Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Windows Installer Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

Cert CC: CVE-2025-3052 InsydeH2O Secure Boot Bypass

Untrusted pointer dereference in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

Windows SDK Elevation of Privilege Vulnerability

Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio allows an authorized attacker to execute code over a network...

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

Windows Storage Management Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

Windows SMB Client Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

PT-2025-24831 · Microsoft · Windows Smb +1

Name of the Vulnerable Software and Affected Versions: Windows SMB affected versions not specified Description: The issue is related to an integer overflow or wraparound in Windows SMB, which allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no...

PT-2025-24846 · Microsoft · Windows Storage Management Provider +1

Name of the Vulnerable Software and Affected Versions: Windows Storage Management Provider affected versions not specified Description: The issue is an out-of-bounds read that allows an authorized attacker to disclose information locally. Recommendations: At the moment, there is no information...

PT-2025-24839 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to the use of an uninitialized resource in the Windows DWM Core Library, which allows an authorized attacker to disclose information locally...

CVE-2025-1777 BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save

The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'uxcbpageoptionssave' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2025-36880

Name of the Vulnerable Software and Affected Versions: Windows NTFS affected versions not specified Description: A stack-based buffer overflow exists in Windows NTFS that could allow a local attacker to execute code. The vulnerability may also allow remote attackers to execute arbitrary code and...

Qualcomm Fixes 3 Zero-Days Used in Targeted Android Attacks via Adreno GPU

Qualcomm has shipped security updates to address three zero-day vulnerabilities that it said have been exploited in limited, targeted attacks in the wild. The flaws in question, which were responsibly disclosed to the company by the Google Android Security team, are listed below - CVE-2025-21479...

CVE-2025-48480 FreeScout Has Business Logic Errors

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...

CVE-2024-20438

A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this...

CVE-2024-43413

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which...

CVE-2024-37389

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client...