# CVEs published 2025-02-11

283 CVEs were published on February 11, 2025: 15 critical, 115 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-3432](https://cve.now/CVE-2020-3432.md): Cisco AnyConnect Secure Mobility Client for Mac OS File Corruption Vulnerability (CVSS 5.6, Cisco Secure Client)
- [CVE-2023-31345](https://cve.now/CVE-2023-31345.md): Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu (CVSS 7.5, AMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +19)
- [CVE-2024-0112](https://cve.now/CVE-2024-0112.md): NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue (CVSS 7.5, NVIDIA Jetson AGX Orin series · NVIDIA IGX Orin)
- [CVE-2023-20508](https://cve.now/CVE-2023-20508.md): Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled b (CVSS 5.0, AMD Radeon™ RX 6000 Series Graphics Products · AMD Rade… +21)
- [CVE-2025-25203](https://cve.now/CVE-2025-25203.md): Ctrlpanel has stored XSS vulnerability in TicketsController priority field (CVSS 8.1, Ctrlpanel-gg panel)
- [CVE-2023-31352](https://cve.now/CVE-2023-31352.md): A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private d (CVSS 6.0, AMD EPYC™ 9004 Processors · AMD EPYC™ Embedded)
- [CVE-2023-31343](https://cve.now/CVE-2023-31343.md): Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu (CVSS 7.5, AMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +22)
- [CVE-2023-31342](https://cve.now/CVE-2023-31342.md): Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu (CVSS 7.5, AMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +22)
- [CVE-2025-1240](https://cve.now/CVE-2025-1240.md): WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, WinZip Computing WinZip)
- [CVE-2024-32037](https://cve.now/CVE-2024-32037.md): GeoNetwork vulnerable to search end-point information disclosure in response headers (CVSS 0.0, core-geonetwork · org.geonetwork-opensource:gn-services)
- [CVE-2023-31331](https://cve.now/CVE-2023-31331.md): Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stac (CVSS 3.0, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +10)
- [CVE-2022-3180](https://cve.now/CVE-2022-3180.md): WPGateway \<= 3.5 - Unauthenticated Privilege Escalation (CVSS 9.8, Jack Hopman WPGateway)
- [CVE-2023-20582](https://cve.now/CVE-2023-20582.md): Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults (CVSS 5.3, AMD EPYC™ 9004 Processors · AMD EPYC™ Embedded)
- [CVE-2023-20581](https://cve.now/CVE-2023-20581.md): Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory int (CVSS 2.5, AMD EPYC™ 9004 Processors · AMD EPYC™ Embedded)
- [CVE-2023-20515](https://cve.now/CVE-2023-20515.md): Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading (CVSS 5.7, AMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™… +20)
- [CVE-2023-20507](https://cve.now/CVE-2023-20507.md): An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data in (CVSS 2.3, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +10)
- [CVE-2024-0179](https://cve.now/CVE-2024-0179.md): SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentia (CVSS 8.2, AMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™… +20)
- [CVE-2024-21925](https://cve.now/CVE-2024-21925.md): Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code ex (CVSS 8.2, AMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +25)
- [CVE-2024-21924](https://cve.now/CVE-2024-21924.md): SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially (CVSS 8.2, AMD EPYC™ 7002 Processors · AMD Ryzen™ Threadripper™ PRO… +3)
- [CVE-2023-31361](https://cve.now/CVE-2023-31361.md): A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privi (CVSS 7.3, AIM-T (AMD Integrated Management Technology) software)
- [CVE-2023-31360](https://cve.now/CVE-2023-31360.md): Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow a (CVSS 7.3, AIM-T(AMD Integrated Management Technology) software)
- [CVE-2025-0911](https://cve.now/CVE-2025-0911.md): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0910](https://cve.now/CVE-2025-0910.md): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor)
- [CVE-2025-0909](https://cve.now/CVE-2025-0909.md): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0908](https://cve.now/CVE-2025-0908.md): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0907](https://cve.now/CVE-2025-0907.md): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0906](https://cve.now/CVE-2025-0906.md): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0905](https://cve.now/CVE-2025-0905.md): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0904](https://cve.now/CVE-2025-0904.md): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0903](https://cve.now/CVE-2025-0903.md): PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor)
- [CVE-2025-0902](https://cve.now/CVE-2025-0902.md): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-0901](https://cve.now/CVE-2025-0901.md): PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor)
- [CVE-2024-21966](https://cve.now/CVE-2024-21966.md): A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility could allow an attacker to achieve privilege escalation, potentially resulti (CVSS 7.3, AMD Ryzen™ Master Utility)
- [CVE-2025-1044](https://cve.now/CVE-2025-1044.md): Logsign Unified SecOps Platform Authentication Bypass Vulnerability (CVSS 9.8, Logsign Unified SecOps Platform)
- [CVE-2025-1052](https://cve.now/CVE-2025-1052.md): Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Mintty)
- [CVE-2024-12547](https://cve.now/CVE-2024-12547.md): Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Tungsten Automation Power PDF)
- [CVE-2024-12548](https://cve.now/CVE-2024-12548.md): Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Tungsten Automation Power PDF)
- [CVE-2024-12549](https://cve.now/CVE-2024-12549.md): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Tungsten Automation Power PDF)
- [CVE-2024-12550](https://cve.now/CVE-2024-12550.md): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Tungsten Automation Power PDF)
- [CVE-2024-12551](https://cve.now/CVE-2024-12551.md): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Tungsten Automation Power PDF)
- [CVE-2024-12833](https://cve.now/CVE-2024-12833.md): Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.0, Paessler PRTG Network Monitor)
- [CVE-2025-0899](https://cve.now/CVE-2025-0899.md): PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor)
- [CVE-2025-25202](https://cve.now/CVE-2025-25202.md): Ash Authentication has flawed token revocation checking logic in actions generated by \`mix ash\_authentication.install\` (CVSS 6.3, team-alembic ash\_authentication)
- [CVE-2025-24042](https://cve.now/CVE-2025-24042.md): Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code - JS Debug Extension)
- [CVE-2025-21373](https://cve.now/CVE-2025-21373.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21414](https://cve.now/CVE-2025-21414.md): Windows Core Messaging Elevation of Privileges Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-21322](https://cve.now/CVE-2025-21322.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PC Manager)
- [CVE-2025-21254](https://cve.now/CVE-2025-21254.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21216](https://cve.now/CVE-2025-21216.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21212](https://cve.now/CVE-2025-21212.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21184](https://cve.now/CVE-2025-21184.md): Windows Core Messaging Elevation of Privileges Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-21181](https://cve.now/CVE-2025-21181.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-21179](https://cve.now/CVE-2025-21179.md): DHCP Client Service Denial of Service Vulnerability (CVSS 4.8, Microsoft Windows)
- [CVE-2025-21400](https://cve.now/CVE-2025-21400.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-21397](https://cve.now/CVE-2025-21397.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-21394](https://cve.now/CVE-2025-21394.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21392](https://cve.now/CVE-2025-21392.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-21390](https://cve.now/CVE-2025-21390.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21387](https://cve.now/CVE-2025-21387.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21386](https://cve.now/CVE-2025-21386.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21381](https://cve.now/CVE-2025-21381.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21377](https://cve.now/CVE-2025-21377.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21371](https://cve.now/CVE-2025-21371.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21367](https://cve.now/CVE-2025-21367.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21359](https://cve.now/CVE-2025-21359.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21358](https://cve.now/CVE-2025-21358.md): Windows Core Messaging Elevation of Privileges Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21350](https://cve.now/CVE-2025-21350.md): Windows Kerberos Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2025-21349](https://cve.now/CVE-2025-21349.md): Windows Remote Desktop Configuration Service Tampering Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-21347](https://cve.now/CVE-2025-21347.md): Windows Deployment Services Denial of Service Vulnerability (CVSS 6.0, Microsoft Windows)
- [CVE-2025-21337](https://cve.now/CVE-2025-21337.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2025-21198](https://cve.now/CVE-2025-21198.md): Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability (CVSS 9.0, Microsoft HPC Pack)
- [CVE-2025-21201](https://cve.now/CVE-2025-21201.md): Windows Telephony Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21200](https://cve.now/CVE-2025-21200.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21190](https://cve.now/CVE-2025-21190.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21410](https://cve.now/CVE-2025-21410.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-21407](https://cve.now/CVE-2025-21407.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21406](https://cve.now/CVE-2025-21406.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21208](https://cve.now/CVE-2025-21208.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-21194](https://cve.now/CVE-2025-21194.md): Microsoft Surface Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Surface Go · Microsoft Surface Hub +6)
