# CVEs published 2025-09-09

346 CVEs were published on September 9, 2025: 34 critical, 154 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-10172](https://cve.now/CVE-2025-10172.md): UTT 750W formPictureUrl buffer overflow (CVSS 8.7, UTT)
- [CVE-2025-59046](https://cve.now/CVE-2025-59046.md): interactive-git-checkout has Command Injection vulnerability (CVSS 9.8, ninofiliu interactive-git-checkout · interactive-git-checko…)
- [CVE-2025-59044](https://cve.now/CVE-2025-59044.md): Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation) (CVSS 4.4, himmelblau-idm himmelblau)
- [CVE-2025-59042](https://cve.now/CVE-2025-59042.md): PyInstaller has local privilege escalation vulnerability (CVSS 7.0, pyinstaller)
- [CVE-2025-59039](https://cve.now/CVE-2025-59039.md): Prebid Universal Creative on npm briefly compromised (CVSS 9.3, prebid-universal-creative)
- [CVE-2025-59038](https://cve.now/CVE-2025-59038.md): Prebid.js NPM package briefly compromised (CVSS 8.6, Prebid.js)
- [CVE-2025-58750](https://cve.now/CVE-2025-58750.md): rAthena missing bound check in chclif\_parse\_moveCharSlot (CVSS 8.2, rathena)
- [CVE-2025-58448](https://cve.now/CVE-2025-58448.md): rAthena has SQL Injection in PartyBooking component via \`WorldName\` parameter. (CVSS 9.1, rathena)
- [CVE-2025-58447](https://cve.now/CVE-2025-58447.md): rAthena has heap-based buffer overflow in login server (CVSS 9.8, rathena)
- [CVE-2025-59036](https://cve.now/CVE-2025-59036.md): Infrahub allows authentication with deleted and expired API tokens (CVSS 5.5, opsmill infrahub · infrahub-server)
- [CVE-2025-58131](https://cve.now/CVE-2025-58131.md): Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon - Race Condition (CVSS 6.6, Zoom Communications Zoom Workplace VDI Plugin macOS Univers…)
- [CVE-2025-58135](https://cve.now/CVE-2025-58135.md): Zoom Workplace Clients for Windows - Improper Action Enforcement (CVSS 5.3, Zoom Communications Zoom Workplace Clients for Windows)
- [CVE-2025-58134](https://cve.now/CVE-2025-58134.md): Zoom Workplace Clients for Windows - Incorrect Authorization (CVSS 4.3, Zoom Communications Zoom Workplace Clients for Windows)
- [CVE-2025-49461](https://cve.now/CVE-2025-49461.md): Zoom Workplace Clients - Cross-site Scripting (CVSS 4.3, Zoom Communications Zoom Workplace Clients)
- [CVE-2025-54258](https://cve.now/CVE-2025-54258.md): Substance3D - Modeler | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-54259](https://cve.now/CVE-2025-54259.md): Substance3D - Modeler | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-54260](https://cve.now/CVE-2025-54260.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-49460](https://cve.now/CVE-2025-49460.md): Zoom Workplace Clients - Argument Injection (CVSS 4.3, Zoom Communications Zoom Workplace Clients)
- [CVE-2025-10171](https://cve.now/CVE-2025-10171.md): UTT 1250GW formConfigApConfTemp sub\_453DC buffer overflow (CVSS 8.7, UTT 1250GW)
- [CVE-2025-49459](https://cve.now/CVE-2025-49459.md): Zoom Workplace for Windows on ARM - Missing Authorization (CVSS 7.8, Zoom Communications Zoom Workplace for Windows on ARM)
- [CVE-2025-49458](https://cve.now/CVE-2025-49458.md): Zoom Workplace Clients - Buffer Overflow (CVSS 6.5, Zoom Communications Zoom Workplace Clients)
- [CVE-2025-9997](https://cve.now/CVE-2025-9997.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause com (CVSS 5.8, Schneider Electric Saitel DR RTU · Schneider Electric Saite…)
- [CVE-2025-9996](https://cve.now/CVE-2025-9996.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the (CVSS 5.8, Schneider Electric Saitel DR RTU · Schneider Electric Saite…)
- [CVE-2025-54244](https://cve.now/CVE-2025-54244.md): Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-54243](https://cve.now/CVE-2025-54243.md): Substance3D - Viewer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-54245](https://cve.now/CVE-2025-54245.md): Substance3D - Viewer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-58462](https://cve.now/CVE-2025-58462.md): OPEXUS FOIAXpress PAL SQL injection (CVSS 9.3, OPEXUS FOIAXpress Public Access Link)
- [CVE-2025-23344](https://cve.now/CVE-2025-23344.md): The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to run code on the platform host as a non-privileged user. (CVSS 7.3, NVIDIA NVDebug tool)
- [CVE-2025-23343](https://cve.now/CVE-2025-23343.md): The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components. (CVSS 7.6, NVIDIA NVDebug tool)
- [CVE-2025-23342](https://cve.now/CVE-2025-23342.md): The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account . (CVSS 8.2, NVIDIA NVDebug tool)
- [CVE-2025-10170](https://cve.now/CVE-2025-10170.md): UTT 1200GW formApLbConfig sub\_4B48F8 buffer overflow (CVSS 8.7, UTT 1200GW)
- [CVE-2025-7746](https://cve.now/CVE-2025-7746.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvali (CVSS 5.3, Schneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altiva… +6)
- [CVE-2025-10169](https://cve.now/CVE-2025-10169.md): UTT 1200GW ConfigWirelessBase buffer overflow (CVSS 8.7, UTT 1200GW)
- [CVE-2025-10159](https://cve.now/CVE-2025-10159.md): An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points (CVSS 9.8, Sophos AP6 Series Wireless Access Points)
- [CVE-2025-54241](https://cve.now/CVE-2025-54241.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-54239](https://cve.now/CVE-2025-54239.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-54240](https://cve.now/CVE-2025-54240.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-54084](https://cve.now/CVE-2025-54084.md): Calix Gigacenter ONT - Command Injection (CVSS 8.5, Calix GigaCenter ONT)
- [CVE-2025-43491](https://cve.now/CVE-2025-43491.md): Poly Lens Desktop Application – Privilege Escalation (CVSS 7.3, HP Poly Lens)
- [CVE-2025-54083](https://cve.now/CVE-2025-54083.md): Calix GigaCenter ONT firmware - Sensitive Information Disclosure (CVSS 5.1, Calix GigaCenter ONT)
- [CVE-2025-59037](https://cve.now/CVE-2025-59037.md): DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware (CVSS 8.6, duckdb-node · duckdb +3)
