CVE-2025-3770 SMM IDT Privilege Escalation Vulnerability

EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability...

CVE-2025-36605

Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. An unauthenticated attacker with remote access could...

CVE-2025-43185

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6. An app may be able to access protected user data...

CVE-2017-20198

The Marathon UI in DC/OS 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem / with read/write privileges. When using a malicious Docker image,...

CVE-2025-47988

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-49702

Access of resource using incompatible type 'type confusion' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-49688

Double free in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

CVE-2025-7410

Summary: CVE-2025-7410 affects LifeStyle Store 1.0 from Code-Projects. The issue is a vulnerability in the /cart_remove.php file where manipulating the ID argument enables SQL injection. The vulnerability is remote and the exploit has been disclosed publicly. Affected component: LifeStyle Store 1...

CVE-2025-49702

Access of resource using incompatible type 'type confusion' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-49696

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-49657

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

CVE-2025-49705

CVE-2025-49705 is a Microsoft PowerPoint remote code execution vulnerability described as a heap-based buffer overflow in PowerPoint that allows an attacker to execute code locally. Connected sources confirm this vulnerability affects PowerPoint components and is addressed by Microsoft security u...

CVE-2025-48824

Technical details (affected product, version, root cause, exploit, or remediation) are not provided in the connected documents; no concrete specifics about CVE-2025-48824 are available here. Monitor for official disclosures and updates.

CVE-2025-7174

A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file /teacher-issue-book.php. The manipulation of the argument idn leads to sql injection. The attack may be initiated remotely. The exploit has been disclos...

PT-2025-28602

Name of the Vulnerable Software and Affected Versions Microsoft Office PowerPoint affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Office affected versions not specified Microsoft Office Long Term Servicing Channel affected versions not...

PT-2025-27329 · Unknown · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical vulnerability was found in the code-projects Inventory Management System. This affects an unknown part of the file /php action/editOrder.php. The manipulation leads...

PT-2025-27079 · Sofass · Sofass

Name of the Vulnerable Software and Affected Versions: Sofass versions 1.3.4 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This means...

CVE-2024-28213

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...

CVE-2023-2330

The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack...

CVE-2023-2329

The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack...