CVE-2025-13223
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Tuesday's vulnerability landscape shows continued stability with four critical vulnerabilities and 74 high-priority CVEs remaining consistent with Monday's disclosure activity. Nine actively exploited CISA KEV vulnerabilities continue to require remediation. The overall critical CVE frequency maintains a 66% decrease compared to historical averages, reflecting sustained below-average disclosure activity as the work week progresses.
Immediate action: Security teams should continue monitoring the four active critical vulnerabilities and review the 74 high-priority CVEs for applicability. Organizations should prioritize remediation of the nine actively exploited CISA KEV vulnerabilities.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Meta React Server Components Remote Code Execution Vulnerability - Active in CISA KEV catalog.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass
In hasAccountsOnAnyUser of DevicePolicyManagerService
A vulnerability was found in code-projects Currency Exchange System 1
A vulnerability was determined in code-projects Currency Exchange System 1
A vulnerability was identified in code-projects Currency Exchange System 1
A security flaw has been discovered in code-projects Currency Exchange System 1
The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack
A vulnerability was identified in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15
In grantAllowlistedPackagePermissions of SettingsSliceProvider
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge
In startAlwaysOnVpn of Vpn
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads
Incorrect access control in the /api/v1/user endpoint of usememos memos v0
A vulnerability has been found in UTT čŋå 512W up to 1
A weakness has been identified in H3C Magic B1 up to 100R004
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session
Input verification vulnerability in the compression and decompression module
Multi-thread race condition vulnerability in the network management module
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy
In multiple functions of Session
In multiple functions of Session
In disassociate of DisassociationProcessor
In multiple functions of NotificationStation
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code
In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation
In sendCommand of MediaSessionRecord
In multiple functions of CertInstaller
In connectInternal of MediaBrowser
In multiple functions of BaseBundle
In onActivityResult of EditFdnContactScreen
In multiple functions of HeaderPrivacyIconsController
In appendFrom of Parcel
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack
In multiple functions of WifiScanModeActivity
In multiple locations, there is a possible way for an application on a work profile to set the main user's default NFC payment setting due to improper input validation
In getComponentName of MediaButtonReceiverHolder
In onSomePackagesChanged of VoiceInteractionManagerService
In init_pkvm_hyp_vcpu of pkvm
In multiple functions of arm-smmu-v3
In startNextMatchingActivity of ActivityTaskManagerService
In validateIconUserBoundary of PrintManagerService
In findAvailRecognizer of VoiceInteractionManagerService
In setDisplayName of AssociationRequest
In multiple functions of mem_protect
In __pkvm_load_tracing of trace
In preparePackage of InstallPackageHelper
In initDecoder of C2SoftDav1dDec
In onHeaderDecoded of LocalImageResolver
A vulnerability was detected in Chanjet CRM up to 20251121
A flaw has been found in Chanjet TPlus up to 20251121
A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2
A weakness has been identified in Campcodes School File Management System 1
A security vulnerability has been detected in projectworlds Advanced Library Management System 1
A vulnerability was detected in projectworlds Advanced Library Management System 1
A flaw has been found in projectworlds Advanced Library Management System 1
A vulnerability has been found in code-projects Simple Leave Manager 1
A vulnerability was identified in itsourcecode Student Management System 1
A vulnerability has been found in IdeaCMS up to 1
A vulnerability was identified in code-projects Simple Shopping Cart 1
A security flaw has been discovered in code-projects Online Ordering System 1
A weakness has been identified in code-projects Online Ordering System 1
A security vulnerability has been detected in code-projects Online Ordering System 1
A vulnerability was detected in itsourcecode Student Management System 1
A flaw has been found in itsourcecode Student Management System 1
In onUidImportance of DisassociationProcessor
In DefaultTransitionHandler
In DefaultTransitionHandler
A vulnerability has been found in itsourcecode Student Management System 1
A weakness has been identified in UGREEN DH2100+ up to 5
A security vulnerability has been detected in UGREEN DH2100+ up to 5
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11
Race condition vulnerability in the network module
In multiple locations, there is a possible intent filter bypass due to a race condition
In multiple locations of UsbDataAdvancedProtectionHook