CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Monday's vulnerability landscape includes 4 critical CVEs (CVSS 9.0+), a 100% increase from yesterday's 2 critical disclosures. High-priority vulnerabilities decreased to 19 from yesterday's 39, representing a 51% reduction. The 17 actively exploited (KEV) vulnerabilities include threats affecting Fortinet products, Android Framework, SonicWall SMA1000, Cisco products, and Microsoft Windows. Notable critical disclosures include CVE-2025-15006 and CVE-2025-15007 affecting Tenda products, and CVE-2025-15016 impacting Ragic Enterprise Cloud Database, all with CVSS 9.8 scores. Patch availability currently stands at 0%, requiring organizations to implement compensating controls while monitoring for vendor updates.
Immediate action: Prioritize network segmentation and access controls for systems affected by KEV vulnerabilities, particularly Fortinet, SonicWall SMA1000, and Cisco products. Monitor vendor security advisories for patch releases and implement network-based detection for exploitation attempts. Beginning-of-week staffing should account for elevated KEV count requiring coordinated response across security teams.
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability - Active in CISA KEV catalog.
Android Framework Information Disclosure Vulnerability - Active in CISA KEV catalog.
Android Framework Privilege Escalation Vulnerability - Active in CISA KEV catalog.
SonicWall SMA1000 Missing Authorization Vulnerability - Active in CISA KEV catalog.
Cisco Multiple Products Improper Input Validation Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out of Bounds Write Vulnerability - Active in CISA KEV catalog.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Use After Free Vulnerability - Active in CISA KEV catalog.
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Google Chromium Out of Bounds Memory Access Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the component HTTP Request Handler. This manipulation of the argument ipaddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.
A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the component HTTP Request Handler. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
The Live Composer â Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites â PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5
Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3
The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2
A security vulnerability has been detected in Tenda AC18 15
A vulnerability was detected in Tenda AC18 15
A flaw has been found in Tenda FH1201 and FH1206 1
A vulnerability has been found in Tenda FH1201 1
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels
Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1
A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1
A vulnerability has been found in SeaCMS up to 13
A vulnerability was detected in Tenda WH450 1
A vulnerability was found in code-projects Simple Stock System 1
A vulnerability was determined in code-projects Refugee Food Management System 1