# CVEs published 2025-01-14 479 CVEs were published on January 14, 2025: 88 critical, 225 high. 7 are now in CISA KEV. Days are UTC. - [CVE-2024-53277](https://cve.now/CVE-2024-53277.md): Cross-site Scripting in form messages in silverstripe framework (CVSS 5.4, silverstripe-framework · silverstripe/framework) - [CVE-2024-47605](https://cve.now/CVE-2024-47605.md): Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin (CVSS 5.4, silverstripe-asset-admin · silverstripe/framework) - [CVE-2024-54142](https://cve.now/CVE-2024-54142.md): Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse (CVSS 9.1, discourse-ai) - [CVE-2024-45102](https://cve.now/CVE-2024-45102.md): A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a co (CVSS 6.8, Lenovo XClarity Administrator) - [CVE-2024-10254](https://cve.now/CVE-2024-10254.md): A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker (CVSS 4.7, Lenovo PC Manager · Lenovo Browser +1) - [CVE-2024-10253](https://cve.now/CVE-2024-10253.md): A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause (CVSS 4.7, Lenovo PC Manager · Lenovo Browser +1) - [CVE-2024-55892](https://cve.now/CVE-2024-55892.md): Potential Open Redirect via Parsing Differences in TYPO3 (CVSS 4.8, typo3 · typo3/cms-core) - [CVE-2024-55893](https://cve.now/CVE-2024-55893.md): TYPO3 Cross-Site Request Forgery in Log Module (CVSS 4.3, typo3 · typo3/cms-belog) - [CVE-2024-55894](https://cve.now/CVE-2024-55894.md): TYPO3 Cross-Site Request Forgery in Backend User Module (CVSS 4.3, typo3 · typo3/cms-beuser) - [CVE-2024-55920](https://cve.now/CVE-2024-55920.md): Cross-Site Request Forgery in Dashboard Module in TYPO3 (CVSS 4.3, typo3 · typo3/cms-dashboard) - [CVE-2024-55921](https://cve.now/CVE-2024-55921.md): Cross-Site Request Forgery in Extension Manager Module in TYPO3 (CVSS 7.5, typo3 · typo3/cms-extensionmanager) - [CVE-2024-53263](https://cve.now/CVE-2024-53263.md): Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVSS 8.5, git-lfs · github.com/git-lfs/git-lfs +1) - [CVE-2024-55922](https://cve.now/CVE-2024-55922.md): Cross-Site Request Forgery in Form Framework Module in TYPO3 (CVSS 5.4, typo3 · typo3/cms-form) - [CVE-2024-55923](https://cve.now/CVE-2024-55923.md): Cross-Site Request Forgery in Indexed Search Module in TYPO3 (CVSS 4.3, typo3 · typo3/cms-indexed-search) - [CVE-2024-55924](https://cve.now/CVE-2024-55924.md): Cross-Site Request Forgery in Scheduler Module in TYPO3 (CVSS 8.0, typo3 · typo3/cms-scheduler) - [CVE-2025-21136](https://cve.now/CVE-2025-21136.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer) - [CVE-2025-21138](https://cve.now/CVE-2025-21138.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer) - [CVE-2025-21139](https://cve.now/CVE-2025-21139.md): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Designer) - [CVE-2025-21137](https://cve.now/CVE-2025-21137.md): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Designer) - [CVE-2024-55945](https://cve.now/CVE-2024-55945.md): Cross-Site Request Forgery in DB Check Module in TYPO3 (CVSS 4.3, typo3 · typo3/cms-lowlevel) - [CVE-2024-55891](https://cve.now/CVE-2024-55891.md): Information Disclosure via Exception Handling/Logger in TYPO3 (CVSS 3.1, typo3 · typo3/cms-install) - [CVE-2025-21135](https://cve.now/CVE-2025-21135.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate) - [CVE-2024-48858](https://cve.now/CVE-2024-48858.md): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (CVSS 7.5, BlackBerry QNX Software Development Platform) - [CVE-2024-48857](https://cve.now/CVE-2024-48857.md): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (CVSS 7.5, BlackBerry QNX Software Development Platform) - [CVE-2025-21134](https://cve.now/CVE-2025-21134.md): Illustrator on iPad | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Illustrator on iPad) - [CVE-2025-21133](https://cve.now/CVE-2025-21133.md): Illustrator on iPad | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Illustrator on iPad) - [CVE-2024-48856](https://cve.now/CVE-2024-48856.md): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (CVSS 9.8, BlackBerry QNX Software Development Platform) - [CVE-2024-49375](https://cve.now/CVE-2024-49375.md): Remote Code Execution via Remote Model Loading in Rasa (CVSS 9.1, RasaHQ rasa-pro-security-advisories · rasa-pro +1) - [CVE-2024-48855](https://cve.now/CVE-2024-48855.md): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (CVSS 5.3, BlackBerry QNX Software Development Platform) - [CVE-2025-21129](https://cve.now/CVE-2025-21129.md): Substance3D - Stager | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Stager) - [CVE-2025-21132](https://cve.now/CVE-2025-21132.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager) - [CVE-2025-21130](https://cve.now/CVE-2025-21130.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager) - [CVE-2025-21131](https://cve.now/CVE-2025-21131.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager) - [CVE-2025-21128](https://cve.now/CVE-2025-21128.md): Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Substance3D - Stager) - [CVE-2025-23074](https://cve.now/CVE-2025-23074.md): Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) (CVSS 2.4, Wikimedia Foundation Mediawiki - SocialProfile Extension) - [CVE-2025-23041](https://cve.now/CVE-2025-23041.md): Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms (CVSS 5.8, Umbraco.Forms.Issues · Umbraco.Forms +1) - [CVE-2024-48854](https://cve.now/CVE-2024-48854.md): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (CVSS 5.3, BlackBerry QNX Software Development Platform) - [CVE-2025-21122](https://cve.now/CVE-2025-21122.md): Photoshop Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Photoshop Desktop) - [CVE-2025-21127](https://cve.now/CVE-2025-21127.md): Photoshop Desktop | Uncontrolled Search Path Element (CWE-427) (CVSS 7.8, Adobe Photoshop Desktop) - [CVE-2025-0474](https://cve.now/CVE-2025-0474.md): Invoice Ninja PDF Rendering Server Side Request Forgery (CVSS 7.7, Invoice Ninja) - [CVE-2025-23042](https://cve.now/CVE-2025-23042.md): Gradio Blocked Path ACL Bypass Vulnerability (CVSS 8.7, gradio-app gradio · gradio) - [CVE-2025-23073](https://cve.now/CVE-2025-23073.md): API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter (CVSS 3.5, Wikimedia Foundation Mediawiki - GlobalBlocking Extension) - [CVE-2024-50349](https://cve.now/CVE-2024-50349.md): Git does not sanitize URLs when asking for credentials interactively (CVSS 2.1, git) - [CVE-2024-52006](https://cve.now/CVE-2024-52006.md): Newline confusion in credential helpers can lead to credential exfiltration in git (CVSS 2.1, git) - [CVE-2025-23072](https://cve.now/CVE-2025-23072.md): XSS in Special:RefreshSpecial (CVSS 5.4, Wikimedia Foundation Mediawiki - RefreshSpecial Extension) - [CVE-2024-50338](https://cve.now/CVE-2024-50338.md): Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager (CVSS 7.4, git-ecosystem git-credential-manager · git-credential-manag…) - [CVE-2025-21245](https://cve.now/CVE-2025-21245.