# CVEs published 2025-10-14

369 CVEs were published on October 14, 2025: 20 critical, 209 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-62376](https://cve.now/CVE-2025-62376.md): pwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM access (CVSS 9.5, pwncollege dojo)
- [CVE-2025-49552](https://cve.now/CVE-2025-49552.md): Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 8.1, Adobe Connect)
- [CVE-2025-49553](https://cve.now/CVE-2025-49553.md): Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2025-54196](https://cve.now/CVE-2025-54196.md): Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 4.3, Adobe Connect)
- [CVE-2025-61797](https://cve.now/CVE-2025-61797.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-54272](https://cve.now/CVE-2025-54272.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-61796](https://cve.now/CVE-2025-61796.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-54267](https://cve.now/CVE-2025-54267.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-54266](https://cve.now/CVE-2025-54266.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-54263](https://cve.now/CVE-2025-54263.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-54265](https://cve.now/CVE-2025-54265.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9, Adobe Commerce · magento/community-edition +1)
- [CVE-2025-54264](https://cve.now/CVE-2025-54264.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-62374](https://cve.now/CVE-2025-62374.md): Parse Javascript SDK vulnerable to prototype pollution in \`Parse.Object\` and internal APIs (CVSS 6.4, parse-community Parse-SDK-JS · parse)
- [CVE-2025-61803](https://cve.now/CVE-2025-61803.md): Substance3D - Stager | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-61802](https://cve.now/CVE-2025-61802.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-61805](https://cve.now/CVE-2025-61805.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-61807](https://cve.now/CVE-2025-61807.md): Substance3D - Stager | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-61806](https://cve.now/CVE-2025-61806.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-61799](https://cve.now/CVE-2025-61799.md): Dimension | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-61798](https://cve.now/CVE-2025-61798.md): Dimension | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-61800](https://cve.now/CVE-2025-61800.md): Dimension | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-61801](https://cve.now/CVE-2025-61801.md): Dimension | Use After Free (CWE-416) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-61678](https://cve.now/CVE-2025-61678.md): FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter (CVSS 8.6, FreePBX endpointman)
- [CVE-2025-34267](https://cve.now/CVE-2025-34267.md): Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages (CVSS 8.4, FlowiseAI Flowise · flowise)
- [CVE-2025-61675](https://cve.now/CVE-2025-61675.md): FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters (CVSS 8.6, FreePBX endpoint)
- [CVE-2025-54283](https://cve.now/CVE-2025-54283.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-54284](https://cve.now/CVE-2025-54284.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-59429](https://cve.now/CVE-2025-59429.md): FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page (CVSS 8.5, FreePBX core)
- [CVE-2025-33177](https://cve.now/CVE-2025-33177.md): NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could allow a local attacker (CVSS 5.5, NVIDIA Jetson Orin Series · NVIDIA Jetson Thor Series +1)
- [CVE-2025-54282](https://cve.now/CVE-2025-54282.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-54281](https://cve.now/CVE-2025-54281.md): Adobe Framemaker | Use After Free (CWE-416) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-59051](https://cve.now/CVE-2025-59051.md): FreePBX Endpoint Manager command injection via Network Scanning feature (CVSS 8.6, FreePBX endpoint)
- [CVE-2025-54276](https://cve.now/CVE-2025-54276.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-33182](https://cve.now/CVE-2025-33182.md): NVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corruption of the L (CVSS 7.6, NVIDIA Jetson Orin Series · NVIDIA Jetson Xavier Series)
- [CVE-2025-54274](https://cve.now/CVE-2025-54274.md): Substance3D - Viewer | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-54273](https://cve.now/CVE-2025-54273.md): Substance3D - Viewer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-54275](https://cve.now/CVE-2025-54275.md): Substance3D - Viewer | Out-of-bounds Write (CWE-787) (CVSS 5.5, Adobe Substance3D - Viewer)
- [CVE-2025-54280](https://cve.now/CVE-2025-54280.md): Substance3D - Viewer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-23356](https://cve.now/CVE-2025-23356.md): NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. (CVSS 8.4, NVIDIA Isaac Lab)
- [CVE-2025-11736](https://cve.now/CVE-2025-11736.md): itsourcecode Online Examination System index.php sql injection (CVSS 6.9, itsourcecode Online Examination System)
- [CVE-2025-8459](https://cve.now/CVE-2025-8459.md): A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page (CVSS 7.7, Centreon Infra Monitoring)
- [CVE-2025-37145](https://cve.now/CVE-2025-37145.md): Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-59497](https://cve.now/CVE-2025-59497.md): Microsoft Defender for Linux Denial of Service Vulnerability (CVSS 7.0, Microsoft Defender for Endpoint for Linux)
- [CVE-2025-59289](https://cve.now/CVE-2025-59289.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59287](https://cve.now/CVE-2025-59287.md): Windows Server Update Service (WSUS) Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft Windows Server)
- [CVE-2025-59285](https://cve.now/CVE-2025-59285.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure Monitor)
- [CVE-2025-59278](https://cve.now/CVE-2025-59278.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59275](https://cve.now/CVE-2025-59275.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-37144](https://cve.now/CVE-2025-37144.md): Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-59261](https://cve.now/CVE-2025-59261.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59260](https://cve.now/CVE-2025-59260.md): Microsoft Failover Cluster Virtual Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-59253](https://cve.now/CVE-2025-59253.md): Windows Search Service Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59230](https://cve.now/CVE-2025-59230.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-59248](https://cve.now/CVE-2025-59248.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 7.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2025-59244](https://cve.now/CVE-2025-59244.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-59241](https://cve.now/CVE-2025-59241.md): Windows Health and Optimized Experiences Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59238](https://cve.now/CVE-2025-59238.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-59232](https://cve.now/CVE-2025-59232.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Access +4)
- [CVE-2025-59229](https://cve.now/CVE-2025-59229.md): Microsoft Office Denial of Service Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-59227](https://cve.now/CVE-2025-59227.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-59226](https://cve.now/CVE-2025-59226.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-59225](https://cve.now/CVE-2025-59225.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-59224](https://cve.now/CVE-2025-59224.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-59223](https://cve.now/CVE-2025-59223.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-59222](https://cve.now/CVE-2025-59222.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-59221](https://cve.now/CVE-2025-59221.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.0, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-59214](https://cve.now/CVE-2025-59214.md): Microsoft Windows File Explorer Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-59213](https://cve.now/CVE-2025-59213.md): Configuration Manager Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Configuration Manager)
- [CVE-2025-59210](https://cve.now/CVE-2025-59210.md): Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-59209](https://cve.now/CVE-2025-59209.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59208](https://cve.now/CVE-2025-59208.md): Windows MapUrlToZone Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-59205](https://cve.now/CVE-2025-59205.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59203](https://cve.now/CVE-2025-59203.md): Windows State Repository API Server File Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59198](https://cve.now/CVE-2025-59198.md): Windows Search Service Denial of Service Vulnerability (CVSS 5.0, Microsoft Windows)
- [CVE-2025-59197](https://cve.now/CVE-2025-59197.md): Windows ETL Channel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59194](https://cve.now/CVE-2025-59194.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59193](https://cve.now/CVE-2025-59193.md): Windows Management Services Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59192](https://cve.now/CVE-2025-59192.md): Storport.sys Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59191](https://cve.now/CVE-2025-59191.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59190](https://cve.now/CVE-2025-59190.md): Windows Search Service Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59189](https://cve.now/CVE-2025-59189.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-59188](https://cve.now/CVE-2025-59188.md): Microsoft Failover Cluster Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-59187](https://cve.now/CVE-2025-59187.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59184](https://cve.now/CVE-2025-59184.md): Storage Spaces Direct Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-58739](https://cve.now/CVE-2025-58739.md): Microsoft Windows File Explorer Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-58738](https://cve.now/CVE-2025-58738.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58737](https://cve.now/CVE-2025-58737.md): Remote Desktop Protocol Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-58736](https://cve.now/CVE-2025-58736.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58734](https://cve.now/CVE-2025-58734.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58733](https://cve.now/CVE-2025-58733.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58731](https://cve.now/CVE-2025-58731.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58730](https://cve.now/CVE-2025-58730.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58729](https://cve.now/CVE-2025-58729.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-58727](https://cve.now/CVE-2025-58727.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58726](https://cve.now/CVE-2025-58726.md): Windows SMB Server Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-58725](https://cve.now/CVE-2025-58725.md): Windows COM+ Event System Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58724](https://cve.now/CVE-2025-58724.md): Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Arc Enabled Servers - Azure Connected Machine Age…)
- [CVE-2025-58720](https://cve.now/CVE-2025-58720.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-58718](https://cve.now/CVE-2025-58718.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-58714](https://cve.now/CVE-2025-58714.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55699](https://cve.now/CVE-2025-55699.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-55698](https://cve.now/CVE-2025-55698.md): DirectX Graphics Kernel Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2025-55697](https://cve.now/CVE-2025-55697.md): Azure Local Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition · Microsoft Win…)
- [CVE-2025-55696](https://cve.now/CVE-2025-55696.md): NtQueryInformation Token function (ntifs.h) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55695](https://cve.now/CVE-2025-55695.md): Windows WLAN AutoConfig Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-55694](https://cve.now/CVE-2025-55694.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55693](https://cve.now/CVE-2025-55693.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-55692](https://cve.now/CVE-2025-55692.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55691](https://cve.now/CVE-2025-55691.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55690](https://cve.now/CVE-2025-55690.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55688](https://cve.now/CVE-2025-55688.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55684](https://cve.now/CVE-2025-55684.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55683](https://cve.now/CVE-2025-55683.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-55682](https://cve.now/CVE-2025-55682.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55680](https://cve.now/CVE-2025-55680.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55679](https://cve.now/CVE-2025-55679.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.1, Microsoft Windows)
- [CVE-2025-55678](https://cve.now/CVE-2025-55678.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55337](https://cve.now/CVE-2025-55337.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55334](https://cve.now/CVE-2025-55334.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2025-55332](https://cve.now/CVE-2025-55332.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55331](https://cve.now/CVE-2025-55331.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55330](https://cve.now/CVE-2025-55330.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55328](https://cve.now/CVE-2025-55328.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55326](https://cve.now/CVE-2025-55326.md): Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-55248](https://cve.now/CVE-2025-55248.md): .NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability (CVSS 4.8, Microsoft .NET · Microsoft Visual Studio +12)
- [CVE-2025-55240](https://cve.now/CVE-2025-55240.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-53768](https://cve.now/CVE-2025-53768.md): Xbox IStorageService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53139](https://cve.now/CVE-2025-53139.md): Windows Hello Security Feature Bypass Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2025-50175](https://cve.now/CVE-2025-50175.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53150](https://cve.now/CVE-2025-53150.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-50152](https://cve.now/CVE-2025-50152.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53717](https://cve.now/CVE-2025-53717.md): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-25004](https://cve.now/CVE-2025-25004.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft PowerShell · Microsoft Windows)
- [CVE-2025-48813](https://cve.now/CVE-2025-48813.md): Virtual Secure Mode Spoofing Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2025-59502](https://cve.now/CVE-2025-59502.md): Remote Procedure Call Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-59494](https://cve.now/CVE-2025-59494.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Monitor)
- [CVE-2025-59295](https://cve.now/CVE-2025-59295.md): Windows URL Parsing Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-59294](https://cve.now/CVE-2025-59294.md): Windows Taskbar Live Preview Information Disclosure Vulnerability (CVSS 2.1, Microsoft Windows)
- [CVE-2025-59292](https://cve.now/CVE-2025-59292.md): Azure Compute Gallery Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Compute Gallery)
- [CVE-2025-59291](https://cve.now/CVE-2025-59291.md): Confidential Azure Container Instances Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Compute Gallery)
- [CVE-2025-59290](https://cve.now/CVE-2025-59290.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59288](https://cve.now/CVE-2025-59288.md): Playwright Spoofing Vulnerability (CVSS 5.3, microsoft/playwright · playwright)
- [CVE-2025-59284](https://cve.now/CVE-2025-59284.md): Windows NTLM Spoofing Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2025-59282](https://cve.now/CVE-2025-59282.md): Internet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59281](https://cve.now/CVE-2025-59281.md): Xbox Gaming Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Xbox Gaming Services)
- [CVE-2025-47979](https://cve.now/CVE-2025-47979.md): Microsoft Failover Cluster Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server 2022, 23H2 Edition · Microsoft Win…)
- [CVE-2025-59280](https://cve.now/CVE-2025-59280.md): Windows SMB Client Tampering Vulnerability (CVSS 3.1, Microsoft Windows)
- [CVE-2025-59277](https://cve.now/CVE-2025-59277.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59259](https://cve.now/CVE-2025-59259.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-59258](https://cve.now/CVE-2025-59258.md): Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows Server)
- [CVE-2025-59257](https://cve.now/CVE-2025-59257.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-59255](https://cve.now/CVE-2025-59255.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59254](https://cve.now/CVE-2025-59254.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59250](https://cve.now/CVE-2025-59250.md): JDBC Driver for SQL Server Spoofing Vulnerability (CVSS 8.1, Microsoft JDBC Driver for SQL Server · com.microsoft.sqlser…)
- [CVE-2025-59249](https://cve.now/CVE-2025-59249.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2025-59243](https://cve.now/CVE-2025-59243.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-49708](https://cve.now/CVE-2025-49708.md): Microsoft Graphics Component Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Windows)
- [CVE-2025-59242](https://cve.now/CVE-2025-59242.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59237](https://cve.now/CVE-2025-59237.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-59236](https://cve.now/CVE-2025-59236.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-59235](https://cve.now/CVE-2025-59235.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Access +4)
- [CVE-2025-59234](https://cve.now/CVE-2025-59234.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-59233](https://cve.now/CVE-2025-59233.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-59231](https://cve.now/CVE-2025-59231.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-59228](https://cve.now/CVE-2025-59228.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-59211](https://cve.now/CVE-2025-59211.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59207](https://cve.now/CVE-2025-59207.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59206](https://cve.now/CVE-2025-59206.md): Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-59204](https://cve.now/CVE-2025-59204.md): Windows Management Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-59202](https://cve.now/CVE-2025-59202.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59201](https://cve.now/CVE-2025-59201.md): Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59200](https://cve.now/CVE-2025-59200.md): Data Sharing Service Spoofing Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2025-59199](https://cve.now/CVE-2025-59199.md): Software Protection Platform (SPP) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59196](https://cve.now/CVE-2025-59196.md): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59195](https://cve.now/CVE-2025-59195.md): Windows Graphics Component Denial of Service Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-59186](https://cve.now/CVE-2025-59186.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-59185](https://cve.now/CVE-2025-59185.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-58735](https://cve.now/CVE-2025-58735.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58732](https://cve.now/CVE-2025-58732.md): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-58728](https://cve.now/CVE-2025-58728.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-58722](https://cve.now/CVE-2025-58722.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-58719](https://cve.now/CVE-2025-58719.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2025-58717](https://cve.now/CVE-2025-58717.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-37143](https://cve.now/CVE-2025-37143.md): Authenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required) (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-58716](https://cve.now/CVE-2025-58716.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-58715](https://cve.now/CVE-2025-58715.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-55701](https://cve.now/CVE-2025-55701.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55700](https://cve.now/CVE-2025-55700.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-55689](https://cve.now/CVE-2025-55689.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55687](https://cve.now/CVE-2025-55687.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-55686](https://cve.now/CVE-2025-55686.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55685](https://cve.now/CVE-2025-55685.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55681](https://cve.now/CVE-2025-55681.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55677](https://cve.now/CVE-2025-55677.md): Windows Device Association Broker Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55676](https://cve.now/CVE-2025-55676.md): Windows USB Video Class System Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-55340](https://cve.now/CVE-2025-55340.md): Windows Remote Desktop Protocol Security Feature Bypass (CVSS 7.0, Microsoft Windows)
- [CVE-2025-55339](https://cve.now/CVE-2025-55339.md): Windows Network Driver Interface Specification (NDIS) Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55338](https://cve.now/CVE-2025-55338.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55336](https://cve.now/CVE-2025-55336.md): Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-55335](https://cve.now/CVE-2025-55335.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-55333](https://cve.now/CVE-2025-55333.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2025-55325](https://cve.now/CVE-2025-55325.md): Windows Storage Management Provider Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-55320](https://cve.now/CVE-2025-55320.md): Configuration Manager Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Configuration Manager)
- [CVE-2025-24052](https://cve.now/CVE-2025-24052.md): Windows Agere Modem Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24990](https://cve.now/CVE-2025-24990.md): Windows Agere Modem Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-55315](https://cve.now/CVE-2025-55315.md): ASP.NET Security Feature Bypass Vulnerability (CVSS 9.9, Microsoft ASP.NET Core · Microsoft Visual Studio +13)
- [CVE-2025-55247](https://cve.now/CVE-2025-55247.md): .NET Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft .NET · Microsoft.Build.Tasks.Core +2)
- [CVE-2025-53782](https://cve.now/CVE-2025-53782.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.4, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2025-50174](https://cve.now/CVE-2025-50174.md): Windows Device Association Broker Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-48004](https://cve.now/CVE-2025-48004.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-47989](https://cve.now/CVE-2025-47989.md): Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Arc Enabled Servers - Azure Connected Machine Age…)
- [CVE-2025-37142](https://cve.now/CVE-2025-37142.md): Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37141](https://cve.now/CVE-2025-37141.md): Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37140](https://cve.now/CVE-2025-37140.md): Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37139](https://cve.now/CVE-2025-37139.md): Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot (CVSS 6.0, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37138](https://cve.now/CVE-2025-37138.md): Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required) (CVSS 6.2, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37137](https://cve.now/CVE-2025-37137.md): Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) (CVSS 6.5, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37136](https://cve.now/CVE-2025-37136.md): Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) (CVSS 6.5, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37135](https://cve.now/CVE-2025-37135.md): Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) (CVSS 6.5, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37134](https://cve.now/CVE-2025-37134.md): Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-8430](https://cve.now/CVE-2025-8430.md): A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-37133](https://cve.now/CVE-2025-37133.md): Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage. (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37132](https://cve.now/CVE-2025-37132.md): Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-11548](https://cve.now/CVE-2025-11548.md): ibi WebFOCUS - Unauthenticated RCE Vulnerability (CVSS 9.3, ibi WebFOCUS)
- [CVE-2025-37148](https://cve.now/CVE-2025-37148.md): Kernel Panic triggered by Modified Ethernet Frames leads to Denial of Service Vulnerability (CVSS 6.5, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37147](https://cve.now/CVE-2025-37147.md): Secure Boot Bypass allows for Compromise of Hardware Root of Trust (CVSS 7.1, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-37146](https://cve.now/CVE-2025-37146.md): Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS)
- [CVE-2025-36730](https://cve.now/CVE-2025-36730.md): Windsurf Prompt Injection via Filename (CVSS 4.6, Windsurf)
- [CVE-2025-37149](https://cve.now/CVE-2025-37149.md): A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware. (CVSS 6.0, Hewlett Packard Enterprise (HPE) ProLiant RL300 Gen11 Server)
- [CVE-2025-11577](https://cve.now/CVE-2025-11577.md): Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain (CVSS 7.6, Clevo Notebook System Firmware)
- [CVE-2025-8429](https://cve.now/CVE-2025-8429.md): A user with elevated privileges can inject XSS in the ACL Action access configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-54893](https://cve.now/CVE-2025-54893.md): A user with elevated privileges can inject XSS in the Hosts templates configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-31514](https://cve.now/CVE-2025-31514.md): A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS (CVSS 2.6, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2025-46774](https://cve.now/CVE-2025-46774.md): An Improper Verification of Cryptographic Signature vulnerability \[CWE-347\] in FortiClient MacOS installer version 7.4.2 and below, version (CVSS 6.8, Fortinet FortiClientMac)
- [CVE-2025-54822](https://cve.now/CVE-2025-54822.md): An improper authorization vulnerability \[CWE-285\] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiO (CVSS 4.2, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2025-62366](https://cve.now/CVE-2025-62366.md): Mailgen vulnerable to HTML injection and cross-site scripting via plaintext email generation (CVSS 2.9, eladnava mailgen · mailgen)
- [CVE-2025-31365](https://cve.now/CVE-2025-31365.md): An Improper Control of Generation of Code ('Code Injection') vulnerability \[CWE-94\] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2 (CVSS 5.5, Fortinet FortiClientMac)
- [CVE-2025-53845](https://cve.now/CVE-2025-53845.md): An improper authentication vulnerability \[CWE-287\] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthen (CVSS 6.2, Fortinet FortiAnalyzer)
- [CVE-2025-59921](https://cve.now/CVE-2025-59921.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in Fortinet FortiADC version 7.4.0, version 7.2.3 and (CVSS 6.2, Fortinet FortiADC)
- [CVE-2024-33507](https://cve.now/CVE-2024-33507.md): An insufficient session expiration vulnerability \[CWE-613\] and an incorrect authorization vulnerability \[CWE-863\] in FortiIsolator 2.4.0 thr (CVSS 7.0, Fortinet FortiIsolator)
- [CVE-2025-57716](https://cve.now/CVE-2025-57716.md): An Uncontrolled Search Path Element vulnerability \[CWE-427\] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versio (CVSS 6.0, Fortinet FortiClientWindows)
- [CVE-2025-25255](https://cve.now/CVE-2025-25255.md): An Improperly Implemented Security Check for Standard vulnerability \[CWE-358\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPr (CVSS 4.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2025-25252](https://cve.now/CVE-2025-25252.md): An Insufficient Session Expiration vulnerability \[CWE-613\] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 (CVSS 4.3, Fortinet FortiOS)
- [CVE-2024-26008](https://cve.now/CVE-2024-26008.md): An improper check or handling of exceptional conditions vulnerability \[CWE-703\] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, For (CVSS 5.0, Fortinet FortiProxy · Fortinet FortiPAM +2)
- [CVE-2024-47569](https://cve.now/CVE-2024-47569.md): A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, (CVSS 4.2, Fortinet FortiManager · Fortinet FortiOS +8)
- [CVE-2025-54973](https://cve.now/CVE-2025-54973.md): A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability \[CWE-362\] in Fortinet FortiAnaly (CVSS 5.3, Fortinet FortiAnalyzer)
- [CVE-2023-46718](https://cve.now/CVE-2023-46718.md): A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thr (CVSS 6.3, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2024-50571](https://cve.now/CVE-2024-50571.md): A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7 (CVSS 6.5, Fortinet FortiManager · Fortinet FortiOS +2)
- [CVE-2025-31366](https://cve.now/CVE-2025-31366.md): An Improper Neutralization of Input During Web Page Generation vulnerability \[CWE-79\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, (CVSS 4.5, Fortinet FortiSASE · Fortinet FortiOS +1)
- [CVE-2025-22258](https://cve.now/CVE-2025-22258.md): A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2. (CVSS 5.7, Fortinet FortiPAM · Fortinet FortiOS +3)
- [CVE-2025-25253](https://cve.now/CVE-2025-25253.md): An Improper Validation of Certificate with Host Mismatch vulnerability \[CWE-297\] in FortiProxy version 7.6.1 and below, version 7.4.8 and be (CVSS 6.8, Fortinet FortiProxy · Fortinet FortiOS +1)
- [CVE-2025-57740](https://cve.now/CVE-2025-57740.md): An Heap-based Buffer Overflow vulnerability \[CWE-122\] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, (CVSS 6.7, Fortinet FortiPAM · Fortinet FortiProxy +1)
- [CVE-2025-47890](https://cve.now/CVE-2025-47890.md): An URL Redirection to Untrusted Site vulnerabilities \[CWE-601\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through (CVSS 2.5, Fortinet FortiOS · Fortinet FortiProxy +1)
- [CVE-2025-57741](https://cve.now/CVE-2025-57741.md): An Incorrect Permission Assignment for Critical Resource vulnerability \[CWE-732\] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11 (CVSS 7.0, Fortinet FortiClientMac)
- [CVE-2025-49201](https://cve.now/CVE-2025-49201.md): A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all ve (CVSS 7.4, Fortinet FortiPAM · Fortinet FortiSwitchManager)
- [CVE-2025-58325](https://cve.now/CVE-2025-58325.md): An Incorrect Provision of Specified Functionality vulnerability \[CWE-684\] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 (CVSS 7.8, Fortinet FortiOS)
- [CVE-2025-58324](https://cve.now/CVE-2025-58324.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7. (CVSS 6.1, Fortinet FortiSIEM)
- [CVE-2025-58903](https://cve.now/CVE-2025-58903.md): An Unchecked Return Value vulnerability \[CWE-252\] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticat (CVSS 2.5, Fortinet FortiOS)
- [CVE-2024-48891](https://cve.now/CVE-2024-48891.md): An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability \[CWE-78\] in FortiSOAR 7.6.0 thro (CVSS 6.6, Fortinet FortiSOAR on-premise)
- [CVE-2025-62172](https://cve.now/CVE-2025-62172.md): Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name (CVSS 8.5, home-assistant core · homeassistant)
- [CVE-2025-54891](https://cve.now/CVE-2025-54891.md): A user with elevated privileges can inject XSS in the ACL Resource Access configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-62157](https://cve.now/CVE-2025-62157.md): Argo Workflows exposes artifact repository credentials in workflow-controller logs (CVSS 8.5, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2025-54892](https://cve.now/CVE-2025-54892.md): A user with elevated privileges can inject XSS in the SNMP traps group configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-54889](https://cve.now/CVE-2025-54889.md): A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-62156](https://cve.now/CVE-2025-62156.md): argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite (CVSS 8.1, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2025-0033](https://cve.now/CVE-2025-0033.md): Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potential (CVSS 6.0, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9005 Series Pr…)
- [CVE-2025-59428](https://cve.now/CVE-2025-59428.md): EspoCRM allows arbitrary user creation via stored SVG injection and CSRF (CVSS 5.4, espocrm)
- [CVE-2024-44088](https://cve.now/CVE-2024-44088.md): Apache Geode: Reflected XSS (CVSS 6.1, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2025-5946](https://cve.now/CVE-2025-5946.md): RCE via the poller reload feature available only to user with high privilege (CVSS 7.2, Centreon Infra Monitoring)
- [CVE-2025-10986](https://cve.now/CVE-2025-10986.md): Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with (CVSS 4.7, Ivanti Endpoint Manager Mobile)
- [CVE-2025-8428](https://cve.now/CVE-2025-8428.md): XSS found in the HTTP loader widget (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-10985](https://cve.now/CVE-2025-10985.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-10243](https://cve.now/CVE-2025-10243.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-10242](https://cve.now/CVE-2025-10242.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-27906](https://cve.now/CVE-2025-27906.md): IBM Content Navigator information disclosure (CVSS 5.3, IBM Content Navigator)
- [CVE-2025-33044](https://cve.now/CVE-2025-33044.md): exFat Memory Corruption Issue (CVSS 5.8, AMI AptioV)
- [CVE-2025-22833](https://cve.now/CVE-2025-22833.md): FixupArray Pointer Validation in NTFS (CVSS 4.6, AMI AptioV)
- [CVE-2025-22832](https://cve.now/CVE-2025-22832.md): Buffer Overflow in NTFS when parsing the ATTRIBUTE\_LIST (CVSS 5.8, AMI AptioV)
- [CVE-2025-22831](https://cve.now/CVE-2025-22831.md): Buffer Overflow in NTFS when parsing the VOLUME\_NAME (CVSS 5.8, AMI AptioV)
- [CVE-2025-47856](https://cve.now/CVE-2025-47856.md): Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities \[CWE-78\] in Fortinet FortiVoi (CVSS 7.2, Fortinet FortiVoice)
- [CVE-2025-9178](https://cve.now/CVE-2025-9178.md): Rockwell Automation 1715 EtherNet/IP Comms Module Denial-Of-Service Vulnerability (CVSS 7.7, Rockwell Automation 1715-AENTR EtherNet/IP Adapter)
- [CVE-2025-9177](https://cve.now/CVE-2025-9177.md): Rockwell Automation 1715 EtherNet/IP Comms Module Denial-Of-Service Vulnerability (CVSS 7.7, Rockwell Automation 1715-AENTR EtherNet/IP Adapter)
- [CVE-2025-7330](https://cve.now/CVE-2025-7330.md): Rockwell Automation 1783-NATR Cross-Site Request Forgery Vulnerability (CVSS 7.0, Rockwell Automation Comms - 1783-NATR)
- [CVE-2025-10610](https://cve.now/CVE-2025-10610.md): SQLi in SFS Winsure (CVSS 9.8, SFS Consulting Information Processing Industry and Foreign…)
- [CVE-2025-11498](https://cve.now/CVE-2025-11498.md): CSV Formula Injection Vulnerability (CVSS 5.3, B&R Industrial Automation Automation Runtime)
- [CVE-2025-7329](https://cve.now/CVE-2025-7329.md): Rockwell Automation Comms - 1783-NATR Stored Cross-Site Scripting Vulnerability (CVSS 8.5, Rockwell Automation Comms - 1783-NATR)
- [CVE-2025-7328](https://cve.now/CVE-2025-7328.md): Rockwell Automation Comms - 1783-NATR Multiple Broken Authentication Vulnerabilities (CVSS 9.9, Rockwell Automation Comms - 1783-NATR)
- [CVE-2025-11720](https://cve.now/CVE-2025-11720.md): Spoofing risk in Android custom tabs (CVSS 8.1, Mozilla Firefox)
- [CVE-2025-11718](https://cve.now/CVE-2025-11718.md): Address bar could be spoofed on Android using visibilitychange (CVSS 6.5, Mozilla Firefox)
- [CVE-2025-11717](https://cve.now/CVE-2025-11717.md): The password edit screen was not hidden in Android card view (CVSS 9.1, Mozilla Firefox)
- [CVE-2025-11721](https://cve.now/CVE-2025-11721.md): Memory safety bug fixed in Firefox 144 and Thunderbird 144 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11719](https://cve.now/CVE-2025-11719.md): Use-after-free caused by the native messaging web extension API on Windows (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11716](https://cve.now/CVE-2025-11716.md): Sandboxed iframes allowed links to open in external apps (Android only) (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11715](https://cve.now/CVE-2025-11715.md): Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11713](https://cve.now/CVE-2025-11713.md): Potential user-assisted code execution in “Copy as cURL” command (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11712](https://cve.now/CVE-2025-11712.md): An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11708](https://cve.now/CVE-2025-11708.md): Use-after-free in MediaTrackGraphImpl::GetInstance() (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11714](https://cve.now/CVE-2025-11714.md): Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11711](https://cve.now/CVE-2025-11711.md): Some non-writable Object properties could be modified (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11710](https://cve.now/CVE-2025-11710.md): Cross-process information leaked due to malicious IPC messages (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-11709](https://cve.now/CVE-2025-11709.md): Out of bounds read/write in a privileged process triggered by WebGL textures (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-9067](https://cve.now/CVE-2025-9067.md): Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities (CVSS 8.5, Rockwell Automation FactoryTalk Linx)
- [CVE-2025-9124](https://cve.now/CVE-2025-9124.md): Rockwell Automation Compact GuardLogix® 5370 Denial-Of-Service Vulnerability (CVSS 8.7, Rockwell Automation Compact GuardLogix®)
- [CVE-2025-9068](https://cve.now/CVE-2025-9068.md): Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities (CVSS 8.5, Rockwell Automation FactoryTalk Linx)
- [CVE-2025-9064](https://cve.now/CVE-2025-9064.md): Rockwell Automation FactoryTalk View Machine Edition Path Traversal (CVSS 8.7, Rockwell Automation FactoryTalk View Machine Edition)
- [CVE-2025-9063](https://cve.now/CVE-2025-9063.md): Rockwell Automation PanelView Plus 7 Performance Series B Authentication Bypass (CVSS 7.0, Rockwell Automation PanelView Plus 7 Performance Series B)
- [CVE-2025-9066](https://cve.now/CVE-2025-9066.md): Rockwell Automation FactoryTalk® ViewPoint XXE to Denial-of-Service Vulnerability (CVSS 8.7, Rockwell Automation FactoryTalk ViewPoint)
- [CVE-2025-9437](https://cve.now/CVE-2025-9437.md): Rockwell Automation ArmorStart® AOP Denial-of-Service Vulnerability (CVSS 8.7, Rockwell Automation ArmorStart AOP)
- [CVE-2025-10228](https://cve.now/CVE-2025-10228.md): Session Hijacking in Rolantis Information Technologies' Agentis (CVSS 8.8, Rolantis Information Technologies Agentis)
- [CVE-2025-40812](https://cve.now/CVE-2025-40812.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 14), Solid Edge SE2025 (All versions \< V225.0 Update (CVSS 7.8, Siemens Solid Edge SE2024 · Siemens Solid Edge SE2025)
- [CVE-2025-40811](https://cve.now/CVE-2025-40811.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 14), Solid Edge SE2025 (All versions \< V225.0 Update (CVSS 7.8, Siemens Solid Edge SE2024 · Siemens Solid Edge SE2025)
- [CVE-2025-40810](https://cve.now/CVE-2025-40810.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 14), Solid Edge SE2025 (All versions \< V225.0 Update (CVSS 7.8, Siemens Solid Edge SE2024 · Siemens Solid Edge SE2025)
- [CVE-2025-40809](https://cve.now/CVE-2025-40809.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 14), Solid Edge SE2025 (All versions \< V225.0 Update (CVSS 7.8, Siemens Solid Edge SE2024 · Siemens Solid Edge SE2025)
- [CVE-2025-40774](https://cve.now/CVE-2025-40774.md): A vulnerability has been identified in SiPass integrated (All versions \< V3.0). (CVSS 4.4, Siemens SiPass integrated)
- [CVE-2025-40773](https://cve.now/CVE-2025-40773.md): A vulnerability has been identified in SiPass integrated (All versions \< V3.0). (CVSS 3.5, Siemens SiPass integrated)
- [CVE-2025-40772](https://cve.now/CVE-2025-40772.md): A vulnerability has been identified in SiPass integrated (All versions \< V3.0). (CVSS 7.4, Siemens SiPass integrated)
- [CVE-2025-40771](https://cve.now/CVE-2025-40771.md): A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions \< V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6 (CVSS 9.8, Siemens SIMATIC CP 1542SP-1 · Siemens SIMATIC CP 1543SP-1 +2)
- [CVE-2025-40765](https://cve.now/CVE-2025-40765.md): A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions \>= V3.1.2.2 \< V3.1.2.3). (CVSS 9.8, Siemens TeleControl Server Basic)
- [CVE-2025-40755](https://cve.now/CVE-2025-40755.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0 SP1). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2011-20002](https://cve.now/CVE-2011-20002.md): A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. (CVSS 7.4, Siemens SIMATIC S7-1200 CPU V1 family · Siemens SIMATIC S7-…)
- [CVE-2011-20001](https://cve.now/CVE-2011-20001.md): A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. (CVSS 7.5, Siemens SIMATIC S7-1200 CPU V1 family · Siemens SIMATIC S7-…)
- [CVE-2025-20724](https://cve.now/CVE-2025-20724.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20717](https://cve.now/CVE-2025-20717.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20716](https://cve.now/CVE-2025-20716.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20715](https://cve.now/CVE-2025-20715.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20723](https://cve.now/CVE-2025-20723.md): In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6835, MT6878, MT6886, MT6897, MT6899, MT6985, MT…)
- [CVE-2025-20722](https://cve.now/CVE-2025-20722.md): In gnss driver, there is a possible out of bounds read due to an integer overflow. (CVSS 5.5, MediaTek MT6835, MT6878, MT6886, MT6897, MT6899, MT6980D, M…)
- [CVE-2025-20714](https://cve.now/CVE-2025-20714.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20713](https://cve.now/CVE-2025-20713.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20721](https://cve.now/CVE-2025-20721.md): In imgsensor, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT…)
- [CVE-2025-20720](https://cve.now/CVE-2025-20720.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7603, MT7615, MT7622, MT7915, MT7916, MT…)
- [CVE-2025-20719](https://cve.now/CVE-2025-20719.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7603, MT7615, MT7622, MT7915, MT7916, MT…)
- [CVE-2025-20718](https://cve.now/CVE-2025-20718.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20709](https://cve.now/CVE-2025-20709.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20710](https://cve.now/CVE-2025-20710.md): In wlan AP driver, there is a possible out of bounds write due to an integer overflow. (CVSS 8.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20711](https://cve.now/CVE-2025-20711.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7916, MT7981, MT7986)
- [CVE-2025-20712](https://cve.now/CVE-2025-20712.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6990, MT7990, MT7991, MT7992, MT7993)
- [CVE-2025-46581](https://cve.now/CVE-2025-46581.md): ZTE ZXCDN product has a Struts RCE Vulnerability (CVSS 9.8, ZTE ZXCDN)
- [CVE-2025-41699](https://cve.now/CVE-2025-41699.md): Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-41718](https://cve.now/CVE-2025-41718.md): Murrelektronik: Unprotected Transport of Credentials (CVSS 7.5, Murrelektronik Firmware Impact67 Pro)
- [CVE-2025-41707](https://cve.now/CVE-2025-41707.md): Phoenix Contact: WebSocket Handler Denial of Service (CVSS 5.3, Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP · Phoenix Con… +2)
- [CVE-2025-41706](https://cve.now/CVE-2025-41706.md): Phoenix Contact: Webserver Denial of Service through Malformed Content-Length (CVSS 5.3, Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP · Phoenix Con… +2)
- [CVE-2025-41705](https://cve.now/CVE-2025-41705.md): Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials (CVSS 6.8, Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP · Phoenix Con… +2)
- [CVE-2025-41704](https://cve.now/CVE-2025-41704.md): Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code (CVSS 5.3, Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP · Phoenix Con… +2)
- [CVE-2025-41703](https://cve.now/CVE-2025-41703.md): Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command (CVSS 7.5, Phoenix Contact QUINT4-UPS/24DC/24DC/5/EIP · Phoenix Con… +2)
- [CVE-2025-55078](https://cve.now/CVE-2025-55078.md): Incomplete validation of kernel object pointers in system calls (CVSS 5.7, Eclipse Foundation ThreadX)
- [CVE-2025-11731](https://cve.now/CVE-2025-11731.md): Libxslt: type confusion in exsltfuncresultcompfunction of libxslt (CVSS 3.1, libxslt · Red Hat Hardened Images +2)
- [CVE-2025-8594](https://cve.now/CVE-2025-8594.md): Pz-LinkCard \< 2.5.7 - Contributor+ SSRF (CVSS 3.8, Pz-LinkCard)
- [CVE-2025-10357](https://cve.now/CVE-2025-10357.md): Simple SEO \< 2.0.32 - Contributor+ Stored XSS (CVSS 6.1, Simple SEO)
- [CVE-2025-10732](https://cve.now/CVE-2025-10732.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure (CVSS 4.3, brainstormforce SureForms – Contact Form, Payment Form & Ot…)
- [CVE-2025-59889](https://cve.now/CVE-2025-59889.md): Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the (CVSS 8.6, Eaton IPP software)
- [CVE-2025-42939](https://cve.now/CVE-2025-42939.md): Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) (CVSS 4.3, SAP\_SE SAP S/4HANA)
- [CVE-2025-42937](https://cve.now/CVE-2025-42937.md): Directory Traversal vulnerability in SAP Print Service (CVSS 9.8, SAP\_SE SAP Print Service)
- [CVE-2025-42910](https://cve.now/CVE-2025-42910.md): Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management (CVSS 9.0, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-42909](https://cve.now/CVE-2025-42909.md): Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances (CVSS 3.0, SAP\_SE SAP Cloud Appliance Library Appliances)
- [CVE-2025-42908](https://cve.now/CVE-2025-42908.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2025-42906](https://cve.now/CVE-2025-42906.md): Directory Traversal vulnerability in SAP Commerce Cloud (CVSS 5.3, SAP\_SE SAP Commerce Cloud)
- [CVE-2025-42903](https://cve.now/CVE-2025-42903.md): User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management (CVSS 4.3, SAP\_SE SAP Financial Service Claims Management)
- [CVE-2025-42902](https://cve.now/CVE-2025-42902.md): Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform (CVSS 5.3, SAP\_SE SAP Netweaver AS ABAP and ABAP Platform)
- [CVE-2025-42901](https://cve.now/CVE-2025-42901.md): Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser) (CVSS 5.4, SAP\_SE SAP Application Server for ABAP)
- [CVE-2025-54603](https://cve.now/CVE-2025-54603.md): An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation (CVSS 9.0)
- [CVE-2025-56747](https://cve.now/CVE-2025-56747.md): Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api\_instructor controller where regul (CVSS 6.5)
- [CVE-2025-57563](https://cve.now/CVE-2025-57563.md): A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files. (CVSS 6.5)
- [CVE-2025-57618](https://cve.now/CVE-2025-57618.md): A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. (CVSS 7.3)
- [CVE-2025-60374](https://cve.now/CVE-2025-60374.md): Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. (CVSS 6.1)
- [CVE-2025-60535](https://cve.now/CVE-2025-60535.md): A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary ope (CVSS 7.3)
- [CVE-2025-60536](https://cve.now/CVE-2025-60536.md): An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploadi (CVSS 7.5)
- [CVE-2025-60537](https://cve.now/CVE-2025-60537.md): Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute (CVSS 6.5)
- [CVE-2025-60540](https://cve.now/CVE-2025-60540.md): karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF). (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.