По дате публикации
Эксплуатируемые и новые серьёзные CVE: сентябрь 2025 г.
197 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
44В плане | CVE-2025-6507Эксплойта нет | Deserialization of Untrusted Data in h2oai/h2o-3h2oai · h2oai/h2o-3 · CWE-502 | Критическая9,8 | — | 16,9 % | 1 сент. 2025 г. |
31Наблюдать | CVE-2022-38691Proof of concept | In BootROM, there is a possible missing validation for Certificate Type 0.unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/ · CWE-250 | Высокая7,8 | — | 0,3 % | 1 сент. 2025 г. |
31Наблюдать | CVE-2022-38694Proof of concept | In BootRom, there is a possible unchecked write address.unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/ · CWE-250 | Высокая7,8 | — | 0,5 % | 1 сент. 2025 г. |
12Наблюдать | CVE-2025-9769Эксплойта нет | D-Link DI-7400G+ mng_platform.asp sub_478D28 command injectiondlink · di-7400g\+ firmware · CWE-74 | Низкая0,9 | — | 29,0 % | 1 сент. 2025 г. |
51В плане | CVE-2024-28988Proof of concept | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerabilitysolarwinds · web help desk · CWE-502 | Критическая9,8 | — | 39,0 % | 1 сент. 2025 г. |
32Наблюдать | CVE-2025-57808Proof of concept | ESP-IDF web_server basic auth bypass using empty or incomplete Authorization headeresphome · esphome firmware · CWE-303 | Высокая8,1 | — | 1,6 % | 2 сент. 2025 г. |
26Наблюдать | CVE-2025-46047Proof of concept | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers tosilverpeas · silverpeas · CWE-20 | Средняя6,5 | — | 0,3 % | 2 сент. 2025 г. |
27Наблюдать | CVE-2024-48705Proof of concept | Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection whwavlink · wl-wn531p3 firmware · CWE-77 | Средняя6,5 | — | 3,3 % | 2 сент. 2025 г. |
26Наблюдать | CVE-2025-50565Proof of concept | Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.doubo erp project · doubo erp · CWE-89 | Средняя6,5 | — | 0,2 % | 2 сент. 2025 г. |
31Наблюдать | CVE-2025-9784Proof of concept | Undertow: undertow madeyoureset http/2 ddos vulnerabilityredhat · build of apache camel for spring boot · CWE-770 | Высокая7,5 | — | 2,3 % | 2 сент. 2025 г. |
28Наблюдать | CVE-2025-22442Proof of concept | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created google · android · CWE-362 | Высокая7,0 | — | 0,0 % | 2 сент. 2025 г. |
39Наблюдать | CVE-2024-32444Proof of concept | WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerabilityinspirythemes · realhomes · CWE-266 | Критическая9,8 | — | 0,6 % | 3 сент. 2025 г. |
16Наблюдать | CVE-2025-56608Proof of concept | The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`donbermoy · android corona virus tracker app for india · CWE-290 | Средняя4,2 | — | 0,3 % | 3 сент. 2025 г. |
39Наблюдать | CVE-2025-57052Proof of concept | cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote atdavegamble · cjson · CWE-125 | Критическая9,8 | — | 0,7 % | 3 сент. 2025 г. |
22Наблюдать | CVE-2025-38678Proof of concept | netfilter: nf_tables: reject duplicate device on updateslinux · linux kernel | Средняя5,5 | — | 0,2 % | 3 сент. 2025 г. |
35Наблюдать | CVE-2025-53691Proof of concept | Sitecore Experience Remote Code Execution through Insecure Deserializationsitecore · experience commerce · CWE-502 | Высокая8,8 | — | 1,6 % | 3 сент. 2025 г. |
45В плане | CVE-2025-53693Proof of concept | HTML Cache Poisoning through Unsafe Reflectionssitecore · experience commerce · CWE-470 | Критическая9,8 | — | 19,9 % | 3 сент. 2025 г. |
32Наблюдать | CVE-2025-53694Proof of concept | Information Disclosure in ItemServices APIsitecore · experience commerce · CWE-200 | Высокая7,5 | — | 6,7 % | 3 сент. 2025 г. |
30Наблюдать | CVE-2025-45805Proof of concept | In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profilephpgurukul · doctor appointment management system · CWE-79 | Высокая7,6 | — | 0,3 % | 3 сент. 2025 г. |
33Наблюдать | CVE-2025-56803Proof of concept | Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader.figma · desktop · CWE-78 | Высокая8,4 | — | 1,0 % | 3 сент. 2025 г. |
38Наблюдать | CVE-2025-55747Proof of concept | XWiki Platform's configuration files can be accessed through the webjars APIxwiki · xwiki · CWE-23 | Критическая9,3 | — | 1,6 % | 3 сент. 2025 г. |
40В плане | CVE-2025-57833Proof of concept | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.djangoproject · django · CWE-89 | Высокая8,1 | — | 26,1 % | 3 сент. 2025 г. |
84Срочно | CVE-2025-53690Готовый эксплойт | Sitecore Products ViewState Deserialization Vulnerabilitysitecore · experience commerce · CWE-502 | Критическая9,0 | KEV | 60,6 % | 3 сент. 2025 г. |
38Наблюдать | CVE-2025-55748Proof of concept | XWiki Platform's configuration files can be accessed through jsx and sx endpointsxwiki · xwiki · CWE-23 | Критическая9,3 | — | 1,7 % | 3 сент. 2025 г. |
28Наблюдать | CVE-2025-6085Proof of concept | Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Uploadcelonis · make connector · CWE-434 | Высокая7,2 | — | 1,2 % | 4 сент. 2025 г. |
28Наблюдать | CVE-2025-9519Proof of concept | Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcodekleor · easy timer · CWE-94 | Высокая7,2 | — | 0,9 % | 4 сент. 2025 г. |
22Наблюдать | CVE-2025-9933Proof of concept | PHPGurukul Beauty Parlour Management System view-appointment.php sql injectionphpgurukul · beauty parlour management system · CWE-74 | Средняя5,5 | — | 0,4 % | 4 сент. 2025 г. |
30Наблюдать | CVE-2025-6984Proof of concept | Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchainlangchain-ai · langchain-ai/langchain · CWE-200 | Высокая7,5 | — | 1,6 % | 4 сент. 2025 г. |
38Наблюдать | CVE-2025-8311Proof of concept | dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint.dotcms · dotcms cloud services (dcs) · CWE-89 | Критическая9,4 | — | 1,7 % | 4 сент. 2025 г. |
21Наблюдать | CVE-2025-57576Proof of concept | PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php.phpgurukul · online shopping portal · CWE-79 | Средняя5,4 | — | 0,2 % | 4 сент. 2025 г. |
20Наблюдать | CVE-2025-0087Proof of concept | In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check.google · android · CWE-689 | Средняя5,1 | — | 0,2 % | 4 сент. 2025 г. |
29Наблюдать | CVE-2025-26443Proof of concept | In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to google · android · CWE-693 | Высокая7,3 | — | 0,1 % | 4 сент. 2025 г. |
29Наблюдать | CVE-2025-22441Proof of concept | In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privilegoogle · android · CWE-441 | Высокая7,3 | — | 0,1 % | 4 сент. 2025 г. |
31Наблюдать | CVE-2025-32324Proof of concept | In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy.google · android · CWE-441 | Высокая7,8 | — | 0,0 % | 4 сент. 2025 г. |
65На этой неделе | CVE-2025-48543Готовый эксплойт | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.google · android · CWE-416 | Высокая8,8 | KEV | 0,6 % | 4 сент. 2025 г. |
22Наблюдать | CVE-2025-48561Proof of concept | In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure.google · android · CWE-203 | Средняя5,5 | — | 0,1 % | 4 сент. 2025 г. |
26Наблюдать | CVE-2025-58179Proof of concept | Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointastro · \@astrojs\/cloudflare · CWE-918 | Средняя6,5 | — | 0,8 % | 4 сент. 2025 г. |
40В плане | CVE-2025-54914Proof of concept | Azure Networking Elevation of Privilege Vulnerabilitymicrosoft · azure networking · CWE-284 | Критическая9,8 | — | 2,4 % | 4 сент. 2025 г. |
41В плане | CVE-2025-55190Proof of concept | Argo CD: Project API Token Exposes Repository Credentialsargoproj · argo cd · CWE-200 | Критическая9,9 | — | 5,6 % | 4 сент. 2025 г. |
30Наблюдать | CVE-2025-58789Proof of concept | WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerabilitythemeisle · wp full stripe free · CWE-89 | Высокая7,6 | — | 0,3 % | 5 сент. 2025 г. |
28Наблюдать | CVE-2025-58780Proof of concept | index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.sciencelogic · sl1 · CWE-89 | Высокая7,2 | — | 0,2 % | 5 сент. 2025 г. |
24Наблюдать | CVE-2025-9998Proof of concept | Improper validation of packets sequencingarcinfo · pcvue · CWE-754 | Средняя6,0 | — | 0,2 % | 5 сент. 2025 г. |
30Наблюдать | CVE-2025-58788Proof of concept | WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerabilitysaad iqbal · license manager for woocommerce · CWE-89 | Высокая7,6 | — | 0,3 % | 5 сент. 2025 г. |
