Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,186 results · page 79 of 304
Jun 4, 2025The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.CVE-2025-48947 · Other software · auth0 · reported by GitHubHigh 7.7
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.
- Product
- nextjs-auth0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.CVE-2025-20991 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jun 3, 2025IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.CVE-2024-45655 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
- Product
- Application Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-48866 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTMLCVE-2024-57783 · Other software · alexpinel · reported by MITREHigh 8.1
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.
- Product
- Dot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025application-urlshortener create shortened URLs for XWiki pages.CVE-2025-48885 · Other software · xwikisas · reported by GitHubMedium 5.7
application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available.
- Product
- application-urlshortener
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42191 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42190 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 30, 2025An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by usCVE-2024-13917 · Other software · Kruger&Matz · reported by cvd@cert.plHigh 8.3
An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application, with no granted Android system permissions, to inject an arbitrary intent with system-level privileges to a protected application. One must know the protecting PIN number (it might be revealed by exploiting CVE-2024-13916) or ask the user to provide it. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. Application update was released in April 2025.
- Product
- com.pri.applock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by usCVE-2024-13916 · Other software · Kruger&Matz · reported by cvd@cert.plMedium 6.9
An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. Application update was released in April 2025.
- Product
- com.pri.applock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing proCVE-2024-13915 · Other software · Ulefone · reported by cvd@cert.plMedium 6.9
Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz).
- Product
- com.pri.factorytest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Fabio is an HTTP(S) and TCP router for deploying applications managed by consul.CVE-2025-48865 · Other software · fabiolb · reported by GitHubCritical 9.1
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6.
- Product
- fabio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python functiCVE-2025-48889 · Other software · gradio-app · reported by GitHubMedium 5.3
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. This issue has been patched in version 5.31.0.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-48068 · Other software · vercel · reported by GitHubLow 2.3
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical.CVE-2025-5326 · Other software · zhilink 智互联(深圳)科技有限公司 · reported by VulDBMedium 5.3
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ADP Application Developer Platform 应用开发者平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical.CVE-2025-5325 · Other software · zhilink 智互联(深圳)科技有限公司 · reported by VulDBMedium 5.3
A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ADP Application Developer Platform 应用开发者平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-4009 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
- Product
- 3080ipx-10G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library wiCVE-2025-4412 · Other software · SparkLabs · reported by cvd@cert.plMedium 4.8
On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. The acquired resource access is limited without entitlements such as access to the camera or microphone. Only user-granted permissions for file resources apply. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 1.11.5 of Viscosity.
- Product
- Viscosity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included withiCVE-2025-33079 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included within the source code.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2.CVE-2025-5140 · Other software · Seeyon · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\ours\www\ehr\openPlatform1\open4ClientType\controller\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zhiyuan OA Web Application System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-43860 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) Text Box fields of Address, Address Line 2, Postal Code and City fields and (2) Drop Down menu options of Address Use, State and Country of the Additional Addresses section of the Contact tab in Patient Demographics. The injected script can execute in two scenarios: (1) dynamically during form input, and (2) when the form data is later loaded for editing. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-32967 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allows password change events to go unrecorded on the client-side log viewer, preventing administrators from auditing critical actions. This weakens traceability and opens the system to undetectable misuse by insiders or attackers. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-32794 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorizatCVE-2025-5098 · Other software · Mobile Dynamix · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Critical 9.1
PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization.
- Product
- PrinterShare Mobile Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comkorelogic.com
May 22, 2025Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadinCVE-2025-2394 · Other software · Ecovacs · reported by vdp@themissinglink.com.auMedium 4.7
Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
- Product
- Ecovacs Mobile and Android Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordecovacs.comthemissinglink.com.au
May 22, 2025An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager functionCVE-2024-40459 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue CVE-2024-13946 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025wire-webapp is the web application for the open-source messaging service Wire.CVE-2025-48066 · Other software · wireapp · reported by GitHubMedium 6
wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary clients (marking the device as a public computer on login) and regular clients instructing the deletion of all personal information and conversations upon logout. Access to the machine is required to access the data. If encryption-at-rest is used, cryptographic material can't be exported. The underlying issue has been fixed with wire-webapp version 2025-05-14-production.0. In order to mitigate potential impact, the database must be manually deleted on devices where the option "This is a public computer" was used prior to log in or a log out with the request to delete local data with the affected versions has happened before.
- Product
- wire-webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025wire-webapp is the web application for the open-source messaging service Wire.CVE-2025-48061 · Other software · wireapp · reported by GitHubMedium 5.6
wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.
- Product
- wire-webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate.CVE-2025-4575 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 6.5
Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenssl-library.org
May 22, 2025TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.CVE-2023-47466 · Other software · TagLib · reported by MITRELow 2.9
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Product
- TagLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-47947 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects.CVE-2025-46822 · Other software · OsamaTaher · reported by GitHubHigh 7.7
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
- Product
- Java-springboot-codebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Langroid is a Python framework to build large language model (LLM)-powered applications.CVE-2025-46725 · Other software · langroid · reported by GitHubHigh 8.1
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `LanceDocChatAgent` uses pandas eval() through `compute_from_docs()`. As a result, an attacker may be able to make the agent run malicious commands through `QueryPlan.dataframe_calc]`) compromising the host system. Langroid 0.53.15 sanitizes input to the affected function by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Langroid is a Python framework to build large language model (LLM)-powered applications.CVE-2025-46724 · Other software · langroid · reported by GitHubCritical 9.8
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025An authenticated user can modify application state data.CVE-2025-48018 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.5
An authenticated user can modify application state data.
- Product
- SEL-5030 acSELerator QuickSet Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of filesCVE-2025-48017 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comCritical 9
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications.CVE-2025-47946 · Other software · symfony · reported by GitHubMedium 6.1
Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values. Instead, use `{{ attributes.render('name') }}` for safe output of individual attributes.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software.CVE-2025-4945 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 19, 2025A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handleCVE-2025-4948 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 18, 2025A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to CVE-2025-23164 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comMedium 4.4
A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests.CVE-2025-4600 · Computers, phones & browsers · Google Cloud · reported by cve-coordination@google.comHigh 8.7
A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.
- Product
- Classic Application Load Balancer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025Flask-AppBuilder is an application development framework built on top of Flask.CVE-2025-32962 · Other software · dpgaspar · reported by GitHubMedium 4.3
Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Zulip is an open-source team chat application.CVE-2025-47930 · Other software · zulip · reported by GitHubMedium 5.3
Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functCVE-2025-47929 · Other software · DumbWareio · reported by GitHubLow 2.1
DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability.
- Product
- DumbDrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025ApplyOnline: Does not protect uploaded files during the application processCVE-2024-10098 · WordPress plugins & themes · reported by WPScanLow 2.7
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
- Product
- ApplyOnline
- Fixed in
- 2.6.3
- What to do
- Update ApplyOnline to 2.6.3 or newer.
May 15, 2025powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM nodCVE-2025-48051 · Other software · Lichess · reported by MITREMedium 4.7
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
- Product
- Lila
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage.CVE-2025-4737 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaMedium 6.2
Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage.
- Product
- com.transsion.aivoiceassistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
May 15, 2025In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.CVE-2025-48024 · Other software · BlueWave · reported by MITREMedium 5
In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-32421 · Other software · vercel · reported by GitHubLow 3.7
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.