A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session. CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer CVSSv3.1 9.9 (CRITICAL) · EPSS 49th percentile
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE. CVSSv3.1 9.8 (CRITICAL)
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and including, 6.6.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators. CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile
Memory corruption while performing SCM call with malformed inputs. CVSSv3.1 8.8 (HIGH) · EPSS 0th percentile
Memory corruption while performing SCM call. CVSSv3.1 8.8 (HIGH)
A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a manipulation of the argument Password can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information fro CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile
Trend Micro and ZDI researchers identified a large-scale RondoDox botnet campaign actively exploiting over 50 vulnerabilities across 30+ vendors since mid-2025, including flaws first disclosed at Pwn2Own competitions. The campaign uses a "shotgun" approach targeting internet-exposed routers, DVRs, NVRs, CCTV systems, and web servers with command-injection exploits, deploying multiarchitecture payloads and co-packaging with Mirai/Morte variants. Multiple CVEs are now in CISA's Known Exploited Vulnerabilities catalog, with evidence of rapid growth via loader-as-a-service infrastructure.
Trend Micro documents two escalating NPM supply-chain attacks: 's1ngularity' malware that weaponizes local AI CLI tools (Gemini, Claude) to harvest credentials via prompt injection, followed by 'Shai-Hulud', a self-propagating worm that compromises maintainer accounts and uses TruffleHog to locate publishing tokens, then automatically republishes infected packages across 187+ packages including CrowdStrike developer tools. The attacks demonstrate a shift toward fully automated, token-driven supply-chain propagation requiring no human intervention after initial compromise.
Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability. CVSSv3.1 9.9 (CRITICAL) · EPSS 96th percentile
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interfac CVSSv3.1 8.0 (HIGH) · EPSS 93th percentile
ResourcePoison is a privilege escalation exploit for CVE-2025-22441 affecting Android, allowing an installed app to achieve code execution within the SystemUI process via untrusted ApplicationInfo passed through RemoteViews. The vulnerability stems from LoadedApk.checkAndUpdateApkPaths() accepting attacker-controlled ApplicationInfo objects from RemoteViews without validation, enabling resource replacement and arbitrary code loading through a race condition during WebView initialization. The exploit chains resource manipulation with WebView loading to achieve RCE in SystemUI, bypassing normal permission boundaries.
Volexity disclosed a sustained spear-phishing campaign by China-aligned APT UTA0388 (tracked as UNK_DropPitch by Proofpoint) running from June–September 2025, delivering the GOVERSHELL backdoor via DLL search-order hijacking. The threat actor evolved five distinct malware variants with progressively sophisticated C2 mechanisms (fake TLS → AES → HTTPS polling → WebSocket → beacon-style), and OpenAI confirmed UTA0388 leveraged ChatGPT for phishing content generation and malware development. The campaign employed rapport-building phishing, multi-language targeting, and cloud-hosted payload delivery across North America, Asia, and Europe.
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information fr CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVSSv3.1 8.1 (HIGH) · EPSS 40th percentile
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issu CVSSv3.1 8.1 (HIGH) · EPSS 81th percentile