CVE-2025-12480
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Monday's vulnerability disclosure shows 2 critical CVEs and 7 high-priority vulnerabilities, reflecting typical first-weekday activity patterns. Six CISA KEV vulnerabilities continue to require remediation across Samsung Mobile, Gladinet Triofox, Microsoft Windows, WatchGuard Firebox, and Google Chromium systems. Nine CVEs have been enhanced with Gemini AI analysis, providing detailed technical context for security teams.
Immediate action: Security teams should review the 2 critical vulnerabilities and assess organizational exposure to the 7 high-priority CVEs. Organizations should continue addressing the 6 CISA KEV vulnerabilities. Detailed analyst comments are available for 9 CVEs to support remediation planning.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP serverβs normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).
A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
A vulnerability has been found in Chanjet CRM up to 20251106
A security flaw has been discovered in Qualitor 8
Kiteworks MFT orchestrates end-to-end file transfer workflows
Kiteworks MFT orchestrates end-to-end file transfer workflows
Tryton trytond 6