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21409](https://cve.now/CVE-2025-21409.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21223](https://cve.now/CVE-2025-21223.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21238](https://cve.now/CVE-2025-21238.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21240](https://cve.now/CVE-2025-21240.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21250](https://cve.now/CVE-2025-21250.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21417](https://cve.now/CVE-2025-21417.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21246](https://cve.now/CVE-2025-21246.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21334](https://cve.now/CVE-2025-21334.md): Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2025-21333](https://cve.now/CVE-2025-21333.md): Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2025-21311](https://cve.now/CVE-2025-21311.md): Windows NTLM V1 Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2025-21326](https://cve.now/CVE-2025-21326.md): Internet Explorer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition · Microsoft Win…) - [CVE-2025-21332](https://cve.now/CVE-2025-21332.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21313](https://cve.now/CVE-2025-21313.md): Windows Security Account Manager (SAM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21218](https://cve.now/CVE-2025-21218.md): Windows Kerberos Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server) - [CVE-2025-21402](https://cve.now/CVE-2025-21402.md): Microsoft Office OneNote Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft OneNote) - [CVE-2025-21378](https://cve.now/CVE-2025-21378.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21374](https://cve.now/CVE-2025-21374.md): Windows CSC Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21372](https://cve.now/CVE-2025-21372.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21370](https://cve.now/CVE-2025-21370.md): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21361](https://cve.now/CVE-2025-21361.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Outlook for Mac) - [CVE-2025-21360](https://cve.now/CVE-2025-21360.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft AutoUpdate for Mac) - [CVE-2025-21343](https://cve.now/CVE-2025-21343.md): Windows Web Threat Defense User Service Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21340](https://cve.now/CVE-2025-21340.md): Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21339](https://cve.now/CVE-2025-21339.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21338](https://cve.now/CVE-2025-21338.md): GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office for Android · Microsoft Office for iOS +4) - [CVE-2025-21336](https://cve.now/CVE-2025-21336.md): Windows Cryptographic Information Disclosure Vulnerability (CVSS 5.6, Microsoft Windows) - [CVE-2025-21331](https://cve.now/CVE-2025-21331.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2025-21324](https://cve.now/CVE-2025-21324.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21172](https://cve.now/CVE-2025-21172.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio 2015 Update +13) - [CVE-2025-21323](https://cve.now/CVE-2025-21323.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21317](https://cve.now/CVE-2025-21317.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21312](https://cve.now/CVE-2025-21312.md): Windows Smart Card Reader Information Disclosure Vulnerability (CVSS 2.4, Microsoft Windows) - [CVE-2025-21310](https://cve.now/CVE-2025-21310.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21308](https://cve.now/CVE-2025-21308.md): Windows Themes Spoofing Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21307](https://cve.now/CVE-2025-21307.md): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2025-21305](https://cve.now/CVE-2025-21305.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21300](https://cve.now/CVE-2025-21300.md): Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21292](https://cve.now/CVE-2025-21292.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21287](https://cve.now/CVE-2025-21287.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21286](https://cve.now/CVE-2025-21286.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21276](https://cve.now/CVE-2025-21276.md): Windows MapUrlToZone Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21275](https://cve.now/CVE-2025-21275.md): Windows App Package Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21274](https://cve.now/CVE-2025-21274.md): Windows Event Tracing Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21273](https://cve.now/CVE-2025-21273.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21189](https://cve.now/CVE-2025-21189.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21261](https://cve.now/CVE-2025-21261.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21256](https://cve.now/CVE-2025-21256.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21232](https://cve.now/CVE-2025-21232.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21231](https://cve.now/CVE-2025-21231.md): IP Helper Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21230](https://cve.now/CVE-2025-21230.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21229](https://cve.now/CVE-2025-21229.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21228](https://cve.now/CVE-2025-21228.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21227](https://cve.now/CVE-2025-21227.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21226](https://cve.now/CVE-2025-21226.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21225](https://cve.now/CVE-2025-21225.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows Server) - [CVE-2025-21224](https://cve.now/CVE-2025-21224.md): Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2025-21213](https://cve.now/CVE-2025-21213.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 4.6, Microsoft Windows) - [CVE-2025-21211](https://cve.now/CVE-2025-21211.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2025-21186](https://cve.now/CVE-2025-21186.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1) - [CVE-2025-21187](https://cve.now/CVE-2025-21187.md): Microsoft Power Automate Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Power Automate for Desktop) - [CVE-2025-21202](https://cve.now/CVE-2025-21202.md): Windows Recovery Environment Agent Elevation of Privilege Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2025-21207](https://cve.now/CVE-2025-21207.md): Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21193](https://cve.now/CVE-2025-21193.md): Active Directory Federation Server Spoofing Vulnerability (CVSS 6.5, Microsoft Windows Server) - [CVE-2025-21335](https://cve.now/CVE-2025-21335.md): Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2025-21220](https://cve.now/CVE-2025-21220.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21330](https://cve.now/CVE-2025-21330.md): Windows Remote Desktop Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21328](https://cve.now/CVE-2025-21328.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21329](https://cve.now/CVE-2025-21329.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21278](https://cve.now/CVE-2025-21278.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2025-21405](https://cve.now/CVE-2025-21405.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio) - [CVE-2025-21217](https://cve.now/CVE-2025-21217.md): Windows NTLM Spoofing Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21403](https://cve.now/CVE-2025-21403.md): On-Premises Data Gateway Information Disclosure Vulnerability (CVSS 6.4, Microsoft On-Premises Data Gateway) - [CVE-2025-21395](https://cve.now/CVE-2025-21395.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1) - [CVE-2025-21393](https://cve.now/CVE-2025-21393.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2025-21389](https://cve.now/CVE-2025-21389.md): Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21219](https://cve.now/CVE-2025-21219.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21382](https://cve.now/CVE-2025-21382.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21366](https://cve.now/CVE-2025-21366.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1) - [CVE-2025-21365](https://cve.now/CVE-2025-21365.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC) - [CVE-2025-21364](https://cve.now/CVE-2025-21364.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC) - [CVE-2025-21363](https://cve.now/CVE-2025-21363.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC) - [CVE-2025-21362](https://cve.now/CVE-2025-21362.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2025-21357](https://cve.now/CVE-2025-21357.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 6.7, Microsoft 365 Apps for Enterprise · Microsoft Office +1) - [CVE-2025-21356](https://cve.now/CVE-2025-21356.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2025-21354](https://cve.now/CVE-2025-21354.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2025-21348](https://cve.now/CVE-2025-21348.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2025-21346](https://cve.now/CVE-2025-21346.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2025-21345](https://cve.now/CVE-2025-21345.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2025-21344](https://cve.now/CVE-2025-21344.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2025-21341](https://cve.now/CVE-2025-21341.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21173](https://cve.now/CVE-2025-21173.md): .NET Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft .NET · Microsoft Visual Studio) - [CVE-2025-21178](https://cve.now/CVE-2025-21178.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio 2015 Update · Microsoft Visual Stud…) - [CVE-2025-21176](https://cve.now/CVE-2025-21176.md): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET · Microsoft Visual Studio 2015 Update +13) - [CVE-2025-21327](https://cve.now/CVE-2025-21327.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21321](https://cve.now/CVE-2025-21321.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21320](https://cve.now/CVE-2025-21320.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21319](https://cve.now/CVE-2025-21319.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21318](https://cve.now/CVE-2025-21318.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21316](https://cve.now/CVE-2025-21316.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21315](https://cve.now/CVE-2025-21315.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21314](https://cve.now/CVE-2025-21314.md): Windows SmartScreen Spoofing Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21309](https://cve.now/CVE-2025-21309.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server) - [CVE-2025-21306](https://cve.now/CVE-2025-21306.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21304](https://cve.now/CVE-2025-21304.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21303](https://cve.now/CVE-2025-21303.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21302](https://cve.now/CVE-2025-21302.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21301](https://cve.now/CVE-2025-21301.md): Windows Geolocation Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21299](https://cve.now/CVE-2025-21299.md): Windows Kerberos Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2025-21298](https://cve.now/CVE-2025-21298.md): Windows OLE Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2025-21297](https://cve.now/CVE-2025-21297.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…) - [CVE-2025-21296](https://cve.now/CVE-2025-21296.md): BranchCache Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21295](https://cve.now/CVE-2025-21295.md): SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2025-21294](https://cve.now/CVE-2025-21294.md): Microsoft Digest Authentication Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2025-21293](https://cve.now/CVE-2025-21293.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21291](https://cve.now/CVE-2025-21291.md): Windows Direct Show Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21290](https://cve.now/CVE-2025-21290.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21289](https://cve.now/CVE-2025-21289.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21288](https://cve.now/CVE-2025-21288.md): Windows COM Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21285](https://cve.now/CVE-2025-21285.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21284](https://cve.now/CVE-2025-21284.md): Windows Virtual Trusted Platform Module Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21282](https://cve.now/CVE-2025-21282.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21281](https://cve.now/CVE-2025-21281.md): Microsoft COM for Windows Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21280](https://cve.now/CVE-2025-21280.md): Windows Virtual Trusted Platform Module Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21277](https://cve.now/CVE-2025-21277.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21272](https://cve.now/CVE-2025-21272.md): Windows COM Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2025-21271](https://cve.now/CVE-2025-21271.