CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Saturday's vulnerability disclosures center on Microsoft products, with multiple Windows and Office CVEs carrying active exploitation status alongside critical flaws in WordPress plugins, Milvus vector database, and MojoPortal CMS. The day's 5 critical CVEs represent a 72% decrease from the prior day's 18, while 72 high-priority vulnerabilities reflect a 28% drop from 100. CVE-2025-69770 in MojoPortal CMS received the maximum CVSS 10.0 score, and CVE-2026-26190 targeting Milvus vector database and CVE-2026-1306 affecting WordPress both scored 9.8. SmarterTools SmarterMail appears three times among actively exploited vulnerabilities, and Microsoft Windows and Office account for seven KEV entries, indicating sustained attacker focus on enterprise infrastructure. Patch availability stands at 0%, requiring organizations to prioritize compensating controls and monitoring until vendor fixes are released.
Immediate action: Prioritize compensating controls for Microsoft Windows, Office, and SmarterTools SmarterMail environments, as these products represent the largest concentration of actively exploited vulnerabilities. With 0% patch availability, deploy network segmentation, enhanced monitoring, and access restrictions for affected systems — particularly MojoPortal CMS, Milvus, and WordPress instances — until vendor patches are released.
SolarWinds Web Help Desk Security Control Bypass Vulnerability - Active in CISA KEV catalog.
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability - Active in CISA KEV catalog.
Linux Kernel Integer Overflow Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
GNU InetUtils Argument Injection Vulnerability - Active in CISA KEV catalog.
Microsoft Office Security Feature Bypass Vulnerability - Active in CISA KEV catalog.
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX OS Command Injection Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX Improper Authentication Vulnerability - Active in CISA KEV catalog.
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Microsoft Windows NULL Pointer Dereference Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the Windows Shell allows an unauthenticated attacker to bypass security features over a network connection.
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate their privileges locally on the affected system.
A type confusion vulnerability in the Desktop Window Manager (DWM) allows an authorized local attacker to elevate their privileges to a higher level.
A security feature bypass vulnerability in Microsoft Office Word exists due to reliance on untrusted inputs, allowing an unauthorized local attacker to circumvent security protections.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Milvus vector database contains multiple authentication bypass vulnerabilities via exposed TCP ports and unauthenticated REST API endpoints, allowing full data manipulation and credential access.
The midi-Synth WordPress plugin allows unauthenticated arbitrary file uploads via the 'export' AJAX action, potentially leading to remote code execution through exposed nonces.
Truelysell Core plugin for WordPress is vulnerable to unauthenticated privilege escalation, allowing attackers to create administrator accounts by manipulating registration parameters.
MojoPortal CMS is vulnerable to a "Zip Slip" exploit in the SkinList.aspx endpoint, allowing attackers to execute arbitrary commands via a specially crafted zip file upload.
A broken authentication vulnerability in Known allows unauthenticated attackers to retrieve password reset tokens from hidden HTML fields, enabling full account takeover of any user.
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas
Google Chrome is vulnerable to a "Use After Free" condition in its CSS engine, which could allow a remote attacker to execute arbitrary code via a crafted webpage.
The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and including, 3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[]
Crawl4AI versions prior to 0
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer
The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0
In Infoblox NIOS through 9
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer
ADB Explorer, a fluent UI for ADB on Windows, contains a high-severity vulnerability that could lead to unauthorized system access or data manipulation.
In Infoblox NIOS through 9
iNetTools for iOS 8
Thrive Smart Home 1
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1
The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscf_name' parameter in all versions up to, and including, 1
The Super Page Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Activity Log in all versions up to, and including, 5
Versions of the package directorytree/imapengine before 1
Centova Cast 3
Realtek IIS Codec Service 6
A flaw in the AMD power management firmware allows a privileged attacker to send malformed messages to the system management unit, potentially resulting in arbitrary code execution.
p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause a denial of service via a packet sent to the server
Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc
NextVPN 4
Traefik is an HTTP reverse proxy and load balancer
A heap buffer overflow vulnerability in the UPF component of free5GC v4
Authentik, an open-source identity provider, is affected by a high-severity vulnerability that could compromise authentication processes or user identity data.
AVS Audio Converter 9
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc
A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution
A high-severity security vulnerability has been identified in authentik, an open-source identity provider, potentially impacting authentication integrity.
BrightSign players running BrightSign OS series 4 prior to v8
AVS Audio Converter 9
FTP Commander Pro 8
SpotAuditor 5
Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc
lakeFS, an open-source data versioning tool for object storage, contains a high-severity vulnerability that may affect repository security.
The Caido web security auditing toolkit is affected by a high-severity vulnerability that could compromise the security of the auditing environment.
The Cursor AI-powered code editor is affected by a high-severity vulnerability that could impact the security of the developer's environment and source code.
An issue in filosoft Comerc
Wondershare MobileGo 8
Tandoor Recipes, a meal management application, contains a high-severity vulnerability that could lead to unauthorized access or data compromise.
An issue in halo v
A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21
Heatmiser Netmonitor 3
XnConvert 1
FTP Navigator 8
SurfOffline Professional 2
Bullwark Momentum Series JAWS 1
PRO-7070 Hazır Profesyonel Web Sitesi version 1
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts
GHIA CamIP 1
SpotAuditor 5
An array index out of bounds vulnerability in the AMF component of free5GC v4
An improper input validation and protocol compliance vulnerability in free5GC v4
BACnet Stack is a BACnet open source protocol stack C library for embedded systems
An issue in OpenSourcePOS v3
TheSystem 1
thesystem App 1