- [CVE-2025-21259](https://cve.now/CVE-2025-21259.md): Microsoft Outlook Spoofing Vulnerability (CVSS 5.3, Microsoft Outlook for Android)
- [CVE-2025-24039](https://cve.now/CVE-2025-24039.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code)
- [CVE-2025-24036](https://cve.now/CVE-2025-24036.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft AutoUpdate for Mac)
- [CVE-2025-21420](https://cve.now/CVE-2025-21420.md): Windows Disk Cleanup Tool Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21419](https://cve.now/CVE-2025-21419.md): Windows Setup Files Cleanup Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-21418](https://cve.now/CVE-2025-21418.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-21391](https://cve.now/CVE-2025-21391.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.1, KEV, Microsoft Windows)
- [CVE-2025-21183](https://cve.now/CVE-2025-21183.md): Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-21182](https://cve.now/CVE-2025-21182.md): Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-21383](https://cve.now/CVE-2025-21383.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-21379](https://cve.now/CVE-2025-21379.md): DHCP Client Service Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-21376](https://cve.now/CVE-2025-21376.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2025-21375](https://cve.now/CVE-2025-21375.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21369](https://cve.now/CVE-2025-21369.md): Microsoft Digest Authentication Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21368](https://cve.now/CVE-2025-21368.md): Microsoft Digest Authentication Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21352](https://cve.now/CVE-2025-21352.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21351](https://cve.now/CVE-2025-21351.md): Windows Active Directory Domain Services API Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-21206](https://cve.now/CVE-2025-21206.md): Visual Studio Installer Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-21188](https://cve.now/CVE-2025-21188.md): Azure Network Watcher VM Extension Elevation of Privilege Vulnerability (CVSS 6.0, Microsoft Azure Network Watcher VM Extension)
- [CVE-2025-26495](https://cve.now/CVE-2025-26495.md): Sensitive Data Exposure in Tableau Server (CVSS 7.5, Salesforce Tableau Server)
- [CVE-2025-24422](https://cve.now/CVE-2025-24422.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce)
- [CVE-2025-24414](https://cve.now/CVE-2025-24414.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24437](https://cve.now/CVE-2025-24437.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.4, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24434](https://cve.now/CVE-2025-24434.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 9.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24415](https://cve.now/CVE-2025-24415.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24411](https://cve.now/CVE-2025-24411.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 8.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24416](https://cve.now/CVE-2025-24416.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24420](https://cve.now/CVE-2025-24420.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce)
- [CVE-2025-24413](https://cve.now/CVE-2025-24413.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24419](https://cve.now/CVE-2025-24419.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce)
- [CVE-2025-24432](https://cve.now/CVE-2025-24432.md): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (CVSS 3.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24424](https://cve.now/CVE-2025-24424.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24430](https://cve.now/CVE-2025-24430.md): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (CVSS 3.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24429](https://cve.now/CVE-2025-24429.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 3.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24436](https://cve.now/CVE-2025-24436.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24407](https://cve.now/CVE-2025-24407.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.1, Adobe Commerce)
- [CVE-2025-24438](https://cve.now/CVE-2025-24438.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24423](https://cve.now/CVE-2025-24423.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce)
- [CVE-2025-24418](https://cve.now/CVE-2025-24418.md): Adobe Commerce | Improper Authorization (CWE-285) (CVSS 8.1, Adobe Commerce)
- [CVE-2025-24406](https://cve.now/CVE-2025-24406.md): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 7.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24417](https://cve.now/CVE-2025-24417.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24409](https://cve.now/CVE-2025-24409.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.2, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24425](https://cve.now/CVE-2025-24425.md): Adobe Commerce | Business Logic Errors (CWE-840) (CVSS 5.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24421](https://cve.now/CVE-2025-24421.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24412](https://cve.now/CVE-2025-24412.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24427](https://cve.now/CVE-2025-24427.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24426](https://cve.now/CVE-2025-24426.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce)
- [CVE-2025-24428](https://cve.now/CVE-2025-24428.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24410](https://cve.now/CVE-2025-24410.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24408](https://cve.now/CVE-2025-24408.md): Adobe Commerce | Information Exposure (CWE-200) (CVSS 6.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-24435](https://cve.now/CVE-2025-24435.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-21162](https://cve.now/CVE-2025-21162.md): Photoshop Elements | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379) (CVSS 5.5, Adobe Photoshop Elements)
- [CVE-2025-26494](https://cve.now/CVE-2025-26494.md): Server Side Request Forgery vulnerability in Tableau Server (CVSS 7.7, Salesforce Tableau Server)
- [CVE-2025-21161](https://cve.now/CVE-2025-21161.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-21160](https://cve.now/CVE-2025-21160.md): Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-21163](https://cve.now/CVE-2025-21163.md): Illustrator | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-21159](https://cve.now/CVE-2025-21159.md): Illustrator | Use After Free (CWE-416) (CVSS 7.8, Adobe Illustrator)
- [CVE-2019-15002](https://cve.now/CVE-2019-15002.md): An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. (CVSS 4.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2025-21156](https://cve.now/CVE-2025-21156.md): InCopy | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe InCopy)
- [CVE-2025-21155](https://cve.now/CVE-2025-21155.md): Substance3D - Stager | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2025-21126](https://cve.now/CVE-2025-21126.md): InDesign Desktop | Improper Input Validation (CWE-20) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-21158](https://cve.now/CVE-2025-21158.md): InDesign Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-21125](https://cve.now/CVE-2025-21125.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-21123](https://cve.now/CVE-2025-21123.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-21157](https://cve.now/CVE-2025-21157.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-21121](https://cve.now/CVE-2025-21121.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-21124](https://cve.now/CVE-2025-21124.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-12756](https://cve.now/CVE-2024-12756.md): Avaya Spaces HTML injection (HTMLi) Vulnerability (CVSS 7.3, Avaya Spaces)
- [CVE-2024-12755](https://cve.now/CVE-2024-12755.md): Avaya Spaces XSS Vulnerability (CVSS 7.9, Avaya Spaces)
- [CVE-2025-24472](https://cve.now/CVE-2025-24472.md): An Authentication Bypass Using an Alternate Path or Channel vulnerability \[CWE-288\] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7. (CVSS 8.1, KEV, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2025-1126](https://cve.now/CVE-2025-1126.md): Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC). (CVSS 9.3, Lexmark Print Management Client)
- [CVE-2025-22399](https://cve.now/CVE-2025-22399.md): Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. (CVSS 7.9, Dell UCC Edge)
- [CVE-2024-27780](https://cve.now/CVE-2024-27780.md): Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities \[CWE-79\] in FortiSIEM 7.1 all (CVSS 2.2, Fortinet FortiSIEM)
- [CVE-2024-27781](https://cve.now/CVE-2024-27781.md): An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 6.9, Fortinet FortiSandbox)
- [CVE-2024-40584](https://cve.now/CVE-2024-40584.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in Fortinet FortiAnalyz (CVSS 6.8, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-36508](https://cve.now/CVE-2024-36508.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability \[CWE-22\] in Fortinet FortiManager version 7. (CVSS 5.9, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-40586](https://cve.now/CVE-2024-40586.md): An Improper Access Control vulnerability \[CWE-284\] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below m (CVSS 6.3, Fortinet FortiClientWindows)
- [CVE-2023-40721](https://cve.now/CVE-2023-40721.md): A use of externally-controlled format string vulnerability \[CWE-134\] vulnerability in Fortinet allows a privileged attacker to execute arbi (CVSS 6.3, Fortinet FortiPAM · Fortinet FortiSwitchManager +2)
- [CVE-2024-50567](https://cve.now/CVE-2024-50567.md): An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allow (CVSS 6.8, Fortinet FortiWeb)
- [CVE-2024-33504](https://cve.now/CVE-2024-33504.md): A use of hard-coded cryptographic key to encrypt sensitive data vulnerability \[CWE-321\] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7 (CVSS 3.9, Fortinet FortiManager)
- [CVE-2024-35279](https://cve.now/CVE-2024-35279.md): A stack-based buffer overflow \[CWE-121\] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows (CVSS 7.7, Fortinet FortiOS)
- [CVE-2024-40591](https://cve.now/CVE-2024-40591.md): An incorrect privilege assignment vulnerability \[CWE-266\] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and be (CVSS 8.0, Fortinet FortiOS)
- [CVE-2024-52966](https://cve.now/CVE-2024-52966.md): An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause informa (CVSS 2.2, Fortinet FortiAnalyzer)
- [CVE-2024-52968](https://cve.now/CVE-2024-52968.md): An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty passwo (CVSS 5.8, Fortinet FortiClientMac)
- [CVE-2024-50569](https://cve.now/CVE-2024-50569.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows (CVSS 6.3, Fortinet FortiWeb)
- [CVE-2025-24470](https://cve.now/CVE-2025-24470.md): An Improper Resolution of Path Equivalence vulnerability \[CWE-41\] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0 (CVSS 8.1, Fortinet FortiPortal)
- [CVE-2024-12797](https://cve.now/CVE-2024-12797.md): RFC7250 handshakes with unauthenticated servers don't abort as expected (CVSS 6.3, OpenSSL · cryptography)
- [CVE-2025-24976](https://cve.now/CVE-2025-24976.md): Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT (CVSS 6.6, distribution · github.com/distribution/distribution)
- [CVE-2025-24973](https://cve.now/CVE-2025-24973.md): Concorde not removing authentication tokens after logging out (CVSS 9.4, nexryai concorde)
- [CVE-2025-24900](https://cve.now/CVE-2025-24900.md): Concorde CSRF vulnerability due to insecure configuration of authentication cookie attributes (CVSS 8.6, nexryai concorde)
- [CVE-2025-24807](https://cve.now/CVE-2025-24807.md): Fast DDS does not verify Permissions CA (CVSS 4.5, eProsima Fast-DDS)
- [CVE-2024-13813](https://cve.now/CVE-2024-13813.md): Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary file (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-13843](https://cve.now/CVE-2024-13843.md): Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a (CVSS 6.0, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-13842](https://cve.now/CVE-2024-13842.md): A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticat (CVSS 6.0, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-13830](https://cve.now/CVE-2024-13830.md): Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthentica (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-12058](https://cve.now/CVE-2024-12058.md): External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a r (CVSS 6.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-10644](https://cve.now/CVE-2024-10644.md): Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticat (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-24897](https://cve.now/CVE-2025-24897.md): Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes (CVSS 8.2, misskey-dev misskey)
- [CVE-2025-22467](https://cve.now/CVE-2025-22467.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code (CVSS 9.9, Ivanti Connect Secure)
- [CVE-2024-11771](https://cve.now/CVE-2024-11771.md): Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. (CVSS 5.3, Ivanti Cloud Services Application)
- [CVE-2024-47908](https://cve.now/CVE-2024-47908.md): OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilege (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2025-24896](https://cve.now/CVE-2025-24896.md): Misskey allows token to remain valid in cookie after signing out (CVSS 8.1, misskey-dev misskey)
- [CVE-2024-33659](https://cve.now/CVE-2024-33659.md): BiosGuard Buffer Overflow and TOCTOU Vulnerability (CVSS 5.7, AMI AptioV)
- [CVE-2025-1231](https://cve.now/CVE-2025-1231.md): Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user pa (CVSS 5.4, Devolutions Server)
- [CVE-2025-26492](https://cve.now/CVE-2025-26492.md): In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources (CVSS 7.7, JetBrains TeamCity)
- [CVE-2025-26493](https://cve.now/CVE-2025-26493.md): In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-12366](https://cve.now/CVE-2024-12366.md): CVE-2024-12366 (CVSS 9.8, Sinaptik AI PandasAI · pandasai)
- [CVE-2025-0588](https://cve.now/CVE-2025-0588.md): In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. (CVSS 5.9, Octopus Deploy Octopus Server)
- [CVE-2024-13506](https://cve.now/CVE-2024-13506.md): GeoDirectory – WP Business Directory Plugin and Classified Listings Directory \<= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display\_name Parameter (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2025-0862](https://cve.now/CVE-2025-0862.md): SuperSaaS – online appointment scheduling \<= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter (CVSS 4.9, SuperSaaS – online appointment scheduling)
- [CVE-2025-24956](https://cve.now/CVE-2025-24956.md): A vulnerability has been identified in OpenV2G (All versions \< V0.9.6). (CVSS 6.2, Siemens OpenV2G)
- [CVE-2025-24812](https://cve.now/CVE-2025-24812.md): A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions \< V4.7), SIMATIC S7-1200 CPU 1 (CVSS 6.5, Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens S… +31)
- [CVE-2025-24811](https://cve.now/CVE-2025-24811.md): A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211 (CVSS 7.5, Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens S… +31)
- [CVE-2025-24532](https://cve.now/CVE-2025-24532.md): A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions \< V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0 (CVSS 4.3, Siemens SCALANCE WAB762-1 · Siemens SCALANCE WAM763-1 +4)
- [CVE-2025-24499](https://cve.now/CVE-2025-24499.md): A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions \< V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0 (CVSS 7.2, Siemens SCALANCE WAB762-1 · Siemens SCALANCE WAM763-1 +4)
- [CVE-2025-23403](https://cve.now/CVE-2025-23403.md): A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). (CVSS 7.0, Siemens SIMATIC IPC DiagBase · Siemens SIMATIC IPC DiagMoni…)
- [CVE-2025-23363](https://cve.now/CVE-2025-23363.md): A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions \< V1 (CVSS 7.4, Siemens Teamcenter)
- [CVE-2024-54090](https://cve.now/CVE-2024-54090.md): A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC S (CVSS 5.9, Siemens APOGEE PXC Series · Siemens TALON TC Series)
- [CVE-2024-54089](https://cve.now/CVE-2024-54089.md): A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC S (CVSS 7.5, Siemens APOGEE PXC Series · Siemens TALON TC Series)
- [CVE-2024-54015](https://cve.now/CVE-2024-54015.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.90), SIPROTEC 5 6MD85 (CP300) (All versions \>= V8.80 \< V9 (CVSS 7.5, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +37)
- [CVE-2024-53977](https://cve.now/CVE-2024-53977.md): A vulnerability has been identified in ModelSim (All versions \< V2025.1), Questa (All versions \< V2025.1). (CVSS 6.7, Siemens ModelSim · Siemens Questa)
- [CVE-2024-53651](https://cve.now/CVE-2024-53651.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (C (CVSS 4.6, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34)
- [CVE-2024-53648](https://cve.now/CVE-2024-53648.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.90), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 (CVSS 6.8, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34)
- [CVE-2024-45386](https://cve.now/CVE-2024-45386.md): A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \< V4.1 Update 2), SIMATIC PCS (CVSS 8.8, Siemens SIMATIC PCS neo · Siemens SIMOCODE ES +3)
- [CVE-2024-23814](https://cve.now/CVE-2024-23814.md): The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving (CVSS 5.3, Siemens SIDOOR ATD430W · Siemens SIDOOR ATE530G COATED +126)
- [CVE-2025-0513](https://cve.now/CVE-2025-0513.md): In affected versions of Octopus Server error messages were handled unsafely on the error page. (CVSS 1.8, Octopus Deploy Octopus Server)
- [CVE-2023-37482](https://cve.now/CVE-2023-37482.md): The login functionality of the web server in affected devices does not normalize the response times of login attempts. (CVSS 5.3, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +86)
- [CVE-2025-0526](https://cve.now/CVE-2025-0526.md): In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. (CVSS 2.3, Octopus Deploy Octopus Server)
- [CVE-2025-0525](https://cve.now/CVE-2025-0525.md): In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. (CVSS 2.3, Octopus Deploy Octopus Server)
- [CVE-2025-26411](https://cve.now/CVE-2025-26411.md): Authenticated Arbitrary Python File Upload via Plugin Manager (CVSS 8.8, Wattsense Bridge)
- [CVE-2025-26410](https://cve.now/CVE-2025-26410.md): Weak Hard-coded Credentials (CVSS 9.8, Wattsense Bridge)
- [CVE-2025-26409](https://cve.now/CVE-2025-26409.md): Access to Bootloader and Shell Over Serial Interface (CVSS 6.8, Wattsense Bridge)
- [CVE-2025-26408](https://cve.now/CVE-2025-26408.md): Unprotected JTAG Interface (CVSS 6.1, Wattsense Bridge)
- [CVE-2025-0589](https://cve.now/CVE-2025-0589.md): In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated (CVSS 6.9, Octopus Deploy Octopus Server)
- [CVE-2025-1182](https://cve.now/CVE-2025-1182.md): GNU Binutils ld elflink.c bfd\_elf\_reloc\_symbol\_deleted\_p memory corruption (CVSS 2.3, GNU Binutils)
- [CVE-2025-1181](https://cve.now/CVE-2025-1181.md): GNU Binutils ld elflink.c \_bfd\_elf\_gc\_mark\_rsec memory corruption (CVSS 2.3, GNU Binutils)
- [CVE-2025-1180](https://cve.now/CVE-2025-1180.md): GNU Binutils ld elf-eh-frame.c \_bfd\_elf\_write\_section\_eh\_frame memory corruption (CVSS 2.3, GNU Binutils)
- [CVE-2024-13643](https://cve.now/CVE-2024-13643.md): Zox News \<= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification (CVSS 8.8, MVPThemes Zox News - Professional WordPress News & Magazine…)
- [CVE-2024-52611](https://cve.now/CVE-2024-52611.md): SolarWinds Platform Information Disclosure Vulnerability (CVSS 3.5, SolarWinds Platform)
- [CVE-2024-52612](https://cve.now/CVE-2024-52612.md): SolarWinds Platform Reflected Cross-Site Scripting Vulnerability (CVSS 6.8, SolarWinds Platform)
- [CVE-2024-45718](https://cve.now/CVE-2024-45718.md): Sensitive data disclosure vulnerability (CVSS 4.6, SolarWinds Kiwi Syslog NG)
- [CVE-2024-52606](https://cve.now/CVE-2024-52606.md): SolarWinds Platform Server-Side Request Forgery Vulnerability (CVSS 3.5, SolarWinds)
- [CVE-2024-28989](https://cve.now/CVE-2024-28989.md): SolarWinds Web Help Desk Cryptographic Key Management Vulnerability (CVSS 5.5, SolarWinds Web Help Desk)
- [CVE-2025-1179](https://cve.now/CVE-2025-1179.md): GNU Binutils ld libbfd.c bfd\_putl64 memory corruption (CVSS 2.3, GNU Binutils)
- [CVE-2025-0181](https://cve.now/CVE-2025-0181.md): WP Foodbakery \<= 4.8 - Authentication Bypass in foodbakery\_parse\_request (CVSS 9.8, Chimpstudio WP Foodbakery)
- [CVE-2025-0180](https://cve.now/CVE-2025-0180.md): WP Foodbakery \<= 4.7 - Unauthenticated Privilege Escalation in foodbakery\_registration\_validation (CVSS 9.8, Chimpstudio WP Foodbakery)
- [CVE-2025-1178](https://cve.now/CVE-2025-1178.md): GNU Binutils ld libbfd.c bfd\_putl64 memory corruption (CVSS 6.3, GNU Binutils)
- [CVE-2025-1177](https://cve.now/CVE-2025-1177.md): dayrui XunRuiCMS Linkage.php import\_add deserialization (CVSS 5.3, dayrui XunRuiCMS)
- [CVE-2024-13570](https://cve.now/CVE-2024-13570.md): Stray Random Quotes \<= 1.9.9 - Reflected XSS (CVSS 6.1, Stray Random Quotes)
- [CVE-2024-13544](https://cve.now/CVE-2024-13544.md): Zarinpal Paid Downloads \<= 2.3 - Admin+ Arbitrary File Upload (CVSS 4.8, Zarinpal Paid Download)
- [CVE-2024-13543](https://cve.now/CVE-2024-13543.md): Zarinpal Paid Downloads \<= 2.3 - Reflected XSS (CVSS 6.1, Zarinpal Paid Download)
- [CVE-2025-1176](https://cve.now/CVE-2025-1176.md): GNU Binutils ld elflink.c \_bfd\_elf\_gc\_mark\_rsec heap-based overflow (CVSS 2.3, GNU Binutils)
- [CVE-2025-1174](https://cve.now/CVE-2025-1174.md): 1000 Projects Bookstore Management System Add Book Page process\_book\_add.php cross site scripting (CVSS 4.8, 1000 Projects Bookstore Management System)
- [CVE-2025-1211](https://cve.now/CVE-2025-1211.md): Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI bu (CVSS 6.3, hackney)
- [CVE-2025-1173](https://cve.now/CVE-2025-1173.md): 1000 Projects Bookstore Management System process\_users\_del.php sql injection (CVSS 5.1, 1000 Projects Bookstore Management System)
- [CVE-2024-12599](https://cve.now/CVE-2024-12599.md): HT Mega – Absolute Addons For Elementor \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-1172](https://cve.now/CVE-2025-1172.md): 1000 Projects Bookstore Management System addtocart.php sql injection (CVSS 5.3, 1000 Projects Bookstore Management System)
- [CVE-2025-1171](https://cve.now/CVE-2025-1171.md): code-projects Real Estate Property Management System CustomerReport.php cross site scripting (CVSS 5.1, code-projects Real Estate Property Management System)
- [CVE-2025-1145](https://cve.now/CVE-2025-1145.md): NetVision Information ISOinsight - Reflected Cross-site Scripting (CVSS 6.1, NetVision Information ISOinsight)
- [CVE-2025-1144](https://cve.now/CVE-2025-1144.md): Quanxun School Affairs System - Exposure of Sensitive Information (CVSS 9.8, Quanxun School Affairs System)
- [CVE-2025-1143](https://cve.now/CVE-2025-1143.md): Billion Electric M120N - Use of Hard-coded Credentials (CVSS 8.4, Billion Electric M100 · Billion Electric M150 +2)
- [CVE-2025-1170](https://cve.now/CVE-2025-1170.md): code-projects Real Estate Property Management System Category.php cross site scripting (CVSS 5.1, code-projects Real Estate Property Management System)
- [CVE-2025-1169](https://cve.now/CVE-2025-1169.md): SourceCodester Image Compressor Tool compressor.php cross site scripting (CVSS 5.1, SourceCodester Image Compressor Tool)
- [CVE-2025-1168](https://cve.now/CVE-2025-1168.md): SourceCodester Contact Manager with Export to VCF delete-contact.php sql injection (CVSS 5.3, SourceCodester Contact Manager with Export to VCF)
- [CVE-2025-1167](https://cve.now/CVE-2025-1167.md): Mayuri K Employee Management System Update\_User.php sql injection (CVSS 5.3, Mayuri K Employee Management System)
- [CVE-2025-1166](https://cve.now/CVE-2025-1166.md): SourceCodester Food Menu Manager update.php unrestricted upload (CVSS 5.3, SourceCodester Food Menu Manager)
- [CVE-2025-25243](https://cve.now/CVE-2025-25243.md): Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) (CVSS 8.6, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-25241](https://cve.now/CVE-2025-25241.md): Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) (CVSS 5.4, SAP\_SE SAP Fiori Apps Reference Library)
- [CVE-2025-24876](https://cve.now/CVE-2025-24876.md): Authentication bypass via authorization code injection in SAP Approuter (CVSS 8.1, SAP\_SE SAP Approuter Node.js package · @sap/approuter)