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21270](https://cve.now/CVE-2025-21270.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21269](https://cve.now/CVE-2025-21269.md): Windows HTML Platforms Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21268](https://cve.now/CVE-2025-21268.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2025-21266](https://cve.now/CVE-2025-21266.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21265](https://cve.now/CVE-2025-21265.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21263](https://cve.now/CVE-2025-21263.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21260](https://cve.now/CVE-2025-21260.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21258](https://cve.now/CVE-2025-21258.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21257](https://cve.now/CVE-2025-21257.md): Windows WLAN AutoConfig Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2025-21255](https://cve.now/CVE-2025-21255.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21252](https://cve.now/CVE-2025-21252.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21251](https://cve.now/CVE-2025-21251.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2025-21249](https://cve.now/CVE-2025-21249.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2025-21248](https://cve.now/CVE-2025-21248.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21244](https://cve.now/CVE-2025-21244.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21243](https://cve.now/CVE-2025-21243.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21242](https://cve.now/CVE-2025-21242.md): Windows Kerberos Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows) - [CVE-2025-21241](https://cve.now/CVE-2025-21241.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21239](https://cve.now/CVE-2025-21239.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21237](https://cve.now/CVE-2025-21237.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21236](https://cve.now/CVE-2025-21236.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21235](https://cve.now/CVE-2025-21235.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21234](https://cve.now/CVE-2025-21234.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2025-21233](https://cve.now/CVE-2025-21233.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21215](https://cve.now/CVE-2025-21215.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 4.6, Microsoft Windows) - [CVE-2025-21214](https://cve.now/CVE-2025-21214.md): Windows BitLocker Information Disclosure Vulnerability (CVSS 4.2, Microsoft Windows) - [CVE-2025-21210](https://cve.now/CVE-2025-21210.md): Windows BitLocker Information Disclosure Vulnerability (CVSS 4.2, Microsoft Windows) - [CVE-2025-21171](https://cve.now/CVE-2025-21171.md): .NET Remote Code Execution Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +13) - [CVE-2025-21413](https://cve.now/CVE-2025-21413.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2025-21411](https://cve.now/CVE-2025-21411.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2024-12087](https://cve.now/CVE-2024-12087.md): Rsync: path traversal vulnerability in rsync (CVSS 6.5, rsync · Red Hat Enterprise Linux +2) - [CVE-2025-23025](https://cve.now/CVE-2025-23025.md): Privilege escalation (PR) through realtime WYSIWYG editing in XWiki (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-realtime…) - [CVE-2025-23366](https://cve.now/CVE-2025-23366.md): Org.jboss.hal:hal-console: wildfly hal console cross-site scripting (CVSS 6.5, hal-console · Red Hat JBoss Enterprise Application Platf… +2) - [CVE-2024-12747](https://cve.now/CVE-2024-12747.md): Rsync: race condition in rsync handling symbolic links (CVSS 5.6, rsync · Red Hat Enterprise Linux +2) - [CVE-2025-23052](https://cve.now/CVE-2025-23052.md): Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS) - [CVE-2024-12088](https://cve.now/CVE-2024-12088.md): Rsync: --safe-links option bypass leads to path traversal (CVSS 6.5, rsync · Red Hat Enterprise Linux +2) - [CVE-2024-12086](https://cve.now/CVE-2024-12086.md): Rsync: rsync server leaks arbitrary client files (CVSS 6.1, rsync · Red Hat Enterprise Linux +2) - [CVE-2024-12085](https://cve.now/CVE-2024-12085.md): Rsync: info leak via uninitialized stack contents (CVSS 7.5, rsync · Red Hat Enterprise Linux +4) - [CVE-2025-23051](https://cve.now/CVE-2025-23051.md): Authenticated Remote Code Execution in AOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS) - [CVE-2025-21607](https://cve.now/CVE-2025-21607.md): Success of Certain Precompile Calls not Checked in Vyper (CVSS 2.3, vyperlang vyper · vyper) - [CVE-2025-0465](https://cve.now/CVE-2025-0465.md): AquilaCMS categories deserialization (CVSS 6.9, AquilaCMS) - [CVE-2024-13162](https://cve.now/CVE-2024-13162.md): SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authentic (CVSS 7.2, Ivanti Endpoint Manager) - [CVE-2024-13163](https://cve.now/CVE-2024-13163.md): Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow (CVSS 7.8, Ivanti Endpoint Manager) - [CVE-2024-13164](https://cve.now/CVE-2024-13164.md): An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a loca (CVSS 7.8, Ivanti Endpoint Manager) - [CVE-2024-13165](https://cve.now/CVE-2024-13165.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager) - [CVE-2024-13166](https://cve.now/CVE-2024-13166.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager) - [CVE-2024-13167](https://cve.now/CVE-2024-13167.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager) - [CVE-2024-13168](https://cve.now/CVE-2024-13168.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager) - [CVE-2024-13169](https://cve.now/CVE-2024-13169.md): An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local au (CVSS 7.8, Ivanti Endpoint Manager) - [CVE-2024-13170](https://cve.now/CVE-2024-13170.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager) - [CVE-2024-13171](https://cve.now/CVE-2024-13171.md): Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows (CVSS 7.8, Ivanti Endpoint Manager) - [CVE-2024-13172](https://cve.now/CVE-2024-13172.md): Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows (CVSS 7.8, Ivanti Endpoint Manager) - [CVE-2024-13158](https://cve.now/CVE-2024-13158.md): An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow (CVSS 7.2, Ivanti Endpoint Manager) - [CVE-2024-13159](https://cve.now/CVE-2024-13159.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager) - [CVE-2024-13160](https://cve.now/CVE-2024-13160.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager) - [CVE-2024-13161](https://cve.now/CVE-2024-13161.