70На этой неделе | CVE-2025-39682Готовый эксплойт | tls: fix handling of zero-length records on the rx_listlinux · linux kernel · CWE-754 | Критическая9,8 | KEV | 2,8 % | 5 сент. 2025 г. |
39Наблюдать | CVE-2025-58371Proof of concept | Roo Code is vulnerable to command injection via GitHub actions workflowroocode · roo code · CWE-78 | Критическая9,9 | — | 0,8 % | 5 сент. 2025 г. |
19Наблюдать | CVE-2025-10046Proof of concept | ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejctionelextensions · elex woocommerce google shopping (google product feed) · CWE-89 | Средняя4,9 | — | 0,7 % | 6 сент. 2025 г. |
37Наблюдать | CVE-2025-9961Proof of concept | Authenticated RCE by CWMP binarytp-link systems inc. · ax10 v1/v1.2/v2/v2.6/v3/v3.6 · CWE-120 | Высокая8,6 | — | 10,4 % | 6 сент. 2025 г. |
39Наблюдать | CVE-2025-8359Proof of concept | AdForest <= 6.0.9 - Authentication Bypass to Adminscriptsbundle · adforest · CWE-288 | Критическая9,8 | — | 0,4 % | 6 сент. 2025 г. |
45В плане | CVE-2025-58443Proof of concept | FOG's authentication bypass leads to full SQL DB dumpfogproject · fogproject · CWE-287 | Критическая9,9 | — | 20,8 % | 6 сент. 2025 г. |
40В плане | CVE-2025-8085Proof of concept | Ditty < 3.1.58 - Unauthenticated SSRFmetaphorcreations · ditty · CWE-918 | Высокая8,6 | — | 20,2 % | 8 сент. 2025 г. |
23Наблюдать | CVE-2025-10090Proof of concept | Jinher OA GetTreeDate.aspx sql injectionjinher · jinher oa · CWE-74 | Средняя5,5 | — | 1,8 % | 8 сент. 2025 г. |
32Наблюдать | CVE-2025-55998Proof of concept | A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitramezereon · smart search and filter · CWE-79 | Высокая8,1 | — | 0,3 % | 8 сент. 2025 г. |
14Наблюдать | CVE-2025-51586Proof of concept | An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive inprestashop · prestashop · CWE-359 | Низкая3,7 | — | 0,8 % | 8 сент. 2025 г. |
40В плане | CVE-2025-56266Proof of concept | A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.avigilon · access control manager · CWE-74 | Критическая9,8 | — | 2,8 % | 8 сент. 2025 г. |
9Наблюдать | CVE-2025-58751Proof of concept | Vite middleware may serve files starting with the same name with the public directoryvitejs · vite · CWE-22 | Низкая2,3 | — | 1,2 % | 8 сент. 2025 г. |
15Наблюдать | CVE-2025-8889Proof of concept | Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Uploadeliehanna · compress \& upload · CWE-434 | Низкая3,8 | — | 0,2 % | 9 сент. 2025 г. |
41В плане | CVE-2025-42944Proof of concept | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)sap_se · sap netweaver (rmi-p4) · CWE-502 | Критическая10,0 | — | 2,9 % | 9 сент. 2025 г. |
22Наблюдать | CVE-2025-53609Эксплойта нет | A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7fortinet · fortiweb · CWE-23 | Средняя4,9 | — | 10,6 % | 9 сент. 2025 г. |
94Срочно | CVE-2025-54236Готовый эксплойт | Adobe Commerce | Improper Input Validation (CWE-20)adobe · commerce · CWE-20 | Критическая9,1 | KEV | 94,6 % | 9 сент. 2025 г. |
42В плане | CVE-2025-9712Эксплойта нет | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toivanti · endpoint manager · CWE-434 | Высокая8,8 | — | 23,8 % | 9 сент. 2025 г. |
40В плане | CVE-2025-9872Эксплойта нет | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toivanti · endpoint manager · CWE-434 | Высокая8,8 | — | 15,7 % | 9 сент. 2025 г. |
25Наблюдать | CVE-2025-47437Эксплойта нет | WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerabilitylitespeed technologies · litespeed cache · CWE-918 | Средняя6,4 | — | 0,2 % | 9 сент. 2025 г. |
36Наблюдать | CVE-2025-54110Proof of concept | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-190 | Высокая8,8 | — | 4,4 % | 9 сент. 2025 г. |
18Наблюдать | CVE-2025-54251Proof of concept | Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)adobe · experience manager · CWE-91 | Средняя4,3 | — | 1,7 % | 9 сент. 2025 г. |
43В плане | CVE-2025-54918Proof of concept | Windows NTLM Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-287 | Высокая8,8 | — | 25,2 % | 9 сент. 2025 г. |
45В плане | CVE-2025-55234Proof of concept | Windows SMB Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-287 | Критическая9,8 | — | 20,7 % | 9 сент. 2025 г. |
28Наблюдать | CVE-2025-9951Proof of concept | Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000ffmpeg · ffmpeg · CWE-122 | Высокая7,2 | — | 0,4 % | 9 сент. 2025 г. |
28Наблюдать | CVE-2025-52915Proof of concept | K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminCWE-269 | Высокая7,2 | — | 0,5 % | 9 сент. 2025 г. |
24Наблюдать | CVE-2025-34174Эксплойта нет | Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scriptingpfsense · pfsense · CWE-79 | Средняя5,1 | — | 12,9 % | 9 сент. 2025 г. |
26Наблюдать | CVE-2025-34175Эксплойта нет | Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scriptingpfsense · pfsense · CWE-79 | Средняя5,1 | — | 19,1 % | 9 сент. 2025 г. |
26Наблюдать | CVE-2025-34176Эксплойта нет | Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosurepfsense · pfsense · CWE-22 | Средняя5,3 | — | 17,2 % | 9 сент. 2025 г. |
27Наблюдать | CVE-2025-54249Proof of concept | Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)adobe · experience manager · CWE-918 | Средняя6,5 | — | 1,9 % | 9 сент. 2025 г. |
47В плане | CVE-2025-54261Эксплойта нет | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · coldfusion · CWE-22 | Критическая10,0 | — | 23,9 % | 9 сент. 2025 г. |
42В плане | CVE-2025-54897Proof of concept | Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Высокая8,8 | — | 21,7 % | 9 сент. 2025 г. |
36Наблюдать | CVE-2025-58180Proof of concept | OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Uploadoctoprint · octoprint · CWE-78 | Высокая7,5 | — | 21,4 % | 9 сент. 2025 г. |
19Наблюдать | CVE-2025-10142Proof of concept | PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injectionmartins56 · pagbank / pagseguro connect para woocommerce · CWE-89 | Средняя4,9 | — | 0,4 % | 10 сент. 2025 г. |
24Наблюдать | CVE-2025-57520Proof of concept | A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3.techhub.p-m · decap cms · CWE-79 | Средняя6,1 | — | 0,3 % | 10 сент. 2025 г. |
28Наблюдать | CVE-2025-57642Proof of concept | A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the sesohamjuhin · tourism management system · CWE-434 | Высокая7,2 | — | 1,5 % | 10 сент. 2025 г. |
31Наблюдать | CVE-2025-57392Proof of concept | BenimPOS Masaustu 3.0.x is affected by insecure file permissions.benimpos · benimpos · CWE-732 | Высокая7,8 | — | 0,1 % | 10 сент. 2025 г. |
35Наблюдать | CVE-2025-10200Proof of concept | Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap cogoogle · chrome · CWE-416 | Высокая8,8 | — | 0,6 % | 10 сент. 2025 г. |
8Наблюдать | CVE-2025-10210Proof of concept | yanyutao0402 ChanCMS Api.js search sql injectionchancms · chancms · CWE-74 | Низкая2,1 | — | 1,3 % | 10 сент. 2025 г. |
42В плане | CVE-2025-54123Proof of concept | Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationhoverfly · hoverfly · CWE-20 | Критическая9,8 | — | 10,5 % | 10 сент. 2025 г. |
31Наблюдать | CVE-2025-59049Proof of concept | Mockoon has a Path Traversal and LFI in the static file serving endpointmockoon · mockoon · CWE-22 | Высокая7,5 | — | 1,7 % | 10 сент. 2025 г. |
8Наблюдать | CVE-2025-10211Proof of concept | yanyutao0402 ChanCMS getArticle CollectController server-side request forgerychancms · chancms · CWE-918 | Низкая2,1 | — | 0,7 % | 10 сент. 2025 г. |
30Наблюдать | CVE-2025-8422Proof of concept | Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Readfassionstorage · propovoice: all-in-one client management system · CWE-73 | Высокая7,5 | — | 0,6 % | 11 сент. 2025 г. |
26Наблюдать | CVE-2025-9776Proof of concept | CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Importcatfolders · catfolders – wordpress media library folders & categories · CWE-89 | Средняя6,5 | — | 0,4 % | 11 сент. 2025 г. |
33Наблюдать | CVE-2025-58320Эксплойта нет | DIALink - Directory Traversal Authentication Bypass Vulnerabilitydeltaww · dialink · CWE-22 | Высокая7,3 | — | 14,5 % | 11 сент. 2025 г. |
39Наблюдать | CVE-2025-8570Proof of concept | BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filterbeyondcart · beyondcart connector · CWE-798 | Критическая9,8 | — | 0,6 % | 11 сент. 2025 г. |
32Наблюдать | CVE-2025-58060Proof of concept | cups has Authentication bypass with AuthType Negotiateopenprinting · cups · CWE-287 | Высокая8,0 | — | 0,9 % | 11 сент. 2025 г. |
