CVE-2025-54253
Adobe Experience Manager Forms Code Execution Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
This curated brief highlights 15 critical vulnerabilities and 87 high-priority updates requiring immediate attention.
Adobe Experience Manager Forms Code Execution Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Unspecified Vulnerability - Active in CISA KEV catalog.
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
Microsoft Windows SMB Client Improper Access Control Vulnerability - Active in CISA KEV catalog.
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Adobe Commerce andβ―Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability - Active in CISA KEV catalog.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
XWiki Platform Eval Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
The ShopLentor β WooCommerce Builder for Elementor & Gutenberg +21 Modules β All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, ...
The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in ve...
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set th...
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including...
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.
The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers t...
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions...
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. Thi...
An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EF...
Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, au...
Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters suc...
Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, pote...
Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection.This issue affects CVLand: from 2.1.0 through 20251103.
The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1
The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3
Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1
NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue
The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1
The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3
A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7
Memory corruption while processing large input data from a remote source via a communication interface
In Modem, there is a possible out of bounds write due to a heap buffer overflow
A vulnerability was identified in Tenda AC21 16
A vulnerability has been found in Tenda AC8 16
A vulnerability was found in Tenda A15 15
A vulnerability was determined in Tenda AC10 16
The issue was addressed with improved memory handling
The issue was addressed with improved memory handling
The issue was addressed with improved memory handling
An out-of-bounds write issue was addressed with improved input validation
Memory corruption while processing a GP command response
A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4
An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other usersβ vehicles
Arbitrary code executionΒ is possible due to improper validation of the file upload functionality in Eaton BLSS
This issue was addressed with additional entitlement checks
The issue was addressed with improved checks
Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
An out-of-bounds read was addressed with improved bounds checking
A race condition was addressed with additional validation
A permissions issue was addressed with additional restrictions
This issue was addressed with improved entitlements
A validation issue was addressed with improved input sanitization
An out-of-bounds read was addressed with improved input validation
A permissions issue was addressed with additional restrictions
Memory corruption while performing encryption and decryption commands
Memory corruption while processing audio streaming operations
Memory corruption while processing request sent from GVM
Memory corruption while processing client message during device management
Memory corruption when triggering a subsystem crash with an out-of-range identifier
Memory corruption while accessing a buffer during IOCTL processing
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing
In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
Directory traversal vulnerability in NextChat thru 2
A permissions issue was addressed with additional restrictions
The issue was addressed with improved memory handling
An out-of-bounds access issue was addressed with improved bounds checking
A privacy issue was addressed by removing the vulnerable code
This issue was addressed with improved redaction of sensitive information
A denial-of-service issue was addressed with improved validation
A permissions issue was addressed with additional sandbox restrictions
A permissions issue was addressed with additional sandbox restrictions
An access issue was addressed with additional sandbox restrictions
The issue was addressed with improved bounds checks
A permissions issue was addressed with additional restrictions
A privacy issue was addressed by removing sensitive data
A permissions issue was addressed with additional restrictions
The issue was addressed with improved handling of caches
A logic issue was addressed with improved checks
This issue was addressed by restricting options offered on a locked device
This issue was addressed through improved state management
The issue was addressed with improved memory handling
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions
A permissions issue was addressed with additional restrictions
The issue was addressed by adding additional logic
A privacy issue was addressed with improved handling of user preferences
A privacy issue was addressed by removing sensitive data
In ims service, there is a possible out of bounds write due to a missing bounds check
In Modem, there is a possible out of bounds write due to an incorrect bounds check
An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580
An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400
An issue was discovered in NPU in Samsung Mobile Processor Exynos through July 2025
An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500
An issue was discovered in the NPU driver in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents
A vulnerability has been found in itsourcecode Online Loan Management System 1
A vulnerability was found in itsourcecode Online Loan Management System 1
A vulnerability was determined in itsourcecode Online Loan Management System 1
A vulnerability was identified in itsourcecode Online Loan Management System 1
A security flaw has been discovered in itsourcecode Online Loan Management System 1
A flaw has been found in itsourcecode Billing System 1
Open Source Social Network (OSSN) 8
The privileged user could log in without sufficient credentials after enabling an application protocol
IdentityIQ 8
IBM InfoSphere Information Server 11
An out-of-bounds access issue was addressed with improved bounds checking
An out-of-bounds access issue was addressed with improved bounds checking