CVEs published February 11, 2025
283 CVEs were published on February 11, 2025: 15 critical, 115 high. 3 are now in CISA KEV.
- Published
- 283
- Critical
- 15
- High
- 115
- Medium
- 120
- Low
- 33
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 123
Most affected products
- Microsoft Windows
- 35
- Adobe Commerce · magento/community-edition +1
- 24
- PDF-XChange Editor
- 12
- Adobe Commerce
- 7
- Adobe InDesign Desktop
- 7
- GNU Binutils
- 6
- Microsoft 365 Apps for Enterprise · Microsoft Excel +1
- 6
- Ivanti Connect Secure · Ivanti Policy Secure
- 5
- Octopus Deploy Octopus Server
- 5
- Tungsten Automation Power PDF
- 5
Critical 15
- CVE-2022-3180WPGateway <= 3.5 - Unauthenticated Privilege EscalationJack Hopman WPGateway
- CVE-2025-1044Logsign Unified SecOps Platform Authentication Bypass VulnerabilityLogsign Unified SecOps Platform
- CVE-2025-21198Microsoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityMicrosoft HPC Pack
- CVE-2025-24434Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2025-1126Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).Lexmark Print Management Client
- CVE-2025-24973Concorde not removing authentication tokens after logging outnexryai concorde
- CVE-2024-10644Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticatIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-22467A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote codeIvanti Connect Secure
- CVE-2024-47908OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilegeIvanti Cloud Services Application
- CVE-2024-12366CVE-2024-12366Sinaptik AI PandasAI · pandasai
- CVE-2025-26410Weak Hard-coded CredentialsWattsense Bridge
- CVE-2025-0181WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_requestChimpstudio WP Foodbakery
- CVE-2025-0180WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validationChimpstudio WP Foodbakery
- CVE-2025-1144Quanxun School Affairs System - Exposure of Sensitive InformationQuanxun School Affairs System
- CVE-2025-25530Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to savin
High 115
- CVE-2023-31345Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execuAMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +19
- CVE-2024-0112NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue NVIDIA Jetson AGX Orin series · NVIDIA IGX Orin
- CVE-2025-25203Ctrlpanel has stored XSS vulnerability in TicketsController priority fieldCtrlpanel-gg panel
- CVE-2023-31343Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execuAMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +22
- CVE-2023-31342Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execuAMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +22
- CVE-2025-1240WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityWinZip Computing WinZip
- CVE-2024-0179SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentiaAMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™… +20
- CVE-2024-21925Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code exAMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +25
- CVE-2024-21924SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentiallyAMD EPYC™ 7002 Processors · AMD Ryzen™ Threadripper™ PRO… +3
- CVE-2023-31361A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve priviAIM-T (AMD Integrated Management Technology) software
- CVE-2023-31360Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow aAIM-T(AMD Integrated Management Technology) software
- CVE-2025-0910PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-0903PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-0901PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2024-21966A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility could allow an attacker to achieve privilege escalation, potentially resultiAMD Ryzen™ Master Utility
- CVE-2025-1052Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityMintty
- CVE-2024-12547Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityTungsten Automation Power PDF
- CVE-2024-12549Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityTungsten Automation Power PDF
- CVE-2024-12551Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityTungsten Automation Power PDF
- CVE-2024-12833Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass VulnerabilityPaessler PRTG Network Monitor
- CVE-2025-0899PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-24042Visual Studio Code JS Debug Extension Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code - JS Debug Extension
- CVE-2025-21373Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21414Windows Core Messaging Elevation of Privileges VulnerabilityMicrosoft Windows
- CVE-2025-21322Microsoft PC Manager Elevation of Privilege VulnerabilityMicrosoft PC Manager
- CVE-2025-21184Windows Core Messaging Elevation of Privileges VulnerabilityMicrosoft Windows
- CVE-2025-21181Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21400Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-21397Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2025-21394Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21392Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-21390Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21387Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21386Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21381Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21371Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21367Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21359Windows Kernel Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-21358Windows Core Messaging Elevation of Privileges VulnerabilityMicrosoft Windows
- CVE-2025-21201Windows Telephony Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21200Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21190Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21410Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-21407Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21406Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21208Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-21194Microsoft Surface Security Feature Bypass VulnerabilityMicrosoft Surface Go · Microsoft Surface Hub +6
- CVE-2025-24039Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code
- CVE-2025-24036Microsoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityMicrosoft AutoUpdate for Mac
- CVE-2025-21420Windows Disk Cleanup Tool Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21419Windows Setup Files Cleanup Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21418Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21391Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21183Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21182Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21383Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-21379DHCP Client Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21376Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21375Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21369Microsoft Digest Authentication Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21368Microsoft Digest Authentication Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21351Windows Active Directory Domain Services API Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21206Visual Studio Installer Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2025-26495Sensitive Data Exposure in Tableau ServerSalesforce Tableau Server
- CVE-2025-24414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24415Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24411Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition +1
- CVE-2025-24416Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24407Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce
- CVE-2025-24438Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24418Adobe Commerce | Improper Authorization (CWE-285)Adobe Commerce
- CVE-2025-24406Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Commerce · magento/community-edition +1
- CVE-2025-24417Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24409Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2025-24412Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24410Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-26494Server Side Request Forgery vulnerability in Tableau ServerSalesforce Tableau Server
- CVE-2025-21161Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance3D - Designer
- CVE-2025-21160Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Illustrator
- CVE-2025-21163Illustrator | Stack-based Buffer Overflow (CWE-121)Adobe Illustrator
- CVE-2025-21159Illustrator | Use After Free (CWE-416)Adobe Illustrator
- CVE-2025-21156InCopy | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe InCopy
- CVE-2025-21158InDesign Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe InDesign Desktop
- CVE-2025-21123InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2025-21157InDesign Desktop | Out-of-bounds Write (CWE-787)Adobe InDesign Desktop
- CVE-2025-21121InDesign Desktop | Out-of-bounds Write (CWE-787)Adobe InDesign Desktop
- CVE-2024-12756Avaya Spaces HTML injection (HTMLi) VulnerabilityAvaya Spaces
- CVE-2024-12755Avaya Spaces XSS VulnerabilityAvaya Spaces
- CVE-2025-24472An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.Fortinet FortiOS · Fortinet FortiProxy
- CVE-2025-22399Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability.Dell UCC Edge
- CVE-2024-35279A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allowsFortinet FortiOS
- CVE-2024-40591An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and beFortinet FortiOS
- CVE-2025-24470An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0Fortinet FortiPortal
- CVE-2025-24900Concorde CSRF vulnerability due to insecure configuration of authentication cookie attributesnexryai concorde
- CVE-2024-13813Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary fileIvanti Secure Access Client
- CVE-2025-24897Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributesmisskey-dev misskey
- CVE-2025-24896Misskey allows token to remain valid in cookie after signing outmisskey-dev misskey
- CVE-2025-26492In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resourcesJetBrains TeamCity
- CVE-2025-24811A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens S… +31
- CVE-2025-24499A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0Siemens SCALANCE WAB762-1 · Siemens SCALANCE WAM763-1 +4
- CVE-2025-23403A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions).Siemens SIMATIC IPC DiagBase · Siemens SIMATIC IPC DiagMoni…
- CVE-2025-23363A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1Siemens Teamcenter
