Vulnerability intelligence

Updated 6 minutes ago

Feeds

Trending now

CVEs trending on social media within the last 24 hours

Hypemeter

580100

Current score

Soft-boiled

  1. 1

    CVE-2025-43300 Published Aug 21, 2025

    Hype score

    58

    ApplemacOS Sonoma

    CVE-2025-43300 is an out-of-bounds write vulnerability that exists within Apple's Image I/O framework. The vulnerability can be triggered when a device processes a maliciously crafted image file, which can lead to memory corruption. Successful exploitation of this vulnerability can occur when a program writes data outside of an allocated memory buffer. This can result in the program crashing, data corruption, or potentially remote code execution. Apple has addressed this issue with improved bounds checking in multiple operating systems, including iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8.

  2. 2

    CVE-2025-54336 Published Aug 19, 2025

    Hype score

    43

    critical 9.8

    Plesk Obsidian

    CVE-2025-54336 is an authentication bypass vulnerability affecting Plesk Obsidian 18.0.70. The vulnerability lies in the `_isAdminPasswordValid` function within `admin/plib/LoginManager.php`, where an insecure comparison (`==`) is used. This weak comparison allows an attacker to log in as an administrator without the correct password if the actual administrator password begins with "0e" followed by only digits. An attacker can use any string that evaluates to 0.0, such as "0e0", to bypass authentication. This vulnerability can lead to full server compromise.

  3. 3

    CVE-2025-55346 Published Aug 14, 2025

    Hype score

    36

    critical 9.8

    JavaScript

    CVE-2025-55346 involves an improper control of code generation, specifically a vulnerability in a dynamic Function constructor. User-controlled input flows to an unsafe implementation, which allows network attackers to run arbitrary, unsandboxed JavaScript code within the host's context. This is achieved by sending a simple POST request. The vulnerability allows a remote attacker to execute arbitrary JavaScript code without requiring any user interaction. This can lead to a complete system compromise, unauthorized access to sensitive data, manipulation of application functionality, and potential lateral movement within the network.

See more

Known exploited

Sourced from CISA's Known Exploited Vulnerability (KEV) catalog.

  1. CVE-2025-54948 Published Aug 5, 2025

    critical 9.4

    Exploit known

    Trend Micro Apex One

    CVE-2025-54948 is a command injection vulnerability that affects the on-premise version of Trend Micro Apex One. It exists within the Apex One management console, which listens on TCP ports 8080 and 4343 by default. The vulnerability stems from the lack of proper validation of a user-supplied string before using it to execute a system call. A pre-authenticated remote attacker could exploit this vulnerability to upload malicious code and execute commands on affected installations. This could allow an attacker to execute code in the context of IUSR. Trend Micro has observed attempts to actively exploit this vulnerability in the wild. A temporary fix is available, and a formal patch is expected in mid-August 2025.

  2. CVE-2025-8088 Published Aug 8, 2025

    high 8.4

    Exploit known

    WinRAR

    CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR. It allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild. It was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. The vulnerability was exploited in phishing attacks to deliver RomCom malware. The attackers can trick the program into saving a file in a different location than the user intended, such as the computer's Startup folder. This allows the attackers to execute their own code. WinRAR patched the vulnerability in version 7.13.

  3. CVE-2025-43300 Published Aug 21, 2025

    Hype score

    58

    macOS SonomaApple

    CVE-2025-43300 is an out-of-bounds write vulnerability that exists within Apple's Image I/O framework. The vulnerability can be triggered when a device processes a maliciously crafted image file, which can lead to memory corruption. Successful exploitation of this vulnerability can occur when a program writes data outside of an allocated memory buffer. This can result in the program crashing, data corruption, or potentially remote code execution. Apple has addressed this issue with improved bounds checking in multiple operating systems, including iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8.

See more

Insights

See more

Our Security Team's most recent CVE analysis

  1. CVE-2025-54418

    critical 9.8

    Link to CVE page

    Intruder Insights

    Updated Jul 31, 2025

    For this vulnerability to be exploitable, the ImageMagick image processing library needs to be used to resize or add a text watermark to a user-uploaded file which was saved using a user-provided filename, or where the parameters for adding a watermark are user-controlled. File upload implementations that use a randomly generated filename before image resizing are not vulnerable.

    This vulnerability is simple to exploit and we expect to see active exploitation soon. However, attackers will need to locate file upload functionality within your applications first which will be difficult to fully automate at scale, so mass exploitation is unlikely.

    CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method or use the `text()` method with user-controlled text content or options. An attacker can upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed or provide malicious text content or options that get executed when adding text to images Users should upgrade to v4.6.2 or later to receive a patch. As a workaround, switch to the GD image handler (`gd`, the default handler), which is not affected by either vulnerability. For file upload scenarios, instead of using user-provided filenames, generate random names to eliminate the attack vector with `getRandomName()` when using the `move()` method, or use the `store()` method, which automatically generates safe filenames. For text operations, if one must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters and validate/restrict text options.

  2. CVE-2025-53770

    critical 9.8

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated Jul 23, 2025

    This is a critical remote code execution vulnerability in Sharepoint when used on-prem - Sharepoint for Microsoft 365 is not affected. It is a variant of a previous bug which, in combination with CVE-2025-53771, allows an unauthenticated attacker to use a deserialization vulnerability to run code on the server.

    If you host a Sharepoint instance you should immediately apply the security update and review the advice on this Microsoft page. Paying particular attention to the sections describing how to rotate your Machine Key and detect if you were already compromised.

    As there was a lag time between information on this vulnerability being available to attackers and the availability of the patch, there has been active exploitation of Sharepoint instances during this period.

    We have deployed an active check (11am 22nd July) and set off an Emerging Threat Scan for all of our Enterprise customers. In addition, we are committing this to the public Nuclei templates repository so that you can check your systems via Intruder - or for free via Nuclei as soon as the request is merged.

    Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

  3. CVE-2025-32463

    critical 9.3

    Link to CVE page

    Intruder Insights

    Updated Jul 2, 2025

    This is a serious local privilege escalation vulnerability in the sudo tool, which is present on most Unix systems. You should update this as soon as possible if your version is less than 1.9.14.

    Exploiting this vulnerability requires an attacker to have access to the machine already - so it's most serious in environments where lower-privileged users routinely have access to systems. However, all vulnerable systems should be patched.

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.