Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,618 results · page 9 of 33
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026NanaZip is an open source file archive.CVE-2026-27114 · Other software · M2Team · reported by GitHubMedium 5.1
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.
- Product
- NanaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and CVE-2026-27014 · Other software · M2Team · reported by GitHubMedium 5.1
NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.
- Product
- NanaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single FiCVE-2026-26282 · Other software · M2Team · reported by GitHubMedium 5.2
NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file with NanaZip causes a crash or leaks heap data to the user. Version 6.0.1630.0 patches the issue.
- Product
- NanaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location.CVE-2026-2817 · Other software · VMware · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
- Product
- Spring Data Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532).CVE-2026-2684 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.5
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532).CVE-2026-2683 · Other software · Tsinghua Unigroup · reported by VulDBLow 2.1
A vulnerability was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Subject/downLoad.html. Performing a manipulation of the argument path results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532).CVE-2026-2682 · Other software · Tsinghua Unigroup · reported by VulDBLow 2.1
A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532).CVE-2026-2672 · Other software · Tsinghua Unigroup · reported by VulDBLow 2.1
A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function Download of the file /Search/Subject/downLoad. Performing a manipulation of the argument path results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect fCVE-2025-33088 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denCVE-2026-1507 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.7
The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.
- Product
- PI Data Archive PI Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.CVE-2025-68621 · Other software · TriliumNext · reported by GitHubHigh 7.4
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the CVE-2025-13375 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system.
- Product
- Common Cryptographic Architecture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers.CVE-2026-25505 · Other software · maziggy · reported by GitHubCritical 9.8
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.
- Product
- bambuddy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.CVE-2026-25510 · Other software · ci4-cms-erp · reported by GitHubCritical 9.9
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.
- Product
- ci4ms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.CVE-2026-25509 · Other software · ci4-cms-erp · reported by GitHubMedium 5.3
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.
- Product
- ci4ms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation.CVE-2025-57529 · Other software · Youdatasum · reported by MITRECritical 9.8
YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This allows remote unauthenticated attackers to execute arbitrary SQL commands via crafted input to the parameter. Successful exploitation could lead to unauthorized data access
- Product
- Cpas Audit Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resCVE-2025-14914 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
- Product
- WebSphere Application Server Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory.CVE-2026-1703 · Other software · Python Packaging Authority · reported by cna@python.orgLow 2
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- Product
- pip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.CVE-2025-61728 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
- Product
- archive/zip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Integer Overflow or Wraparound vulnerability in MuntashirAkon AppManager (app/src/main/java/org/apache/commons/compress/archivers/tar modules).CVE-2026-1464 · Other software · MuntashirAkon · reported by cve_disclosure@tech.gov.sgMedium 4.6
Integer Overflow or Wraparound vulnerability in MuntashirAkon AppManager (app/src/main/java/org/apache/commons/compress/archivers/tar modules). This vulnerability is associated with program files TarUtils.Java. This issue affects AppManager: before 4.0.4.
- Product
- AppManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive membeCVE-2026-20613 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
- Product
- Container
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate databaseCVE-2021-47872 · Other software · SEO Panel · reported by VulnCheckHigh 7
SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate database queries through the 'order_col' parameter. Attackers can use sqlmap to exploit the vulnerability and extract database information by injecting malicious SQL code into the order column parameter.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.CVE-2025-36419 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.
- Product
- ApplinX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.CVE-2025-25652 · Other software · Eptura · reported by MITREHigh 7.5
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.
- Product
- Archibus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeptura.compacketstorm.news
Dec 31, 2025WP-EasyArchives: Cross-Site Request Forgery (CSRF)CVE-2025-49345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.
- Product
- WP-EasyArchives
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update WP-EasyArchives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-14421 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comMedium 5.5
pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-27915.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability.CVE-2025-14420 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7.8
pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBZ files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27514.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-14419 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7.8
pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27902.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability.CVE-2025-14418 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7
pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27502.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability.CVE-2025-14417 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7.8
pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27501.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability.CVE-2025-14416 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7
pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27503.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server.CVE-2023-53942 · Other software · leefish · reported by VulnCheckCritical 9.4
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
- Product
- File Thingie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 18, 2025A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.CVE-2025-40898 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.2
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comcert-portal.siemens.com
Dec 9, 2025IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.CVE-2025-36437 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
- Product
- IBM Planning Analytics Local
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files.CVE-2025-65806 · Other software · E-point · reported by MITREMedium 4.3
The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZIP) where the inner archive contains an executable file (e.g. webshell.php). When the application extracts the uploaded archives, the executable may be extracted into a web-accessible directory. This can lead to remote code execution (RCE), data disclosure, account compromise, or further system compromise depending on the web server/process privileges. The issue arises from insufficient validation of archive contents and inadequate restrictions on extraction targets.
- Product
- E-point CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature.CVE-2025-65843 · Other software · Acustica-audio · reported by MITREHigh 7.7
Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The application follows symbolic links placed inside the ~/Library/Logs/Aquarius directory and treats them as regular files. When building the support ZIP, Aquarius recursively enumerates logs using a JUCE directory iterator configured to follow symlinks, and later writes file data without validating whether the target is a symbolic link. A local attacker can exploit this behavior by planting symlinks to arbitrary filesystem locations, resulting in unauthorized disclosure or modification of arbitrary files. When chained with the associated HelperTool privilege escalation issue, root-owned files may also be exposed.
- Product
- Aquarius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user processCVE-2025-8045 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comMedium 4
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.
- Product
- Valhall GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user processCVE-2025-6349 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comMedium 5.1
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.
- Product
- Valhall GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel DriveCVE-2025-2879 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comMedium 5.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expose sensitive data.This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.
- Product
- Valhall GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives.CVE-2025-12638 · Other software · keras-team · reported by security@huntr.devHigh 8
Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.
- Product
- keras-team/keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with lCVE-2025-59890 · Other software · Eaton · reported by CybersecurityCOE@eaton.comHigh 7.3
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
- Product
- Eaton Galileo Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitaCVE-2025-12888 · Other software · wolfSSL · reported by facts@wolfssl.comLow 1
Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of X25519, which is now turned on as the default for Xtensa.
- Product
- wolfSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel conCVE-2025-41436 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/CVE-2025-11776 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2025-64530 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives. Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access control requirements on interface types/fields to each implementing object type/field where appropriate. Do not remove those access control requirements from the interface types/fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema.
- Product
- federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a uCVE-2025-20355 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page.
- Product
- Cisco Digital Network Architecture Center (DNA Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 13, 2025A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scriptingCVE-2025-20353 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Digital Network Architecture Center (DNA Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 13, 2025A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container aCVE-2025-20349 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.3
A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.
- Product
- Cisco Digital Network Architecture Center (DNA Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.