Latest CVE Feed
-
8.8
HIGHCVE-2025-59141
simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware pa... Read more
Affected Products :- Published: Sep. 15, 2025
- Modified: Sep. 16, 2025
- Vuln Type: Supply Chain
-
8.8
HIGHCVE-2025-57803
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses byt... Read more
Affected Products : imagemagick- Published: Aug. 26, 2025
- Modified: Sep. 02, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-30036
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up t... Read more
Affected Products :- Published: Aug. 27, 2025
- Modified: Aug. 29, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-35433
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.... Read more
Affected Products : thorium- Published: Sep. 17, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2025-22411
In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not need... Read more
Affected Products : android- Published: Aug. 26, 2025
- Modified: Sep. 02, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-55422
In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.... Read more
Affected Products : foxcms- Published: Aug. 27, 2025
- Modified: Sep. 09, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-9580
A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be la... Read more
- Published: Aug. 28, 2025
- Modified: Sep. 12, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-9841
A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possib... Read more
Affected Products : mobile_shop_management_system- Published: Sep. 03, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Misconfiguration
-
8.8
HIGHCVE-2025-9687
A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote l... Read more
Affected Products : i-educar- Published: Aug. 30, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Authorization
-
8.8
HIGHCVE-2025-9667
A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. The attack may be init... Read more
Affected Products : simple_grading_system- Published: Aug. 29, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-9760
A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack... Read more
Affected Products : i-educar- Published: Sep. 01, 2025
- Modified: Sep. 17, 2025
- Vuln Type: Authorization
-
8.8
HIGHCVE-2025-32468
A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur when calculating the stride for decoding. Af... Read more
Affected Products : sail- Published: Aug. 25, 2025
- Modified: Sep. 02, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2024-43115
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, ... Read more
Affected Products : dolphinscheduler- Published: Sep. 03, 2025
- Modified: Sep. 09, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-56413
OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint.... Read more
Affected Products : 1panel- Published: Sep. 10, 2025
- Modified: Sep. 17, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-53969
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Misconfiguration
-
8.8
HIGHCVE-2025-54918
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.... Read more
Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_10_1507 +7 more products- Published: Sep. 09, 2025
- Modified: Sep. 11, 2025
-
8.8
HIGHCVE-2025-9690
A flaw has been found in SourceCodester Advanced School Management System 1.0. This affects an unknown function of the file /index.php/stock/vendordetails. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. Th... Read more
Affected Products : advanced_school_management_system- Published: Aug. 30, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-6366
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() funct... Read more
Affected Products : event_list- Published: Aug. 26, 2025
- Modified: Aug. 29, 2025
- Vuln Type: Authorization
-
8.8
HIGHCVE-2025-5931
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff ... Read more
Affected Products : dokan_pro_plugin- Published: Aug. 26, 2025
- Modified: Aug. 26, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2025-10537
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrar... Read more
- Published: Sep. 16, 2025
- Modified: Sep. 20, 2025
- Vuln Type: Memory Corruption