CVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures included 9 critical-severity CVEs, a 200% increase from the prior day's 3. High-priority vulnerabilities also rose substantially to 66 from 26, representing a 154% increase. Eight actively exploited vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog, including issues affecting GeoServer, Google Chromium, Apple products, MongoDB, and ASUS Live Update. Notable critical vulnerabilities include CVE-2025-52691 (CVSS 10) enabling unauthenticated arbitrary file uploads, CVE-2025-68860 affecting Mobile Builder with authentication bypass, and CVE-2025-68897 involving code generation control issues. Patch availability stands at 0%, requiring organizations to prioritize compensating controls and monitoring.
Immediate action: Organizations using GeoServer, Apple products, MongoDB, ASUS Live Update, Chromium, or Gladinet CentreStack should review KEV entries immediately. With no patches currently available for newly disclosed critical issues, implement network segmentation and enhanced monitoring for affected systems.
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Google Chromium Out of Bounds Memory Access Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.7.3.
WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through 1.4.2.
Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through 1.2.
DVP-12SE11T - Password Protection Bypass
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CedCommerce CedCommerce Integration for Good Market allows PHP Local File Inclusion
phpMyFAQ is an open source FAQ web application
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP allows PHP Local File Inclusion
The Plugin Organizer WordPress plugin before 10
A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rakessh Ads24 Lite allows Reflected XSS
Unrestricted Upload of File with Dangerous Type vulnerability in Innorix Innorix WP allows Upload a Web Shell to a Web Server
WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files
DVP-12SE11T - Authentication Bypass via Partial Password Disclosure
A security vulnerability has been detected in TRENDnet TEW-800MB 1
A vulnerability was detected in TRENDnet TEW-800MB 1
A vulnerability was identified in D-Link DWR-M920 up to 1
A security flaw has been discovered in D-Link DWR-M920 up to 1
A vulnerability was detected in D-Link DWR-M920 up to 1
CWE-434 Unrestricted Upload of File with Dangerous Type
A vulnerability was determined in Tenda AC10U 15
A vulnerability was identified in Tenda AC23 16
A security flaw has been discovered in Tenda AC23 16
A weakness has been identified in Tenda AC10U 15
A vulnerability was found in Tenda M3 1
A vulnerability was determined in Tenda M3 1
A vulnerability was identified in Tenda M3 1
A security flaw has been discovered in Tenda M3 1
A weakness has been identified in Tenda M3 1
Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation
In GnuPG through 2
Missing Authorization vulnerability in Gmission Web Fax allows Privilege Abuse, Session Credential Falsification through Manipulation
coturn is a free open source implementation of TURN and STUN Server
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS
Missing Authorization vulnerability in Emraan Cheema CubeWP allows Accessing Functionality Not Properly Constrained by ACLs
DVP-12SE11T - Denial of Service Vulnerability
A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada
A vulnerability has been found in itsourcecode Online Cake Ordering System 1
A vulnerability was found in itsourcecode Online Cake Ordering System 1
A vulnerability was determined in itsourcecode Online Cake Ordering System 1
A vulnerability was identified in itsourcecode Student Management System 1
A security flaw has been discovered in code-projects Refugee Food Management System 1
A weakness has been identified in code-projects Refugee Food Management System 1
A security vulnerability has been detected in code-projects Refugee Food Management System 1
A vulnerability was detected in code-projects Refugee Food Management System 1
A flaw has been found in code-projects Refugee Food Management System 1
A vulnerability has been found in code-projects Refugee Food Management System 1
A vulnerability was determined in code-projects Assessment Management 1
A vulnerability was identified in code-projects Assessment Management 1
A weakness has been identified in code-projects College Notes Uploading System 1
A flaw has been found in Campcodes Supplier Management System 1
A vulnerability has been found in Campcodes Supplier Management System 1
A security flaw has been discovered in code-projects Refugee Food Management System 1
A vulnerability has been found in Tenda WH450 1
A vulnerability was found in Tenda WH450 1
A vulnerability was determined in Tenda WH450 1
A vulnerability was identified in Tenda WH450 1
A security flaw has been discovered in Tenda WH450 1
A vulnerability has been found in Tenda WH450 1
A vulnerability was found in Tenda WH450 1
A vulnerability was determined in Tenda WH450 1
A vulnerability was identified in Tenda WH450 1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prasadkirpekar Advanced Custom CSS allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Councilsoft Content Grid Slider allows Reflected XSS
Missing Authorization vulnerability in Plugin Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sleekplan allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO allows Reflected XSS