CVE-2025-54236
Adobe Commerce and Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Thursday's security environment reveals a significant shift in threat patterns with 3 critical vulnerabilities (down 40% from Wednesday) and 100 high-priority issues (up 186% from yesterday's 35 disclosures), marking a dramatic mid-week surge in disclosure activity. The threat landscape is dominated by authentication bypass flaws in Dell Data Lakehouse (CVE-2025-46608, CVSS 9.1) and dual critical vulnerabilities in aEnrich a+HRD (CVE-2025-12870, CVE-2025-12871, both CVSS 9.8). With 12 actively exploited vulnerabilities and only 8% patch availability, organizations face heightened risk. Two urgent CISA KEV deadlines pass today (November 13) for Adobe Commerce and Microsoft Windows WSUS, both rated CVSS 9.5, while two additional Dassault DELMIA Apriso vulnerabilities approach deadlines on November 17.
Immediate action: IMMEDIATE ACTION REQUIRED: Patch Adobe Commerce and Microsoft WSUS systems before end of day to meet federal deadline. Organizations using Dell Data Lakehouse or aEnrich a+HRD must prioritize emergency patching for CVSS 9.0+ authentication bypass vulnerabilities.
Adobe Commerce and Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability - Active in CISA KEV catalog.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
XWiki Platform Eval Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with elevated privileges, compromising system integrity and customer data. Dell recommends customers upgrade to the latest version at the earliest opportunity.
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up to, and including, 0
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network
The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2
Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally
AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2
Inappropriate implementation in V8 in Google Chrome prior to 142
Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23
Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23
Fujitsu fbiosdrv
Memory safety bugs present in Firefox 144 and Thunderbird 144
Out-of-bounds write for some Intel(R) QAT Windows software before version 2
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally
Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally
Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows TDX
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Photoshop Desktop versions 26
Illustrator on iPad versions 3
Illustrator on iPad versions 3
Illustrator on iPad versions 3
Illustrator on iPad versions 3
Illustrator on iPad versions 3
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name
Dell SmartFabric OS10 Software, versions prior to 10
Dell SmartFabric OS10 Software, versions prior to 10
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics allows SQL Injection
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature
Use-after-free in the Audio/Video component
Use-after-free in the WebRTC: Audio/Video component
Improper input validation for some Intel(R) CIP software before version WIN_DCA_2
Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2
Improper input validation for some Intel QuickAssist Technology before version 2
NVIDIA AIStore contains a vulnerability in AuthN
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network
A vulnerability has been identified in Spectrum Power 4 (All versions < V4
A flaw was found in the Observability Operator
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network
Evervault is a payment security solution
Incorrect default permissions in some firmware for the Intel(R) Arc(TM) B-series GPUs within Ring 1: Device Drivers may allow an escalation of privilege
Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc
Same-origin policy bypass in the DOM: Notifications component
Mitigation bypass in the DOM: Security component
Same-origin policy bypass in the DOM: Workers component
Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network
Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege
Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8
NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue
NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation
NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection
InDesign Desktop versions 20
InDesign Desktop versions 20
InCopy versions 20
InCopy versions 20
InCopy versions 20
InDesign Desktop versions 20
InDesign Desktop versions 20
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally
Illustrator versions 28
Illustrator versions 28
Format Plugins versions 1
Format Plugins versions 1
Format Plugins versions 1
A vulnerability has been identified in Spectrum Power 4 (All versions < V4
A vulnerability has been identified in Spectrum Power 4 (All versions < V4
A vulnerability has been identified in Spectrum Power 4 (All versions < V4
A vulnerability has been identified in Altair Grid Engine (All versions < V2026
A vulnerability has been identified in Siemens Software Center (All versions < V3
Substance3D - Stager versions 3
Substance3D - Stager versions 3
Substance3D - Stager versions 3
Substance3D - Stager versions 3
A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability
An issue in Agnitum Outpost Security Suite 7
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions)
SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN