CVE-2025-61932
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Wednesday's security landscape remains stable with 5 critical vulnerabilities (CVSS 9.0+) and 35 high-priority issues, unchanged from Tuesday's disclosure activity. The threat environment continues to be dominated by authentication bypass flaws in EIP Plus (CVE-2025-12866) and New Site Server (CVE-2025-12868), both rated CVSS 9.8, along with critical issues affecting JetBrains YouTrack, Triofox, and Soft Serve. Vendor patches remain available for 13% of disclosed vulnerabilities. Ten vulnerabilities are being actively exploited in the wild, with one urgent deadline passing today (November 12) for Motex LANSCOPE (CVE-2025-61932), while Adobe Commerce and Microsoft Windows patches have deadlines approaching November 13.
Immediate action: URGENT: Motex LANSCOPE CVE-2025-61932 deadline passed today (November 12). Organizations must patch immediately. Priority patching also required for Adobe Commerce (CVE-2025-54236) and Microsoft Windows (CVE-2025-59287) with deadlines November 13. For critical vulnerabilities CVE-2025-12866 (EIP Plus) and CVE-2025-12868 (New Site Server), both CVSS 9.8, organizations should review vendor advisories and implement patches immediately. Given limited patch availability (13%), security teams should implement network segmentation, enhanced monitoring, and access controls for unpatched vulnerabilities.
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Adobe Commerce and Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability - Active in CISA KEV catalog.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
XWiki Platform Eval Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successf...
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on...
In JetBrains YouTrack before 2025.3.104432 misconfiguration in the Junie could lead to exposure of the global Junie token
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create web...
U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents
U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142
Inappropriate implementation in V8 in Google Chrome prior to 142
Race in V8 in Google Chrome prior to 142
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php
Inappropriate implementation in Views in Google Chrome on Windows prior to 142
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs
A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role
Dell Display and Peripheral Manager, versions prior to 2
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups
EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Combodo iTop is a web based IT service management tool
Versions of the package cloudinary before 2
Pdfminer
Combodo iTop is a web based IT service management tool
In JetBrains ReSharper before 2025
In JetBrains YouTrack before 2025
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1
Tenda AX-3 v16
Bugsink is a self-hosted error tracking tool
Bugsink is a self-hosted error tracking tool
A vulnerability was identified in the password generation algorithm when accessing the debug-interface
In JetBrains YouTrack before 2025
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
A vulnerability was detected in code-projects Online Job Search Engine 1
A flaw has been found in SourceCodester Survey Application System 1
A vulnerability was identified in projectworlds Online Admission System 1
Combodo iTop is a web based IT service management tool