CVE-2025-21042
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Tuesday's vulnerability landscape marks a return to critical vulnerability activity with 3 critical CVEs (first critical disclosures after a 3-day absence) alongside a 147% surge in high-priority vulnerabilities from Monday's 19 to 47 CVEs. Six actively exploited CISA KEV vulnerabilities require immediate remediation across Samsung Mobile, Gladinet Triofox, Microsoft Windows, WatchGuard Firebox, Google Chromium, and Oracle Fusion Middleware systems. The disclosure environment features maximum severity CVSS 9.8-9.9 vulnerabilities affecting MILLENSYS Vision Tools (unauthenticated credential exposure), Fluent Bit log processing (command injection), and Desktop Security System (directory traversal), representing a significant Tuesday escalation in attack surface risk.
Immediate action: IMMEDIATE TUESDAY RESPONSE: Security teams must prioritize the three critical vulnerabilities disclosed today, starting with CVE-2025-63958 (MILLENSYS Vision Tools), which exposes plaintext database credentials through an unauthenticated configuration endpoint accessible at /MILLENSYS/settings. Organizations running MILLENSYS Vision Tools Workspace 6.5.0.2585 should immediately implement Web Application Firewall rules to block external access to this endpoint, rotate all exposed database credentials, and apply vendor patches. CVE-2025-25736 (Fluent Bit) requires immediate mitigation for organizations using Fluent Bit log processing in production environments, as threat actors can inject malicious commands through log data processed by in_http, in_splunk, and in_elasticsearch plugins. Deploy input validation filters and update to patched Fluent Bit versions urgently. CVE-2025-38064 (Desktop Security System) demands directory traversal protection through application server configuration hardening and access control verification. The six CISA KEV vulnerabilities require continued priority remediation to meet federal compliance deadlines, with Samsung Mobile, Microsoft Windows, and Google Chromium V8 vulnerabilities enabling privilege escalation and code execution attacks across consumer and enterprise devices. Organizations should leverage Tuesday maintenance windows to address the 147% surge in high-priority CVEs, focusing first on the 15 CVEs enhanced with Gemini AI analyst comments (indicated by the analysis badge) that provide detailed exploitation scenarios and compensating controls. For vulnerabilities lacking vendor patches, implement network segmentation to isolate affected systems, deploy Web Application Firewalls with command injection and directory traversal detection rules, enable enhanced logging to detect exploitation attempts, and restrict administrative access to trusted IP addresses only.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function.
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.
A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions.
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the âsite_idâ parameter in all versions up to, and including, 4
The update mechanism in Xtooltech Xtool AnyScan Android Application 4
The WordPress eCommerce Plugin WordPress plugin through 2
The Broken Link Manager WordPress plugin through 0
The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length
NULL pointer dereference in src/coap_openssl
NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl
Integer signedness error in tls_verify_call_back() in src/coap_openssl
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service
Use after free in endpoint destructors in Redboltz async_mqtt 10
A flaw has been found in D-Link DIR-822K and DWR-M920 1
A vulnerability has been found in D-Link DIR-822K and DWR-M920 1
A vulnerability was found in D-Link DIR-822K 1
A vulnerability was determined in D-Link DIR-822K and DWR-M920 1
A vulnerability was identified in D-Link DIR-822K and DWR-M920 1
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1
A weakness has been identified in D-Link DWR-M920 1
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6
A DLL hijacking vulnerability in AMD StoreMIâĸ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution
Incorrect default permissions in AMD StoreMIâĸ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution
A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability
A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session
A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID)
An issue in the size query parameter (/views/file
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability
ZIRA Group WBRM 7
An issue was discovered in Free5GC v4
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6
A security vulnerability has been detected in Campcodes Supplier Management System 1
A vulnerability was detected in Campcodes School File Management System 1
A flaw has been found in Campcodes Online Polling System 1
A vulnerability has been found in Campcodes Online Polling System 1
A vulnerability was found in SourceCodester Company Website CMS 1
A vulnerability was determined in SourceCodester Company Website CMS 1
A vulnerability was identified in D-Link DIR-852 1
A vulnerability was identified in projectworlds Advanced Library Management System 1
A vulnerability has been found in code-projects Library System 1
A security flaw has been discovered in code-projects Jonnys Liquor 1
A weakness has been identified in code-projects Question Paper Generator 1
A vulnerability was detected in code-projects COVID Tracking System 1
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability