Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,174 results · page 74 of 304
Sep 3, 2025Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.CVE-2025-58056 · Other software · netty · reported by GitHubLow 2.9
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55748 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55747 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original UCVE-2025-56139 · Other software · Linkedin · reported by MITREMedium 5.3
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different URL, which can be malicious. This UI misrepresentation enables attackers to deceive users by displaying trusted previews for harmful links, facilitating phishing attacks and user confusion.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhdhrmi.blogspot.comhdhrmi.blogspot.com
Sep 3, 2025SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.CVE-2025-9822 · Other software · Mautic · reported by security@mautic.orgMedium 5.5
SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.CVE-2023-21481 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.4
Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Sep 3, 2025Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs.CVE-2025-58176 · Other software · OpenAgentPlatform · reported by GitHubHigh 8.8
Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object. An attacker can exploit the vulnerability in the following two scenarios: a victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or a victim clicks on such a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes Dive's custom URL handler (dive:), which launches the Dive app and processes the crafted URL, leading to arbitrary code execution on the victim’s machine. This vulnerability is caused by improper processing of custom url. This is fixed in version 0.9.4.
- Product
- Dive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to CVE-2025-22442 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commandCVE-2025-55373 · Other software · Beakon · reported by MITREMedium 5.3
Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights.
- Product
- Beakon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeakon.com.aupacketstorm.news
Sep 2, 2025An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2025-55372 · Other software · Beakon · reported by MITREMedium 5.3
An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- Beakon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist butCVE-2025-52548 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 6.9
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication.CVE-2025-52543 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 5.3
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication.CVE-2025-44017 · Other software · Gunosy Inc. · reported by vultures@jpcert.or.jpMedium 5.1
"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token).
- Product
- "Gunosy" App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025MobSF is a mobile application security testing tool used.CVE-2025-58162 · Other software · MobSF · reported by GitHubMedium 6.5
MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025MobSF is a mobile application security testing tool used.CVE-2025-58161 · Other software · MobSF · reported by GitHubLow 1.3
MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deCVE-2025-54943 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-57822 · Other software · vercel · reported by GitHubMedium 6.5
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-57752 · Other software · vercel · reported by GitHubMedium 6.2
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-55173 · Other software · vercel · reported by GitHubMedium 4.3
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Basecamp's Google Sign-In adds Google sign-in to Rails applications.CVE-2025-58067 · Other software · basecamp · reported by GitHubMedium 4.2
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds.
- Product
- google_sign_in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.CVE-2025-48979 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comLow 3.4
An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.
- Product
- UISP Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-58049 · Other software · xwiki · reported by GitHubMedium 5.8
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions dCVE-2025-31979 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.
- Product
- BigFix Service Management (SM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 27, 2025Basecamp's Google Sign-In adds Google sign-in to Rails applications.CVE-2025-57821 · Other software · basecamp · reported by GitHubMedium 4.2
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applications configured to store the flash information in a session cookie may be vulnerable, if this can be chained with an attack that allows injection of arbitrary data into the session cookie. This issue has been patched in version 1.3.0. If upgrading is not possible at this time, a way to mitigate the chained attack can be done by explicitly setting SameSite=Lax or SameSite=Strict on the application session cookie.
- Product
- google_sign_in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow.CVE-2025-34159 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
- Product
- Coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025traQ is a messenger application built for Digital Creators Club traP.CVE-2025-57813 · Other software · traPtitech · reported by GitHubMedium 5.9
traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing them.
- Product
- traQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint.CVE-2025-52085 · Other software · Yoosee · reported by MITREHigh 8.8
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
- Product
- Yoosee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerabiCVE-2010-20109 · Network & remote access · Barracuda Networks · reported by VulnCheckHigh 8.7
Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/snapshot/config.snapshot, potentially exposing credentials, internal settings, and other critical data.
- Product
- Spam & Virus Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Aug 21, 2025An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validatCVE-2025-52395 · Other software · reported by MITRECritical 9.8
An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroadcube.com
Aug 20, 2025A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application sCVE-2025-27217 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.1
A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.
- Product
- UISP Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges.CVE-2025-27216 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.8
Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges.
- Product
- UISP Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55732 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55731 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF).CVE-2025-1142 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Edge Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permissCVE-2025-1139 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment.
- Product
- Edge Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts CVE-2025-4437 · Other software · Red Hat · reported by Red HatMedium 5.7
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
- Product
- Red Hat OpenShift Container Platform 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 19, 2025nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure.CVE-2025-55740 · Other software · Anipaleja · reported by GitHubMedium 6.5
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
- Product
- nginx-defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplCVE-2025-52584 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplCVE-2025-46269 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplCVE-2025-53705 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplCVE-2025-41392 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025Genealogy is a family tree PHP application.CVE-2025-55288 · Other software · MGeurts · reported by GitHubMedium 5.5
Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Reflected Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0.
- Product
- genealogy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025Genealogy is a family tree PHP application.CVE-2025-55287 · Other software · MGeurts · reported by GitHubMedium 5.4
Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0.
- Product
- genealogy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.CVE-2025-41242 · Other software · VMware · reported by security@vmware.comMedium 5.9
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server.CVE-2025-9060 · Other software · MSoft · reported by vulnerability@kaspersky.comCritical 9.1
A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of parameters when setting up security components. This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and above.
- Product
- MFlash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request.CVE-2025-36047 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
- Product
- WebSphere Application Server Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.CVE-2025-33142 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application dCVE-2025-48861 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 5.3
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.
- Product
- ctrlX OS - Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup arCVE-2025-48860 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.
- Product
- ctrlX OS - Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025Netty is an asynchronous, event-driven network application framework.CVE-2025-55163 · Other software · netty · reported by GitHubHigh 8.2
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.