CVE-2025-21204 Windows Process Activation Elevation of Privilege Vulnerability

...

CVE-2025-21203

CVE-2025-21203 affects Windows Routing and Remote Access Service (RRAS). The connected data confirms a network-accessible vulnerability in RRAS that can cause an information disclosure via a buffer over-read. Affected component: RRAS on Windows; root cause: buffer over-read; impact: confidential ...

CVE-2025-21174 Windows Standards-Based Storage Management Service Denial of Service Vulnerability

...

CVE-2025-29824 Windows Common Log File System Driver Elevation of Privilege Vulnerability

...

CVE-2025-29820 Microsoft Word Remote Code Execution Vulnerability

...

CVE-2025-27749 Microsoft Office Remote Code Execution Vulnerability

...

CVE-2025-27742 NTFS Information Disclosure Vulnerability

...

CVE-2025-27478 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

...

CVE-2025-27477 Windows Telephony Service Remote Code Execution Vulnerability

...

CVE-2025-27477

CVE-2025-27477 is a heap-based buffer overflow in Windows Telephony Service that enables remote code execution over a network. The CVE is confirmed in multiple sources (NVD entry and Microsoft KB references) as affecting Windows Telephony Service with network-exposed vectors and total impact. The...

CVE-2025-27470 Windows Standards-Based Storage Management Service Denial of Service Vulnerability

...

CVE-2025-26668

CVE-2025-26668 is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) that allows a network-authenticated attacker to execute code remotely. Affected component is RRAS (Windows Routing and Remote Access Service); root cause is a heap-based overflow that can lead to ar...

CVE-2025-22855

creationtimestamp| type| source ---|---|--- 2025-04-08 17:22:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmcygex44e2v 2025-04-08 18:10:59+00:00| seen| https://t.me/cvedetector/22465...

CVE-2024-54025

creationtimestamp| type| source ---|---|--- 2025-04-08 17:22:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmcyge57sl2i 2025-04-08 18:10:58+00:00| seen| https://t.me/cvedetector/22464...

CVE-2025-32024

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

CVE-2025-26663

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:48:33+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114304071245143216 2025-04-08 20:07:42+00:00| seen|...

CVE-2025-32020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser

The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...

CVE-2025-22461

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution...

CVE-2025-22855

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code...

CVE-2025-29999

creationtimestamp| type| source ---|---|--- 2025-04-08 13:59:50+00:00| seen| https://t.me/cvedetector/22442 2025-04-10 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-01...