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager) - [CVE-2025-0464](https://cve.now/CVE-2025-0464.md): SourceCodester Task Reminder System Maintenance Section cross site scripting (CVSS 5.1, SourceCodester Task Reminder System) - [CVE-2025-0463](https://cve.now/CVE-2025-0463.md): Shanghai Lingdang Information Technology Lingdang CRM index.php unrestricted upload (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM) - [CVE-2024-10811](https://cve.now/CVE-2024-10811.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, Ivanti Endpoint Manager) - [CVE-2025-23081](https://cve.now/CVE-2025-23081.md): Various security vulnerabilities in Extension:DataTransfer (CVSS 6.1, Wikimedia Foundation Mediawiki - DataTransfer Extension · m…) - [CVE-2024-13181](https://cve.now/CVE-2024-13181.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. (CVSS 7.3, Ivanti Avalanche) - [CVE-2024-13180](https://cve.now/CVE-2024-13180.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. (CVSS 7.5, Ivanti Avalanche) - [CVE-2024-13179](https://cve.now/CVE-2024-13179.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. (CVSS 7.3, Ivanti Avalanche) - [CVE-2024-52898](https://cve.now/CVE-2024-52898.md): IBM MQ information disclosure (CVSS 6.2, IBM MQ) - [CVE-2024-10630](https://cve.now/CVE-2024-10630.md): A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the applicati (CVSS 7.8, Ivanti Application Control Engine) - [CVE-2025-23080](https://cve.now/CVE-2025-23080.md): XSSes in Special:BadgeView (CVSS 5.3, Wikimedia Foundation Mediawiki - OpenBadges Extension) - [CVE-2025-0462](https://cve.now/CVE-2025-0462.md): Shanghai Lingdang Information Technology Lingdang CRM index.php sql injection (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM) - [CVE-2024-45627](https://cve.now/CVE-2024-45627.md): Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability (CVSS 5.9, Apache Software Foundation Apache Linkis Metadata Query Ser…) - [CVE-2025-0461](https://cve.now/CVE-2025-0461.md): Shanghai Lingdang Information Technology Lingdang CRM index.php path traversal (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM) - [CVE-2025-0460](https://cve.now/CVE-2025-0460.md): Blog Botz for Journal Theme blog\_add unrestricted upload (CVSS 6.9, Blog Botz for Journal Theme) - [CVE-2024-29980](https://cve.now/CVE-2024-29980.md): Unsafe Handling of IHV UEFI Variables (CVSS 4.6, Phoenix SecureCore™ for Intel Kaby Lake · Phoenix Secure… +2) - [CVE-2024-29979](https://cve.now/CVE-2024-29979.md): Unsafe Handling of Phoenix UEFI Variables (CVSS 4.6, Phoenix SecureCore™ for Intel Kaby Lake · Phoenix Secure… +2) - [CVE-2025-0459](https://cve.now/CVE-2025-0459.md): libretro RetroArch Startup profapi.dll untrusted search path (CVSS 4.8, libretro RetroArch) - [CVE-2025-0458](https://cve.now/CVE-2025-0458.md): Virtual Computer Vysual RH Solution Login Panel index.php cross site scripting (CVSS 6.9, Virtual Computer Vysual RH Solution) - [CVE-2024-42444](https://cve.now/CVE-2024-42444.md): TOCTOU Race Condition between DMA and SMM (CVSS 7.5, AMI AptioV) - [CVE-2024-34166](https://cve.now/CVE-2024-34166.md): An os command injection vulnerability exists in the touchlist\_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39363](https://cve.now/CVE-2024-39363.md): A cross-site scripting (xss) vulnerability exists in the login.cgi set\_lang\_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.6, Wavlink AC3000) - [CVE-2024-39761](https://cve.now/CVE-2024-39761.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39760](https://cve.now/CVE-2024-39760.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39759](https://cve.now/CVE-2024-39759.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-36290](https://cve.now/CVE-2024-36290.md): A buffer overflow vulnerability exists in the login.cgi Goto\_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39765](https://cve.now/CVE-2024-39765.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39764](https://cve.now/CVE-2024-39764.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39763](https://cve.now/CVE-2024-39763.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39762](https://cve.now/CVE-2024-39762.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39288](https://cve.now/CVE-2024-39288.md): A buffer overflow vulnerability exists in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39770](https://cve.now/CVE-2024-39770.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39769](https://cve.now/CVE-2024-39769.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39768](https://cve.now/CVE-2024-39768.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39367](https://cve.now/CVE-2024-39367.md): An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39756](https://cve.now/CVE-2024-39756.md): A buffer overflow vulnerability exists in the adm.cgi rep\_as\_router() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-37184](https://cve.now/CVE-2024-37184.md): A buffer overflow vulnerability exists in the adm.cgi rep\_as\_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39294](https://cve.now/CVE-2024-39294.md): A buffer overflow vulnerability exists in the adm.cgi set\_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39358](https://cve.now/CVE-2024-39358.md): A buffer overflow vulnerability exists in the adm.cgi set\_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-21797](https://cve.now/CVE-2024-21797.md): A command execution vulnerability exists in the adm.cgi set\_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-37357](https://cve.now/CVE-2024-37357.md): A buffer overflow vulnerability exists in the adm.cgi set\_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39774](https://cve.now/CVE-2024-39774.md): A buffer overflow vulnerability exists in the adm.cgi set\_sys\_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39370](https://cve.now/CVE-2024-39370.md): An arbitrary code execution vulnerability exists in the adm.cgi set\_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-37186](https://cve.now/CVE-2024-37186.md): An os command injection vulnerability exists in the adm.cgi set\_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39783](https://cve.now/CVE-2024-39783.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39782](https://cve.now/CVE-2024-39782.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39781](https://cve.now/CVE-2024-39781.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39754](https://cve.now/CVE-2024-39754.md): A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39773](https://cve.now/CVE-2024-39773.md): An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 5.3, Wavlink AC3000) - [CVE-2024-39608](https://cve.now/CVE-2024-39608.md): A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0, Wavlink AC3000) - [CVE-2024-39273](https://cve.now/CVE-2024-39273.md): A firmware update vulnerability exists in the fw\_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.0, Wavlink AC3000) - [CVE-2024-39604](https://cve.now/CVE-2024-39604.md): A command execution vulnerability exists in the update\_filter\_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.0, Wavlink AC3000) - [CVE-2024-39357](https://cve.now/CVE-2024-39357.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39359](https://cve.now/CVE-2024-39359.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-36493](https://cve.now/CVE-2024-36493.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi set\_wifi\_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39603](https://cve.now/CVE-2024-39603.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi set\_wifi\_basic\_mesh() functionality of Wavlink AC3000 M33A8.V5030.210 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39757](https://cve.now/CVE-2024-39757.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-34544](https://cve.now/CVE-2024-34544.md): A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-36272](https://cve.now/CVE-2024-36272.md): A buffer overflow vulnerability exists in the usbip.cgi set\_info() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-36258](https://cve.now/CVE-2024-36258.md): A stack-based buffer overflow vulnerability exists in the touchlist\_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210 (CVSS 10.0, Wavlink AC3000) - [CVE-2024-36295](https://cve.now/CVE-2024-36295.md): A command execution vulnerability exists in the qos.cgi qos\_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39299](https://cve.now/CVE-2024-39299.md): A buffer overflow vulnerability exists in the qos.cgi qos\_sta\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39803](https://cve.now/CVE-2024-39803.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39802](https://cve.now/CVE-2024-39802.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39801](https://cve.now/CVE-2024-39801.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39800](https://cve.now/CVE-2024-39800.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39799](https://cve.now/CVE-2024-39799.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39798](https://cve.now/CVE-2024-39798.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-38666](https://cve.now/CVE-2024-38666.md): An external config control vulnerability exists in the openvpn.cgi openvpn\_client\_setup() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39602](https://cve.now/CVE-2024-39602.md): An external config control vulnerability exists in the nas.cgi set\_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39795](https://cve.now/CVE-2024-39795.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39794](https://cve.now/CVE-2024-39794.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39793](https://cve.now/CVE-2024-39793.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39360](https://cve.now/CVE-2024-39360.md): An os command injection vulnerability exists in the nas.cgi remove\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39280](https://cve.now/CVE-2024-39280.md): An external config control vulnerability exists in the nas.cgi set\_smb\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39790](https://cve.now/CVE-2024-39790.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39789](https://cve.now/CVE-2024-39789.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39788](https://cve.now/CVE-2024-39788.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39787](https://cve.now/CVE-2024-39787.md): Multiple directory traversal vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39786](https://cve.now/CVE-2024-39786.md): Multiple directory traversal vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39785](https://cve.now/CVE-2024-39785.md): Multiple command execution vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-39784](https://cve.now/CVE-2024-39784.md): Multiple command execution vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1, Wavlink AC3000) - [CVE-2024-32115](https://cve.now/CVE-2024-32115.md): A relative path traversal vulnerability \[CWE-23\] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged (CVSS 5.2, Fortinet FortiManager) - [CVE-2024-23106](https://cve.now/CVE-2024-23106.md): An improper restriction of excessive authentication attempts \[CWE-307\] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allow (CVSS 7.7, Fortinet FortiClientEMS) - [CVE-2023-37931](https://cve.now/CVE-2023-37931.md): An improper neutralization of special elements used in an sql command ('sql injection') vulnerability \[CWE-88\] in FortiVoice Entreprise vers (CVSS 8.6, Fortinet FortiVoice) - [CVE-2024-47571](https://cve.now/CVE-2024-47571.md): An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper acc (CVSS 7.9, Fortinet FortiManager) - [CVE-2024-47572](https://cve.now/CVE-2024-47572.md): An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthoriz (CVSS 8.3, Fortinet FortiSOAR) - [CVE-2024-46667](https://cve.now/CVE-2024-46667.md): A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all v (CVSS 6.9, Fortinet FortiSIEM) - [CVE-2024-36504](https://cve.now/CVE-2024-36504.md): An out-of-bounds read vulnerability \[CWE-125\] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 a (CVSS 6.2, Fortinet FortiOS) - [CVE-2024-21758](https://cve.now/CVE-2024-21758.md): A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to exec (CVSS 6.1, Fortinet FortiWeb) - [CVE-2024-46666](https://cve.now/CVE-2024-46666.md): An allocation of resources without limits or throttling \[CWE-770\] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 (CVSS 4.8, Fortinet FortiOS) - [CVE-2024-45326](https://cve.now/CVE-2024-45326.md): An Improper Access Control vulnerability \[CWE-284\] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDecep (CVSS 3.9, Fortinet FortiDeceptor) - [CVE-2024-35277](https://cve.now/CVE-2024-35277.md): A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4. (CVSS 8.4, Fortinet FortiManager) - [CVE-2024-26012](https://cve.now/CVE-2024-26012.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4 (CVSS 6.3, Fortinet FortiAP-S · Fortinet FortiAP-W2 +1) - [CVE-2024-36506](https://cve.now/CVE-2024-36506.md): An improper verification of source of a communication channel vulnerability \[CWE-940\] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all (CVSS 3.5, Fortinet FortiClientEMS) - [CVE-2024-48890](https://cve.now/CVE-2024-48890.