CVE-2023-52163 (reserved 2023, disclosed 2025)
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Sunday's disclosure activity reveals 4 critical vulnerabilities (CVSS 9.0+), representing a 64% decrease from the prior day's 11 critical issues. High-priority vulnerabilities also declined substantially, with 34 disclosed compared to 71 previously, a 52% reduction. Four actively exploited vulnerabilities (KEV) require attention, including legacy threats targeting Microsoft Office (CVE-2009-0556), MongoDB Server (CVE-2025-14847), and HPE OneView (CVE-2025-37164). Notable critical disclosures include CVE-2025-65091 affecting XWiki Full Calendar Macro with a maximum CVSS 10 score, CVE-2026-22688 in WeKnora with CVSS 9.9, and CVE-2026-61686 impacting React Router. With 0% patch availability currently reported, organizations should prioritize compensating controls and monitoring until vendor patches are released.
Immediate action: Organizations using Microsoft Office, MongoDB Server, HPE OneView, or Digiever DS-2105 Pro should prioritize review of the four actively exploited vulnerabilities. With no patches currently available for Sunday's disclosures, implement network segmentation, enhanced monitoring, and access restrictions for affected systems until vendor remediation guidance is released.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Microsoft Office PowerPoint Code Injection Vulnerability - Active in CISA KEV catalog.
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability - Active in CISA KEV catalog.
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station
HAX CMS helps manage microsite universe with PHP or NodeJs backends
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0
This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station
Spree is an open source e-commerce solution built with Ruby on Rails
React Router is a router for React
React Router is a router for React
React Router is a router for React
A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3
DevToys is a desktop app for developers
A vulnerability was determined in UTT θΏε 520W 1
A vulnerability was identified in UTT θΏε 520W 1
A security flaw has been discovered in UTT θΏε 520W 1
A weakness has been identified in UTT θΏε 520W 1
A security vulnerability has been detected in UTT θΏε 520W 1
A vulnerability was detected in UTT θΏε 520W 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18
This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device
A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2
Ghost is a Node
Ghost is a Node
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18
An issue in Hero Motocorp Vida V1 Pro 2
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3
A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3
A vulnerability was determined in quickjs-ng quickjs up to 0
GitLab has remediated an issue in GitLab EE affecting all versions from 18