CVE-2025-59374
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures reveal 14 critical vulnerabilities (CVSS 9.0+), a substantial increase from zero critical CVEs the prior day. High-priority vulnerabilities also increased significantly to 59, up 269% from the previous day's 16. Three actively exploited vulnerabilities remain on CISA's KEV catalog, affecting ASUS Live Update, Digiever DS-2105 Pro, and MongoDB Server. Notable critical issues include multiple Coolify vulnerabilities (CVE-2025-64419, CVE-2025-64420, CVE-2025-59157) with CVSS scores up to 9.9, WordPress plugin privilege escalation flaws, and SQL injection vulnerabilities across multiple products. Patch availability stands at 0%, requiring organizations to implement compensating controls and monitor vendor advisories.
Immediate action: Organizations using Coolify, WordPress with AS Password Field or FS Registration Password plugins, ASUS Live Update, Digiever DS-2105 Pro, or MongoDB should prioritize review. With no patches currently available, implement network segmentation, access restrictions, and enhanced monitoring for affected systems.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.
The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global allows SQL Injection.This issue affects Infility Global: from n/a through 2.14.48.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.
Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5.7.7.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent allows PHP Local File Inclusion
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3
The Team WordPress plugin before 5
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Corourke iPhone Webclip Manager allows Stored XSS
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server
Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection
Authentication bypass issue exists in OpenBlocks series versions prior to FW5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection
Frappe is a full-stack web application framework
A flaw has been found in Seeyon Zhiyuan OA Web Application System up to 20251223
A vulnerability has been found in Seeyon Zhiyuan OA Web Application System up to 20251223
A security vulnerability has been detected in UTT čŋå 520W 1
A vulnerability was detected in UTT čŋå 520W 1
A flaw has been found in UTT čŋå 520W 1
A vulnerability has been found in UTT čŋå 520W 1
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6
muffon is a cross-platform music streaming client for desktop
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels
An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580
An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs
Spinnaker is an open source, multi-cloud continuous delivery platform
An issue was discovered in Samsung Magician 6
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts allows Retrieve Embedded Sensitive Data
Missing Authorization vulnerability in WPweb Follow My Blog Post allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in Codepeople Sell Downloads allows Exploiting Incorrectly Configured Access Control Security Levels
An issue in ComfyUI-Manager prior to version 3
Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs
Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1
An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123, and Modem 5400
A Denial of Service (DoS) vulnerability in evershop 2
iccDEV provides a set of libraries and tools for working with ICC color management profiles
A vulnerability has been found in code-projects Online Product Reservation System 1
A vulnerability was found in code-projects Online Product Reservation System 1
A vulnerability has been found in bg5sbk MiniCMS up to 1
A vulnerability was found in bg5sbk MiniCMS up to 1
A vulnerability was determined in bg5sbk MiniCMS up to 1
A security flaw has been discovered in code-projects Online Product Reservation System 1
A security vulnerability has been detected in code-projects Online Product Reservation System 1
A vulnerability was found in code-projects Online Product Reservation System 1
A security flaw has been discovered in code-projects Online Product Reservation System 1
A security vulnerability has been detected in code-projects Online Music Site 1
A vulnerability was detected in code-projects Online Music Site 1
A flaw has been found in code-projects Online Music Site 1
In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup
Zimbra Collaboration (ZCS) 10 before 10
vega-functions provides function implementations for the Vega expression language
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, W920, W930, and W1000
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables