Trending now

CVE-2025-33073 is an elevation of privilege vulnerability affecting the Windows Server Message Block (SMB) client. It stems from improper access control within Windows SMB, potentially allowing an authorized attacker to elevate privileges over a network. To exploit this vulnerability, an attacker could execute a specially crafted script. This script would coerce the victim machine to connect back to the attacker's system using SMB and authenticate, potentially resulting in the attacker gaining SYSTEM privileges.

CVE-2025-0133 is a reflected cross-site scripting (XSS) vulnerability found in the GlobalProtect gateway and portal features of Palo Alto Networks PAN-OS software. This vulnerability allows for the execution of malicious JavaScript within the browser of an authenticated Captive Portal user when they interact with a specially crafted link. The primary risk associated with this vulnerability is the potential for phishing attacks that could lead to the theft of user credentials, particularly if Clientless VPN is enabled. An attacker could create links that appear to be hosted on the GlobalProtect portal to steal credentials. Threat IDs 510003 and 510004 can be enabled to block attacks. Disabling Clientless VPN can also serve as mitigation.

CVE-2025-32717 is a heap-based buffer overflow vulnerability in Microsoft Office Word. It allows an unauthorized attacker to execute code locally on a vulnerable system. The vulnerability can be exploited through a maliciously crafted RTF file, which could be triggered via the Preview Pane without requiring user interaction. Successful exploitation of this vulnerability could allow an attacker to compromise the system. A security update was released on June 10, 2025, to address this vulnerability in Microsoft 365 Apps.

CVE-2024-43468 is a SQL injection vulnerability affecting Microsoft Configuration Manager (SCCM). It allows an unauthenticated attacker with network access to a Management Point to execute arbitrary SQL queries on the site database. The vulnerability stems from the lack of proper sanitization of externally influenced input when constructing SQL commands. Successful exploitation grants the attacker unauthorized access to the SQL server database with the same privileges as the SCCM process, potentially leading to remote code execution, malware deployment, credential theft, and lateral movement within the network.

CVE-2025-4275 is a vulnerability in Insyde H2O UEFI firmware that allows attackers to bypass Secure Boot protections. This is achieved by injecting rogue digital certificates into a poorly protected NVRAM variable named SecureFlashCertData. The firmware then mistakenly trusts the attacker's certificate, which allows the execution of malicious UEFI modules. Attackers with administrative OS-level access can write their own certificate to the SecureFlashCertData variable. During the next boot cycle, this injected certificate is used by the firmware to verify and execute unsigned or tampered UEFI code during early boot. This enables attackers to load pre-boot malware, rootkits, or firmware-level persistence mechanisms before the OS and its security tools initialize.

CVE-2025-4123 is a cross-site scripting (XSS) vulnerability found in Grafana. It stems from a combination of client path traversal and an open redirect issue within the handling of custom frontend plugins. This flaw allows attackers to redirect users to malicious websites and execute arbitrary JavaScript code. The vulnerability is particularly concerning because it can be exploited even without editor permissions, especially if anonymous access is enabled in Grafana. Furthermore, if the Grafana Image Renderer plugin is installed, the vulnerability can be escalated to a full read Server-Side Request Forgery (SSRF), potentially exposing internal services and cloud metadata. All supported versions of Grafana OSS and Grafana Enterprise, starting from Grafana 8 are affected.

CVE-2025-26685 is an improper authentication vulnerability affecting Microsoft Defender for Identity. It allows an unauthorized attacker on an adjacent network to perform spoofing. Specifically, an unauthenticated attacker with local network access can coerce and capture the Net-NTLM hash of the Directory Service Account (DSA) associated with the MDI sensor. This vulnerability abuses the Lateral Movement Paths (LMPs) feature. By initiating a connection to a Domain Controller, an attacker can trigger the MDI sensor to authenticate and query the attacker's system for members of the Local Administrators group. This can lead to the attacker gathering information about the domain and potentially escalating privileges in Active Directory environments.

CVE-2025-49113 is a remote code execution vulnerability affecting Roundcube Webmail versions before 1.5.10 and 1.6.x before 1.6.11. It stems from the insufficient validation of the `_from` parameter in the `program/actions/settings/upload.php` file. This lack of validation allows for PHP Object Deserialization, potentially enabling authenticated users to execute arbitrary code on the Roundcube Webmail server. The vulnerability has been addressed in Roundcube Webmail versions 1.5.10 and 1.6.11.

CVE-2025-33053 is a remote code execution vulnerability affecting the WebDAV client in Microsoft Windows. It stems from insufficient input validation in WebDAV file path handling, allowing an attacker to execute arbitrary code over a network. Successful exploitation requires a user to click on a specially crafted WebDAV URL, potentially leading to unauthorized access to sensitive system resources, compromise of system integrity and confidentiality, or even full control of the affected system. This vulnerability has been actively exploited in the wild.

CVE-2025-21420 is an elevation of privilege vulnerability that exists in the Windows Disk Cleanup tool. Successful exploitation could allow an attacker to elevate their privileges to SYSTEM level. As of February 18, 2025, the CVSS v3 score is 7.8, considered High. Microsoft has addressed this vulnerability. It is recommended to apply the necessary security updates to mitigate the risk.