CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Friday's vulnerability disclosures include 18 critical and 100 high-priority CVEs, with Microsoft Windows and Office accounting for multiple actively exploited flaws. Critical counts rose 13% from the prior day while high-priority volume held steady. Notable critical disclosures include CVE-2026-26216 (CVSS 10.0, Docker API deployment), CVE-2026-1729 and CVE-2025-14892 (both CVSS 9.8, WordPress), and CVE-2026-26218 (CVSS 9.8, newbee-mall). SmarterTools SmarterMail appears in three separate actively exploited vulnerabilities, and Microsoft products span six KEV entries covering Windows and Office components. No patches are currently available for disclosed vulnerabilities, requiring defenders to prioritize compensating controls and network segmentation.
Immediate action: Prioritize compensating controls for Microsoft Windows, Microsoft Office, and SmarterTools SmarterMail environments given multiple actively exploited vulnerabilities with no patches currently available. Apply network segmentation and restrict access to Docker API, WordPress, and FreePBX instances until vendor patches are released.
SolarWinds Web Help Desk Security Control Bypass Vulnerability - Active in CISA KEV catalog.
Linux Kernel Integer Overflow Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
GNU InetUtils Argument Injection Vulnerability - Active in CISA KEV catalog.
Microsoft Office Security Feature Bypass Vulnerability - Active in CISA KEV catalog.
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX OS Command Injection Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX Improper Authentication Vulnerability - Active in CISA KEV catalog.
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Microsoft Windows NULL Pointer Dereference Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the Windows Shell allows an unauthenticated attacker to bypass security features over a network connection.
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate their privileges locally on the affected system.
A type confusion vulnerability in the Desktop Window Manager (DWM) allows an authorized local attacker to elevate their privileges to a higher level.
A security feature bypass vulnerability in Microsoft Office Word exists due to reliance on untrusted inputs, allowing an unauthorized local attacker to circumvent security protections.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Attackers can send crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter to retrieve comprehensive user information.
Crawl4AI versions prior to 0.8.0 allow unauthenticated remote code execution via the `/crawl` endpoint by exploiting the `hooks` parameter to import arbitrary Python modules.
The newbee-mall application uses unsalted MD5 hashing for password storage, allowing attackers who obtain the database to rapidly recover plaintext credentials via offline attacks.
A Cross-Site Request Forgery (CSRF) vulnerability in Dolibarr ERP & CRM v.22.0.9 allows remote attackers to escalate privileges by manipulating the notes field in perms.php.
The AdForest WordPress theme (<= 6.0.12) is vulnerable to authentication bypass via the sb_login_user_with_otp_fun function, allowing attackers to log in as any user, including admins.
The Prime Listing Manager plugin for WordPress contains a hardcoded secret that allows unauthenticated attackers to gain administrative access to the targeted website.
The newbee-mall application utilizes pre-seeded administrator accounts with predictable default passwords, allowing unauthenticated attackers to gain full administrative control upon deployment.
Prime95 version 29.8 build 6 contains a buffer overflow in the user ID and proxy host fields, allowing remote attackers to execute arbitrary code and establish a bind shell.
Domain Quester Pro 6.02 is vulnerable to a stack-based buffer overflow via the 'Domain Name Keywords' field, allowing remote attackers to execute arbitrary code by overwriting SEH registers.
FTP Navigator 8.03 is vulnerable to a stack-based buffer overflow via the Custom Command textbox, enabling remote code execution through the overwriting of SEH registers.
Airleader Master versions 6.381 and prior allow unauthenticated users to perform unrestricted file uploads to high-privilege webpages, potentially leading to remote code execution.
Farktor Software E-Commerce Package is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands, affecting versions through 27112025.
CordysCRM 1.4.1 contains an SQL Injection vulnerability in the employee list query interface (/user/list) via the 'departmentIds' parameter.
webfsd 1.21 is vulnerable to a buffer overflow through the 'filename' variable in crafted requests, potentially allowing remote attackers to execute arbitrary code.
Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Smart Panel allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Smart Panel: before 20251215.
ClamAV ClamBC bytecode interpreter contains a vulnerability in function name processing that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
SolaX devices fail to validate server certificates when connecting to the MQTTS server, enabling Man-in-the-Middle (MITM) attackers to intercept traffic and issue unauthorized commands.
A privilege escalation vulnerability in authentik allows authenticated users with specific viewing permissions to execute arbitrary code via the property mapping/policy test endpoint.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database
The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun
Dell iDRAC Service Module (iSM) for Windows, versions prior to 6
Use after free in CSS in Google Chrome prior to 145
Heap buffer overflow in Codecs in Google Chrome prior to 145
Inappropriate implementation in WebGPU in Google Chrome prior to 145
The FastDup â Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2
Race in DevTools in Google Chrome prior to 145
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1
Crawl4AI versions prior to 0
In Infoblox NIOS through 9
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer
WorkgroupMail 7
In Infoblox NIOS through 9
P2PWIFICAM2 for iOS 10
Top Password Firefox Password Recovery 2
Dell Update Package (DUP) Framework, versions 23
Thrive Smart Home 1
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code
AVideo Platform 8
Realtek IIS Codec Service 6
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by providing an oversized registration key
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions
A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution
Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary code execution
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18
The installer of M-Track Duo HD version 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18
Zilab Remote Console Server 3
NextVPN 4
A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23
Redir 3
A buffer overflow vulnerability has been reported to affect Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central
An out-of-bounds write vulnerability has been reported to affect Qsync Central
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5
An issue was discovered in Pacom Unison Client 5
Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9
Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9
A logic issue was addressed with improved checks
JUNG Smart Visu Server 1
authentik is an open-source identity provider
AVS Audio Converter 9
FileZen contains an OS command injection vulnerability
Statmatic is a Laravel and Git powered content management system (CMS)
authentik is an open-source identity provider
Kanboard is project management software focused on Kanban methodology
BrightSign players running BrightSign OS series 4 prior to v8
AVS Audio Converter 9
FTP Commander Pro 8
SpotAuditor 5
Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central
A race condition vulnerability exists in MedusaJS Medusa v2
A command injection vulnerability has been reported to affect Media Streaming add-on
BlackMoon FTP Server 3
Mikogo 5
ActiveFax Server 6
An issue was discovered in OpenSatKit 2
This issue was addressed with improved handling of symlinks
This issue was addressed with improved checks
An issue in filosoft Comerc
Wondershare MobileGo 8
Outline is a service that allows for collaborative documentation
OpenMetadata is a unified metadata platform
A weak authentication vulnerability has been reported to affect File Station 5
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication
An issue in Sunbird-Ed SunbirdEd-portal v1
Directory traversal vulnerability in OpenSatKit 2
ajv (Another JSON Schema Validator) through version 8
An issue in Statping-ng v
An issue in Statping-ng v
ASTPP 4
BOOTP Turbo 2
KeePass Password Safe versions before 2
APKF Product Key Finder 2
GTalk Password Finder 2
Backup Key Recovery 2
SpotDialup 1
SpotOutlook 1
TaskCanvas 1
Top Password Software Dialup Password Recovery 1
ZIP Password Recovery 2
Backup Key Recovery 2
BlueAuditor 1
Duplicate Cleaner Pro 4
NBMonitor 1