Security Radar

CVE-2024-50302 Severity under analysis added on 03/04/2025

Linux Kernel Use of Uninitialized Resource Vulnerability

Linux · Kernel · CWE-908

The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.

CVE-2024-4885 Severity under analysis added on 03/03/2025

Progress WhatsUp Gold Path Traversal Vulnerability

Progress · WhatsUp Gold · CWE-22

Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.

CVE-2023-20118 Severity under analysis added on 03/03/2025

Cisco Small Business RV Series Routers Command Injection Vulnerability

Cisco · Small Business RV Series Routers · CWE-77

Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.

CVE-2018-8639 Severity under analysis Ransomware added on 03/03/2025

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft · Windows · CWE-404

Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

CVE-2024-49035 Severity under analysis added on 02/25/2025

Microsoft Partner Center Improper Access Control Vulnerability

Microsoft · Partner Center · CWE-269

Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.

CVE-2024-20953 Severity under analysis added on 02/24/2025

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Oracle · Agile Product Lifecycle Management (PLM) · CWE-502

Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

CVE-2017-3066 Severity under analysis added on 02/24/2025

Adobe ColdFusion Deserialization Vulnerability

Adobe · ColdFusion · CWE-502

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

CVE-2025-24989 Severity under analysis added on 02/21/2025

Microsoft Power Pages Improper Access Control Vulnerability

Microsoft · Power Pages · CWE-284

Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.

CVE-2025-0111 Severity under analysis added on 02/20/2025

Palo Alto Networks PAN-OS File Read Vulnerability

Palo Alto Networks · PAN-OS · CWE-73

Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.

CVE-2025-0108 Severity under analysis added on 02/18/2025

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · CWE-306

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

CVE-2024-53704 Severity under analysis Ransomware added on 02/18/2025

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

SonicWall · SonicOS · CWE-287

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

CVE-2025-21418 Severity under analysis added on 02/11/2025

Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

Microsoft · Windows · CWE-122

Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

CVE-2025-21391 Severity under analysis added on 02/11/2025

Microsoft Windows Storage Link Following Vulnerability

Microsoft · Windows · CWE-59

Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.

CVE-2024-21413 Severity under analysis added on 02/06/2025

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft · Office Outlook · CWE-20

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

CVE-2024-53104 Severity under analysis added on 02/05/2025

Linux Kernel Out-of-Bounds Write Vulnerability

Linux · Kernel · CWE-787

Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

CVE-2024-45195 Severity under analysis added on 02/04/2025

Apache OFBiz Forced Browsing Vulnerability

Apache · OFBiz · CWE-425

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

CVE-2024-29059 Severity under analysis added on 02/04/2025

Microsoft .NET Framework Information Disclosure Vulnerability

Microsoft · .NET Framework · CWE-209

Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.

CVE-2025-23006 Severity under analysis Ransomware added on 01/24/2025

SonicWall SMA1000 Appliances Deserialization Vulnerability

SonicWall · SMA1000 Appliances · CWE-502

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

CVE-2025-21335 Severity under analysis added on 01/14/2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.

CVE-2025-21334 Severity under analysis added on 01/14/2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.

CVE-2025-21333 Severity under analysis added on 01/14/2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Microsoft · Windows · CWE-122

Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.

CVE-2024-55591 Severity under analysis Ransomware added on 01/14/2025

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxy · CWE-288

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

CVE-2025-0282 Severity under analysis Ransomware added on 01/08/2025

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · CWE-121

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

CVE-2020-2883 Severity under analysis added on 01/07/2025

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.