- [CVE-2025-24875](https://cve.now/CVE-2025-24875.md): SameSite Defense in Depth not applied for some cookies in SAP Commerce (CVSS 6.8, SAP\_SE SAP Commerce)
- [CVE-2025-24874](https://cve.now/CVE-2025-24874.md): Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice (CVSS 6.8, SAP\_SE SAP Commerce)
- [CVE-2025-24872](https://cve.now/CVE-2025-24872.md): Missing Authorization check in SAP ABAP Platform (ABAP Build Framework) (CVSS 4.3, SAP\_SE SAP ABAP Platform)
- [CVE-2025-24870](https://cve.now/CVE-2025-24870.md): Insecure Key & Secret Management vulnerability in SAP GUI for Windows (CVSS 6.0, SAP\_SE SAP GUI for Windows)
- [CVE-2025-24869](https://cve.now/CVE-2025-24869.md): Information Disclosure vulnerability in SAP NetWeaver Application Server Java (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2025-24868](https://cve.now/CVE-2025-24868.md): Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services) (CVSS 7.1, SAP\_SE SAP HANA extended application services, advanced mod…)
- [CVE-2025-24867](https://cve.now/CVE-2025-24867.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad) (CVSS 6.1, SAP\_SE SAP BusinessObjects Platform)
- [CVE-2025-23193](https://cve.now/CVE-2025-23193.md): Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (CVSS 5.3, SAP\_SE SAP NetWeaver Server ABAP)
- [CVE-2025-23191](https://cve.now/CVE-2025-23191.md): Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP (CVSS 3.1, SAP\_SE SAP Fiori for SAP ERP)
- [CVE-2025-23190](https://cve.now/CVE-2025-23190.md): Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) (CVSS 4.3, SAP\_SE SAP NetWeaver and ABAP platform)
- [CVE-2025-23189](https://cve.now/CVE-2025-23189.md): Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) (CVSS 4.3, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-23187](https://cve.now/CVE-2025-23187.md): Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) (CVSS 5.3, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-0064](https://cve.now/CVE-2025-0064.md): Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console) (CVSS 8.7, SAP\_SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2025-0054](https://cve.now/CVE-2025-0054.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2025-1165](https://cve.now/CVE-2025-1165.md): Lumsoft ERP FileUploadApi.ashx DoWebUpload unrestricted upload (CVSS 6.9, Lumsoft ERP)
- [CVE-2025-1164](https://cve.now/CVE-2025-1164.md): code-projects Police FIR Record Management System Add Record stack-based overflow (CVSS 4.8, code-projects Police FIR Record Management System)
- [CVE-2022-35202](https://cve.now/CVE-2022-35202.md): A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the (CVSS 5.1)
- [CVE-2022-37660](https://cve.now/CVE-2022-37660.md): In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. (CVSS 6.5)
- [CVE-2024-33469](https://cve.now/CVE-2024-33469.md): An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate met (CVSS 7.9)
- [CVE-2024-44336](https://cve.now/CVE-2024-44336.md): An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory (CVSS 5.3)
- [CVE-2024-51324](https://cve.now/CVE-2024-51324.md): An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bri (CVSS 3.8)
- [CVE-2024-54772](https://cve.now/CVE-2024-54772.md): An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.1 (CVSS 5.4)
- [CVE-2024-54916](https://cve.now/CVE-2024-54916.md): An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and esca (CVSS 6.8)
- [CVE-2024-55212](https://cve.now/CVE-2024-55212.md): DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo\_xBlog/Resource\_Service.aspx (CVSS 6.5)
- [CVE-2024-57241](https://cve.now/CVE-2024-57241.md): Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. (CVSS 6.5)
- [CVE-2024-57777](https://cve.now/CVE-2024-57777.md): Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information (CVSS 5.1)
- [CVE-2025-25522](https://cve.now/CVE-2025-25522.md): Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting op (CVSS 7.3)
- [CVE-2025-25523](https://cve.now/CVE-2025-25523.md): Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v1(1.00.023) due to the lack of length verification, which is related t (CVSS 5.9)
- [CVE-2025-25524](https://cve.now/CVE-2025-25524.md): Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652\_B20230116 due to the lack of length verification, which is related to (CVSS 5.1)
- [CVE-2025-25525](https://cve.now/CVE-2025-25525.md): Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the s (CVSS 5.1)
- [CVE-2025-25526](https://cve.now/CVE-2025-25526.md): Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration (CVSS 5.1)
- [CVE-2025-25527](https://cve.now/CVE-2025-25527.md): Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the confi (CVSS 5.1)
- [CVE-2025-25528](https://cve.now/CVE-2025-25528.md): Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on use (CVSS 5.1)
- [CVE-2025-25529](https://cve.now/CVE-2025-25529.md): Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the config (CVSS 5.1)
- [CVE-2025-25530](https://cve.now/CVE-2025-25530.md): Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to savin (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.