CVE-2025-14847
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures revealed only 2 critical vulnerabilities, a 91% decrease from the prior day's 22 critical issues. High-priority CVEs dropped 47% to 53, indicating lighter weekend disclosure volume. Five actively exploited vulnerabilities require attention, including CVE-2025-14847 affecting MongoDB, CVE-2026-20805 targeting Microsoft Windows, and CVE-2025-37164 impacting HPE OneView. The critical issues CVE-2025-10484 and CVE-2025-15403 both affect the RegistrationMagic WordPress plugin with privilege escalation flaws. Patch availability stands at 0%, requiring organizations to implement compensating controls until vendor fixes become available.
Immediate action: Organizations running MongoDB, Microsoft Windows, HPE OneView, Microsoft Office, or Gogs should review exposure to the five actively exploited vulnerabilities. With no patches currently available for yesterday's disclosures, implement network segmentation and access controls as interim mitigations.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Microsoft Office PowerPoint Code Injection Vulnerability - Active in CISA KEV catalog.
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability - Active in CISA KEV catalog.
Gogs Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Information Disclosure Vulnerability - Active in CISA KEV catalog.
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery
WebSSH for iOS 14
The Membership Plugin â Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3
Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network
In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2
Missing about:blank indicator in custom-sized new windows in Dia before 1
In Apache Airflow versions before 3
In Apache Airflow versions before 3
Skipper is an HTTP router and reverse proxy for service composition
wlc is a Weblate command-line client using Weblate's REST API
The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external content provided by an attacker, which can be used to proxy requests through The Librarian infrastructure
Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints
In ConnectWise PSA versions older than 2026
Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX
In the eap-mschapv2 plugin (client-side) in strongSwan before 6
SteelSeries Nahimic 3 1
The issue was addressed with improved bounds checks
DiskBoss Service 12
Acer ePowerSvc 6
Acer Updater Service 1
Acer Backup Manager 3
BOOTP Turbo 2
DHCP Broadband 4
Sandboxie Plus 0
WifiHotSpot 1
Spy Emergency 25
Disk Sorter Server 13
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent
The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and services, enabling scanning of the Hertzner cloud environment that TheLibrarian uses
TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system
Tenda AX-1806 v1
DupTerminator 1
RarmaRadio 2
iDailyDiary 4
Sandboxie 5
In Umbraco UmbracoForms through 8
pyasn1 is a generic ASN
An issue was discovered in Chamillo LMS 1
HCL MyXalytics v6
The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9
A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa
A vulnerability was identified in EasyCMS up to 1
In the portal in LemonLDAP::NG before 2
Freeter 1
Markdownify 1
Markright 1
Marky 0
Moeditor 0
StudyMD 0
WeGIA is a web manager for charitable institutions
In MIT Kerberos 5 (aka krb5) before 1