An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. CVSSv3.1 9.1 (CRITICAL) · EPSS 40th percentile
Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
SpecterOps released RelayInformer, a Python tool and Cobalt Strike BOF suite that enumerates Extended Protection for Authentication (EPA) enforcement across MSSQL, HTTP/S, and LDAPS services. The research demonstrates methodologies for detecting all three EPA enforcement levels (Disabled, Allowed/When Supported, Required) by manipulating NTLM AV pairs and analyzing server responses, enabling attackers to determine relay feasibility before investing in coercion and tunneling infrastructure.
watchTowr researchers discovered 80,000+ saved JSON/code snippets on public formatter websites (JSONFormatter.org, CodeBeautify.org) containing thousands of exposed secrets including Active Directory credentials, API keys, cloud environment keys, private keys, and sensitive PII from critical infrastructure, government, finance, banking, and cybersecurity organizations. The researchers exploited trivial enumeration of sequential IDs and public "Recent Links" pages to systematically extract credentials, database passwords, CI/CD pipeline tokens, and full KYC banking data across a 5-year historical window.
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls. CVSSv3.1 8.2 (HIGH) · EPSS 30th percentile
A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. CVSSv3.1 8.3 (HIGH) · EPSS 23th percentile
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4. CVSSv3.1 9.1 (CRITICAL) · EPSS 43th percentile
Adam Chester (SpecterOps) discovered CVE-2025-64755, a remote code execution vulnerability in Claude Code v2.0.25 via sed expression injection. The vulnerability allowed attackers to write arbitrary files (including shell initialization files) through prompt injection, bypassing regex-based command filtering. Anthropic patched the issue in v2.0.31 within 7 days of disclosure.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13. CVSSv3.1 8.5 (HIGH)
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, wh CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they m CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to th CVSSv3.1 8.1 (HIGH)
SpecterOps disclosed a critical authentication bypass in Microsoft SCCM's Entra ID integration (prior to KB5360093) that allows unauthenticated attackers to impersonate privileged accounts and achieve full hierarchy takeover. The vulnerability stems from insufficient authorization checks in the AdminService REST API—the service validates Entra tokens but trusts UPN claims without verifying the token's associated AD account exists or has appropriate permissions, enabling attackers to craft tokens with spoofed UPNs of site server machine accounts or privileged admins. The attack requires AD domain verification in Entra and ability to manipulate UPNs, but once achieved, grants complete administrative control over the SCCM infrastructure.
Bishop Fox disclosed CVE-2025-64446, a critical authentication bypass in Fortinet FortiWeb that allows unauthenticated attackers to create administrative accounts via a single HTTP POST request combining path traversal and a forged CGIINFO header. The vulnerability affects multiple versions (7.0.x, 7.2.x, 7.4.x, 7.6.x, 8.0.x) and is actively exploited in the wild; Fortinet patched it by restricting cgi-bin access in httpd.conf. Bishop Fox released a public scanner and detailed exploit analysis including version-specific vulnerability matrix.
CVE-2025-32463 is a privilege escalation vulnerability in sudo versions 1.9.14–1.9.17 affecting the chroot (-R) option, allowing unprivileged users to escalate to root. A public proof-of-concept exploit with Docker reproduction environment has been released, demonstrating reliable root shell access on vulnerable systems.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's s CVSSv3.1 8.8 (HIGH)