Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
206 results · page 1 of 5
Oct 7, 2026CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60.CVE-2026-97717 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6
CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60.CVE-2026-97716 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.7
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60.CVE-2026-97715 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 7.1
CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60.CVE-2026-97714 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.2
CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly wCVE-2026-82368 · Other software · Brocade · reported by sirt@brocade.comHigh 8.7
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access pCVE-2026-59781 · Other software · Zabbix · reported by security@zabbix.comMedium 5.4
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57.CVE-2026-55402 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.7
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57.CVE-2026-55401 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57.CVE-2026-55400 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55.CVE-2026-55399 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.1
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55.CVE-2026-55398 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55.CVE-2026-33445 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.7
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55.CVE-2026-33444 · Other software · Absolute Secutity · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55.CVE-2026-40958 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comLow 2.3
CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55.CVE-2026-40957 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.1
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55.CVE-2026-40956 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comLow 2.1
CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55.CVE-2026-40955 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comLow 2.1
CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55.CVE-2026-40954 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comLow 2.1
CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55.CVE-2026-40953 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.7
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55.CVE-2026-40952 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.5
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55.CVE-2026-33443 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 7.1
CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows.CVE-2026-53566 · Network & remote access · Citrix · reported by secure@citrix.comMedium 6.8
Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.
- Product
- Citrix Secure Access Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows.CVE-2026-53565 · Network & remote access · Citrix · reported by secure@citrix.comHigh 8.5
Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.
- Product
- Secure Access Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-23663 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Global Secure Access (GSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary codeCVE-2026-8992 · Network & remote access · ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMCVE-2026-7432 · Network & remote access · ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensCVE-2026-7431 · Network & remote access · ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 4.4
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50.CVE-2026-40951 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comMedium 6.8
CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger a denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50.CVE-2026-40950 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comHigh 7.1
CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50.CVE-2026-40949 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comMedium 6.8
CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to trigger a denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50.CVE-2026-33452 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comMedium 5.9
CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to ‘blue screen’ the system.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50.CVE-2026-33451 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comHigh 8.5
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and elevate their level of privilege to system.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50.CVE-2026-33450 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comLow 2.3
CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50. Attackers with control of a modified server can send a malformed packet to the client causing a denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to 14.50.CVE-2026-33449 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comLow 2.3
CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a cryptographically valid message to the client, overwriting a small portion of memory conceivably leading to a denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50.CVE-2026-33448 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comMedium 4.8
CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50.CVE-2026-33447 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comLow 2.3
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026CVE-2026-33446 is a buffer overflow in the authentication sub-system of the Secure Access client prior to 14.50.CVE-2026-33446 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comLow 2.3
CVE-2026-33446 is a buffer overflow in the authentication sub-system of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or a denial of service.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8).CVE-2026-27668 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.
- Product
- RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Mar 11, 2026Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a cCVE-2025-66956 · Other software · reported by MITRECritical 9.9
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlive.asee.io
Jan 16, 2026In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations.CVE-2026-0519 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 4.6
In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20.CVE-2026-0518 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 4.8
CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20.CVE-2026-0517 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6
CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2025CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12.CVE-2025-59596 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2025CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12.CVE-2025-59595 · Other software · Absolute · reported by SecurityResponse@netmotionsoftware.comHigh 8.2
CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC usCVE-2025-54603 · Other software · reported by MITRECritical 9
An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comclaroty.com
Oct 2, 2025CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10.CVE-2025-54089 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 4.6
CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges required to execute the attack are high and the victim must actively participate in the attack sequence. There is no impact to confidentiality or availability, there is a low impact to integrity.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10.CVE-2025-54088 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.5
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10.CVE-2025-54087 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comLow 1.8
CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. The attack complexity is high, there are no attack requirements, and user interaction is required. There is no direct impact to confidentiality, integrity, or availability. There is a low severity subsequent system impact to integrity.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10.CVE-2025-54086 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.3
CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel.CVE-2025-57802 · Other software · airlinklabs · reported by GitHubHigh 8.7
Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with access to the affected container can create symbolic links inside the mounted directory (/app/data). Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive locations on the host filesystem. When the application or other processes follow these symlinks, the attacker can gain unauthorized read access to host files outside the container. This issue has been patched in version 1.0.1.
- Product
- daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.