PT-2025-42399

Name of the Vulnerable Software and Affected Versions go-witness versions 0.8.6 and earlier witness versions 0.9.2 and earlier Description The AWS attestor in go-witness and witness improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is n...

PT-2025-42281

Name of the Vulnerable Software and Affected Versions WordPress Task Scheduler plugin versions prior to 1.6.4 Description The Task Scheduler plugin for WordPress is susceptible to Server-Side Request Forgery. This affects authenticated attackers with Administrator-level access or higher. Attacker...

go-witness Trust Management Vulnerability

go-witness is a Golang library open-sourced by in-toto. A trust management issue vulnerability exists in go-witness version 0.8.6 and earlier, which stems from the AWS attestor not properly validating AWS EC2 instance identity documents, which could lead to the acceptance of forged identity...

EUVD-2025-34366

Improper link resolution before file access 'link following' in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

EUVD-2025-34390

Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally...

EUVD-2025-34391

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

EUVD-2025-34319

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

CVE-2025-59281

Improper link resolution before file access 'link following' in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

CVE-2025-59281

Improper link resolution before file access 'link following' in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

CVE-2025-59258

Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally...

CVE-2025-59258

Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally...

CVE-2025-59204

Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally...

CVE-2025-59204

Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally...

CVE-2025-59202

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

CVE-2025-59193

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Management Services allows an authorized attacker to elevate privileges locally...

CVE-2025-59193

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Management Services allows an authorized attacker to elevate privileges locally...

CVE-2025-58720

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

CVE-2025-58720

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

CVE-2025-59287 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

...

CVE-2025-59287

CVE-2025-59287 is a deserialization vulnerability in Windows Server Update Services (WSUS) that enables unauthenticated, remote code execution over the network via crafted data (notably SOAP requests to WSUS endpoints such as Client.asmx). Connected exploit analyses confirm the root cause as unsa...