По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2025 г.
207 записей · 26 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
40В плане | CVE-2024-12824Proof of concept | Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Changescriptsbundle · nokri – job board wordpress theme · CWE-620 | Критическая9,8 | — | 2,3 % | 1 мар. 2025 г. |
21Наблюдать | CVE-2025-1799Эксплойта нет | Zorlan SkyCaiji Tool.php previewAction server-side request forgeryskycaiji · skycaiji · CWE-918 | Средняя5,3 | — | 0,3 % | 1 мар. 2025 г. |
25Наблюдать | CVE-2025-1829Эксплойта нет | TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injectiontotolink · x18 firmware · CWE-77 | Средняя5,3 | — | 12,3 % | 2 мар. 2025 г. |
47В плане | CVE-2025-27590Proof of concept | In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux usoxidized web project · oxidized web · CWE-22 | Критическая9,8 | — | 27,5 % | 3 мар. 2025 г. |
34Наблюдать | CVE-2025-1851Эксплойта нет | Tenda AC7 SetFirewallCfg formSetFirewallCfg stack-based overflowtenda · ac7 firmware · CWE-119 | Высокая8,7 | — | 1,0 % | 3 мар. 2025 г. |
30Наблюдать | CVE-2024-53027Proof of concept | Buffer Copy Without Checking Size of Input in WLAN Hostqualcomm · qca9367 firmware · CWE-120 | Высокая7,5 | — | 0,2 % | 3 мар. 2025 г. |
27Наблюдать | CVE-2025-1868Proof of concept | Information display on multiple products from Famatech Corpfamatech corp · advanced ip scanner · CWE-200 | Средняя6,9 | — | 0,2 % | 3 мар. 2025 г. |
31Наблюдать | CVE-2025-0288Proof of concept | Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function,paragon-software · paragon backup \& recovery · CWE-131 | Высокая7,8 | — | 0,4 % | 3 мар. 2025 г. |
35Наблюдать | CVE-2025-27423Эксплойта нет | Improper Input Validation in Vimvim · vim · CWE-77 | Высокая7,1 | — | 22,4 % | 3 мар. 2025 г. |
20Наблюдать | CVE-2023-49031Proof of concept | Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to reaoneadvanced · tikit emarketing · CWE-98 | Средняя5,1 | — | 0,7 % | 3 мар. 2025 г. |
35Наблюдать | CVE-2025-25967Proof of concept | Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF).ddsn · acora cms · CWE-352 | Высокая8,8 | — | 0,5 % | 3 мар. 2025 г. |
36Наблюдать | CVE-2025-26206Proof of concept | Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html coselldone · storefront · CWE-352 | Критическая9,0 | — | 0,6 % | 3 мар. 2025 г. |
34Наблюдать | CVE-2024-51962Эксплойта нет | SQL injection vulnerability in ArcGIS Serveresri · arcgis server · CWE-89 | Высокая8,7 | — | 0,5 % | 3 мар. 2025 г. |
35Наблюдать | CVE-2025-1639Proof of concept | Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationcrowdytheme · arolax · CWE-862 | Высокая8,8 | — | 1,0 % | 4 мар. 2025 г. |
35Наблюдать | CVE-2025-1306Proof of concept | Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Uploadspicethemes · newscrunch · CWE-352 | Высокая8,8 | — | 0,5 % | 4 мар. 2025 г. |
40В плане | CVE-2025-1307Proof of concept | Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Uploadspicethemes · newscrunch · CWE-862 | Критическая9,8 | — | 2,1 % | 4 мар. 2025 г. |
92Срочно | CVE-2024-48248Готовый эксплойт | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lnakivo · backup \& replication director · CWE-36 | Высокая8,6 | KEV | 94,3 % | 4 мар. 2025 г. |
32Наблюдать | CVE-2025-0370Эксплойта нет | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parametervanokhin · shortcodes ultimate · CWE-79 | Средняя5,4 | — | 35,6 % | 4 мар. 2025 г. |
62На этой неделе | CVE-2025-22224Готовый эксплойт | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.vmware · esxi · CWE-367 | Высокая8,2 | KEV | 1,5 % | 4 мар. 2025 г. |
62На этой неделе | CVE-2025-22225Готовый эксплойт | VMware ESXi contains an arbitrary write vulnerability.vmware · esxi · CWE-787 | Высокая8,2 | KEV | 1,0 % | 4 мар. 2025 г. |
55В плане | CVE-2025-22226Готовый эксплойт | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.vmware · esxi · CWE-125 | Средняя6,0 | KEV | 1,7 % | 4 мар. 2025 г. |
28Наблюдать | CVE-2024-10930Proof of concept | Carrier Block Load Privilege Escalationcarrier · block load · CWE-427 | Высокая7,1 | — | 0,3 % | 4 мар. 2025 г. |
17Наблюдать | CVE-2025-26202Proof of concept | Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in CWE-79 | Средняя4,3 | — | 0,6 % | 4 мар. 2025 г. |
23Наблюдать | CVE-2025-26318Proof of concept | hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connectedtsplus · tsplus remote access · CWE-201 | Средняя5,8 | — | 0,9 % | 4 мар. 2025 г. |
89Срочно | CVE-2025-1316Готовый эксплойт | Edimax IC-7100 IP Camera OS Command Injectionedimax · ic-7100 firmware · CWE-78 | Критическая9,3 | KEV | 74,4 % | 4 мар. 2025 г. |
56В плане | CVE-2025-26319Proof of concept | FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.flowiseai · flowise · CWE-434 | Критическая9,8 | — | 55,8 % | 4 мар. 2025 г. |
21Наблюдать | CVE-2024-8682Proof of concept | JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registrationhttps://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 · jnews - wordpress newspaper magazine blog amp theme · CWE-862 | Средняя5,3 | — | 0,2 % | 5 мар. 2025 г. |
21Наблюдать | CVE-2024-48246Proof of concept | Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/bookjanobe · vehicle management system · CWE-79 | Средняя5,4 | — | 0,4 % | 5 мар. 2025 г. |
27Наблюдать | CVE-2025-27515Proof of concept | Laravel has a File Validation Bypasslaravel · framework · CWE-155 | Средняя6,9 | — | 0,7 % | 5 мар. 2025 г. |
24Наблюдать | CVE-2025-27506Proof of concept | NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Pagenocodb · nocodb · CWE-79 | Средняя6,1 | — | 0,7 % | 6 мар. 2025 г. |
27Наблюдать | CVE-2024-57972Proof of concept | The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) tmicrosoft · hololens · CWE-770 | Средняя6,5 | — | 2,5 % | 6 мар. 2025 г. |
39Наблюдать | CVE-2025-25763Proof of concept | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.phpcrmeb · crmeb · CWE-89 | Критическая9,8 | — | 0,9 % | 6 мар. 2025 г. |
19Наблюдать | CVE-2024-9458Proof of concept | Reservit Hotel < 3.0 - Admin+ Stored XSSreservit · reservit hotel · CWE-79 | Средняя4,8 | — | 0,8 % | 7 мар. 2025 г. |
17Наблюдать | CVE-2025-25617Proof of concept | Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.CWE-284 | Средняя4,3 | — | 0,4 % | 7 мар. 2025 г. |
30Наблюдать | CVE-2025-27152Proof of concept | Possible SSRF and Credential Leakage via Absolute URL in axios Requestsaxios · axios · CWE-918 | Высокая7,7 | — | 0,7 % | 7 мар. 2025 г. |
37Наблюдать | CVE-2025-27519Proof of concept | Cognita Arbitrary File Writetruefoundry · cognita · CWE-22 | Критическая9,3 | — | 1,3 % | 7 мар. 2025 г. |
35Наблюдать | CVE-2025-27607Proof of concept | Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependencynhairs · python json logger · CWE-829 | Высокая8,8 | — | 1,6 % | 7 мар. 2025 г. |
25Наблюдать | CVE-2025-2094Эксплойта нет | TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injectiontotolink · ex1800t firmware · CWE-77 | Средняя5,3 | — | 12,9 % | 7 мар. 2025 г. |
40В плане | CVE-2025-1323Proof of concept | WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injectionplechevandrey · wp-recall · CWE-89 | Критическая9,8 | — | 2,9 % | 8 мар. 2025 г. |
27Наблюдать | CVE-2025-27840Proof of concept | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).espressif · esp32 firmware · CWE-912 | Средняя6,8 | — | 1,3 % | 8 мар. 2025 г. |
51В плане | CVE-2025-27636Proof of concept | Apache Camel: Camel Message Header Injection via Improper Filteringapache · camel · CWE-178 | Средняя5,6 | — | 97,0 % | 9 мар. 2025 г. |
24Наблюдать | CVE-2025-2126Proof of concept | JoomlaUX JUX Real Estate GET Parameter realties sql injectionjoomlaux · jux real estate · CWE-74 | Средняя5,3 | — | 11,2 % | 9 мар. 2025 г. |
21Наблюдать | CVE-2025-2127Proof of concept | JoomlaUX JUX Real Estate realties cross site scriptingjoomlaux · jux real estate · CWE-79 | Средняя5,3 | — | 0,9 % | 9 мар. 2025 г. |
25Наблюдать | CVE-2025-2129Proof of concept | Mage AI insecure default initialization of resourceCWE-1188 | Средняя6,3 | — | 1,0 % | 9 мар. 2025 г. |
10Наблюдать | CVE-2025-25615Proof of concept | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.changeweb · unifiedtransform · CWE-284 | Низкая2,7 | — | 0,4 % | 10 мар. 2025 г. |
17Наблюдать | CVE-2025-25616Proof of concept | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams.changeweb · unifiedtransform · CWE-284 | Средняя4,3 | — | 0,4 % | 10 мар. 2025 г. |
14Наблюдать | CVE-2025-26865Proof of concept | Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCEapache · ofbiz · CWE-1336 | Низкая3,5 | — | 0,6 % | 10 мар. 2025 г. |
35Наблюдать | CVE-2025-25614Proof of concept | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow changeweb · unifiedtransform · CWE-284 | Высокая8,8 | — | 0,7 % | 10 мар. 2025 г. |
21Наблюдать | CVE-2025-25620Proof of concept | Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.changeweb · unifiedtransform · CWE-79 | Средняя5,4 | — | 0,5 % | 10 мар. 2025 г. |
99Срочно | CVE-2025-24813Готовый эксплойт | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTapache · tomcat · CWE-44 | Критическая9,8 | KEV | 99,9 % | 10 мар. 2025 г. |
22Наблюдать | CVE-2025-27136Proof of concept | LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injectionrobothy · local-s3 · CWE-611 | Средняя5,5 | — | 0,5 % | 10 мар. 2025 г. |
37Наблюдать | CVE-2025-2135Proof of concept | Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted google · chrome · CWE-843 | Высокая8,8 | — | 6,5 % | 10 мар. 2025 г. |
56В плане | CVE-2025-1661Proof of concept | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusionpluginus · husky - products filter professional for woocommerce · CWE-22 | Критическая9,8 | — | 56,3 % | 11 мар. 2025 г. |
24Наблюдать | CVE-2024-13853Proof of concept | SEO Tools <= 4.0.7 - Reflected XSSzynit · seo tools · CWE-79 | Средняя6,1 | — | 0,6 % | 11 мар. 2025 г. |
32Наблюдать | CVE-2025-2190Эксплойта нет | The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.tecno · com.transsnet.store · CWE-297 | Высокая8,1 | — | 0,3 % | 11 мар. 2025 г. |
30Наблюдать | CVE-2025-1550Proof of concept | Arbitrary Code Execution via Crafted Keras Config for Model Loadingkeras · keras · CWE-94 | Высокая7,3 | — | 2,6 % | 11 мар. 2025 г. |
17Наблюдать | CVE-2025-27893Proof of concept | In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such aarcherirm · archer · CWE-472 | Средняя4,3 | — | 0,3 % | 11 мар. 2025 г. |
88Срочно | CVE-2024-54085Готовый эксплойт | Redfish Authentication Bypassami · megarac sp-x · CWE-290 | Критическая10,0 | KEV | 60,7 % | 11 мар. 2025 г. |
70На этой неделе | CVE-2025-27363Готовый эксплойт | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parsefreetype · freetype · CWE-787 | Высокая8,1 | KEV | 27,7 % | 11 мар. 2025 г. |
31Наблюдать | CVE-2024-54018Эксплойта нет | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a prfortinet · fortisandbox · CWE-78 | Высокая7,2 | — | 10,0 % | 11 мар. 2025 г. |
21Наблюдать | CVE-2025-25747Proof of concept | Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive infodigitaldruid · hoteldruid · CWE-79 | Средняя5,4 | — | 0,5 % | 11 мар. 2025 г. |
33Наблюдать | CVE-2025-24035Proof of concept | Windows Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-591 | Высокая8,1 | — | 1,7 % | 11 мар. 2025 г. |
70На этой неделе | CVE-2025-24054Готовый эксплойт | NTLM Hash Disclosure Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-73 | Средняя5,4 | KEV | 62,2 % | 11 мар. 2025 г. |
33Наблюдать | CVE-2025-24071Proof of concept | Microsoft Windows File Explorer Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-200 | Средняя6,5 | — | 23,3 % | 11 мар. 2025 г. |
30Наблюдать | CVE-2025-24076Proof of concept | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerabilitymicrosoft · windows 11 22h2 · CWE-284 | Высокая7,3 | — | 3,2 % | 11 мар. 2025 г. |
58В плане | CVE-2025-24983Готовый эксплойт | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Высокая7,0 | KEV | 1,3 % | 11 мар. 2025 г. |
49В плане | CVE-2025-24984Готовый эксплойт | Windows NTFS Information Disclosure Vulnerabilitymicrosoft · windows 10 1507 · CWE-532 | Средняя4,6 | KEV | 1,9 % | 11 мар. 2025 г. |
62На этой неделе | CVE-2025-24985Готовый эксплойт | Windows Fast FAT File System Driver Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 | Высокая7,8 | KEV | 3,8 % | 11 мар. 2025 г. |
53В плане | CVE-2025-24991Готовый эксплойт | Windows NTFS Information Disclosure Vulnerabilitymicrosoft · windows 10 1507 · CWE-125 | Средняя5,5 | KEV | 2,0 % | 11 мар. 2025 г. |
62На этой неделе | CVE-2025-24993Готовый эксплойт | Windows NTFS Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 | Высокая7,8 | KEV | 2,1 % | 11 мар. 2025 г. |
67На этой неделе | CVE-2025-26633Готовый эксплойт | Microsoft Management Console Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-707 | Высокая7,0 | KEV | 30,3 % | 11 мар. 2025 г. |
26Наблюдать | CVE-2021-37787Proof of concept | The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POSabocms · abo.cms · CWE-89 | Средняя6,5 | — | 0,3 % | 11 мар. 2025 г. |
71На этой неделе | CVE-2025-24201Готовый эксплойт | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.apple · safari · CWE-787 | Критическая10,0 | KEV | 3,8 % | 11 мар. 2025 г. |
29Наблюдать | CVE-2025-25748Proof of concept | A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifyidigitaldruid · hoteldruid · CWE-352 | Высокая7,3 | — | 0,4 % | 11 мар. 2025 г. |
28Наблюдать | CVE-2025-25749Proof of concept | An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength polidigitaldruid · hoteldruid · CWE-521 | Высокая7,1 | — | 0,6 % | 11 мар. 2025 г. |
27Наблюдать | CVE-2025-27591Proof of concept | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/facebook · below · CWE-732 | Средняя6,8 | — | 0,3 % | 11 мар. 2025 г. |
23Наблюдать | CVE-2025-28906Proof of concept | WordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilitythiago s.f. · skitter slideshow · CWE-79 | Средняя5,9 | — | 0,5 % | 11 мар. 2025 г. |
36Наблюдать | CVE-2025-28915Proof of concept | WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerabilitytheme egg · themeegg toolkit · CWE-434 | Критическая9,1 | — | 1,2 % | 11 мар. 2025 г. |
48В плане | CVE-2025-22954Proof of concept | GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or koha · koha · CWE-89 | Критическая10,0 | — | 25,5 % | 12 мар. 2025 г. |
52В плане | CVE-2025-27915Готовый эксплойт | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.synacor · zimbra collaboration suite · CWE-79 | Средняя5,4 | KEV | 4,0 % | 12 мар. 2025 г. |
42В плане | CVE-2025-29891Эксплойта нет | Apache Camel: Camel Message Header Injection through request parametersapache · camel · CWE-164 | Средняя4,8 | — | 76,0 % | 12 мар. 2025 г. |
34Наблюдать | CVE-2025-20115Proof of concept | Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerabilitycisco · ios xr · CWE-120 | Высокая8,6 | — | 0,9 % | 12 мар. 2025 г. |
57В плане | CVE-2025-21590Готовый эксплойт | Junos OS: An local attacker with shell access can execute arbitrary codejuniper · junos · CWE-653 | Средняя6,7 | KEV | 1,7 % | 12 мар. 2025 г. |
28Наблюдать | CVE-2025-0117Proof of concept | GlobalProtect App: Local Privilege Escalation (PE) Vulnerabilitypalo alto networks · globalprotect app · CWE-807 | Высокая7,1 | — | 0,1 % | 12 мар. 2025 г. |
17Наблюдать | CVE-2025-22870Proof of concept | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netgo standard library · net/http · CWE-115 | Средняя4,4 | — | 0,4 % | 12 мар. 2025 г. |
37Наблюдать | CVE-2025-27407Proof of concept | Remote code execution when loading a crafted GraphQL schemarmosolgo · graphql-ruby · CWE-94 | Критическая9,0 | — | 3,1 % | 12 мар. 2025 г. |
43В плане | CVE-2025-25291Proof of concept | ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)omniauth · omniauth saml · CWE-347 | Критическая9,3 | — | 20,9 % | 12 мар. 2025 г. |
57В плане | CVE-2025-25292Эксплойта нет | Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)omniauth · omniauth saml · CWE-347 | Критическая9,3 | — | 65,0 % | 12 мар. 2025 г. |
60На этой неделе | CVE-2025-2264Готовый эксплойт | Santesoft Sante PACS Server Path Traversal Information Disclosuresantesoft · sante pacs server · CWE-22 | Высокая7,5 | — | 35,3 % | 13 мар. 2025 г. |
24Наблюдать | CVE-2024-55060Proof of concept | A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web srafed-system · rafed cms website · CWE-79 | Средняя6,1 | — | 0,5 % | 13 мар. 2025 г. |
31Наблюдать | CVE-2025-2221Proof of concept | WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injectionwpcom · wpcom member · CWE-89 | Высокая7,5 | — | 1,7 % | 14 мар. 2025 г. |
30Наблюдать | CVE-2024-8176Proof of concept | Libexpat: expat: improper restriction of xml entity expansion depth in libexpatred hat · red hat enterprise linux 10 · CWE-674 | Высокая7,5 | — | 1,3 % | 14 мар. 2025 г. |
37Наблюдать | CVE-2025-2304Proof of concept | Camaleon CMS Privilege Escalationowen2345 · camaleon-cms · CWE-915 | Критическая9,4 | — | 0,6 % | 14 мар. 2025 г. |
25Наблюдать | CVE-2023-33300Эксплойта нет | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlfortinet · fortinac · CWE-77 | Средняя5,3 | — | 13,7 % | 14 мар. 2025 г. |
40В плане | CVE-2025-29384Proof of concept | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to tenda · ac9 firmware · CWE-787 | Критическая9,8 | — | 1,9 % | 14 мар. 2025 г. |
40В плане | CVE-2025-29774Proof of concept | xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo Referencesnode-saml · xml-crypto · CWE-347 | Критическая9,3 | — | 9,1 % | 14 мар. 2025 г. |
40В плане | CVE-2025-29775Proof of concept | xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Commentnode-saml · xml-crypto · CWE-347 | Критическая9,3 | — | 9,5 % | 14 мар. 2025 г. |
31Наблюдать | CVE-2023-52927Proof of concept | netfilter: allow exp not to be removed in nf_ct_find_expectationlinux · linux kernel · CWE-416 | Высокая7,8 | — | 0,3 % | 14 мар. 2025 г. |
86Срочно | CVE-2025-30066Готовый эксплойт | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.tj-actions · changed-files · CWE-506 | Высокая8,6 | KEV | 72,0 % | 15 мар. 2025 г. |
18Наблюдать | CVE-2024-13126Proof of concept | Download Manager < 3.3.07 - Unauthenticated Data Exposurew3eden · download manager · CWE-552 | Средняя4,6 | — | 0,4 % | 16 мар. 2025 г. |
- CVE-2024-1282440В плане
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
КритическаяCVSS 9,8Proof of conceptEPSS 2 %scriptsbundle · nokri – job board wordpress theme1 мар. 2025 г.
- CVE-2025-179921Наблюдать
Zorlan SkyCaiji Tool.php previewAction server-side request forgery
СредняяCVSS 5,3Эксплойта нетEPSS 0 %skycaiji · skycaiji1 мар. 2025 г.
- CVE-2025-182925Наблюдать
TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 12 %totolink · x18 firmware2 мар. 2025 г.
- CVE-2025-2759047В плане
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux us
КритическаяCVSS 9,8Proof of conceptEPSS 27 %oxidized web project · oxidized web3 мар. 2025 г.
- CVE-2025-185134Наблюдать
Tenda AC7 SetFirewallCfg formSetFirewallCfg stack-based overflow
ВысокаяCVSS 8,7Эксплойта нетEPSS 1 %tenda · ac7 firmware3 мар. 2025 г.
- CVE-2024-5302730Наблюдать
Buffer Copy Without Checking Size of Input in WLAN Host
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %qualcomm · qca9367 firmware3 мар. 2025 г.
- CVE-2025-186827Наблюдать
Information display on multiple products from Famatech Corp
СредняяCVSS 6,9Proof of conceptEPSS 0 %famatech corp · advanced ip scanner3 мар. 2025 г.
- CVE-2025-028831Наблюдать
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function,
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %paragon-software · paragon backup \& recovery3 мар. 2025 г.
- CVE-2025-2742335Наблюдать
Improper Input Validation in Vim
ВысокаяCVSS 7,1Эксплойта нетEPSS 22 %vim · vim3 мар. 2025 г.
- CVE-2023-4903120Наблюдать
Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to rea
СредняяCVSS 5,1Proof of conceptEPSS 0 %oneadvanced · tikit emarketing3 мар. 2025 г.
- CVE-2025-2596735Наблюдать
Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF).
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %ddsn · acora cms3 мар. 2025 г.
- CVE-2025-2620636Наблюдать
Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html co
КритическаяCVSS 9,0Proof of conceptEPSS 0 %selldone · storefront3 мар. 2025 г.
- CVE-2024-5196234Наблюдать
SQL injection vulnerability in ArcGIS Server
ВысокаяCVSS 8,7Эксплойта нетEPSS 0 %esri · arcgis server3 мар. 2025 г.
- CVE-2025-163935Наблюдать
Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %crowdytheme · arolax4 мар. 2025 г.
- CVE-2025-130635Наблюдать
Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %spicethemes · newscrunch4 мар. 2025 г.
- CVE-2025-130740В плане
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 2 %spicethemes · newscrunch4 мар. 2025 г.
- CVE-2024-4824892Срочно
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 94 %nakivo · backup \& replication director4 мар. 2025 г.
- CVE-2025-037032Наблюдать
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
СредняяCVSS 5,4Эксплойта нетEPSS 35 %vanokhin · shortcodes ultimate4 мар. 2025 г.
- CVE-2025-2222462На этой неделе
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.
ВысокаяCVSS 8,2KEVГотовый эксплойтEPSS 1 %vmware · esxi4 мар. 2025 г.
- CVE-2025-2222562На этой неделе
VMware ESXi contains an arbitrary write vulnerability.
ВысокаяCVSS 8,2KEVГотовый эксплойтEPSS 1 %vmware · esxi4 мар. 2025 г.
- CVE-2025-2222655В плане
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.
СредняяCVSS 6,0KEVГотовый эксплойтEPSS 1 %vmware · esxi4 мар. 2025 г.
- CVE-2024-1093028Наблюдать
Carrier Block Load Privilege Escalation
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %carrier · block load4 мар. 2025 г.
- CVE-2025-2620217Наблюдать
Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in
СредняяCVSS 4,3Proof of conceptEPSS 0 %4 мар. 2025 г.
- CVE-2025-2631823Наблюдать
hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected
СредняяCVSS 5,8Proof of conceptEPSS 0 %tsplus · tsplus remote access4 мар. 2025 г.
- CVE-2025-131689Срочно
Edimax IC-7100 IP Camera OS Command Injection
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 74 %edimax · ic-7100 firmware4 мар. 2025 г.
- CVE-2025-2631956В плане
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
КритическаяCVSS 9,8Proof of conceptEPSS 55 %flowiseai · flowise4 мар. 2025 г.
- CVE-2024-868221Наблюдать
JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
СредняяCVSS 5,3Proof of conceptEPSS 0 %https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 · jnews - wordpress newspaper magazine blog amp theme5 мар. 2025 г.
- CVE-2024-4824621Наблюдать
Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book
СредняяCVSS 5,4Proof of conceptEPSS 0 %janobe · vehicle management system5 мар. 2025 г.
- CVE-2025-2751527Наблюдать
Laravel has a File Validation Bypass
СредняяCVSS 6,9Proof of conceptEPSS 0 %laravel · framework5 мар. 2025 г.
- CVE-2025-2750624Наблюдать
NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
СредняяCVSS 6,1Proof of conceptEPSS 0 %nocodb · nocodb6 мар. 2025 г.
- CVE-2024-5797227Наблюдать
The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) t
СредняяCVSS 6,5Proof of conceptEPSS 2 %microsoft · hololens6 мар. 2025 г.
- CVE-2025-2576339Наблюдать
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
КритическаяCVSS 9,8Proof of conceptEPSS 0 %crmeb · crmeb6 мар. 2025 г.
- CVE-2024-945819Наблюдать
Reservit Hotel < 3.0 - Admin+ Stored XSS
СредняяCVSS 4,8Proof of conceptEPSS 0 %reservit · reservit hotel7 мар. 2025 г.
- CVE-2025-2561717Наблюдать
Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
СредняяCVSS 4,3Proof of conceptEPSS 0 %7 мар. 2025 г.
- CVE-2025-2715230Наблюдать
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
ВысокаяCVSS 7,7Proof of conceptEPSS 0 %axios · axios7 мар. 2025 г.
- CVE-2025-2751937Наблюдать
Cognita Arbitrary File Write
КритическаяCVSS 9,3Proof of conceptEPSS 1 %truefoundry · cognita7 мар. 2025 г.
- CVE-2025-2760735Наблюдать
Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %nhairs · python json logger7 мар. 2025 г.
- CVE-2025-209425Наблюдать
TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 12 %totolink · ex1800t firmware7 мар. 2025 г.
- CVE-2025-132340В плане
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 2 %plechevandrey · wp-recall8 мар. 2025 г.
- CVE-2025-2784027Наблюдать
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
СредняяCVSS 6,8Proof of conceptEPSS 1 %espressif · esp32 firmware8 мар. 2025 г.
- CVE-2025-2763651В плане
Apache Camel: Camel Message Header Injection via Improper Filtering
СредняяCVSS 5,6Proof of conceptEPSS 97 %apache · camel9 мар. 2025 г.
- CVE-2025-212624Наблюдать
JoomlaUX JUX Real Estate GET Parameter realties sql injection
СредняяCVSS 5,3Proof of conceptEPSS 11 %joomlaux · jux real estate9 мар. 2025 г.
- CVE-2025-212721Наблюдать
JoomlaUX JUX Real Estate realties cross site scripting
СредняяCVSS 5,3Proof of conceptEPSS 0 %joomlaux · jux real estate9 мар. 2025 г.
- CVE-2025-212925Наблюдать
Mage AI insecure default initialization of resource
СредняяCVSS 6,3Proof of conceptEPSS 1 %9 мар. 2025 г.
- CVE-2025-2561510Наблюдать
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
НизкаяCVSS 2,7Proof of conceptEPSS 0 %changeweb · unifiedtransform10 мар. 2025 г.
- CVE-2025-2561617Наблюдать
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams.
СредняяCVSS 4,3Proof of conceptEPSS 0 %changeweb · unifiedtransform10 мар. 2025 г.
- CVE-2025-2686514Наблюдать
Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE
НизкаяCVSS 3,5Proof of conceptEPSS 0 %apache · ofbiz10 мар. 2025 г.
- CVE-2025-2561435Наблюдать
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %changeweb · unifiedtransform10 мар. 2025 г.
- CVE-2025-2562021Наблюдать
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
СредняяCVSS 5,4Proof of conceptEPSS 0 %changeweb · unifiedtransform10 мар. 2025 г.
- CVE-2025-2481399Срочно
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %apache · tomcat10 мар. 2025 г.
- CVE-2025-2713622Наблюдать
LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %robothy · local-s310 мар. 2025 г.
- CVE-2025-213537Наблюдать
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted
ВысокаяCVSS 8,8Proof of conceptEPSS 6 %google · chrome10 мар. 2025 г.
- CVE-2025-166156В плане
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 56 %pluginus · husky - products filter professional for woocommerce11 мар. 2025 г.
- CVE-2024-1385324Наблюдать
SEO Tools <= 4.0.7 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %zynit · seo tools11 мар. 2025 г.
- CVE-2025-219032Наблюдать
The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
ВысокаяCVSS 8,1Эксплойта нетEPSS 0 %tecno · com.transsnet.store11 мар. 2025 г.
- CVE-2025-155030Наблюдать
Arbitrary Code Execution via Crafted Keras Config for Model Loading
ВысокаяCVSS 7,3Proof of conceptEPSS 2 %keras · keras11 мар. 2025 г.
- CVE-2025-2789317Наблюдать
In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such a
СредняяCVSS 4,3Proof of conceptEPSS 0 %archerirm · archer11 мар. 2025 г.
- CVE-2024-5408588Срочно
Redfish Authentication Bypass
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 60 %ami · megarac sp-x11 мар. 2025 г.
- CVE-2025-2736370На этой неделе
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse
ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 27 %freetype · freetype11 мар. 2025 г.
- CVE-2024-5401831Наблюдать
Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a pr
ВысокаяCVSS 7,2Эксплойта нетEPSS 10 %fortinet · fortisandbox11 мар. 2025 г.
- CVE-2025-2574721Наблюдать
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive info
СредняяCVSS 5,4Proof of conceptEPSS 0 %digitaldruid · hoteldruid11 мар. 2025 г.
- CVE-2025-2403533Наблюдать
Windows Remote Desktop Services Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2405470На этой неделе
NTLM Hash Disclosure Spoofing Vulnerability
СредняяCVSS 5,4KEVГотовый эксплойтEPSS 62 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2407133Наблюдать
Microsoft Windows File Explorer Spoofing Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 23 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2407630Наблюдать
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
ВысокаяCVSS 7,3Proof of conceptEPSS 3 %microsoft · windows 11 22h211 мар. 2025 г.
- CVE-2025-2498358В плане
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
ВысокаяCVSS 7,0KEVГотовый эксплойтEPSS 1 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2498449В плане
Windows NTFS Information Disclosure Vulnerability
СредняяCVSS 4,6KEVГотовый эксплойтEPSS 1 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2498562На этой неделе
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2499153В плане
Windows NTFS Information Disclosure Vulnerability
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 2 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2499362На этой неделе
Windows NTFS Remote Code Execution Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 2 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2025-2663367На этой неделе
Microsoft Management Console Security Feature Bypass Vulnerability
ВысокаяCVSS 7,0KEVГотовый эксплойтEPSS 30 %microsoft · windows 10 150711 мар. 2025 г.
- CVE-2021-3778726Наблюдать
The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POS
СредняяCVSS 6,5Proof of conceptEPSS 0 %abocms · abo.cms11 мар. 2025 г.
- CVE-2025-2420171На этой неделе
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 3 %apple · safari11 мар. 2025 г.
- CVE-2025-2574829Наблюдать
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifyi
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %digitaldruid · hoteldruid11 мар. 2025 г.
- CVE-2025-2574928Наблюдать
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength poli
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %digitaldruid · hoteldruid11 мар. 2025 г.
- CVE-2025-2759127Наблюдать
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/
СредняяCVSS 6,8Proof of conceptEPSS 0 %facebook · below11 мар. 2025 г.
- CVE-2025-2890623Наблюдать
WordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability
СредняяCVSS 5,9Proof of conceptEPSS 0 %thiago s.f. · skitter slideshow11 мар. 2025 г.
- CVE-2025-2891536Наблюдать
WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 1 %theme egg · themeegg toolkit11 мар. 2025 г.
- CVE-2025-2295448В плане
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or
КритическаяCVSS 10,0Proof of conceptEPSS 25 %koha · koha12 мар. 2025 г.
- CVE-2025-2791552В плане
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.
СредняяCVSS 5,4KEVГотовый эксплойтEPSS 4 %synacor · zimbra collaboration suite12 мар. 2025 г.
- CVE-2025-2989142В плане
Apache Camel: Camel Message Header Injection through request parameters
СредняяCVSS 4,8Эксплойта нетEPSS 76 %apache · camel12 мар. 2025 г.
- CVE-2025-2011534Наблюдать
Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerability
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %cisco · ios xr12 мар. 2025 г.
- CVE-2025-2159057В плане
Junos OS: An local attacker with shell access can execute arbitrary code
СредняяCVSS 6,7KEVГотовый эксплойтEPSS 1 %juniper · junos12 мар. 2025 г.
- CVE-2025-011728Наблюдать
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %palo alto networks · globalprotect app12 мар. 2025 г.
- CVE-2025-2287017Наблюдать
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
СредняяCVSS 4,4Proof of conceptEPSS 0 %go standard library · net/http12 мар. 2025 г.
- CVE-2025-2740737Наблюдать
Remote code execution when loading a crafted GraphQL schema
КритическаяCVSS 9,0Proof of conceptEPSS 3 %rmosolgo · graphql-ruby12 мар. 2025 г.
- CVE-2025-2529143В плане
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
КритическаяCVSS 9,3Proof of conceptEPSS 20 %omniauth · omniauth saml12 мар. 2025 г.
- CVE-2025-2529257В плане
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
КритическаяCVSS 9,3Эксплойта нетEPSS 65 %omniauth · omniauth saml12 мар. 2025 г.
- CVE-2025-226460На этой неделе
Santesoft Sante PACS Server Path Traversal Information Disclosure
ВысокаяCVSS 7,5Готовый эксплойтEPSS 35 %santesoft · sante pacs server13 мар. 2025 г.
- CVE-2024-5506024Наблюдать
A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web s
СредняяCVSS 6,1Proof of conceptEPSS 0 %rafed-system · rafed cms website13 мар. 2025 г.
- CVE-2025-222131Наблюдать
WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %wpcom · wpcom member14 мар. 2025 г.
- CVE-2024-817630Наблюдать
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %red hat · red hat enterprise linux 1014 мар. 2025 г.
- CVE-2025-230437Наблюдать
Camaleon CMS Privilege Escalation
КритическаяCVSS 9,4Proof of conceptEPSS 0 %owen2345 · camaleon-cms14 мар. 2025 г.
- CVE-2023-3330025Наблюдать
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earl
СредняяCVSS 5,3Эксплойта нетEPSS 13 %fortinet · fortinac14 мар. 2025 г.
- CVE-2025-2938440В плане
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to
КритическаяCVSS 9,8Proof of conceptEPSS 1 %tenda · ac9 firmware14 мар. 2025 г.
- CVE-2025-2977440В плане
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
КритическаяCVSS 9,3Proof of conceptEPSS 9 %node-saml · xml-crypto14 мар. 2025 г.
- CVE-2025-2977540В плане
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
КритическаяCVSS 9,3Proof of conceptEPSS 9 %node-saml · xml-crypto14 мар. 2025 г.
- CVE-2023-5292731Наблюдать
netfilter: allow exp not to be removed in nf_ct_find_expectation
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel14 мар. 2025 г.
- CVE-2025-3006686Срочно
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 72 %tj-actions · changed-files15 мар. 2025 г.
- CVE-2024-1312618Наблюдать
Download Manager < 3.3.07 - Unauthenticated Data Exposure
СредняяCVSS 4,6Proof of conceptEPSS 0 %w3eden · download manager16 мар. 2025 г.