CVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Wednesday's vulnerability landscape demonstrates continued disclosure activity with 6 critical vulnerabilities (50% increase from yesterday's 4) and 86 high-priority vulnerabilities (69% increase from 51). The primary concerns include three CVSS 9.8 vulnerabilities enabling unauthenticated remote code execution across multiple affected devices, alongside three CVSS 9.1 vulnerabilities in SolarWinds Serv-U requiring administrative privileges for exploitation. Patch availability improved modestly to 10% from yesterday's 7%, requiring organizations to maintain compensating controls for the majority of newly disclosed vulnerabilities. Ten actively exploited CISA KEV vulnerabilities continue to require priority remediation across VMware, Fortinet, Microsoft, and Samsung products.
Immediate action: Security teams must immediately address the three unauthenticated remote code execution vulnerabilities (CVE-2025-41734, CVE-2025-9312, CVE-2025-41733) by applying vendor patches where available or implementing network segmentation and access controls. Organizations running SolarWinds Serv-U should evaluate the three CVSS 9.1 vulnerabilities (CVE-2025-40547, CVE-2025-40548, CVE-2025-40549) and restrict administrative access as a compensating control. With 90% of new vulnerabilities lacking vendor patches, implement Web Application Firewalls with command injection and authentication bypass detection rules. Continue priority remediation of the ten actively exploited vulnerabilities while monitoring for the six new critical disclosures.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - Active in CISA KEV catalog.
XWiki Platform Eval Injection Vulnerability - Active in CISA KEV catalog.
Fortinet FortiWeb Path Traversal Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificateâbased authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected.
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8
A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7
A stack-based buffer overflow in Fortinet FortiOS 7
A stack-based buffer overflow in Fortinet FortiOS 7
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution
The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1
The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2
The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules
phpMyFAQ is an open source FAQ web application
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142
The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2
The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1
The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions in all versions up to, and including, 1
A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prior to 5
A buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 prior to 5
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in Fortinet FortiVoice 7
A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5
A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input
EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in denial of web service
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service
Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine
A vulnerability was detected in Tenda AC20 up to 16
A security vulnerability has been detected in Tenda CH22 1
QaTraq 6
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1
A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability
MyScreenTools v2
Piwigo is a full featured open source photo gallery application for the web
IBM Planning Analytics Local 2
In bta_hf_client_cb_init of bta_hf_client_main
A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29
OpenStack Keystone before 26
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only
Glob matches files using patterns the shell uses
IBM Storage Virtualize 8
The password change endpoint in Open Source Point of Sale 3
The openml/openml
Plaintext password storage in Kotaemon 0
Multiple vulnerabilities exist in cbor2 through version 5
A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students
A security vulnerability has been detected in itsourcecode Inventory Management System 1
A vulnerability was determined in lsfusion platform up to 6
A vulnerability was determined in Campcodes School Fees Payment Management System 1
A vulnerability was identified in Campcodes School Fees Payment Management System 1
A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455
A flaw has been found in code-projects Nero Social Networking Site 1
A vulnerability was determined in CodeAstro Simple Inventory System 1
A vulnerability was identified in itsourcecode Online Voting System 1
A vulnerability was found in Campcodes Supplier Management System 1
A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1
A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1
A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1
A vulnerability has been found in itsourcecode Web-Based Internet Laboratory Management System 1
A vulnerability was found in itsourcecode Web-Based Internet Laboratory Management System 1
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1
A weakness has been identified in SourceCodester Train Station Ticketing System 1
A vulnerability was discovered in Awesome Miner thru 11
There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F
There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability
PDFPatcher thru 1
Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO