CVE-2025-61932
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Tuesday's security landscape shows increased disclosure activity with 5 critical vulnerabilities (CVSS 9.0+) and 35 high-priority issues, representing a 218% increase from Monday's 11 high-priority CVEs. The 5 critical vulnerabilities include authentication bypass flaws in EIP Plus and New Site Server (both CVSS 9.8), along with security issues affecting JetBrains YouTrack, Triofox, and Soft Serve. Vendor patches are available for 13% of newly disclosed vulnerabilities. Ten vulnerabilities are being actively exploited in the wild, including issues affecting Adobe Commerce, Microsoft Windows, and Motex LANSCOPE systems that should receive priority attention from security teams.
Immediate action: Priority patching recommended for the 5 critical vulnerabilities, particularly CVE-2025-12866 (EIP Plus) and CVE-2025-12868 (New Site Server) with CVSS 9.8 scores. Organizations using JetBrains YouTrack, Triofox, or Soft Serve should review vendor advisories immediately. For the 10 actively exploited vulnerabilities, implement available patches for Adobe Commerce (CVE-2025-54236), Microsoft Windows (CVE-2025-59287), and Motex LANSCOPE (CVE-2025-61932). Given limited patch availability (13%), security teams should implement network segmentation and enhanced monitoring for unpatched vulnerabilities.
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Adobe Commerce and Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability - Active in CISA KEV catalog.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
XWiki Platform Eval Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successf...
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on...
In JetBrains YouTrack before 2025.3.104432 misconfiguration in the Junie could lead to exposure of the global Junie token
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create web...
U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents
U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142
Inappropriate implementation in V8 in Google Chrome prior to 142
Race in V8 in Google Chrome prior to 142
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php
Inappropriate implementation in Views in Google Chrome on Windows prior to 142
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs
A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role
Dell Display and Peripheral Manager, versions prior to 2
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups
EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Versions of the package cloudinary before 2
Pdfminer
Combodo iTop is a web based IT service management tool
In JetBrains ReSharper before 2025
In JetBrains YouTrack before 2025
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1
Tenda AX-3 v16
Bugsink is a self-hosted error tracking tool
Bugsink is a self-hosted error tracking tool
A vulnerability was identified in the password generation algorithm when accessing the debug-interface
In JetBrains YouTrack before 2025
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
A vulnerability was detected in code-projects Online Job Search Engine 1
A flaw has been found in SourceCodester Survey Application System 1
A vulnerability was identified in projectworlds Online Admission System 1
Combodo iTop is a web based IT service management tool