- CVE-2024-54089A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC SSiemens APOGEE PXC Series · Siemens TALON TC Series
- CVE-2024-54015A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +37
- CVE-2024-45386A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCSSiemens SIMATIC PCS neo · Siemens SIMOCODE ES +3
- CVE-2025-26411Authenticated Arbitrary Python File Upload via Plugin ManagerWattsense Bridge
- CVE-2024-13643Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options ModificationMVPThemes Zox News - Professional WordPress News & Magazine…
- CVE-2025-1143Billion Electric M120N - Use of Hard-coded CredentialsBillion Electric M100 · Billion Electric M150 +2
- CVE-2025-25243Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)SAP_SE SAP Supplier Relationship Management
- CVE-2025-24876Authentication bypass via authorization code injection in SAP ApprouterSAP_SE SAP Approuter Node.js package · @sap/approuter
- CVE-2025-24868Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)SAP_SE SAP HANA extended application services, advanced mod…
- CVE-2025-0064Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)SAP_SE SAP BusinessObjects Business Intelligence platform
- CVE-2024-33469An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate met
- CVE-2025-25522Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting op
Medium, low and unrated 153
- CVE-2020-3432Cisco AnyConnect Secure Mobility Client for Mac OS File Corruption VulnerabilityCisco Secure Client
- CVE-2023-20508Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bAMD Radeon™ RX 6000 Series Graphics Products · AMD Rade… +21
- CVE-2023-31352A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private dAMD EPYC™ 9004 Processors · AMD EPYC™ Embedded
- CVE-2024-32037GeoNetwork vulnerable to search end-point information disclosure in response headerscore-geonetwork · org.geonetwork-opensource:gn-services
- CVE-2023-31331Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stacAMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +10
- CVE-2023-20582Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults AMD EPYC™ 9004 Processors · AMD EPYC™ Embedded
- CVE-2023-20581Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory intAMD EPYC™ 9004 Processors · AMD EPYC™ Embedded
- CVE-2023-20515Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leadingAMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™… +20
- CVE-2023-20507An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data inAMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +10
- CVE-2025-0911PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0909PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0908PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0907PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0906PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0905PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0904PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-0902PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-12548Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure VulnerabilityTungsten Automation Power PDF
- CVE-2024-12550Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityTungsten Automation Power PDF
- CVE-2025-25202Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`team-alembic ash_authentication
- CVE-2025-21254Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21216Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21212Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21179DHCP Client Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21377NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows
- CVE-2025-21350Windows Kerberos Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21349Windows Remote Desktop Configuration Service Tampering VulnerabilityMicrosoft Windows
- CVE-2025-21347Windows Deployment Services Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21337Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21259Microsoft Outlook Spoofing VulnerabilityMicrosoft Outlook for Android
- CVE-2025-21352Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-21188Azure Network Watcher VM Extension Elevation of Privilege VulnerabilityMicrosoft Azure Network Watcher VM Extension
- CVE-2025-24422Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce
- CVE-2025-24437Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2025-24420Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce
- CVE-2025-24419Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce
- CVE-2025-24432Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)Adobe Commerce · magento/community-edition +1
- CVE-2025-24424Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition +1
- CVE-2025-24430Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)Adobe Commerce · magento/community-edition +1
- CVE-2025-24429Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition +1
- CVE-2025-24436Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2025-24423Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce
- CVE-2025-24425Adobe Commerce | Business Logic Errors (CWE-840)Adobe Commerce · magento/community-edition +1
- CVE-2025-24421Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2025-24427Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition +1
- CVE-2025-24426Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce
- CVE-2025-24428Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2025-24408Adobe Commerce | Information Exposure (CWE-200)Adobe Commerce · magento/community-edition +1
- CVE-2025-24435Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition +1
- CVE-2025-21162Photoshop Elements | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)Adobe Photoshop Elements
- CVE-2019-15002An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0.Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2025-21155Substance3D - Stager | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Stager
- CVE-2025-21126InDesign Desktop | Improper Input Validation (CWE-20)Adobe InDesign Desktop
- CVE-2025-21125InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2025-21124InDesign Desktop | Out-of-bounds Read (CWE-125)Adobe InDesign Desktop
- CVE-2024-27780Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 allFortinet FortiSIEM
- CVE-2024-27781An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 throughFortinet FortiSandbox
- CVE-2024-40584An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2024-36508An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.Fortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2024-40586An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below mFortinet FortiClientWindows
- CVE-2023-40721A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbiFortinet FortiPAM · Fortinet FortiSwitchManager +2
- CVE-2024-50567An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allowFortinet FortiWeb
- CVE-2024-33504A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7Fortinet FortiManager
- CVE-2024-52966An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause informaFortinet FortiAnalyzer
- CVE-2024-52968An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty passwoFortinet FortiClientMac
- CVE-2024-50569A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allowsFortinet FortiWeb
- CVE-2024-12797RFC7250 handshakes with unauthenticated servers don't abort as expectedOpenSSL · cryptography
- CVE-2025-24976Distribution's token authentication allows attacker to inject an untrusted signing key in a JWTdistribution · github.com/distribution/distribution
- CVE-2025-24807Fast DDS does not verify Permissions CAeProsima Fast-DDS
- CVE-2024-13843Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-13842A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticatIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-13830Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticaIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-12058External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-11771Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.Ivanti Cloud Services Application
- CVE-2024-33659BiosGuard Buffer Overflow and TOCTOU VulnerabilityAMI AptioV
- CVE-2025-1231Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user paDevolutions Server
- CVE-2025-26493In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tabJetBrains TeamCity
- CVE-2025-0588In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses.Octopus Deploy Octopus Server
- CVE-2024-13506GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameterpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2025-0862SuperSaaS – online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after ParameterSuperSaaS – online appointment scheduling
- CVE-2025-24956A vulnerability has been identified in OpenV2G (All versions < V0.9.6).Siemens OpenV2G
- CVE-2025-24812A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens S… +31
- CVE-2025-24532A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0Siemens SCALANCE WAB762-1 · Siemens SCALANCE WAM763-1 +4
- CVE-2024-54090A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC SSiemens APOGEE PXC Series · Siemens TALON TC Series
- CVE-2024-53977A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1).Siemens ModelSim · Siemens Questa
- CVE-2024-53651A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CSiemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34
- CVE-2024-53648A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34
- CVE-2024-23814The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receivingSiemens SIDOOR ATD430W · Siemens SIDOOR ATE530G COATED +126
- CVE-2025-0513In affected versions of Octopus Server error messages were handled unsafely on the error page.Octopus Deploy Octopus Server
- CVE-2023-37482The login functionality of the web server in affected devices does not normalize the response times of login attempts.Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +86
- CVE-2025-0526In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint.Octopus Deploy Octopus Server
- CVE-2025-0525In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file.Octopus Deploy Octopus Server
- CVE-2025-26409Access to Bootloader and Shell Over Serial InterfaceWattsense Bridge
- CVE-2025-26408Unprotected JTAG InterfaceWattsense Bridge
- CVE-2025-0589In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated Octopus Deploy Octopus Server
- CVE-2025-1182GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruptionGNU Binutils
- CVE-2025-1181GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruptionGNU Binutils
- CVE-2025-1180GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruptionGNU Binutils
- CVE-2024-52611SolarWinds Platform Information Disclosure VulnerabilitySolarWinds Platform
- CVE-2024-52612SolarWinds Platform Reflected Cross-Site Scripting VulnerabilitySolarWinds Platform
- CVE-2024-45718Sensitive data disclosure vulnerabilitySolarWinds Kiwi Syslog NG
- CVE-2024-52606SolarWinds Platform Server-Side Request Forgery VulnerabilitySolarWinds
- CVE-2024-28989SolarWinds Web Help Desk Cryptographic Key Management VulnerabilitySolarWinds Web Help Desk
- CVE-2025-1179GNU Binutils ld libbfd.c bfd_putl64 memory corruptionGNU Binutils
- CVE-2025-1178GNU Binutils ld libbfd.c bfd_putl64 memory corruptionGNU Binutils
- CVE-2025-1177dayrui XunRuiCMS Linkage.php import_add deserializationdayrui XunRuiCMS
- CVE-2024-13570Stray Random Quotes <= 1.9.9 - Reflected XSSStray Random Quotes
- CVE-2024-13544Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File UploadZarinpal Paid Download
- CVE-2024-13543Zarinpal Paid Downloads <= 2.3 - Reflected XSSZarinpal Paid Download
- CVE-2025-1176GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflowGNU Binutils
- CVE-2025-11741000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scripting1000 Projects Bookstore Management System
- CVE-2025-1211Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI buhackney
- CVE-2025-11731000 Projects Bookstore Management System process_users_del.php sql injection1000 Projects Bookstore Management System
- CVE-2024-12599HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-11721000 Projects Bookstore Management System addtocart.php sql injection1000 Projects Bookstore Management System
- CVE-2025-1171code-projects Real Estate Property Management System CustomerReport.php cross site scriptingcode-projects Real Estate Property Management System
- CVE-2025-1145NetVision Information ISOinsight - Reflected Cross-site ScriptingNetVision Information ISOinsight
- CVE-2025-1170code-projects Real Estate Property Management System Category.php cross site scriptingcode-projects Real Estate Property Management System
- CVE-2025-1169SourceCodester Image Compressor Tool compressor.php cross site scriptingSourceCodester Image Compressor Tool
- CVE-2025-1168SourceCodester Contact Manager with Export to VCF delete-contact.php sql injectionSourceCodester Contact Manager with Export to VCF
- CVE-2025-1167Mayuri K Employee Management System Update_User.php sql injectionMayuri K Employee Management System
- CVE-2025-1166SourceCodester Food Menu Manager update.php unrestricted uploadSourceCodester Food Menu Manager
- CVE-2025-25241Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)SAP_SE SAP Fiori Apps Reference Library
- CVE-2025-24875SameSite Defense in Depth not applied for some cookies in SAP CommerceSAP_SE SAP Commerce
- CVE-2025-24874Missing Defense in Depth Against Clickjacking in SAP Commerce BackofficeSAP_SE SAP Commerce
- CVE-2025-24872Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)SAP_SE SAP ABAP Platform
- CVE-2025-24870Insecure Key & Secret Management vulnerability in SAP GUI for WindowsSAP_SE SAP GUI for Windows
- CVE-2025-24869Information Disclosure vulnerability in SAP NetWeaver Application Server JavaSAP_SE SAP NetWeaver Application Server Java
- CVE-2025-24867Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad)SAP_SE SAP BusinessObjects Platform
- CVE-2025-23193Information Disclosure vulnerability in SAP NetWeaver Application Server ABAPSAP_SE SAP NetWeaver Server ABAP
- CVE-2025-23191Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERPSAP_SE SAP Fiori for SAP ERP
- CVE-2025-23190Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)SAP_SE SAP NetWeaver and ABAP platform
- CVE-2025-23189Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)SAP_SE SAP NetWeaver and ABAP Platform
- CVE-2025-23187Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)SAP_SE SAP NetWeaver and ABAP Platform
- CVE-2025-0054Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaSAP_SE SAP NetWeaver Application Server Java
- CVE-2025-1165Lumsoft ERP FileUploadApi.ashx DoWebUpload unrestricted uploadLumsoft ERP
- CVE-2025-1164code-projects Police FIR Record Management System Add Record stack-based overflowcode-projects Police FIR Record Management System
- CVE-2022-35202A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the
- CVE-2022-37660In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association.
- CVE-2024-44336An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory
- CVE-2024-51324An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bri
- CVE-2024-54772An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.1
- CVE-2024-54916An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and esca
- CVE-2024-55212DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx
- CVE-2024-57241Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.
- CVE-2024-57777Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information
- CVE-2025-25523Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v1(1.00.023) due to the lack of length verification, which is related t
- CVE-2025-25524Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to
- CVE-2025-25525Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the s
- CVE-2025-25526Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration
- CVE-2025-25527Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the confi
- CVE-2025-25528Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on use
- CVE-2025-25529Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the config