Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 12:08Z
2025-12-09
2025-12-09 16:18Z
CRIT

CVE-2025-66568 — Onelogin Ruby-saml: Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66568

The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the D CVSSv3.1 9.1 (CRITICAL)

CWECWE 347VNDOneloginTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-09
2025-12-09 16:18Z
CRIT

CVE-2025-66567 — Onelogin Ruby-saml: versions up to and including 1.12.4 contain an authentication bypass vulnerability due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66567

The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0. CVSSv3.1 9.1 (CRITICAL)

CWECWE 347VNDOneloginTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-09
2025-12-09 16:18Z
CRIT

CVE-2025-66565 — Gofiber Utils: In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66565

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 331CWECWE 338CWECWE 252VNDGofiberVNDFiberTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-09
2025-12-09 16:18Z
HIGH

CVE-2025-62093 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62093

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows SQL Injection.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-12-09
2025-12-09 16:18Z
HIGH

CVE-2025-61075 — Adata Mitarbeiter_portal: Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61075

Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out administrative functions and manipulate data of other users via unauthorized API calls. CVSSv3.1 8.1 (HIGH) · EPSS 44th percentile

CWECWE 639VNDAdataTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
CRIT

CVE-2025-42928 — Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-42928

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system. CVSSv3.1 9.1 (CRITICAL) · EPSS 95th percentile

CWECWE 502TYPVulnerability
9.1
CVSS v3.1
98
Edit Score
2025-12-09
2025-12-09 16:17Z
CRIT

CVE-2025-42880 — SAP: Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-42880

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system. CVSSv3.1 9.9 (CRITICAL) · EPSS 91th percentile

CWECWE 94VNDSapTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-42878 — SAP: Web Dispatcher and ICM may expose internal testing interfaces that are not intended

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-42878

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application. CVSSv3.1 8.2 (HIGH) · EPSS 28th percentile

CWECWE 1244VNDSapTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41752 — Phoenixcontact Fl_nat_2008_firmware: An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41752

An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. Th CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41751 — Phoenixcontact Fl_nat_2008_firmware: An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41751

An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. T CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41750 — Phoenixcontact Fl_switch_2008f_firmware: An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41750

An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. Th CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41748 — Phoenixcontact Fl_nat_2008_firmware: An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41748

An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. T CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41747 — Phoenixcontact Fl_nat_2008_firmware: An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41747

An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web applicat CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-41746 — Phoenixcontact Fl_switch_2406-2sfx_pn_firmware: An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41746

An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web applicati CVSSv3.1 7.1 (HIGH) · EPSS 95th percentile

CWECWE 79VNDXssVNDPhoenixcontactTYPVulnerability
7.1
CVSS v3.1
88
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40938 — Siemens Simatic_cn_4100_firmware: This could allow an attacker to access and misuse this information, potentially impacting the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40938

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability. CVSSv3.1 8.1 (HIGH) · EPSS 30th percentile

CWECWE 798VNDSiemensTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40937 — Siemens Simatic_cn_4100_firmware: This could allow an authenticated attacker to execute arbitrary code with limited privileges.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40937

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges. CVSSv3.1 8.3 (HIGH) · EPSS 46th percentile

CWECWE 77VNDSiemensTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40801 — This could allow an attacker to perform a man-in-the-middle attack.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40801

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Clou CVSSv3.1 8.1 (HIGH) · EPSS 18th percentile

CWECWE 295TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
CRIT

CVE-2025-40343 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40343

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current implementation checks whether an association is about to be removed, but only after the work item has CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40342 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40342

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40337 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Correctly handle

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40337

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Correctly handle Rx checksum offload errors The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype. However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignore CVSSv3.1 8.2 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40336 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40336

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) CVSSv3.1 8.8 (HIGH) · EPSS 8th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-40328 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40328

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-14333 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14333

Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. CVSSv3.1 8.1 (HIGH)

CWECWE 787CWECWE 119VNDMozillaTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-09
2025-12-09 16:17Z
CRIT

CVE-2025-14330 — Mozilla Firefox: JIT miscompilation in the JavaScript Engine: JIT component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14330

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. CVSSv3.1 9.8 (CRITICAL)

CWECWE 843CWECWE 119CWECWE 686VNDMozillaVNDJitTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-09
2025-12-09 16:17Z
HIGH

CVE-2025-14329 — Mozilla Firefox: Privilege escalation in the Netmonitor component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14329

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. CVSSv3.1 8.8 (HIGH)

VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score