CVE-2025-34509

Sitecore XM/XP affected: Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE; root cause is a hardcoded user account that allows unauthenticated, remote access to the ad...

CVE-2025-5349

CVE-2025-5349 affects Citrix NetScaler ADC and NetScaler Gateway via Improper access control on the NetScaler Management Interface. The Citrix security bulletin CTX693420 documents affected versions and fixes: upgrade to 14.1-43.56 or later, 13.1-58.32 or later (and 13.1-FIPS/13.1-NDcPP 37.235 an...

CVE-2025-5777

CVE-2025-6543 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can cause unintended control flow and Denial of Service when the appliance is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The Citrix security bulle...

CVE-2025-43200

Apple CVE-2025-43200 is a logic issue in processing a maliciously crafted photo or video shared via an iCloud Link that affects iOS, iPadOS, macOS, watchOS, and visionOS. The issue has been fixed in a broad set of updates (watchOS 11.3.1; macOS Ventura 13.7.4; iOS 15.8.4, 16.7.11, 17.7.5, 18.3.1;...

CVE-2025-49596

Summary: CVE-2025-49596 affects MCP Inspector deployments prior to 0.14.1. An unauthenticated bridge between the Inspector client and proxy allows remote code execution by sending MCP commands via stdio. This can enable arbitrary command execution with high impact (confidentiality, integrity, and...

CVE-2025-45985

CVE-2025-45985 affects Blink router models including BL-WR9000 (2.4.9), BL-AC2100 AZ3 (1.0.4), BL-X10_AC8 (1.0.5), BL-LTE300 (1.2.3), BL-F1200_AT1 (1.0.0), BL-X26_AC8 (1.2.8), BLAC450M_AE4 (4.0.0), and BL-X26_DA3 (1.2.7). A command injection vulnerability exists in the bs_SetSSIDHide function, al...

CVE-2025-45988

The CVE-2025-45988 entry affects Blink routers (BL-WR9000, BL-AC2100 AZ3, BL-X10 AC8, BL-LTE300, BL-F1200 AT1, BL-X26 AC8, BLAC450M AE4, BL-X26 DA3) with multiple command injection vulnerabilities in the bs_SetCmd function via the cmd parameter. Root cause: improper handling of the cmd parameter ...

CVE-2025-1055

CVE-2025-1055 affects the K7RKScan.sys driver in the K7 Security Anti-Malware suite. A missing access control in the driver’s IOCTL handler lets a local, low-privilege user craft IOCTLs to terminate a wide range of processes running with admin or system privileges (excluding OS-protected ones). C...

CVE-2025-47170

CVE-2025-47170 : Microsoft Word (Office) contains a use-after-free vulnerability in Word that allows an attacker to achieve local code execution. The CVSSv3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a local, high-impact issue requiring user interaction and with total impact on conf...

CVE-2025-47165

CVE-2025-47165 is a Microsoft Excel/Office remote code execution vulnerability attributed to a use-after-free in Excel. Connected sources describe an attacker leveraging a crafted DOCM delivery to compel a user to execute code, enabling local RCE. The CVE is tracked in Microsoft’s June 2025 secur...

CVE-2025-33073

CVE-2025-33073 is a network-accessible elevation of privilege in the Windows SMB Client caused by improper access control in the SMB protocol stack. The initial description confirms privilege escalation with network access. Connected documents provide concrete exploit presence: PoCs and proof‑of‑...

CVE-2025-33053

Summary of CVE-2025-33053 : A vulnerability in Windows WebDAV/Internet Shortcut handling allows remote code execution when a vulnerable host opens a crafted .url file that points to a WebDAV share. Exploitation relies on the WebClient service resolving UNC paths via WebDAV and may trigger arbitra...

CVE-2025-30220

Geoserver-related CVE-2025-30220 is an XXE processing vulnerability in the GeoTools gt-xsd-core handling used by GeoServer WFS. The issue arises when building in‑memory XSD schemas without applying a proper EntityResolver, enabling unauthenticated attackers to exfiltrate local files and trigger S...

CVE-2025-27505

GeoServer contains a REST API index authorization bypass vulnerability (CVE-2025-27505). The REST security excludes paths with extensions (for example rest.html), allowing unauthenticated access to the REST API Index and potentially revealing installed extensions and API endpoints. Affected codep...

CVE-2024-29198

CVE-2024-29198 affects GeoServer via an unauthenticated SSRF vulnerability in the Demo Request endpoint when Proxy Base URL is not set. The root cause is insufficient validation/controls in the TestWfsPost path, allowing the server to issue requests on behalf of an attacker to internal networks o...

CVE-2025-27817

CVE-2025-27817 : An arbitrary file read and SSRF flaw in the Apache Kafka Client (affecting Kafka Connect and related clients) allows untrusted configuration of SASL/OAUTHBEARER endpoint URLs to read local files or reach unintended URLs. Root cause: endpoints sasl.oauthbearer.token.endpoint.url a...

CVE-2025-48281

The CVE describes a SQL Injection vulnerability in the WordPress plugin MyStyle Custom Product Designer (versions up to and including 3.21.1). The issue stems from improper neutralization of user-supplied input and insufficient query preparation, enabling blind SQL injection. Unauthenticated atta...

CVE-2025-49619

Skyvern is affected by a server-side template injection (SSTI) in the Prompt field of workflow blocks (notably Navigation v2). The root cause is improper sanitization of Jinja2 input, allowing an authenticated user to inject expressions that are evaluated server-side, leading to blind remote code...

CVE-2025-41646

CVE-2025-41646 affects RevPi Webstatus (≤ v2.4.5). The authentication bypass is caused by an incorrect type conversion in the login mechanism, allowing an unauthenticated remote attacker to gain full device access. Connected documents identify RevPi Webstatus as vulnerable to improper type handli...

CVE-2025-47827

Technical details for CVE-2025-47827 are not publicly provided in the supplied documents. The initial description notes a Secure Boot bypass via igel-flash-driver, but no additional technical specifics, affected versions, or fixes are included here. Monitor for updates.