GitHubMedium 6.9
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.CVE-2025-58056 · Other software · netty · reported by GitHubLow 2.9
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Aug 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-54421 · Other software · NamelessMC · reported by GitHubHigh 7.2
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter. This vulnerability is fixed in 2.2.4.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-54118 · Other software · NamelessMC · reported by GitHubMedium 5.3
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthenticated remote attacker to gain sensitive information such as absolute path of the source code via list parameter. This vulnerability is fixed in 2.2.4.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-54117 · Other software · NamelessMC · reported by GitHubCritical 9
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed in 2.2.4.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability in the management and VPN web servers of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacCVE-2025-20243 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the management and VPN web servers of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to improper validation of user-supplied input on an interface with VPN web services. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on an affected device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 14, 2025A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could aCVE-2025-20133 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly stop responding, resulting in a DoS condition. This vulnerability is due to ineffective validation of user-supplied input during the Remote Access SSL VPN authentication process. An attacker could exploit this vulnerability by sending a crafted request to the VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition where the device stops responding to Remote Access SSL VPN authentication requests.
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 14, 2025The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers.CVE-2025-8943 · Other software · Flowiseai · reported by reefs@jfrog.comCritical 9.8
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations.CVE-2025-8862 · Other software · YugabyteDB Inc · reported by security@yugabyte.comHigh 7
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.
- Product
- YugabyteDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840.CVE-2025-26469 · Other software · MedDream · reported by talos-cna@cisco.comCritical 9.3
An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially crafted application can decrypt credentials stored in a configuration-related registry key. An attacker can execute a malicious script or application to exploit this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.