CVE-2025-58034
Fortinet FortiWeb OS Command Injection Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Saturday's vulnerability landscape demonstrates significant moderation with 6 critical vulnerabilities (50% decrease from yesterday's 12), including two maximum severity CVSS 10.0 issues affecting unknown systems and Grafana Enterprise SCIM provisioning. High-priority CVEs remained unchanged at 44, while nine actively exploited CISA KEV vulnerabilities continue to require priority weekend remediation. The disclosure environment features two CVSS 10.0 vulnerabilities and four CVSS 9.8/9.1 vulnerabilities enabling unauthenticated remote code execution and authentication bypass attacks. Patch availability improved to 24% from yesterday's 17%, enabling more direct remediation heading into the weekend.
Immediate action: WEEKEND PRIORITY ACTION: Security teams must immediately assess CVE-2025-65108 and CVE-2025-41115 (both CVSS 10.0) to determine environmental presence and impact despite vendor uncertainty. Priority weekend patching should address the three CVSS 9.8 unauthenticated remote code execution vulnerabilities, particularly CVE-2025-11456 (WordPress HelpDesk), CVE-2025-11127 (WordPress Mobile App plugin), and CVE-2025-64310 (EPSON projector products) where weekend vendor patch deployment may be feasible. With 24% patch availability (7% improvement), organizations should leverage weekend maintenance windows for direct remediation where possible. The nine actively exploited CISA KEV vulnerabilities require continued weekend focus, with network segmentation, administrative access restrictions, and Web Application Firewall deployment as compensating controls for the remaining 76% unpatched vulnerabilities until vendors release updates.
Fortinet FortiWeb OS Command Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
SCIM provisioning wasΒ introducedΒ in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only ifΒ allΒ of the following conditions are met: - `enableSCIM`Β feature flag set to true - `user_sync_enabled`Β config option in theΒ `[auth.scim]`Β block set to true
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.
EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack.
The Vitepos β Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3
The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1
The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1
The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2
Azure Monitor Elevation of Privilege Vulnerability
Microsoft Defender Portal Spoofing Vulnerability
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2
Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows)
The fetch function in file thinkphp\library\think\Template
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1
The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6
The S2B AI Assistant β ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeFile() function in all versions up to, and including, 1
The Flo Forms β Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash
Vaultβs Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration
A flaw has been found in Tenda AC21 16
A vulnerability has been found in Tenda AC21 16
Authorization bypass in Revive Adserver 5
IBM webMethods Integration 10
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network
vLLM is an inference and serving engine for large language models (LLMs)
Improper input neutralization in the stats-conversions
Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection
Roo Code is an AI-powered autonomous coding agent that lives in users' editors
Kafka dissector crash in Wireshark 4
Wazuh is a free and open source platform used for threat prevention, detection, and response
Vulnerability in LimeSurvey 6
Vulnerability in LimeSurvey 6
An issue was discovered in Clerk-js 5
FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless
Qlik Sense Enterprise v14
In RNP version 0
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing
A security vulnerability has been detected in UTT θΏε 750W up to 3
A vulnerability was found in code-projects Online Shop Project 1
A vulnerability was identified in SourceCodester Online Shop Project 1
Lite XL versions 2
Lite XL versions 2
A security flaw has been discovered in itsourcecode Online File Management System 1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd
Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd
Missing authorization check in Revive Adserver 5
A security flaw has been discovered in Muse Group MuseHub 2