29Наблюдать | CVE-2025-8061Proof of concept | A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenolenovo · dispatcher 3.0 driver · CWE-782 | Высокая7,3 | — | 0,3 % | 11 сент. 2025 г. |
39Наблюдать | CVE-2025-55319Proof of concept | Agentic AI and Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio code · CWE-77 | Критическая9,8 | — | 0,9 % | 11 сент. 2025 г. |
79На этой неделе | CVE-2025-21042Готовый эксплойт | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.samsung · android · CWE-787 | Критическая9,8 | KEV | 33,1 % | 12 сент. 2025 г. |
70На этой неделе | CVE-2025-21043Готовый эксплойт | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.samsung · android · CWE-787 | Критическая9,8 | KEV | 2,1 % | 12 сент. 2025 г. |
21Наблюдать | CVE-2025-59139Proof of concept | Hono has Body Limit Middleware Bypasshono · hono · CWE-400 | Средняя5,3 | — | 0,4 % | 12 сент. 2025 г. |
25Наблюдать | CVE-2025-55996Proof of concept | Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interfacerakuten · viber · CWE-79 | Средняя6,3 | — | 0,1 % | 12 сент. 2025 г. |
11Наблюдать | CVE-2025-10327Proof of concept | MiczFlor RPi-Jukebox-RFID shuffle.php os command injectionsourcefabric · rpi-jukebox-rfid · CWE-77 | Низкая2,1 | — | 10,1 % | 12 сент. 2025 г. |
54В плане | CVE-2025-58434Proof of concept | Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeoverflowiseai · flowise · CWE-306 | Критическая9,8 | — | 49,8 % | 12 сент. 2025 г. |
8Наблюдать | CVE-2025-10370Proof of concept | MiczFlor RPi-Jukebox-RFID userScripts.php cross site scriptingsourcefabric · rpi-jukebox-rfid · CWE-79 | Низкая2,0 | — | 0,7 % | 13 сент. 2025 г. |
28Наблюдать | CVE-2025-10204Proof of concept | Unauth Admin Reset Password on AC Smart IIlg electronics · ac smart ii · CWE-306 | Высокая7,1 | — | 0,4 % | 14 сент. 2025 г. |
40В плане | CVE-2025-59359Proof of concept | OS command injection in Chaos Mesh via the cleanTcs mutationchaos-mesh · chaos mesh · CWE-78 | Критическая9,8 | — | 2,9 % | 15 сент. 2025 г. |
- CVE-2025-650744В плане
Deserialization of Untrusted Data in h2oai/h2o-3
КритическаяCVSS 9,8Эксплойта нетEPSS 16 %h2oai · h2oai/h2o-31 сент. 2025 г.
- CVE-2022-3869131Наблюдать
In BootROM, there is a possible missing validation for Certificate Type 0.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/1 сент. 2025 г.
- CVE-2022-3869431Наблюдать
In BootRom, there is a possible unchecked write address.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/1 сент. 2025 г.
- CVE-2025-976912Наблюдать
D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection
НизкаяCVSS 0,9Эксплойта нетEPSS 29 %dlink · di-7400g\+ firmware1 сент. 2025 г.
- CVE-2024-2898851В плане
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 39 %solarwinds · web help desk1 сент. 2025 г.
- CVE-2025-5780832Наблюдать
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %esphome · esphome firmware2 сент. 2025 г.
- CVE-2025-4604726Наблюдать
A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to
СредняяCVSS 6,5Proof of conceptEPSS 0 %silverpeas · silverpeas2 сент. 2025 г.
- CVE-2024-4870527Наблюдать
Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection wh
СредняяCVSS 6,5Proof of conceptEPSS 3 %wavlink · wl-wn531p3 firmware2 сент. 2025 г.
- CVE-2025-5056526Наблюдать
Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.
СредняяCVSS 6,5Proof of conceptEPSS 0 %doubo erp project · doubo erp2 сент. 2025 г.
- CVE-2025-978431Наблюдать
Undertow: undertow madeyoureset http/2 ddos vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %redhat · build of apache camel for spring boot2 сент. 2025 г.
- CVE-2025-2244228Наблюдать
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %google · android2 сент. 2025 г.
- CVE-2024-3244439Наблюдать
WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %inspirythemes · realhomes3 сент. 2025 г.
- CVE-2025-5660816Наблюдать
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`
СредняяCVSS 4,2Proof of conceptEPSS 0 %donbermoy · android corona virus tracker app for india3 сент. 2025 г.
- CVE-2025-5705239Наблюдать
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote at
КритическаяCVSS 9,8Proof of conceptEPSS 0 %davegamble · cjson3 сент. 2025 г.
- CVE-2025-3867822Наблюдать
netfilter: nf_tables: reject duplicate device on updates
СредняяCVSS 5,5Proof of conceptEPSS 0 %linux · linux kernel3 сент. 2025 г.
- CVE-2025-5369135Наблюдать
Sitecore Experience Remote Code Execution through Insecure Deserialization
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %sitecore · experience commerce3 сент. 2025 г.
- CVE-2025-5369345В плане
HTML Cache Poisoning through Unsafe Reflections
КритическаяCVSS 9,8Proof of conceptEPSS 19 %sitecore · experience commerce3 сент. 2025 г.
- CVE-2025-5369432Наблюдать
Information Disclosure in ItemServices API
ВысокаяCVSS 7,5Proof of conceptEPSS 6 %sitecore · experience commerce3 сент. 2025 г.
- CVE-2025-4580530Наблюдать
In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %phpgurukul · doctor appointment management system3 сент. 2025 г.
- CVE-2025-5680333Наблюдать
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader.
ВысокаяCVSS 8,4Proof of conceptEPSS 1 %figma · desktop3 сент. 2025 г.
- CVE-2025-5574738Наблюдать
XWiki Platform's configuration files can be accessed through the webjars API
КритическаяCVSS 9,3Proof of conceptEPSS 1 %xwiki · xwiki3 сент. 2025 г.
- CVE-2025-5783340В плане
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.
ВысокаяCVSS 8,1Proof of conceptEPSS 26 %djangoproject · django3 сент. 2025 г.
- CVE-2025-5369084Срочно
Sitecore Products ViewState Deserialization Vulnerability
КритическаяCVSS 9,0KEVГотовый эксплойтEPSS 60 %sitecore · experience commerce3 сент. 2025 г.
- CVE-2025-5574838Наблюдать
XWiki Platform's configuration files can be accessed through jsx and sx endpoints
КритическаяCVSS 9,3Proof of conceptEPSS 1 %xwiki · xwiki3 сент. 2025 г.
- CVE-2025-608528Наблюдать
Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %celonis · make connector4 сент. 2025 г.
- CVE-2025-951928Наблюдать
Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %kleor · easy timer4 сент. 2025 г.
- CVE-2025-993322Наблюдать
PHPGurukul Beauty Parlour Management System view-appointment.php sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %phpgurukul · beauty parlour management system4 сент. 2025 г.
- CVE-2025-698430Наблюдать
Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %langchain-ai · langchain-ai/langchain4 сент. 2025 г.
- CVE-2025-831138Наблюдать
dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint.
КритическаяCVSS 9,4Proof of conceptEPSS 1 %dotcms · dotcms cloud services (dcs)4 сент. 2025 г.
- CVE-2025-5757621Наблюдать
PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php.
СредняяCVSS 5,4Proof of conceptEPSS 0 %phpgurukul · online shopping portal4 сент. 2025 г.
- CVE-2025-008720Наблюдать
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check.
СредняяCVSS 5,1Proof of conceptEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-2644329Наблюдать
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-2244129Наблюдать
In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privile
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-3232431Наблюдать
In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-4854365На этой неделе
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-4856122Наблюдать
In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure.
СредняяCVSS 5,5Proof of conceptEPSS 0 %google · android4 сент. 2025 г.
- CVE-2025-5817926Наблюдать
Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
СредняяCVSS 6,5Proof of conceptEPSS 0 %astro · \@astrojs\/cloudflare4 сент. 2025 г.
- CVE-2025-5491440В плане
Azure Networking Elevation of Privilege Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 2 %microsoft · azure networking4 сент. 2025 г.
- CVE-2025-5519041В плане
Argo CD: Project API Token Exposes Repository Credentials
КритическаяCVSS 9,9Proof of conceptEPSS 5 %argoproj · argo cd4 сент. 2025 г.
- CVE-2025-5878930Наблюдать
WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %themeisle · wp full stripe free5 сент. 2025 г.
- CVE-2025-5878028Наблюдать
index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %sciencelogic · sl15 сент. 2025 г.
- CVE-2025-999824Наблюдать
Improper validation of packets sequencing
СредняяCVSS 6,0Proof of conceptEPSS 0 %arcinfo · pcvue5 сент. 2025 г.
- CVE-2025-5878830Наблюдать
WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %saad iqbal · license manager for woocommerce5 сент. 2025 г.
- CVE-2025-3968270На этой неделе
tls: fix handling of zero-length records on the rx_list
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 2 %linux · linux kernel5 сент. 2025 г.
- CVE-2025-5837139Наблюдать
Roo Code is vulnerable to command injection via GitHub actions workflow
КритическаяCVSS 9,9Proof of conceptEPSS 0 %roocode · roo code5 сент. 2025 г.
