Critical vulnerabilities, curated daily for security professionals
🎯 SSCV Profile
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Risk scores will be adjusted based on your selected environment
📊
Archived Security Brief
This week's threat landscape delivered 109 critical vulnerabilities and 48 actively exploited CISA KEV entries, marking an intense period for security teams. D-Link surveillance infrastructure faces catastrophic authentication bypass exposures with federal deadlines expiring Monday. Friday brings fresh threats including Salesforce Tableau type confusion (CVE-2025-26496, CVSS 9.6) and Voltronic Power management systems with perfect CVSS 10 remote code execution. The week saw WordPress ecosystem under sustained attack, Microsoft Office vulnerabilities resurface in KEV catalog, and critical authentication bypasses across enterprise platforms.
109 critical vulnerabilities disclosed this week - 33% above average
48 CISA KEV entries with 3 federal deadlines expiring Monday August 25
Friday: Voltronic Power management RCE with CVSS 10 - public exploit available
Salesforce Tableau Server type confusion enables complete environment compromise
MallChat authentication bypass grants full API access without credentials
Immediate action: URGENT: D-Link DCS-2530L, DCS-2670L, and DNR-322L devices must be isolated or replaced by Monday federal deadline. Patch Voltronic Power ViewPower/PowerShield immediately. Review and secure all Tableau Server instances.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Section Navigation
⚠️
CISA Known Exploited Vulnerabilities
⚠️ CISA KEVURGENT
CVE-2020-25078
9.5
D-LinkDCS-2530L and DCS-2670L Devices
⏰ Federal Deadline:August 25, 2025(3 days remaining)
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEVURGENT
CVE-2020-25079
9.5
D-LinkDCS-2530L and DCS-2670L Devices
⏰ Federal Deadline:August 25, 2025(3 days remaining)
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEVURGENT
CVE-2022-40799
9.5
D-LinkDNR-322L
⏰ Federal Deadline:August 25, 2025(3 days remaining)
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEV
CVE-2025-8088
9.5
RARLABWinRAR
⏰ Federal Deadline:September 1, 2025(10 days remaining)
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEV
CVE-2007-0671
9.5
MicrosoftOffice
⏰ Federal Deadline:September 1, 2025(10 days remaining)
Microsoft Office Excel Remote Code Execution Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEV
CVE-2013-3893
9.5
MicrosoftInternet Explorer
⏰ Federal Deadline:September 1, 2025(10 days remaining)
Microsoft Internet Explorer Resource Management Errors Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEV
CVE-2025-54948
9.5📝
Trend MicroApex One
⏰ Federal Deadline:September 7, 2025(16 days remaining)
Trend Micro Apex One OS Command Injection Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
⚠️ CISA KEV
CVE-2025-43300
9.5📝
AppleiOS, iPadOS, and macOS
⏰ Federal Deadline:September 10, 2025(19 days remaining)
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
CVSS Base9.5
→
CRSSelect profile
🚨
Critical Vulnerabilities
CVE-2025-26496
9.6📝
Access of Resource Using Incompatible TypeMultiple Products
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue...
CVSS Base9.6
→
CRSSelect profile
CVE-2024-50645
9.8📝
MallChatMultiple Products
MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token.
CVSS Base9.8
→
CRSSelect profile
CVE-2022-31491
10📝
Voltronic Power ViewPower throughMultiple Products
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interfac...
CVSS Base10
→
CRSSelect profile
CVE-2025-9254
9.8📝
WebITR developed by Uniong has a Missing AuthenticationMultiple Products
WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specific functionality.
CVSS Base9.8
→
CRSSelect profile
CVE-2022-43110
9.8📝
Voltronic Power ViewPower throughMultiple Products
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote att...
CVSS Base9.8
→
CRSSelect profile
CVE-2025-29365
9.8📝
spimsimulator spimMultiple Products
spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL.
CVSS Base9.8
→
CRSSelect profile
CVE-2024-52786
9.8📝
An authentication bypass vulnerability inMultiple Products
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL.
CVSS Base9.8
→
CRSSelect profile
CVE-2025-55613
9.8📝
TendaMultiple Products
Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter.
CVSS Base9.8
→
CRSSelect profile
CVE-2024-53496
9.8📝
Incorrect access control in the doFilter function ofMultiple Products
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.
CVSS Base9.8
→
CRSSelect profile
⚠️
High Priority Updates
CVE-2025-9255
7.5📝
WebITRMultiple Products
WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents
CVSS Base7.5
→
CRSSelect profile
CVE-2025-52451
8.5📝
TableauMultiple Products
Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal
CVSS Base8.5
→
CRSSelect profile
CVE-2025-8592
8.1📝
WordPressMultiple Products
The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2
CVSS Base8.1
→
CRSSelect profile
CVE-2025-55230
7.8📝
UntrustedMultiple Products
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally
CVSS Base7.8
→
CRSSelect profile
CVE-2024-56179
7.8📝
priorMultiple Products
In MindManager Windows versions prior to 24
CVSS Base7.8
→
CRSSelect profile
CVE-2025-50674
7.8📝
issueMultiple Products
An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user
CVSS Base7.8
→
CRSSelect profile
CVE-2025-55231
7.5📝
ConcurrentMultiple Products
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code over a network
CVSS Base7.5
→
CRSSelect profile
CVE-2025-9302
7.3📝
ManagementMultiple Products
A vulnerability was identified in PHPGurukul User Management System 1
CVSS Base7.3
→
CRSSelect profile
CVE-2025-9307
7.3📝
CourseMultiple Products
A flaw has been found in PHPGurukul Online Course Registration 3
CVSS Base7.3
→
CRSSelect profile
CVE-2025-8281
7.1📝
WordPressMultiple Products
The WP Talroo WordPress plugin through 2
CVSS Base7.1
→
CRSSelect profile
CVE-2024-48988
7.6📝
Apache SQL InjectionMultiple Products
SQL Injection vulnerability in Apache StreamPark
CVSS Base7.6
→
CRSSelect profile
CVE-2025-38743
7.8📝
DellMultiple Products
Dell iDRAC Service Module (iSM), versions prior to 6
CVSS Base7.8
→
CRSSelect profile
CVE-2025-55573
8.8📝
QuantumNousMultiple Products
QuantumNous new-api v
CVSS Base8.8
→
CRSSelect profile
CVE-2024-50641
8.1📝
An authenticationMultiple Products
An authentication bypass vulnerability in PandoraNext-TokensTool v0
CVSS Base8.1
→
CRSSelect profile
CVE-2025-52194
7.5📝
libsndfileMultiple Products
A buffer overflow vulnerability exists in libsndfile version 1
CVSS Base7.5
→
CRSSelect profile
CVE-2025-9297
8.8
wasMultiple Products
A vulnerability was detected in Tenda i22 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-9298
8.8
flawMultiple Products
A flaw has been found in Tenda M3 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-9299
8.8
hasMultiple Products
A vulnerability has been found in Tenda M3 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-55368
8.8
IncorrectMultiple Products
Incorrect access control in the component \controller\RoleController
CVSS Base8.8
→
CRSSelect profile
CVE-2025-55370
8.8
IncorrectMultiple Products
Incorrect access control in the component \controller\ResourceController
CVSS Base8.8
→
CRSSelect profile
CVE-2025-9303
8.8
TOTOLINKMultiple Products
A security flaw has been discovered in TOTOLINK A720R 4
CVSS Base8.8
→
CRSSelect profile
CVE-2025-55420
8.8
ReflectedMultiple Products
A Reflected Cross Site Scripting (XSS) vulnerability was found in /index
CVSS Base8.8
→
CRSSelect profile
CVE-2025-55743
8.8
UnoPimMultiple Products
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework
CVSS Base8.8
→
CRSSelect profile
CVE-2025-57761
8.8
WebMultiple Products
WeGIA is a Web manager for charitable institutions
CVSS Base8.8
→
CRSSelect profile
CVE-2025-52351
8.8
AikaanMultiple Products
Aikaan IoT management platform v3
CVSS Base8.8
→
CRSSelect profile
CVE-2025-51606
8.8
UnknownMultiple Products
hippo4j 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-57800
8.8
audiobookMultiple Products
Audiobookshelf is an open-source self-hosted audiobook server
CVSS Base8.8
→
CRSSelect profile
CVE-2025-52287
8.8
ScriptMultiple Products
OperaMasks SDK ELite Script Engine v0
CVSS Base8.8
→
CRSSelect profile
CVE-2025-6791
8.8
monitoringMultiple Products
On the monitoring event logs page, it is possible to alter the http request to insert a payload in the DB
CVSS Base8.8
→
CRSSelect profile
CVE-2025-9355
8.8
LinksysMultiple Products
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-9356
8.8
LinksysMultiple Products
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1
CVSS Base8.8
→
CRSSelect profile
CVE-2025-55383
8.6
MossMultiple Products
Moss before v0
CVSS Base8.6
→
CRSSelect profile
CVE-2025-7051
8.3
centralMultiple Products
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server
CVSS Base8.3
→
CRSSelect profile
CVE-2025-51605
8.1
issueMultiple Products
An issue was discovered in Shopizer 3
CVSS Base8.1
→
CRSSelect profile
CVE-2025-55741
8.1
UnoPimMultiple Products
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework
CVSS Base8.1
→
CRSSelect profile
CVE-2025-57771
8.1
RooMultiple Products
Roo Code is an AI-powered autonomous coding agent that lives in users' editors
CVSS Base8.1
→
CRSSelect profile
CVE-2025-55742
8
UnoPimMultiple Products
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework
CVSS Base8
→
CRSSelect profile
CVE-2025-33120
7.8
IBMMultiple Products
IBM QRadar SIEM 7
CVSS Base7.8
→
CRSSelect profile
CVE-2025-55564
7.5
TendaMultiple Products
Tenda AC15 v15
CVSS Base7.5
→
CRSSelect profile
CVE-2025-48956
7.5
servingMultiple Products
vLLM is an inference and serving engine for large language models (LLMs)
CVSS Base7.5
→
CRSSelect profile
CVE-2025-27721
7.5
SystemMultiple Products
Unauthorized users can access INFINITT PACS System Manager without proper authorization,
which could lead to unauthorized access to system resources
CVSS Base7.5
→
CRSSelect profile
CVE-2025-55631
7.5
ReolinkMultiple Products
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3
CVSS Base7.5
→
CRSSelect profile
CVE-2025-55634
7.5
RTMPMultiple Products
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3
CVSS Base7.5
→
CRSSelect profile
CVE-2025-9304
7.3
ManagementMultiple Products
A weakness has been identified in SourceCodester Online Bank Management System 1
CVSS Base7.3
→
CRSSelect profile
CVE-2025-9305
7.3
ManagementMultiple Products
A security vulnerability has been detected in SourceCodester Online Bank Management System 1
CVSS Base7.3
→
CRSSelect profile
CVE-2025-9311
7.3
ManagementMultiple Products
A vulnerability was identified in itsourcecode Apartment Management System 1
CVSS Base7.3
→
CRSSelect profile
CVE-2025-55524
7.3
InsecureMultiple Products
Insecure permissions in Agent-Zero v0
CVSS Base7.3
→
CRSSelect profile
CVE-2025-55630
7.3
ReolinkMultiple Products
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3
CVSS Base7.3
→
CRSSelect profile
CVE-2025-55581
7.3
D-LinkMultiple Products
D-Link DCS-825L firmware version 1
CVSS Base7.3
→
CRSSelect profile
CVE-2025-4650
7.2
UserMultiple Products
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
CVSS Base7.2
→
CRSSelect profile
CVE-2025-54460
7.1
TheMultiple Products
The vulnerability, if exploited, could allow an authenticated miscreant
(with privileges to create or access publication targets of type Text
File or HDFS) to upload and persist files that could potentially be
executed
CVSS Base7.1
→
CRSSelect profile
CVE-2025-51989
7
registrationMultiple Products
HTML injection vulnerability in the registration interface in Evolution Consulting Kft