- [CVE-2025-34178](https://cve.now/CVE-2025-34178.md): Netgate pfSense CE Suricata package v7.0.8\_2 Stored Cross-Site Scripting (CVSS 5.1, Netgate pfSense CE)
- [CVE-2025-58768](https://cve.now/CVE-2025-58768.md): DeepChat's Mermaid rendering has XSS leading to RCE (CVSS 9.7, ThinkInAIXYZ deepchat)
- [CVE-2025-34177](https://cve.now/CVE-2025-34177.md): Netgate pfSense CE Suricata package v7.0.8\_2 Stored Cross-Site Scripting (CVSS 5.1, Netgate pfSense CE)
- [CVE-2025-58765](https://cve.now/CVE-2025-58765.md): wabac.js has XSS vulnerability in 404 error handling logic (CVSS 7.1, webrecorder wabac.js · @webrecorder/wabac +2)
- [CVE-2025-34176](https://cve.now/CVE-2025-34176.md): Netgate pfSense CE Suricata Package v7.0.8\_2 Directory Traversal Information Disclosure (CVSS 5.3, Netgate pfSense CE)
- [CVE-2025-58763](https://cve.now/CVE-2025-58763.md): Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection (CVSS 8.1, Tautulli)
- [CVE-2025-54255](https://cve.now/CVE-2025-54255.md): Acrobat Reader | Violation of Secure Design Principles (CWE-657) (CVSS 4.0, Adobe Acrobat Reader)
- [CVE-2025-34175](https://cve.now/CVE-2025-34175.md): Netgate pfSense CE Suricata package v7.0.8\_2 Reflected Cross-Site Scripting (CVSS 5.1, Netgate pfSense CE)
- [CVE-2025-54257](https://cve.now/CVE-2025-54257.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-7635](https://cve.now/CVE-2025-7635.md): Calix GigaCenter ONT - Unauthenticated Telnet (CVSS 8.7, Calix GigaCenter ONT)
- [CVE-2025-58762](https://cve.now/CVE-2025-58762.md): Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and \`Script\` notification agent (CVSS 9.1, Tautulli)
- [CVE-2025-34174](https://cve.now/CVE-2025-34174.md): Netgate pfSense CE Status\_Traffic\_Totals Package v2.3.2\_7 Stored Cross-Site Scripting (CVSS 5.1, Netgate pfSense CE)
- [CVE-2025-53914](https://cve.now/CVE-2025-53914.md): Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges (CVSS 7.0, Calix GigaCenter ONT)
- [CVE-2025-58761](https://cve.now/CVE-2025-58761.md): Tautulli vulnerable to Unauthenticated Path Traversal in \`real\_pms\_image\_proxy\` (CVSS 8.6, Tautulli)
- [CVE-2025-34173](https://cve.now/CVE-2025-34173.md): Netgate pfSense CE Snort package v4.1.6\_25 Directory Traversal Information Disclosure (CVSS 5.3, Netgate pfSense CE)
- [CVE-2025-58760](https://cve.now/CVE-2025-58760.md): Tautulli vulnerable to Unauthenticated Path Traversal in \`/image\` endpoint (CVSS 8.6, Tautulli)
- [CVE-2025-58753](https://cve.now/CVE-2025-58753.md): copyparty: Sharing a single file does not fully restrict access to other files in source folder (CVSS 5.3, 9001 copyparty · copyparty)
- [CVE-2025-53913](https://cve.now/CVE-2025-53913.md): Calix GigaCenter ONT (Quantenna SoC) - Excessive Privileges (CVSS 7.0, Calix GigaCenter ONT)
- [CVE-2025-58759](https://cve.now/CVE-2025-58759.md): TinyEnv: Inline comments not stripped properly in .env values (CVSS 5.1, datahihi1 tiny-env · datahihi1/tiny-env)
- [CVE-2025-58758](https://cve.now/CVE-2025-58758.md): TinyEnv: Missing .env file not required — may cause unexpected behavior (CVSS 5.1, datahihi1 tiny-env · datahihi1/tiny-env)
- [CVE-2025-58442](https://cve.now/CVE-2025-58442.md): Saleor has user enumeration vulnerability due to different error messages (CVSS 5.3, saleor)
- [CVE-2025-58435](https://cve.now/CVE-2025-58435.md): Open OnDemand didn't rotate password for VNC batch\_connect (CVSS 4.1, OSC ondemand)
- [CVE-2025-34172](https://cve.now/CVE-2025-34172.md): Netgate pfSense CE HAProxy Package 0.63\_10 Reflected Cross-Site Scripting (CVSS 4.8, Netgate pfSense CE)
- [CVE-2025-58430](https://cve.now/CVE-2025-58430.md): listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover (CVSS 8.6, knadh listmonk · github.com/knadh/listmonk)
- [CVE-2025-58180](https://cve.now/CVE-2025-58180.md): OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload (CVSS 7.5, OctoPrint)
- [CVE-2025-36011](https://cve.now/CVE-2025-36011.md): IBM Jazz for Service Management information disclosure (CVSS 4.3, IBM Jazz for Service Management)
- [CVE-2025-36125](https://cve.now/CVE-2025-36125.md): IBM Hardware Management Console - Power Systems cross-site scripting (CVSS 6.4, IBM Hardware Management Console)
- [CVE-2025-58063](https://cve.now/CVE-2025-58063.md): CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion (CVSS 7.1, coredns · github.com/coredns/coredns)
- [CVE-2025-47415](https://cve.now/CVE-2025-47415.md): RECWAVE Filepath Traversal (CVSS 6.8, CRESTRON TOUCHSCREENS x60, x70 series)
- [CVE-2025-55054](https://cve.now/CVE-2025-55054.md): CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 6.1, Baicells EG7035E-M11)
- [CVE-2025-55053](https://cve.now/CVE-2025-55053.md): CWE-328: Use of Weak Hash (CVSS 6.5, Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846)
- [CVE-2025-43786](https://cve.now/CVE-2025-43786.md): Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 throu (CVSS 6.9, Liferay Portal · Liferay DXP +3)
- [CVE-2025-55052](https://cve.now/CVE-2025-55052.md): CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, Baicells NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOV…)
- [CVE-2025-55051](https://cve.now/CVE-2025-55051.md): CWE-1392: Use of Default Credentials (CVSS 10.0, Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846)
- [CVE-2025-55050](https://cve.now/CVE-2025-55050.md): CWE-1242: Inclusion of Undocumented Features (CVSS 9.8, Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846)
- [CVE-2025-55730](https://cve.now/CVE-2025-55730.md): XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro (CVSS 10.0, xwikisas xwiki-pro-macros)
- [CVE-2025-55049](https://cve.now/CVE-2025-55049.md): Use of Default Cryptographic Key (CWE-1394) (CVSS 9.1, Baicells NEUTRINO430)
- [CVE-2025-55729](https://cve.now/CVE-2025-55729.md): XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro (CVSS 10.0, xwikisas xwiki-pro-macros)
- [CVE-2025-43781](https://cve.now/CVE-2025-43781.md): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-55048](https://cve.now/CVE-2025-55048.md): Multiple CWE-78 (CVSS 9.8, Baicells NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOV…)
- [CVE-2025-55047](https://cve.now/CVE-2025-55047.md): CWE-798 Use of Hard-coded Credentials (CVSS 8.4, Baicells SPECTRA LTE-U eNB)
- [CVE-2025-55728](https://cve.now/CVE-2025-55728.md): XWiki Remote Macros vulnerable to remote code execution using the panel macro (CVSS 10.0, xwikisas xwiki-pro-macros)
- [CVE-2025-10164](https://cve.now/CVE-2025-10164.md): lmsys sglang update\_weights\_from\_tensor main deserialization (CVSS 6.9, lmsys sglang · sglang)
- [CVE-2025-55727](https://cve.now/CVE-2025-55727.md): XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro (CVSS 10.0, xwikisas xwiki-pro-macros)
- [CVE-2025-54242](https://cve.now/CVE-2025-54242.md): Premiere Pro | Use After Free (CWE-416) (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2025-54256](https://cve.now/CVE-2025-54256.md): Dreamweaver Desktop | Cross-Site Request Forgery (CSRF) (CWE-352) (CVSS 8.6, Adobe Dreamweaver Desktop)
- [CVE-2025-43775](https://cve.now/CVE-2025-43775.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10199](https://cve.now/CVE-2025-10199.md): A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows (CVSS 7.8, LizardByte Sunshine for Windows)
- [CVE-2025-10198](https://cve.now/CVE-2025-10198.md): LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability (CVSS 7.8, LizardByte Sunshine for Windows)
- [CVE-2025-9269](https://cve.now/CVE-2025-9269.md): Server-Side Request Forgery (SSRF) vulnerability found in embedded web server (CVSS 6.9, Lexmark CX, XC, CS, MS, MX, XM, et. al.)
- [CVE-2025-55234](https://cve.now/CVE-2025-55234.md): Windows SMB Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-55227](https://cve.now/CVE-2025-55227.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…)
- [CVE-2025-55224](https://cve.now/CVE-2025-55224.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54917](https://cve.now/CVE-2025-54917.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2025-54915](https://cve.now/CVE-2025-54915.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-54912](https://cve.now/CVE-2025-54912.md): Windows BitLocker Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54911](https://cve.now/CVE-2025-54911.md): Windows BitLocker Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-54910](https://cve.now/CVE-2025-54910.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-54901](https://cve.now/CVE-2025-54901.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54900](https://cve.now/CVE-2025-54900.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54116](https://cve.now/CVE-2025-54116.md): Windows MultiPoint Services Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-54115](https://cve.now/CVE-2025-54115.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54114](https://cve.now/CVE-2025-54114.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54113](https://cve.now/CVE-2025-54113.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-54112](https://cve.now/CVE-2025-54112.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54109](https://cve.now/CVE-2025-54109.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-54108](https://cve.now/CVE-2025-54108.md): Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54107](https://cve.now/CVE-2025-54107.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2025-54105](https://cve.now/CVE-2025-54105.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54104](https://cve.now/CVE-2025-54104.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-54103](https://cve.now/CVE-2025-54103.md): Windows Management Service Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-54098](https://cve.now/CVE-2025-54098.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54094](https://cve.now/CVE-2025-54094.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-54093](https://cve.now/CVE-2025-54093.md): Windows TCP/IP Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54092](https://cve.now/CVE-2025-54092.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54091](https://cve.now/CVE-2025-54091.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53810](https://cve.now/CVE-2025-53810.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-53809](https://cve.now/CVE-2025-53809.md): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-53808](https://cve.now/CVE-2025-53808.md): Windows Defender Firewall Service Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-53807](https://cve.now/CVE-2025-53807.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-53806](https://cve.now/CVE-2025-53806.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-53805](https://cve.now/CVE-2025-53805.md): HTTP.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-53804](https://cve.now/CVE-2025-53804.md): Windows Kernel-Mode Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-53803](https://cve.now/CVE-2025-53803.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-53802](https://cve.now/CVE-2025-53802.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-53801](https://cve.now/CVE-2025-53801.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53800](https://cve.now/CVE-2025-53800.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53799](https://cve.now/CVE-2025-53799.md): Windows Imaging Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office for Android · Microsoft Windows)
- [CVE-2025-53796](https://cve.now/CVE-2025-53796.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-47997](https://cve.now/CVE-2025-47997.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…)
- [CVE-2025-49692](https://cve.now/CVE-2025-49692.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Connected Machine Agent)
- [CVE-2025-55317](https://cve.now/CVE-2025-55317.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft AutoUpdate for Mac)
- [CVE-2025-55316](https://cve.now/CVE-2025-55316.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Connected Machine Agent)
- [CVE-2025-55243](https://cve.now/CVE-2025-55243.md): Microsoft OfficePlus Spoofing Vulnerability (CVSS 7.5, Microsoft OfficePLUS)
- [CVE-2025-55245](https://cve.now/CVE-2025-55245.md): Xbox Gaming Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Xbox Gaming Services)
- [CVE-2025-55236](https://cve.now/CVE-2025-55236.md): Graphics Kernel Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-55232](https://cve.now/CVE-2025-55232.md): Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability (CVSS 9.8, Microsoft HPC Pack)
- [CVE-2025-55228](https://cve.now/CVE-2025-55228.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55226](https://cve.now/CVE-2025-55226.md): Graphics Kernel Remote Code Execution Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-55225](https://cve.now/CVE-2025-55225.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-55223](https://cve.now/CVE-2025-55223.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54919](https://cve.now/CVE-2025-54919.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-54918](https://cve.now/CVE-2025-54918.md): Windows NTLM Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-54916](https://cve.now/CVE-2025-54916.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54913](https://cve.now/CVE-2025-54913.md): Windows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54908](https://cve.now/CVE-2025-54908.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-54907](https://cve.now/CVE-2025-54907.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-54906](https://cve.now/CVE-2025-54906.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +2)
- [CVE-2025-54905](https://cve.now/CVE-2025-54905.md): Microsoft Word Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-54904](https://cve.now/CVE-2025-54904.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54903](https://cve.now/CVE-2025-54903.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54902](https://cve.now/CVE-2025-54902.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54899](https://cve.now/CVE-2025-54899.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54898](https://cve.now/CVE-2025-54898.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54897](https://cve.now/CVE-2025-54897.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-54896](https://cve.now/CVE-2025-54896.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-54895](https://cve.now/CVE-2025-54895.md): SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54894](https://cve.now/CVE-2025-54894.md): Local Security Authority Subsystem Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54111](https://cve.now/CVE-2025-54111.md): Windows UI XAML Phone DatePickerFlyout Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54110](https://cve.now/CVE-2025-54110.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-54106](https://cve.now/CVE-2025-54106.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-54102](https://cve.now/CVE-2025-54102.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-54101](https://cve.now/CVE-2025-54101.md): Windows SMB Client Remote Code Execution Vulnerability (CVSS 4.8, Microsoft Windows)
- [CVE-2025-54099](https://cve.now/CVE-2025-54099.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-54097](https://cve.now/CVE-2025-54097.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-54096](https://cve.now/CVE-2025-54096.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-54095](https://cve.now/CVE-2025-54095.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-53798](https://cve.now/CVE-2025-53798.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-53797](https://cve.now/CVE-2025-53797.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49734](https://cve.now/CVE-2025-49734.md): PowerShell Direct Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft PowerShell · Microsoft Windows)
- [CVE-2025-54261](https://cve.now/CVE-2025-54261.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2025-54250](https://cve.now/CVE-2025-54250.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 4.9, Adobe Experience Manager)
- [CVE-2025-54247](https://cve.now/CVE-2025-54247.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 6.5, Adobe Experience Manager)
- [CVE-2025-54246](https://cve.now/CVE-2025-54246.md): Adobe Experience Manager | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe Experience Manager)
- [CVE-2025-54248](https://cve.now/CVE-2025-54248.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 7.7, Adobe Experience Manager)
- [CVE-2025-54251](https://cve.now/CVE-2025-54251.md): Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91) (CVSS 4.3, Adobe Experience Manager)
- [CVE-2025-54252](https://cve.now/CVE-2025-54252.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-54249](https://cve.now/CVE-2025-54249.md): Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 6.5, Adobe Experience Manager)
- [CVE-2025-58975](https://cve.now/CVE-2025-58975.md): WordPress Advanced Settings Plugin \<= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Helmut Wandl Advanced Settings)
- [CVE-2025-58976](https://cve.now/CVE-2025-58976.md): WordPress Accessibility Checker by Equalize Digital Plugin \<= 1.31.0 - Broken Access Control Vulnerability (CVSS 4.3, Accessibility Checker by Equalize Digital)
- [CVE-2025-58977](https://cve.now/CVE-2025-58977.md): WordPress WP eBay Product Feeds Plugin \<= 3.4.8 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Rhys Wynne WP eBay Product Feeds)
- [CVE-2025-58978](https://cve.now/CVE-2025-58978.md): WordPress PDF Generator for WordPress Plugin \<= 1.5.4 - Broken Access Control Vulnerability (CVSS 5.3, WP Swings PDF Generator for WordPress)
- [CVE-2025-58979](https://cve.now/CVE-2025-58979.md): WordPress BerqWP Plugin \<= 2.2.53 - Broken Access Control Vulnerability (CVSS 5.3, BerqWP)
- [CVE-2025-58980](https://cve.now/CVE-2025-58980.md): WordPress Export WP Page to Static HTML/CSS Plugin \<= 4.1.0 - Broken Access Control Vulnerability (CVSS 5.3, recorp Export WP Page to Static HTML/CSS)
- [CVE-2025-58981](https://cve.now/CVE-2025-58981.md): WordPress Accessibility Checker by Equalize Digital Plugin \<= 1.31.0 - Broken Access Control Vulnerability (CVSS 5.4, Accessibility Checker by Equalize Digital)
- [CVE-2025-58982](https://cve.now/CVE-2025-58982.md): WordPress Pixeline's Email Protector Plugin \<= 1.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Pixeline's Email Protector)
- [CVE-2025-58983](https://cve.now/CVE-2025-58983.md): WordPress Include Me Plugin \<= 1.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Stefano Lissa Include Me)
- [CVE-2025-58984](https://cve.now/CVE-2025-58984.md): WordPress Welcart e-Commerce Plugin \<= 2.11.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, info@welcart Welcart e-Commerce)
- [CVE-2025-58985](https://cve.now/CVE-2025-58985.md): WordPress Additional Custom Product Tabs for WooCommerce Plugin \<= 1.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Additional Custom Product Tabs for WooCommerce)
- [CVE-2025-58987](https://cve.now/CVE-2025-58987.md): WordPress Football Pool Plugin \<= 2.12.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AntoineH Football Pool)
- [CVE-2025-58988](https://cve.now/CVE-2025-58988.md): WordPress My Tickets Plugin \<= 2.0.22 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Joe Dolson My Tickets)
- [CVE-2025-58989](https://cve.now/CVE-2025-58989.md): WordPress Dynamic Text Field For Contact Form 7 Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, silverplugins217 Dynamic Text Field For Contact Form)
- [CVE-2025-58991](https://cve.now/CVE-2025-58991.md): WordPress WooCommerce Booking Bundle Hours Plugin \<= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Cristiano Zanca WooCommerce Booking Bundle Hours)
- [CVE-2025-58990](https://cve.now/CVE-2025-58990.md): WordPress ShopLentor Plugin \<= 3.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DevItems ShopLentor)
- [CVE-2025-58993](https://cve.now/CVE-2025-58993.md): WordPress Tutor LMS Plugin \<= 3.7.4 - SQL Injection Vulnerability (CVSS 7.6, Themeum Tutor LMS)
- [CVE-2025-58997](https://cve.now/CVE-2025-58997.md): WordPress Mow Theme \<= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 9.6, Frenify Mow)
- [CVE-2025-5500](https://cve.now/CVE-2025-5500.md): ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components (CVSS 4.8, ZhenShi Mibro Fit App)
- [CVE-2025-5005](https://cve.now/CVE-2025-5005.md): Shanghai Lingdang Information Technology Lingdang CRM index\_event.php server-side request forgery (CVSS 6.9, Shanghai Lingdang Information Technology Lingdang CRM)
- [CVE-2025-53303](https://cve.now/CVE-2025-53303.md): WordPress ThemeMove Core Plugin \<= 1.4.2 - PHP Object Injection Vulnerability (CVSS 8.8, ThemeMove Core)
- [CVE-2025-58215](https://cve.now/CVE-2025-58215.md): WordPress Ziston Theme \< 1.4.5 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Ziston)
- [CVE-2025-48101](https://cve.now/CVE-2025-48101.md): WordPress Constant Contact for WordPress Plugin \<= 4.1.1 - PHP Object Injection Vulnerability (CVSS 8.8, webdevstudios Constant Contact for WordPress)
- [CVE-2025-49430](https://cve.now/CVE-2025-49430.md): WordPress Ultimate Video Player Plugin \<= 10.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 7.2, FWDesign Ultimate Video Player)
- [CVE-2025-30875](https://cve.now/CVE-2025-30875.md): WordPress WP Weixin plugin \<= 1.3.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Alexandre Froger WP Weixin)
- [CVE-2025-53291](https://cve.now/CVE-2025-53291.md): WordPress Spreadconnect plugin \<= 2.1.5 - Broken Access Control Vulnerability (CVSS 5.4, spoddev2021 Spreadconnect)
- [CVE-2025-53340](https://cve.now/CVE-2025-53340.md): WordPress Awesome Support plugin \<= 6.3.6 - Sensitive Data Exposure vulnerability (CVSS 5.3, awesomesupport Awesome Support)
- [CVE-2025-53348](https://cve.now/CVE-2025-53348.md): WordPress Kalium Theme \<= 3.18.3 - Broken Access Control Vulnerability (CVSS 5.3, Laborator Kalium)
- [CVE-2025-54709](https://cve.now/CVE-2025-54709.md): WordPress Sala Theme \<= 1.1.6 - Local File Inclusion Vulnerability (CVSS 8.1, uxper Sala)
- [CVE-2025-32486](https://cve.now/CVE-2025-32486.md): WordPress Material Dashboard plugin \<= 1.4.6 - Privilege Escalation Vulnerability (CVSS 9.8, Hossein Material Dashboard)
- [CVE-2025-32689](https://cve.now/CVE-2025-32689.md): WordPress Download Manager and Payment Form plugin \<= 2.8.2 - Price Manipulation vulnerability (CVSS 7.5, Convers Lab WP SmartPay)
- [CVE-2025-32688](https://cve.now/CVE-2025-32688.md): WordPress Target Video Easy Publish plugin \<= 3.8.9 - Arbitrary Code Execution vulnerability (CVSS 5.4, Nebojsa Target Video Easy Publish)
- [CVE-2025-39523](https://cve.now/CVE-2025-39523.md): WordPress GoodBarber plugin \<= 1.0.26 - Open Redirection Vulnerability (CVSS 4.7, GoodBarber)
- [CVE-2025-39541](https://cve.now/CVE-2025-39541.md): WordPress WP Simple Booking Calendar plugin \<= 2.0.13 - Broken Access Control vulnerability (CVSS 6.5, Roland Murg WP Simple Booking Calendar)
- [CVE-2025-39553](https://cve.now/CVE-2025-39553.md): WordPress Church Admin plugin \<= 5.0.9 - Sensitive Data Exposure vulnerability (CVSS 4.3, andy\_moyle Church Admin)
- [CVE-2025-47437](https://cve.now/CVE-2025-47437.md): WordPress LiteSpeed Cache plugin \<= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2025-47569](https://cve.now/CVE-2025-47569.md): WordPress WooCommerce Ultimate Gift Card plugin \<= 2.9.6 - SQL Injection vulnerability (CVSS 9.3, WPSwings WooCommerce Ultimate Gift Card)
- [CVE-2025-47570](https://cve.now/CVE-2025-47570.md): WordPress WooCommerce Photo Reviews plugin \<= 1.3.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, villatheme WooCommerce Photo Reviews)
- [CVE-2025-47571](https://cve.now/CVE-2025-47571.md): WordPress Super Store Finder plugin \< 7.8 - Local File Inclusion vulnerability (CVSS 7.5, highwarden Super Store Finder)
- [CVE-2025-47579](https://cve.now/CVE-2025-47579.md): WordPress Photography Theme \<= 7.7.2 - PHP Object Injection Vulnerability (CVSS 9.0, ThemeGoods Photography)
- [CVE-2025-47694](https://cve.now/CVE-2025-47694.md): WordPress Blog Designer PRO plugin \<= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, solwin Blog Designer PRO)
- [CVE-2025-47695](https://cve.now/CVE-2025-47695.md): WordPress Blog Designer PRO plugin \<= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability (CVSS 7.5, solwin Blog Designer PRO)
- [CVE-2025-49860](https://cve.now/CVE-2025-49860.md): WordPress Majestic Support plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, Majestic Support)
- [CVE-2025-59005](https://cve.now/CVE-2025-59005.md): WordPress Categorify plugin \<= 1.0.7.5 - Broken Access Control vulnerability (CVSS 4.3, frenify Categorify)
- [CVE-2025-59008](https://cve.now/CVE-2025-59008.md): WordPress ZIP Code Based Content Protection plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 7.6, PressTigers ZIP Code Based Content Protection)
- [CVE-2025-55144](https://cve.now/CVE-2025-55144.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 5.4, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55143](https://cve.now/CVE-2025-55143.md): Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55142](https://cve.now/CVE-2025-55142.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55141](https://cve.now/CVE-2025-55141.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55139](https://cve.now/CVE-2025-55139.md): SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 6.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55148](https://cve.now/CVE-2025-55148.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 7.6, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55147](https://cve.now/CVE-2025-55147.md): CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55146](https://cve.now/CVE-2025-55146.md): An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55145](https://cve.now/CVE-2025-55145.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.9, Ivanti Connect Secure 22.7R2.9 · Ivanti Policy Secure +2)
- [CVE-2025-8711](https://cve.now/CVE-2025-8711.md): CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 5.4, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-8712](https://cve.now/CVE-2025-8712.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22 (CVSS 5.4, Ivanti Connect Secure before · Ivanti Policy Secure +2)
- [CVE-2025-9872](https://cve.now/CVE-2025-9872.md): Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-9712](https://cve.now/CVE-2025-9712.md): Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-10183](https://cve.now/CVE-2025-10183.md): XML External Entity Injection in TecConnect 4.1 (CVSS 9.1, TecCom TecConnect)
- [CVE-2025-10107](https://cve.now/CVE-2025-10107.md): TRENDnet TEW-831DR formSysCmd command injection (CVSS 5.1, TRENDnet TEW-831DR)
- [CVE-2025-43776](https://cve.now/CVE-2025-43776.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202 (CVSS 4.6, Liferay Portal · Liferay DXP +3)
- [CVE-2025-33045](https://cve.now/CVE-2025-33045.md): Legacy Serial Redirection SMRAM Vulnerabilities (CVSS 8.2, AMI AptioV)
- [CVE-2025-9951](https://cve.now/CVE-2025-9951.md): Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000 (CVSS 7.2, FFmpeg)
- [CVE-2025-47416](https://cve.now/CVE-2025-47416.md): ConsoleFindCommandMatchList (CVSS 5.9, CRESTRON TOUCHSCREEN x70 · CRESTRON Touchscreen x60s)
- [CVE-2024-45325](https://cve.now/CVE-2024-45325.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities \[CWE-78\] in Fortinet FortiDDoS (CVSS 6.5, Fortinet FortiDDoS-F)
- [CVE-2025-53609](https://cve.now/CVE-2025-53609.md): A Relative Path Traversal vulnerability \[CWE-23\] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7 (CVSS 4.7, Fortinet FortiWeb)
- [CVE-2025-54236](https://cve.now/CVE-2025-54236.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 9.1, KEV, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-9994](https://cve.now/CVE-2025-9994.md): Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication (CVSS 9.8, Amped RF BT-AP)
- [CVE-2025-9161](https://cve.now/CVE-2025-9161.md): Rockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability (CVSS 7.3, Rockwell Automation FactoryTalk Optix)
- [CVE-2025-7350](https://cve.now/CVE-2025-7350.md): Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability (CVSS 8.6, Rockwell Automation Stratix IOS)
- [CVE-2025-9065](https://cve.now/CVE-2025-9065.md): Rockwell Automation ThinManager® Server-Side Request Forgery Vulnerability (CVSS 8.6, Rockwell Automation ThinManager)
- [CVE-2025-7970](https://cve.now/CVE-2025-7970.md): Rockwell Automation FactoryTalk Activation Manager Lack of Encryption Vulnerability (CVSS 8.7, Rockwell Automation FactoryTalk Activation Manager)
- [CVE-2025-9364](https://cve.now/CVE-2025-9364.md): Rockwell Automation FactoryTalk® Analytics™ LogixAI® Exposed Redis DB (CVSS 8.7, Rockwell Automation FactoryTalk® Analytics™ LogixAI®)
- [CVE-2025-9166](https://cve.now/CVE-2025-9166.md): Rockwell Automation ControlLogix® 5580 V35.013 Denial-Of-Service (CVSS 8.2, Rockwell Automation ControlLogix®)
- [CVE-2025-9160](https://cve.now/CVE-2025-9160.md): Rockwell Automation CompactLogix® 5480 Code Execution Vulnerability (CVSS 7.0, Rockwell Automation CompactLogix®)
- [CVE-2025-8007](https://cve.now/CVE-2025-8007.md): Rockwell Automation 1756-ENT2R, EN4TR, EN4TRXT Vulnerability (CVSS 7.1, Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT)
- [CVE-2025-8008](https://cve.now/CVE-2025-8008.md): Rockwell Automation 1756-ENT2R, EN4TR, EN4TRXT Vulnerability (CVSS 7.1, Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT)
- [CVE-2025-8277](https://cve.now/CVE-2025-8277.md): Libssh: memory exhaustion via repeated key exchange in libssh (CVSS 3.1, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-10095](https://cve.now/CVE-2025-10095.md): SQL injection in SMPP component of SMSEagle firmware (CVSS 5.3, Proximus sp. z o.o. SMSEagle)
- [CVE-2025-48208](https://cve.now/CVE-2025-48208.md): Apache HertzBeat (incubating): Jmx JNDI injection vulnerability (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2025-24404](https://cve.now/CVE-2025-24404.md): Apache HertzBeat (incubating): RCE by parse http sitemap xml response (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2025-59019](https://cve.now/CVE-2025-59019.md): Information Disclosure via CSV Download (CVSS 5.3, TYPO3 CMS · typo3/cms-backend +1)
- [CVE-2025-59018](https://cve.now/CVE-2025-59018.md): Information Disclosure in Workspaces Module (CVSS 7.1, TYPO3 CMS · typo3/cms-workspaces)
- [CVE-2025-59017](https://cve.now/CVE-2025-59017.md): Broken Access Control in Backend AJAX Routes (CVSS 5.3, TYPO3 CMS · typo3/cms-workspaces +4)
- [CVE-2025-59016](https://cve.now/CVE-2025-59016.md): Information Disclosure via File Abstraction Layer (CVSS 5.3, TYPO3 CMS · typo3/cms-core)
- [CVE-2025-59015](https://cve.now/CVE-2025-59015.md): Insufficient Entropy in Password Generation (CVSS 6.3, TYPO3 CMS · typo3/cms-core)
- [CVE-2025-59014](https://cve.now/CVE-2025-59014.md): Denial of Service in TYPO3 Bookmark Toolbar (CVSS 5.1, TYPO3 CMS · typo3/cms-backend)
- [CVE-2025-59013](https://cve.now/CVE-2025-59013.md): Open Redirect in TYPO3 CMS (CVSS 5.3, TYPO3 CMS · typo3/cms-core)
- [CVE-2025-41701](https://cve.now/CVE-2025-41701.md): Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering (CVSS 7.8, Beckhoff TE1000 | TwinCAT 3 Enineering)
- [CVE-2025-40804](https://cve.now/CVE-2025-40804.md): A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). (CVSS 9.1, Siemens SIMATIC Virtualization as a Service)
- [CVE-2025-40803](https://cve.now/CVE-2025-40803.md): A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). (CVSS 3.1, Siemens RUGGEDCOM RST2428P)
- [CVE-2025-40802](https://cve.now/CVE-2025-40802.md): A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). (CVSS 3.1, Siemens RUGGEDCOM RST2428P)
- [CVE-2025-40798](https://cve.now/CVE-2025-40798.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens User Management Component)
- [CVE-2025-40797](https://cve.now/CVE-2025-40797.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens User Management Component)
- [CVE-2025-40796](https://cve.now/CVE-2025-40796.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens User Management Component)
- [CVE-2025-40795](https://cve.now/CVE-2025-40795.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v (CVSS 9.8, Siemens SIMATIC PCS neo · Siemens User Management Component)
- [CVE-2025-40757](https://cve.now/CVE-2025-40757.md): A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC S (CVSS 5.3, Siemens APOGEE PXC Series · Siemens TALON TC Series)
- [CVE-2025-40594](https://cve.now/CVE-2025-40594.md): A vulnerability has been identified in SINAMICS G220 V6.4 (All versions \< V6.4 HF2), SINAMICS S200 V6.4 (All versions \< V6.4 HF7), SINAMICS (CVSS 6.3, Siemens SINAMICS G220 · Siemens SINAMICS S200 +1)
- [CVE-2025-10134](https://cve.now/CVE-2025-10134.md): Goza - Nonprofit Charity WordPress Theme \<= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion (CVSS 9.1, Bearsthemes Goza - Nonprofit Charity WordPress Theme)
- [CVE-2025-9539](https://cve.now/CVE-2025-9539.md): AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress \<= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation (CVSS 8.0, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2025-9542](https://cve.now/CVE-2025-9542.md): AutomatorWP \<= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions (CVSS 5.4, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2025-9111](https://cve.now/CVE-2025-9111.md): WPBOT \< 7.1.0 - Admin+ Stored XSS (CVSS 3.5, AI ChatBot for WordPress)
- [CVE-2025-8889](https://cve.now/CVE-2025-8889.md): Compress Then Upload \< 1.0.5 - Admin+ Arbitrary File Upload (CVSS 3.8, Compress & Upload)
- [CVE-2025-9058](https://cve.now/CVE-2025-9058.md): Mikado Core \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Mikado Themes Mikado Core)
- [CVE-2025-9061](https://cve.now/CVE-2025-9061.md): Wilmer Core \<= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Mikado Themes Wilmer Core)
- [CVE-2025-9489](https://cve.now/CVE-2025-9489.md): WP-Members Membership Plugin \<= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names (CVSS 5.0, cbutlerjr WP-Members Membership Plugin)
- [CVE-2025-43777](https://cve.now/CVE-2025-43777.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10123](https://cve.now/CVE-2025-10123.md): D-Link DIR-823X set\_static\_leases sub\_415028 command injection (CVSS 6.9, D-Link DIR-823X)
- [CVE-2025-10122](https://cve.now/CVE-2025-10122.md): Maccms10 Database.php rep sql injection (CVSS 5.1, Maccms10)
- [CVE-2025-42958](https://cve.now/CVE-2025-42958.md): Missing Authentication check in SAP NetWeaver (CVSS 9.1, SAP\_SE SAP NetWeaver)
- [CVE-2025-42944](https://cve.now/CVE-2025-42944.md): Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) (CVSS 10.0, SAP\_SE SAP Netweaver)
- [CVE-2025-42938](https://cve.now/CVE-2025-42938.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform (CVSS 6.1, SAP\_SE SAP NetWeaver ABAP Platform)
- [CVE-2025-42933](https://cve.now/CVE-2025-42933.md): Insecure Storage of Sensitive Information in SAP Business One (SLD) (CVSS 8.8, SAP\_SE SAP Business One)
- [CVE-2025-42930](https://cve.now/CVE-2025-42930.md): Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation (CVSS 6.5, SAP\_SE SAP Business Planning and Consolidation)
- [CVE-2025-42929](https://cve.now/CVE-2025-42929.md): Missing input validation vulnerability in SAP Landscape Transformation Replication Server (CVSS 8.1, SAP\_SE SAP Landscape Transformation Replication Server)
- [CVE-2025-42927](https://cve.now/CVE-2025-42927.md): Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) (CVSS 3.4, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2025-42926](https://cve.now/CVE-2025-42926.md): Missing Authentication check in SAP NetWeaver Application Server Java (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2025-42925](https://cve.now/CVE-2025-42925.md): Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) (CVSS 4.3, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2025-42923](https://cve.now/CVE-2025-42923.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups) (CVSS 4.3, SAP\_SE SAP Fiori App)
- [CVE-2025-42922](https://cve.now/CVE-2025-42922.md): Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service) (CVSS 9.9, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2025-42920](https://cve.now/CVE-2025-42920.md): Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (CVSS 6.1, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-42918](https://cve.now/CVE-2025-42918.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2025-42917](https://cve.now/CVE-2025-42917.md): Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application) (CVSS 6.5, SAP\_SE SAP HCM)
- [CVE-2025-42916](https://cve.now/CVE-2025-42916.md): Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) (CVSS 8.1, SAP\_SE SAP S/4HANA)
- [CVE-2025-42915](https://cve.now/CVE-2025-42915.md): Missing Authorization Check in Fiori app (Manage Payment Blocks) (CVSS 5.4, SAP\_SE Fiori app)
- [CVE-2025-42914](https://cve.now/CVE-2025-42914.md): Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) (CVSS 3.1, SAP\_SE SAP HCM)
- [CVE-2025-42913](https://cve.now/CVE-2025-42913.md): Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) (CVSS 3.1, SAP\_SE SAP HCM)
- [CVE-2025-42912](https://cve.now/CVE-2025-42912.md): Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) (CVSS 6.5, SAP\_SE SAP HCM)
- [CVE-2025-42911](https://cve.now/CVE-2025-42911.md): Missing Authorization check in SAP NetWeaver (Service Data Download) (CVSS 5.0, SAP\_SE SAP NetWeaver)
- [CVE-2025-10121](https://cve.now/CVE-2025-10121.md): uverif kami\_list addbatch sql injection (CVSS 5.3, uverif)
- [CVE-2025-10120](https://cve.now/CVE-2025-10120.md): Tenda AC20 GetParentControlInfo strcpy buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-10118](https://cve.now/CVE-2025-10118.md): itsourcecode E-Logbook with Health Monitoring System for COVID-19 login.php sql injection (CVSS 6.9, itsourcecode E-Logbook with Health Monitoring System for CO…)
- [CVE-2025-43778](https://cve.now/CVE-2025-43778.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 20 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10117](https://cve.now/CVE-2025-10117.md): SourceCodester Simple To-Do List System Add New Task fetch\_tasks.php cross site scripting (CVSS 5.1, SourceCodester Simple To-Do List System)
- [CVE-2025-10116](https://cve.now/CVE-2025-10116.md): SiempreCMS file\_upload.php unrestricted upload (CVSS 6.9, SiempreCMS)
- [CVE-2025-10115](https://cve.now/CVE-2025-10115.md): SiempreCMS user\_search\_ajax.php sql injection (CVSS 6.9, SiempreCMS)
- [CVE-2025-10114](https://cve.now/CVE-2025-10114.md): PHPGurukul Small CRM profile.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-10113](https://cve.now/CVE-2025-10113.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-29089](https://cve.now/CVE-2025-29089.md): An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information (CVSS 7.5)
- [CVE-2025-44593](https://cve.now/CVE-2025-44593.md): Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. (CVSS 6.1)
- [CVE-2025-44594](https://cve.now/CVE-2025-44594.md): halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload- (CVSS 9.1)
- [CVE-2025-44595](https://cve.now/CVE-2025-44595.md): Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo\_host/archives/{name}. (CVSS 6.1)
- [CVE-2025-52277](https://cve.now/CVE-2025-52277.md): Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta co (CVSS 6.1, yeswiki/yeswiki)
- [CVE-2025-52322](https://cve.now/CVE-2025-52322.md): An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to (CVSS 7.5)
- [CVE-2025-52915](https://cve.now/CVE-2025-52915.md): K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to termin (CVSS 7.2)
- [CVE-2025-57057](https://cve.now/CVE-2025-57057.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. (CVSS 7.5)
- [CVE-2025-57058](https://cve.now/CVE-2025-57058.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and (CVSS 7.5)
- [CVE-2025-57059](https://cve.now/CVE-2025-57059.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. (CVSS 7.5)
- [CVE-2025-57060](https://cve.now/CVE-2025-57060.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dns\_forward\_rule\_store function. (CVSS 7.5)
- [CVE-2025-57061](https://cve.now/CVE-2025-57061.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, (CVSS 7.5)
- [CVE-2025-57062](https://cve.now/CVE-2025-57062.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function. (CVSS 7.5)
- [CVE-2025-57063](https://cve.now/CVE-2025-57063.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. (CVSS 7.5)
- [CVE-2025-57064](https://cve.now/CVE-2025-57064.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. (CVSS 7.5)
- [CVE-2025-57069](https://cve.now/CVE-2025-57069.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function. (CVSS 7.5)
- [CVE-2025-57070](https://cve.now/CVE-2025-57070.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function. (CVSS 7.5)
- [CVE-2025-57071](https://cve.now/CVE-2025-57071.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function. (CVSS 7.5)
- [CVE-2025-57072](https://cve.now/CVE-2025-57072.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute functio (CVSS 7.5)
- [CVE-2025-57078](https://cve.now/CVE-2025-57078.md): Tenda G3 v3.0br\_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhi (CVSS 7.5)
- [CVE-2025-57085](https://cve.now/CVE-2025-57085.md): Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. (CVSS 9.8)
- [CVE-2025-57086](https://cve.now/CVE-2025-57086.md): Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. (CVSS 7.5)
- [CVE-2025-57087](https://cve.now/CVE-2025-57087.md): Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. (CVSS 7.5)
- [CVE-2025-57278](https://cve.now/CVE-2025-57278.md): The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800\_B10\_ALK\_SL\_V01.01.02P42U14\_06 does not implement proper session handlin (CVSS 8.8)
- [CVE-2025-57538](https://cve.now/CVE-2025-57538.md): A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Envir (CVSS 5.4)
- [CVE-2025-57539](https://cve.now/CVE-2025-57539.md): A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PV (CVSS 5.4)
- [CVE-2025-57540](https://cve.now/CVE-2025-57540.md): A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox (CVSS 5.4)
- [CVE-2025-57633](https://cve.now/CVE-2025-57633.md): A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS comman (CVSS 9.8)
- [CVE-2025-57665](https://cve.now/CVE-2025-57665.md): Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security ab (CVSS 6.4, element-plus)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.