- CVE-2025-1004619Наблюдать
ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction
СредняяCVSS 4,9Proof of conceptEPSS 0 %elextensions · elex woocommerce google shopping (google product feed)6 сент. 2025 г.
- CVE-2025-996137Наблюдать
Authenticated RCE by CWMP binary
ВысокаяCVSS 8,6Proof of conceptEPSS 10 %tp-link systems inc. · ax10 v1/v1.2/v2/v2.6/v3/v3.66 сент. 2025 г.
- CVE-2025-835939Наблюдать
AdForest <= 6.0.9 - Authentication Bypass to Admin
КритическаяCVSS 9,8Proof of conceptEPSS 0 %scriptsbundle · adforest6 сент. 2025 г.
- CVE-2025-5844345В плане
FOG's authentication bypass leads to full SQL DB dump
КритическаяCVSS 9,9Proof of conceptEPSS 20 %fogproject · fogproject6 сент. 2025 г.
- CVE-2025-808540В плане
Ditty < 3.1.58 - Unauthenticated SSRF
ВысокаяCVSS 8,6Proof of conceptEPSS 20 %metaphorcreations · ditty8 сент. 2025 г.
- CVE-2025-1009023Наблюдать
Jinher OA GetTreeDate.aspx sql injection
СредняяCVSS 5,5Proof of conceptEPSS 1 %jinher · jinher oa8 сент. 2025 г.
- CVE-2025-5599832Наблюдать
A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitra
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %mezereon · smart search and filter8 сент. 2025 г.
- CVE-2025-5158614Наблюдать
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive in
НизкаяCVSS 3,7Proof of conceptEPSS 0 %prestashop · prestashop8 сент. 2025 г.
- CVE-2025-5626640В плане
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %avigilon · access control manager8 сент. 2025 г.
- CVE-2025-587519Наблюдать
Vite middleware may serve files starting with the same name with the public directory
НизкаяCVSS 2,3Proof of conceptEPSS 1 %vitejs · vite8 сент. 2025 г.
- CVE-2025-888915Наблюдать
Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload
НизкаяCVSS 3,8Proof of conceptEPSS 0 %eliehanna · compress \& upload9 сент. 2025 г.
- CVE-2025-4294441В плане
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
КритическаяCVSS 10,0Proof of conceptEPSS 2 %sap_se · sap netweaver (rmi-p4)9 сент. 2025 г.
- CVE-2025-5360922Наблюдать
A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7
СредняяCVSS 4,9Эксплойта нетEPSS 10 %fortinet · fortiweb9 сент. 2025 г.
- CVE-2025-5423694Срочно
Adobe Commerce | Improper Input Validation (CWE-20)
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 94 %adobe · commerce9 сент. 2025 г.
- CVE-2025-971242В плане
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to
ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %ivanti · endpoint manager9 сент. 2025 г.
- CVE-2025-987240В плане
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %ivanti · endpoint manager9 сент. 2025 г.
- CVE-2025-4743725Наблюдать
WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability
СредняяCVSS 6,4Эксплойта нетEPSS 0 %litespeed technologies · litespeed cache9 сент. 2025 г.
- CVE-2025-5411036Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 4 %microsoft · windows 10 15079 сент. 2025 г.
- CVE-2025-5425118Наблюдать
Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
СредняяCVSS 4,3Proof of conceptEPSS 1 %adobe · experience manager9 сент. 2025 г.
- CVE-2025-5491843В плане
Windows NTLM Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 25 %microsoft · windows 10 15079 сент. 2025 г.
- CVE-2025-5523445В плане
Windows SMB Elevation of Privilege Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 20 %microsoft · windows 10 15079 сент. 2025 г.
- CVE-2025-995128Наблюдать
Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %ffmpeg · ffmpeg9 сент. 2025 г.
- CVE-2025-5291528Наблюдать
K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to termin
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %9 сент. 2025 г.
- CVE-2025-3417424Наблюдать
Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
СредняяCVSS 5,1Эксплойта нетEPSS 12 %pfsense · pfsense9 сент. 2025 г.
- CVE-2025-3417526Наблюдать
Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting
СредняяCVSS 5,1Эксплойта нетEPSS 19 %pfsense · pfsense9 сент. 2025 г.
- CVE-2025-3417626Наблюдать
Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure
СредняяCVSS 5,3Эксплойта нетEPSS 17 %pfsense · pfsense9 сент. 2025 г.
- CVE-2025-5424927Наблюдать
Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
СредняяCVSS 6,5Proof of conceptEPSS 1 %adobe · experience manager9 сент. 2025 г.
- CVE-2025-5426147В плане
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
КритическаяCVSS 10,0Эксплойта нетEPSS 23 %adobe · coldfusion9 сент. 2025 г.