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in FortiSOAR IMAP conne (CVSS 6.3, Fortinet FortiSOAR) - [CVE-2024-33502](https://cve.now/CVE-2024-33502.md): An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 thr (CVSS 6.4, Fortinet FortiManager · Fortinet FortiAnalyzer) - [CVE-2024-50564](https://cve.now/CVE-2024-50564.md): A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all ve (CVSS 3.2, Fortinet FortiClientWindows) - [CVE-2024-36510](https://cve.now/CVE-2024-36510.md): An observable response discrepancy vulnerability \[CWE-204\] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5 (CVSS 4.9, Fortinet FortiClientEMS · Fortinet FortiSOAR) - [CVE-2024-54021](https://cve.now/CVE-2024-54021.md): An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability \[CWE-113\] in Fortinet FortiOS 7.2.0 t (CVSS 6.4, Fortinet FortiOS · Fortinet FortiProxy) - [CVE-2024-35278](https://cve.now/CVE-2024-35278.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 (CVSS 4.1, Fortinet FortiPortal) - [CVE-2024-52967](https://cve.now/CVE-2024-52967.md): An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacke (CVSS 3.3, Fortinet FortiPortal) - [CVE-2024-40587](https://cve.now/CVE-2024-40587.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in Fortinet FortiVoice (CVSS 6.3, Fortinet FortiVoice) - [CVE-2024-46664](https://cve.now/CVE-2024-46664.md): A relative path traversal in Fortinet FortiRecorder \[CWE-23\] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to re (CVSS 5.2, Fortinet FortiRecorder) - [CVE-2024-47566](https://cve.now/CVE-2024-47566.md): A improper limitation of a pathname to a restricted directory ('path traversal') \[CWE-23\] in Fortinet FortiRecorder version 7.2.0 through 7. (CVSS 4.8, Fortinet FortiRecorder) - [CVE-2024-48886](https://cve.now/CVE-2024-48886.md): A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, For (CVSS 8.0, Fortinet FortiOS · Fortinet FortiProxy) - [CVE-2024-27778](https://cve.now/CVE-2024-27778.md): An improper neutralization of special elements used in an OS Command vulnerability \[CWE-78\] vulnerability in Fortinet FortiSandbox 4.4.0 thr (CVSS 8.3, Fortinet FortiSandbox) - [CVE-2024-33503](https://cve.now/CVE-2024-33503.md): A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, Fo (CVSS 6.7, Fortinet FortiManager Cloud · Fortinet FortiManager) - [CVE-2023-37936](https://cve.now/CVE-2023-37936.md): A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 throug (CVSS 9.6, Fortinet FortiSwitch) - [CVE-2023-37937](https://cve.now/CVE-2023-37937.md): An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2. (CVSS 7.6, Fortinet FortiSwitch) - [CVE-2024-56497](https://cve.now/CVE-2024-56497.md): An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7 (CVSS 6.5, Fortinet FortiMail · Fortinet FortiRecorder) - [CVE-2024-48884](https://cve.now/CVE-2024-48884.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, (CVSS 6.7, Fortinet FortiOS · Fortinet FortiProxy +1) - [CVE-2024-52969](https://cve.now/CVE-2024-52969.md): An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability \[CWE-89\] in FortiSIEM ersion 7.1.7 and (CVSS 3.7, Fortinet FortiSIEM) - [CVE-2024-46668](https://cve.now/CVE-2024-46668.md): An allocation of resources without limits or throttling vulnerability \[CWE-770\] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 thro (CVSS 7.1, Fortinet FortiOS) - [CVE-2024-35273](https://cve.now/CVE-2024-35273.md): A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to esc (CVSS 7.0, Fortinet FortiAnalyzer · Fortinet FortiManager) - [CVE-2023-46715](https://cve.now/CVE-2023-46715.md): An origin validation error \[CWE-346\] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below al (CVSS 4.7, Fortinet FortiProxy · Fortinet FortiOS) - [CVE-2023-42786](https://cve.now/CVE-2023-42786.md): A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versio (CVSS 6.4, Fortinet FortiOS) - [CVE-2024-35276](https://cve.now/CVE-2024-35276.md): A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer (CVSS 5.0, Fortinet FortiAnalyzer · Fortinet FortiManager Cloud +1) - [CVE-2024-35275](https://cve.now/CVE-2024-35275.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 (CVSS 6.5, Fortinet FortiManager · Fortinet FortiAnalyzer) - [CVE-2023-42785](https://cve.now/CVE-2023-42785.md): A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versio (CVSS 6.4, Fortinet FortiOS) - [CVE-2024-36512](https://cve.now/CVE-2024-36512.md): An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4. (CVSS 7.0, Fortinet FortiManager · Fortinet FortiAnalyzer) - [CVE-2024-46670](https://cve.now/CVE-2024-46670.md): An Out-of-bounds Read vulnerability \[CWE-125\] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE Forti (CVSS 7.5, Fortinet FortiOS · Fortinet FortiProxy +1) - [CVE-2024-46669](https://cve.now/CVE-2024-46669.md): An Integer Overflow or Wraparound vulnerability \[CWE-190\] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b For (CVSS 3.2, Fortinet FortiOS) - [CVE-2024-55593](https://cve.now/CVE-2024-55593.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 al (CVSS 2.6, Fortinet FortiWeb) - [CVE-2024-50566](https://cve.now/CVE-2024-50566.md): A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7. (CVSS 7.2, Fortinet FortiManager) - [CVE-2024-55591](https://cve.now/CVE-2024-55591.md): An Authentication Bypass Using an Alternate Path or Channel vulnerability \[CWE-288\] affecting FortiOS version 7.0.0 through 7.0.16 and Forti (CVSS 9.6, KEV, Fortinet FortiOS · Fortinet FortiProxy) - [CVE-2024-52963](https://cve.now/CVE-2024-52963.md): A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4 (CVSS 3.5, Fortinet FortiProxy · Fortinet FortiOS +1) - [CVE-2024-48893](https://cve.now/CVE-2024-48893.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 (CVSS 6.4, Fortinet FortiSOAR) - [CVE-2024-46665](https://cve.now/CVE-2024-46665.md): An insertion of sensitive information into sent data vulnerability \[CWE-201\] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in (CVSS 3.5, Fortinet FortiOS) - [CVE-2024-11497](https://cve.now/CVE-2024-11497.md): Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation (CVSS 8.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2) - [CVE-2024-11864](https://cve.now/CVE-2024-11864.md): SCP-Firmware Vulnerability (CVSS 7.5, Arm SCP-Firmware) - [CVE-2024-11863](https://cve.now/CVE-2024-11863.md): SCP-Firmware Vulnerability (CVSS 5.3, Arm SCP-Firmware) - [CVE-2024-7344](https://cve.now/CVE-2024-7344.md): Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. (CVSS 8.2, Radix SmartRecovery · Greenware Technologies GreenGuard +4) - [CVE-2024-12240](https://cve.now/CVE-2024-12240.md): Page Builder by SiteOrigin \<= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter (CVSS 6.4, gpriday Page Builder by SiteOrigin) - [CVE-2024-56841](https://cve.now/CVE-2024-56841.md): A vulnerability has been identified in Mendix LDAP (All versions \< V1.1.2). (CVSS 7.4, Siemens Mendix LDAP) - [CVE-2024-53649](https://cve.now/CVE-2024-53649.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.80), SIPROTEC 5 6MD85 (CP300) (All versions \>= V7.80 \< V9 (CVSS 6.5, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34) - [CVE-2024-47100](https://cve.now/CVE-2024-47100.md): A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211 (CVSS 7.1, Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens S… +31) - [CVE-2024-45385](https://cve.now/CVE-2024-45385.md): A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). (CVSS 4.7, Siemens Industrial Edge Management OS) - [CVE-2025-20620](https://cve.now/CVE-2025-20620.md): SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. (CVSS 7.5, Y'S STEALTHONE D220 · Y'S STEALTHONE D340) - [CVE-2025-20055](https://cve.now/CVE-2025-20055.md): OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. (CVSS 9.8, Y'S STEALTHONE D220 · Y'S STEALTHONE D340) - [CVE-2025-20016](https://cve.now/CVE-2025-20016.md): OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. (CVSS 7.2, Y'S STEALTHONE D220 · Y'S STEALTHONE D340 +1) - [CVE-2024-12919](https://cve.now/CVE-2024-12919.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.13.7 - Authentication Bypass via pms\_payment\_id (CVSS 9.8, cozmoslabs Paid Membership Subscriptions – Effortless Membe…) - [CVE-2024-11736](https://cve.now/CVE-2024-11736.md): Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables (CVSS 4.9, keycloak · Red Hat build of Keycloak +3) - [CVE-2024-11734](https://cve.now/CVE-2024-11734.md): Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers (CVSS 6.5, keycloak · Red Hat build of Keycloak +3) - [CVE-2024-13156](https://cve.now/CVE-2024-13156.md): HTML5 Video Player – mp4 Video Player Plugin and Block \<= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter (CVSS 6.4, bplugins HTML5 Video Player – Embed and Play Videos in Cust…) - [CVE-2025-0394](https://cve.now/CVE-2025-0394.md): Groundhogg \<= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh\_big\_file\_upload Function (CVSS 8.8, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…) - [CVE-2025-0393](https://cve.now/CVE-2025-0393.md): Royal Elementor Addons and Templates \<= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, wproyal Royal Addons for Elementor – Addons and Templates K…) - [CVE-2024-12008](https://cve.now/CVE-2024-12008.md): W3 Total Cache \<= 2.8.1 Information Exposure via Log Files (CVSS 5.3, boldgrid W3 Total Cache) - [CVE-2024-12006](https://cve.now/CVE-2024-12006.md): W3 Total Cache \<= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation (CVSS 5.3, boldgrid W3 Total Cache) - [CVE-2024-12365](https://cve.now/CVE-2024-12365.md): W3 Total Cache \<= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery (CVSS 8.5, boldgrid W3 Total Cache) - [CVE-2024-13323](https://cve.now/CVE-2024-13323.md): Booking Calendar \<= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode (CVSS 6.4, wpdevelop Booking Calendar) - [CVE-2025-23082](https://cve.now/CVE-2025-23082.md): Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). (CVSS 7.2, Veeam Backup for Microsoft Azure) - [CVE-2024-12398](https://cve.now/CVE-2024-12398.md): An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) an (CVSS 8.8, Zyxel WBE530 firmware · Zyxel WBE660S firmware) - [CVE-2024-12083](https://cve.now/CVE-2024-12083.md): Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers (CVSS 6.6, OMRON Machine Automation Controller NJ-series · OMRON Machi…) - [CVE-2024-12298](https://cve.now/CVE-2024-12298.md): Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer (CVSS 5.5, OMRON Programable Terminals NB-Designer) - [CVE-2025-0070](https://cve.now/CVE-2025-0070.md): Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform (CVSS 9.9, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…) - [CVE-2025-0069](https://cve.now/CVE-2025-0069.md): DLL Hijacking vulnerability in SAPSetup (CVSS 7.8, SAP\_SE SAPSetup) - [CVE-2025-0068](https://cve.now/CVE-2025-0068.md): Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server ABAP) - [CVE-2025-0067](https://cve.now/CVE-2025-0067.md): Missing Authorization check in SAP NetWeaver Application Server Java (CVSS 6.3, SAP\_SE SAP NetWeaver Application Server Java) - [CVE-2025-0066](https://cve.now/CVE-2025-0066.md): Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) (CVSS 9.9, SAP\_SE SAP NetWeaver AS for ABAP and ABAP Platform) - [CVE-2025-0063](https://cve.now/CVE-2025-0063.md): SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (CVSS 8.8, SAP\_SE SAP NetWeaver AS ABAP and ABAP Platform) - [CVE-2025-0061](https://cve.now/CVE-2025-0061.md): Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform (CVSS 8.7, SAP\_SE SAP BusinessObjects Business Intelligence Platform) - [CVE-2025-0060](https://cve.now/CVE-2025-0060.md): Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform (CVSS 6.5, SAP\_SE SAP BusinessObjects Business Intelligence Platform) - [CVE-2025-0059](https://cve.now/CVE-2025-0059.md): Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) (CVSS 6.0, SAP\_SE SAP NetWeaver Application Server ABAP) - [CVE-2025-0058](https://cve.now/CVE-2025-0058.md): Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow (CVSS 6.5, SAP\_SE SAP Business Workflow and SAP Flexible Workflow) - [CVE-2025-0057](https://cve.now/CVE-2025-0057.md): Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application) (CVSS 4.8, SAP\_SE SAP NetWeaver AS JAVA) - [CVE-2025-0056](https://cve.now/CVE-2025-0056.md): Information Disclosure vulnerability in SAP GUI for Java (CVSS 6.0, SAP\_SE SAP GUI for Java) - [CVE-2025-0055](https://cve.now/CVE-2025-0055.md): Information Disclosure vulnerability in SAP GUI for Windows (CVSS 6.0, SAP\_SE SAP GUI for Windows) - [CVE-2025-0053](https://cve.now/CVE-2025-0053.md): Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…) - [CVE-2024-42911](https://cve.now/CVE-2024-42911.md): ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability. (CVSS 7.4) - [CVE-2024-48760](https://cve.now/CVE-2024-48760.md): An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. (CVSS 9.8) - [CVE-2024-50857](https://cve.now/CVE-2024-50857.md): The ip\_do\_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). (CVSS 4.8) - [CVE-2024-50858](https://cve.now/CVE-2024-50858.md): Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). (CVSS 8.8) - [CVE-2024-50859](https://cve.now/CVE-2024-50859.md): The ip\_import\_acl\_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. (CVSS 4.8) - [CVE-2024-50861](https://cve.now/CVE-2024-50861.md): The ip\_mod\_dns\_key\_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. (CVSS 6.1) - [CVE-2024-53561](https://cve.now/CVE-2024-53561.md): A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a (CVSS 8.7) - [CVE-2024-53563](https://cve.now/CVE-2024-53563.md): A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web (CVSS 5.4) - [CVE-2024-54730](https://cve.now/CVE-2024-54730.md): Flatnotes \