CVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures include 20 critical-severity vulnerabilities, marking a 122% increase from the prior day's 9 critical CVEs. High-priority vulnerabilities also increased substantially with 100 CVEs representing a 52% rise. Eight actively exploited vulnerabilities remain on the KEV list, including CVE-2025-58360 affecting OSGeo GeoServer, CVE-2025-14174 in Google Chromium, and CVE-2025-43529 impacting Apple products. Notable critical disclosures include multiple Improper Control of Filename vulnerabilities (CVE-2025-68974, CVE-2025-68987, CVE-2025-68983) with CVSS 9.8 scores affecting multiple products, plus CVE-2025-15255 targeting Tenda devices. Patch availability stands at 0%, requiring organizations to prioritize compensating controls and monitoring.
Immediate action: Organizations using GeoServer, Chromium, Apple products, MongoDB, Tenda devices, Sierra Wireless AirLink, ASUS Live Update, or Gladinet CentreStack should implement additional monitoring and access controls. With 0% patch availability for today's disclosures, focus on network segmentation and detection capabilities for affected systems.
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Google Chromium Out of Bounds Memory Access Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama - A WordPress Theme for Movie Studios and Filmmakers cinerama allows PHP Local File Inclusion.This issue affects Cinerama - A WordPress Theme for Movie Studios and Filmmakers: from n/a through <= 2.4.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through <= 4.2.11.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through <= 2.6.39.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.
Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through 1.1.9.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scripts. Attackers can abuse ping.php, traceroute.php, and dns.php to generate network flooding attacks targeting external hosts.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.
A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay or ffmpeg scripts. Attackers can exploit the vulnerability by calling specific web scripts to disclose radio stream details without requiring authentication.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files. Attackers can exploit the vulnerability by manipulating the 'file' GET parameter to disclose arbitrary files on the affected device.
Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affected Akuvox doorphone and intercom devices.
Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.77, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.77 contains a fix for the issue.
Ksenia Security Lares 4.0 Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.
DVP-12SE11T - Password Protection Bypass
DVP-12SE11T - Out-of-bound memory write Vulnerability
The Lucky Wheel for WooCommerce â Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CedCommerce CedCommerce Integration for Good Market allows PHP Local File Inclusion
phpMyFAQ is an open source FAQ web application
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos allows PHP Local File Inclusion
Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels
A weakness has been identified in BiggiDroid Simple PHP CMS 1
H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter
FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability
FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability
FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels
FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability
FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user session through brute-force attacks and subsequently log into the system
VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data
Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations
DVP-12SE11T - Authentication Bypass via Partial Password Disclosure
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appointify allows Blind SQL Injection
A buffer overflow vulnerability in function gnu_special in file cplus-dem
Buffer overflow vulnerability in function strcat in asan_interceptors
Buffer overflow vulnerability in function dcputchar in decompile
A vulnerability was identified in D-Link DWR-M920 up to 1
A security flaw has been discovered in D-Link DWR-M920 up to 1
A vulnerability was detected in D-Link DWR-M920 up to 1
CWE-434 Unrestricted Upload of File with Dangerous Type
A vulnerability was determined in Tenda AC10U 15
A vulnerability was identified in Tenda AC23 16
A security flaw has been discovered in Tenda AC23 16
A weakness has been identified in Tenda AC10U 15
A vulnerability was found in Tenda M3 1
A vulnerability was determined in Tenda M3 1
A vulnerability was identified in Tenda M3 1
A security flaw has been discovered in Tenda M3 1
A weakness has been identified in Tenda M3 1
Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels
A flaw has been found in Tenda M3 1
A vulnerability has been found in Tenda M3 1
A vulnerability has been found in Tenda AC20 up to 16
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
Tosibox Key Service 3
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
NLB mKlik Macedonia 3
Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels
Ksenia Security Lares 4
Ksenia Security Lares 4
A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65
coturn is a free open source implementation of TURN and STUN Server
An issue was discovered in function d_discriminator in file cp-demangle
An issue was discovered in function d_print_comp_inner in file cp-demangle
givanz VvvebJs 1
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS
Missing Authorization vulnerability in Emraan Cheema CubeWP allows Accessing Functionality Not Properly Constrained by ACLs
DVP-12SE11T - Denial of Service Vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data
The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
SOUND4 IMPACT/FIRST/PULSE/Eco <=2
SoX 14
Fetch FTP Client 5
Anevia Flamingo XL/XS 3
Tinycontrol LAN Controller 1
Ksenia Security Lares 4
A weakness has been identified in code-projects Refugee Food Management System 1
A security vulnerability has been detected in code-projects Refugee Food Management System 1
A vulnerability was detected in code-projects Refugee Food Management System 1
A flaw has been found in code-projects Refugee Food Management System 1
A vulnerability has been found in code-projects Refugee Food Management System 1
A vulnerability was determined in code-projects Assessment Management 1
A vulnerability was identified in code-projects Assessment Management 1
A weakness has been identified in code-projects College Notes Uploading System 1
A flaw has been found in Campcodes Supplier Management System 1
A vulnerability has been found in Campcodes Supplier Management System 1
A security flaw has been discovered in code-projects Refugee Food Management System 1
A flaw has been found in code-projects Simple Stock System 1
A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2e3da4d6f68589424
A vulnerability was identified in Edimax BR-6208AC 1
A security flaw has been discovered in Edimax BR-6208AC 1
A vulnerability was determined in FeehiCMS up to 2
A vulnerability was detected in itsourcecode Society Management System 1
A flaw has been found in itsourcecode Society Management System 1
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prasadkirpekar Advanced Custom CSS allows Reflected XSS