CVEs of 2025.

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2012

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Drop everything exploited Injection OS & kernel react-native-community React Native Community Cli

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

exploited Code execution OS & kernel Microsoft Windows 10 1507

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

exploited Auth & access OS & kernel Microsoft Windows 10 1507

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

Code execution OS & kernel Microsoft Windows 11 23h2

Windows OLE Remote Code Execution Vulnerability

Drop everything Memory safety OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.

Memory safety OS & kernel Linux Kernel

Out-of-bounds read in Web Threat Defense (WTD.sys) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 11 22h2

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

exploited Other OS & kernel Microsoft Windows 10 1507

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Drop everything exploited Other OS & kernel Sudo Project Sudo

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Memory safety OS & kernel Microsoft Windows 10 1507

Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.

Auth & access OS & kernel Microsoft Windows 10 1507

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.   This issue affects Apache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.

Disclosure OS & kernel Apache Solr

Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

Drop everything Memory safety OS & kernel Microsoft Windows 10 1507

NTLM Hash Disclosure Spoofing Vulnerability

Other OS & kernel Microsoft Windows 10 1507

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Denial of service OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF.

Memory safety OS & kernel Linux Kernel

Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows Server 2012

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

Disclosure OS & kernel Microsoft Windows 10 1507

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Other OS & kernel Lynxtechnology Twonky Server

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

exploited Other OS & kernel Microsoft Windows 10 1507

A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.

Auth & access OS & kernel Cisco iOS Xe

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

exploited Code execution OS & kernel Microsoft Windows 10 1507

Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.

Auth & access OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

Memory safety OS & kernel Linux Kernel

Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network.

Denial of service OS & kernel Microsoft Windows 10 1507

Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

Disclosure OS & kernel Microsoft Windows 10 1507

Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network.

Disclosure OS & kernel Microsoft Windows 10 1507

A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.

Code execution OS & kernel Whatsapp

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

Drop everything exploited Memory safety OS & kernel Apple macOS

SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against relay attacks: SMB Server signing SMB Server Extended Protection for Authentication (EPA) Microsoft is releasing this CVE to provide customers with audit capabilities to help them to assess their environment and to identify any potential device or software incompatibility issues before deploying SMB Server hardening measures that protect against relay attacks. If you have not already enabled SMB Server hardening measures, we advise customers to take the following actions to be protected from these relay attacks: Assess your environment by utilizing the audit capabilities that we are exposing in the September 2025 security updates. See Support for Audit Events to deploy SMB Server Hardening—SMB Server Signing & SMB Server EPA. Adopt appropriate SMB Server hardening measures.

Auth & access OS & kernel Microsoft Windows 10 1507

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

exploited Memory safety OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.

Other OS & kernel Linux Kernel

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1507

Windows Remote Desktop Services Remote Code Execution Vulnerability

Code execution OS & kernel Microsoft Windows Server 2012

Active Directory Domain Services Elevation of Privilege Vulnerability

Auth & access OS & kernel Microsoft Windows 10 1507

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid.

Memory safety OS & kernel Linux Kernel

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

Disclosure OS & kernel

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.

Memory safety OS & kernel Linux Kernel

Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Injection OS & kernel Tridium Niagara

In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data each time before we parse we can overflow the allocated skb space. Constructing a scenario in which we're under pressure without enough data in the socket to parse the length upfront is quite hard. syzbot figured out a way to do this by serving us the header in small OOB sends, and then filling in the recvbuf with a large normal send. Make sure that tls_rx_msg_size() aborts strp, if we reach an invalid record there's really no way to recover.

Other OS & kernel Linux Kernel

Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1507

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.

Injection OS & kernel Dataease

Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Other OS & kernel Microsoft Windows 11 24h2

Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1507

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

exploited Memory safety OS & kernel Microsoft Windows 10 21h2

Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1809

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

Memory safety OS & kernel Microsoft Windows 10 1507