A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. CVSSv3.1 8.3 (HIGH) · EPSS 23th percentile
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4. CVSSv3.1 9.1 (CRITICAL) · EPSS 43th percentile
Adam Chester (SpecterOps) discovered CVE-2025-64755, a remote code execution vulnerability in Claude Code v2.0.25 via sed expression injection. The vulnerability allowed attackers to write arbitrary files (including shell initialization files) through prompt injection, bypassing regex-based command filtering. Anthropic patched the issue in v2.0.31 within 7 days of disclosure.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13. CVSSv3.1 8.5 (HIGH)
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, wh CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they m CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to th CVSSv3.1 8.1 (HIGH)
SpecterOps disclosed a critical authentication bypass in Microsoft SCCM's Entra ID integration (prior to KB5360093) that allows unauthenticated attackers to impersonate privileged accounts and achieve full hierarchy takeover. The vulnerability stems from insufficient authorization checks in the AdminService REST API—the service validates Entra tokens but trusts UPN claims without verifying the token's associated AD account exists or has appropriate permissions, enabling attackers to craft tokens with spoofed UPNs of site server machine accounts or privileged admins. The attack requires AD domain verification in Entra and ability to manipulate UPNs, but once achieved, grants complete administrative control over the SCCM infrastructure.
Bishop Fox disclosed CVE-2025-64446, a critical authentication bypass in Fortinet FortiWeb that allows unauthenticated attackers to create administrative accounts via a single HTTP POST request combining path traversal and a forged CGIINFO header. The vulnerability affects multiple versions (7.0.x, 7.2.x, 7.4.x, 7.6.x, 8.0.x) and is actively exploited in the wild; Fortinet patched it by restricting cgi-bin access in httpd.conf. Bishop Fox released a public scanner and detailed exploit analysis including version-specific vulnerability matrix.
CVE-2025-32463 is a privilege escalation vulnerability in sudo versions 1.9.14–1.9.17 affecting the chroot (-R) option, allowing unprivileged users to escalate to root. A public proof-of-concept exploit with Docker reproduction environment has been released, demonstrating reliable root shell access on vulnerable systems.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's s CVSSv3.1 8.8 (HIGH)
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default. CVSSv3.1 9.1 (CRITICAL) · EPSS 52th percentile
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.0 (HIGH) · EPSS 58th percentile
Trend Micro research documents five S3 ransomware variants targeting AWS environments, ranging from KMS-based encryption attacks to exfiltration-and-deletion tactics. The variants exploit misconfigured IAM policies, leaked credentials, and lesser-known AWS features like SSE-C, external key material imports, and External Key Store (XKS) to render victim data permanently inaccessible. The research includes defensive policy recommendations to restrict dangerous encryption and key management operations.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system. CVSSv3.1 8.0 (HIGH) · EPSS 56th percentile
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user wi CVSSv3.1 7.2 (HIGH) · EPSS 95th percentile
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack. CVSSv3.1 8.8 (HIGH) · EPSS 34th percentile
QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system. CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile