Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.
R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM station setup access.
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can control the 0th argument of packed executables to execute another executable, allowing them to bypass restrictions and gain unauthorized access.
A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2-1.41) that allows a local network attacker to achieve Remote Code Execution (RCE) with root privileges. The issue occurs due to improper session invalidation after administrator logout. When an administrator logs out, the session token remains valid. An attacker on the local network can reuse this stale token to send crafted requests via the router’s diagnostic endpoint, resulting in command execution as root.
VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.
Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.
An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.
Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to execute de-authentication attacks, allowing crafted deauthentication and disassociation frames to be broadcast without authentication or encryption.
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext.
This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests when frontend menu updates (such as privilege revocation) fail to propagate to the backend permission table in real-time, creating a dangerous desynchronization. While users lose access to restricted functions through the web interface (as UI elements properly disappear), the stale permission records still validate unauthorized API requests when accessed directly through tools like Postman. Attackers exploiting this inconsistency can perform privileged operations including but not limited to: creating high-permission user accounts, accessing sensitive data beyond their clearance level, and executing admin-level commands.
Local memory corruption in the Linux kernel's imx_sc_key input driver (drivers/input/keyboard/imx_sc_key.c) for NXP i.MX SoCs occurs during module unload/unbind: a devm cleanup action was registered with the address of a stack variable (&priv) instead of the priv pointer itself, so imx_sc_key_action() dereferences a stale stack address. Triggering the corruption requires unloading or unbinding the driver on affected i.MX hardware, and there is no public exploit identified at time of analysis. EPSS is negligible (0.05%, 16th percentile) and it is not in CISA KEV, so this is a stability/robustness fix on niche hardware rather than a broadly exploited flaw.
Local privilege-escalation-grade memory corruption in the Linux kernel's AF_VSOCK (virtio/vhost vsock) stack allows a local user to trigger a use-after-free or NULL-pointer dereference by racing a signal or timeout against an in-progress connect() on an already-established socket. Aborting the connect could tear down a connected socket while a concurrent sendmsg() or sockmap operation runs, corrupting credit accounting (bytes_unsent), breaking sockmap invariants, and enabling a transport change/drop after TCP_ESTABLISHED. No public exploit is identified at time of analysis and EPSS is 0.05%, but the flaw is patched across many stable branches and tracked by Ubuntu, Debian, and Siemens.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
Local denial of service in the Linux kernel's mlx5_core driver (Mellanox/NVIDIA ConnectX network adapters) allows a system crash when mlx5_irq_alloc() fails on an exhausted IRQ vector pool. The faulty error path frees the entire CPU reverse-map (rmap) instead of only the newly added IRQ glue object, producing a general protection fault in free_irq_cpu_rmap() when another thread later dereferences the freed structure. The fix is available from vendor; EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis.
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offline/bundle/upload/ endpoints allow low-privilege users to upload ZIP files to the server. The plupload_file_upload function handles these file uploads and constructs the destination file path by using either the name parameter or the uploaded filename, neither of which is properly sanitized. The file extension is extracted by splitting the filename, and a format string is used to construct the final file path, leaving the destination path vulnerable to path traversal. An authenticated attacker with network connectivity can write arbitrary files to the server, enabling remote code execution after overwriting an executable file. An example is the pdflatex executable, which is executed through subprocess.Popen in the write_report_pdf function after requests to a /report/latex/(\d+).pdf endpoint.
The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
Memory corruption in the Linux kernel's s390/ctcm mainframe network driver stems from a double-kfree: mpc_rcvd_sweep_req() frees the mpcginfo structure, then ctcmpc_unpack_skb() frees the same pointer again after the conditional call returns. Discovered via clang static analysis, it affects IBM Z (s390) systems using the CTCM MPC networking driver and could lead to kernel memory corruption, denial of service, or potentially escalation when a crafted MPC sweep-request frame is processed. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.05%), and it is not listed in CISA KEV; the fix has shipped in stable kernel releases.
Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.
Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.
Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.
CVE-2025-13932 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
XPath Injection in WatchGuard Fireware OS exposes sensitive Firebox configuration data to remote unauthenticated attackers via the authentication or management web interface. Affected systems span four major version branches from 11.11 through 2025.1.2, covering a wide range of deployed Firebox hardware appliances. Exploitation is conditioned on the authentication hotspot feature being enabled; no public exploit code exists and EPSS sits at 0.11% (30th percentile), indicating low observed exploitation activity despite the high CVSS 4.0 score of 8.2.
Out-of-bounds memory access in the Linux kernel's arm64 protected-KVM (pKVM) hypervisor allows a compromised or malicious host kernel to read beyond the bounds of the hypervisor's FF-A (Arm Firmware Framework) shared-memory buffer by supplying an unvalidated composite-memory-region offset in the range [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]. Because the host is normally treated as untrusted relative to the hypervisor in the pKVM confidential-compute model, this breaks the host/hypervisor isolation boundary (CVSS scope change) and can disclose hypervisor memory or crash it. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with a hard-to-reach, config-specific hypervisor bug rather than mass exploitation.
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
A security vulnerability in Taiko Alethia (CVSS 8.0). High severity vulnerability requiring prompt remediation.
Stale extent-map cache handling in the Linux kernel's OCFS2 clustered filesystem lets a local, low-privileged user with access to an OCFS2 mount crash the kernel and read or corrupt on-disk extent data. After a reflinked (OCFS2_EXT_REFCOUNTED) extent is moved or defragmented, the in-memory extent cache retains stale flags while the disk holds updated ones; a subsequent write hits a BUG_ON in ocfs2_refcount_cal_cow_clusters(), producing a panic (denial of service) and potential data/integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a niche, non-KEV local kernel bug rather than a mass-exploited flaw.
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Memory-map miscalculation in the Linux kernel's nios2 architecture code allows local low-privileged users to trigger kernel paging failures and denial of service on affected nios2 (soft-core) systems built with CONFIG_FLATMEM. Because memblock.current_limit is left at its default MEMBLOCK_ALLOC_ANYWHERE when pfn limits are computed, max_low_pfn can exceed max_pfn and push mem_map beyond valid DRAM, producing 'Unable to handle kernel paging request' oopses and kernel panics. No public exploit identified at time of analysis; EPSS is 0.04% (11th percentile) and the flaw is not in CISA KEV.
Uninitialized-memory read in the Linux kernel's HFS+ filesystem driver (__hfsplus_ext_cache_extent) allows a local actor who can write to a mounted HFS+ volume to trigger use of uninitialized heap data, leading to information disclosure or a kernel crash. The flaw, found by syzbot via KMSAN on kernel 6.12-rc5, is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 11th percentile). Distributions including Ubuntu (USN-8029/8030/8033/8034) and Debian (DLA-4404-1) have shipped patches.
Uninitialized-memory (KMSAN uninit-value) defect in the Linux kernel HFS filesystem driver allows a local attacker who can mount or operate on a crafted HFS volume to corrupt on-disk allocation state and destabilize the filesystem. The bitmap buffer in hfs_mdb_get() was allocated with kmalloc() (leaving residual heap garbage) and later consumed by hfs_find_set_zero_bits() during block allocation, so non-zero uninitialized bits can drive incorrect bitmap decisions leading to volume corruption and driver misbehavior. Discovered by syzbot fuzzing; there is no public exploit identified at time of analysis and EPSS risk is very low (0.04%).
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddleware, authenticates users as ionadmin if the REMOTE_ADDR property in request.META is set to 127.0.0.1, to 127.0.1.1, or to ::1. Any user with local access to the server may bypass authentication.
Local privilege-context memory corruption in the Linux kernel's GPIO character device (gpio cdev) subsystem allows a use-after-free on the file structure backing an open GPIO chardev descriptor. When a GPIO line-change event fires after the final fput() has dropped the fd's reference count to zero but before the deferred .release() callback unregisters the notifier, the kernel calls get_file() on a file with a zero refcount, triggering a use-after-free (warned as 'f_count incremented from zero; use-after-free condition present'). No public exploit has been identified at time of analysis and the EPSS score is negligible (0.03%), consistent with a hard-to-win local race rather than a widely exploited flaw.
Denial of service in the Linux kernel EROFS filesystem driver (versions 6.15 through the 6.17.x series before 6.17.6) lets a local user crash the system by mounting or reading a specially crafted read-only filesystem image. The flaw lives in the 'encoded extents' feature added in Linux 6.15, where malformed physical-length (plen) values and out-of-48-bit physical block addresses trigger an out-of-bounds access in z_erofs_submit_queue(). No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), but vendor patches are available and the issue is tracked by Ubuntu (medium priority) and Debian.
Local privilege-relevant memory corruption in the Linux kernel's io_uring resource (rsrc) subsystem stems from faulty offset arithmetic when computing the first page of a coalesced folio from an unaligned user virtual address, allowing a local low-privileged user submitting io_uring requests to trigger out-of-bounds access with high confidentiality, integrity, and availability impact. Fixed upstream and backported to stable trees (6.12.36, 6.15.5, 6.16); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 6th percentile). Not listed in CISA KEV.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure. Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files. This vulnerability existed in the NI System Web Server 2012 and prior versions. It was fixed in 2013.