CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Sunday's vulnerability disclosures dropped to 2 critical CVEs, an 85% decrease from Saturday's 13 critical issues. High-priority vulnerabilities also declined significantly to 39, down 57% from yesterday's 91. The actively exploited vulnerability count holds steady at 17 KEV entries, including threats affecting Fortinet products, Android Framework, SonicWall SMA1000, Cisco products, and Microsoft Windows. Notable critical vulnerabilities include CVE-2025-13329 and CVE-2025-13619, both WordPress plugin file upload and privilege escalation flaws. With 0% patch availability reported, organizations should prioritize network segmentation and access controls for affected systems.
Immediate action: Focus immediate attention on the 17 actively exploited KEV vulnerabilities, particularly those affecting perimeter devices like Fortinet, SonicWall SMA1000, and WatchGuard Firebox. Implement network segmentation, disable unnecessary services, and enhance monitoring for affected systems until patches become available. Weekend security teams should maintain heightened awareness given the number of exploitation-active vulnerabilities.
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability - Active in CISA KEV catalog.
Android Framework Information Disclosure Vulnerability - Active in CISA KEV catalog.
Android Framework Privilege Escalation Vulnerability - Active in CISA KEV catalog.
SonicWall SMA1000 Missing Authorization Vulnerability - Active in CISA KEV catalog.
Cisco Multiple Products Improper Input Validation Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out of Bounds Write Vulnerability - Active in CISA KEV catalog.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Use After Free Vulnerability - Active in CISA KEV catalog.
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Google Chromium Out of Bounds Memory Access Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
The Live Composer â Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites â PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7
ArcSearch for iOS versions prior to 1
ArcSearch for Android versions prior to 1
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3
The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2
igmpproxy 0
BrainyCP 1
Dotclear 2
Flatnux 2021-03
A security vulnerability has been detected in Tenda AC18 15
A vulnerability was detected in Tenda AC18 15
A flaw has been found in Tenda FH1201 and FH1206 1
A vulnerability has been found in Tenda FH1201 1
Arcsoft PhotoStudio 6
OCS Inventory NG 2
AspEmail 5
Langflow is a tool for building and deploying AI-powered agents and workflows
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels
EVE-NG 6
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client
Turms AI-Serving module v0
The Takes web framework's TkFiles take thru 2
LDAP Tool Box Self Service Password 1
Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses
A weakness has been identified in code-projects Scholars Tracking System 1
A security vulnerability has been detected in code-projects Scholars Tracking System 1
A vulnerability was detected in Campcodes Supplier Management System 1
A weakness has been identified in code-projects Simple Stock System 1
A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1
A vulnerability was detected in code-projects Simple Blood Donor Management System 1
A vulnerability was identified in itsourcecode Student Management System 1
A security flaw has been discovered in code-projects Simple Stock System 1
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1
A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1
Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc
Langflow is a tool for building and deploying AI-powered agents and workflows