- CVE-2025-5489742В плане
Microsoft SharePoint Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 21 %microsoft · sharepoint server9 сент. 2025 г.
- CVE-2025-5818036Наблюдать
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
ВысокаяCVSS 7,5Proof of conceptEPSS 21 %octoprint · octoprint9 сент. 2025 г.
- CVE-2025-1014219Наблюдать
PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection
СредняяCVSS 4,9Proof of conceptEPSS 0 %martins56 · pagbank / pagseguro connect para woocommerce10 сент. 2025 г.
- CVE-2025-5752024Наблюдать
A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3.
СредняяCVSS 6,1Proof of conceptEPSS 0 %techhub.p-m · decap cms10 сент. 2025 г.
- CVE-2025-5764228Наблюдать
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the se
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %sohamjuhin · tourism management system10 сент. 2025 г.
- CVE-2025-5739231Наблюдать
BenimPOS Masaustu 3.0.x is affected by insecure file permissions.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %benimpos · benimpos10 сент. 2025 г.
- CVE-2025-1020035Наблюдать
Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap co
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %google · chrome10 сент. 2025 г.
- CVE-2025-102108Наблюдать
yanyutao0402 ChanCMS Api.js search sql injection
НизкаяCVSS 2,1Proof of conceptEPSS 1 %chancms · chancms10 сент. 2025 г.
- CVE-2025-5412342В плане
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
КритическаяCVSS 9,8Proof of conceptEPSS 10 %hoverfly · hoverfly10 сент. 2025 г.
- CVE-2025-5904931Наблюдать
Mockoon has a Path Traversal and LFI in the static file serving endpoint
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %mockoon · mockoon10 сент. 2025 г.
- CVE-2025-102118Наблюдать
yanyutao0402 ChanCMS getArticle CollectController server-side request forgery
НизкаяCVSS 2,1Proof of conceptEPSS 0 %chancms · chancms10 сент. 2025 г.
- CVE-2025-842230Наблюдать
Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %fassionstorage · propovoice: all-in-one client management system11 сент. 2025 г.
- CVE-2025-977626Наблюдать
CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import
СредняяCVSS 6,5Proof of conceptEPSS 0 %catfolders · catfolders – wordpress media library folders & categories11 сент. 2025 г.
- CVE-2025-5832033Наблюдать
DIALink - Directory Traversal Authentication Bypass Vulnerability
ВысокаяCVSS 7,3Эксплойта нетEPSS 14 %deltaww · dialink11 сент. 2025 г.
- CVE-2025-857039Наблюдать
BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter
КритическаяCVSS 9,8Proof of conceptEPSS 0 %beyondcart · beyondcart connector11 сент. 2025 г.
- CVE-2025-5806032Наблюдать
cups has Authentication bypass with AuthType Negotiate
ВысокаяCVSS 8,0Proof of conceptEPSS 0 %openprinting · cups11 сент. 2025 г.
- CVE-2025-806129Наблюдать
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Leno
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %lenovo · dispatcher 3.0 driver11 сент. 2025 г.
- CVE-2025-5531939Наблюдать
Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %microsoft · visual studio code11 сент. 2025 г.
- CVE-2025-2104279На этой неделе
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 33 %samsung · android12 сент. 2025 г.
- CVE-2025-2104370На этой неделе
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 2 %samsung · android12 сент. 2025 г.
- CVE-2025-5913921Наблюдать
Hono has Body Limit Middleware Bypass
СредняяCVSS 5,3Proof of conceptEPSS 0 %hono · hono12 сент. 2025 г.
- CVE-2025-5599625Наблюдать
Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface
СредняяCVSS 6,3Proof of conceptEPSS 0 %rakuten · viber12 сент. 2025 г.
- CVE-2025-1032711Наблюдать
MiczFlor RPi-Jukebox-RFID shuffle.php os command injection
НизкаяCVSS 2,1Proof of conceptEPSS 10 %sourcefabric · rpi-jukebox-rfid12 сент. 2025 г.
- CVE-2025-5843454В плане
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
КритическаяCVSS 9,8Proof of conceptEPSS 49 %flowiseai · flowise12 сент. 2025 г.
- CVE-2025-103708Наблюдать
MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting
НизкаяCVSS 2,0Proof of conceptEPSS 0 %sourcefabric · rpi-jukebox-rfid13 сент. 2025 г.
- CVE-2025-1020428Наблюдать
Unauth Admin Reset Password on AC Smart II
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %lg electronics · ac smart ii14 сент. 2025 г.
- CVE-2025-5935940В плане
OS command injection in Chaos Mesh via the cleanTcs mutation
КритическаяCVSS 9,8Proof of conceptEPSS 2 %chaos-mesh · chaos mesh15 сент. 2025 г.