CVE-2025-49691

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-48821

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2025-48002

Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network...

CVE-2025-47999

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network...

CVE-2025-47988

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-47178

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network...

CVE-2025-48002

CVE-2025-48002 (Windows Hyper-V) describes an information-disclosure flaw caused by an integer overflow/wraparound in Hyper-V. An authenticated attacker on an adjacent network can potentially disclose data from the host. Public exploit presence is noted in referenced materials. Remediation is via...

CVE-2025-25271

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...

CVE-2025-25268

Phoenix Contact CHARX SEC-3150 (and related CHARX SEC-3xxx) devices expose a configuration service (TCP port 5001) that allows network-adjacent attackers to bypass authentication and modify configuration via an API endpoint, leading to read/write access. The issue is due to a lack of authenticati...

CVE-2025-47988: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-47178: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network...

CVE-2025-47999: Missing Synchronization

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network...

CVE-2025-25271: Initialization of a Resource with an Insecure Default

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...

CVE-2025-20693: Out-of-bounds Read

In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-34...

CVE-2025-48821: Use After Free

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2025-49722: Uncontrolled Resource Consumption

Uncontrolled resource consumption in Windows Print Spooler Components allows an authorized attacker to deny service over an adjacent network...

CVE-2025-48002: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network...

CVE-2025-5824

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pai...

CVE-2025-5827

Autel MaxiCharger AC Wallbox Commercial bleprocessesp32msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authenticati...

CVE-2025-6522: Improper Neutralization of Special Elements used in a Command

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string...