CVE-2025-20362
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense · Adăugată: 2025-09-25
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
Măsura recomandată de CISAThe KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Detalii CVE ↗CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · Adăugată: 2025-09-23
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-5086
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
Dassault Systèmes · DELMIA Apriso · Adăugată: 2025-09-11
Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-38352
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
Linux · Kernel · Adăugată: 2025-09-04
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-48543
Android Runtime Use-After-Free Vulnerability
Android · Runtime · Adăugată: 2025-09-04
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Sitecore · Multiple Products · Adăugată: 2025-09-04
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2023-50224
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
TP-Link · TL-WR841N · Adăugată: 2025-09-03
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-9377
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
TP-Link · Multiple Routers · Adăugată: 2025-09-03
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2020-24363
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
TP-Link · TL-WA855RE · Adăugată: 2025-09-02
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
Meta Platforms · WhatsApp · Adăugată: 2025-09-02
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-57819
Sangoma FreePBX Authentication Bypass Vulnerability
Sangoma · FreePBX · Adăugată: 2025-08-29
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-7775
Citrix NetScaler Memory Overflow Vulnerability
Citrix · NetScaler · Adăugată: 2025-08-26
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2024-8068
Citrix Session Recording Improper Privilege Management Vulnerability
Citrix · Session Recording · Adăugată: 2025-08-25
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Citrix · Session Recording · Adăugată: 2025-08-25
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-48384
Git Link Following Vulnerability
Git · Git · Adăugată: 2025-08-25
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Apple · iOS, iPadOS, and macOS · Adăugată: 2025-08-21
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability
Trend Micro · Apex One · Adăugată: 2025-08-18
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-8875
N-able N-Central Insecure Deserialization Vulnerability
N-able · N-Central · Adăugată: 2025-08-13
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2025-8876
N-able N-Central Command Injection Vulnerability
N-able · N-Central · Adăugată: 2025-08-13
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft · Office · Adăugată: 2025-08-12
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Măsura recomandată de CISAApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Detalii CVE ↗