CVE Brief Security Intelligence

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston allows PHP Local File Inclusion

Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core allows Object Injection

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally

Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally

Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally

Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally

Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally

The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in all versions up to, and including, 1

Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally

Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network

The Ditty WordPress plugin before 3

WeiPHP v5

APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5

Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally

No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally

Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally

Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally

Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally

Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally

Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally

Acrobat Reader versions 24

Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6

Adobe Experience Manager versions 6

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution

Tautulli is a Python based monitoring and tracking tool for Plex Media Server

Tautulli is a Python based monitoring and tracking tool for Plex Media Server

Tautulli is a Python based monitoring and tracking tool for Plex Media Server

When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs

A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection allows SQL Injection

Missing authorization in Ivanti Connect Secure before 22

An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password

A vulnerability ( CVE-2025-21176 https://www

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1

An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging

A vulnerability was detected in Tenda AC20 up to 16

Missing authorization in Ivanti Connect Secure before 22

Missing authorization in Ivanti Connect Secure before 22

CSRF in Ivanti Connect Secure before 22

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network

SMB Server might be susceptible to relay attacks depending on the configuration

A weakness has been identified in UTT 1200GW up to 3

A security vulnerability has been detected in UTT 1200GW up to 3

A vulnerability was detected in UTT 1250GW up to 3

A flaw has been found in UTT 750W up to 3

Dreamweaver Desktop versions 21

CWE-798 Use of Hard-coded Credentials

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server

A vulnerability ( CVE-2024-38229 https://www

A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify App 1

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool

Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally

Premiere Pro versions 25

Substance3D - Viewer versions 0

Substance3D - Viewer versions 0

Substance3D - Viewer versions 0

Substance3D - Modeler versions 1

Substance3D - Modeler versions 1

Substance3D - Modeler versions 1

Missing authorization in Ivanti Connect Secure before 22

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components

A vulnerability (CVE-2025-21172) exists in msdia140

JSON::XS before version 4

JSON::SIMD before version 1

Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build

A vulnerability has been identified in SIMATIC PCS neo V4

A vulnerability has been identified in SIMATIC PCS neo V4

A vulnerability has been identified in SIMATIC PCS neo V4

Improper Validation of Specified Quantity in Input vulnerability in ThemesGrove WP SmartPay