Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2025-0124

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2024-52331

ECOVACS lawnmowers and vacuums deterministic firmware encryption key

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-45744

TopQuadrant TopBraid EDG password manager stores external credentials insecurely

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Topquadrant
Products
Topbraid Edg
CVE-2024-10934

OpenBSD NFS double-free vulnerability

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openbsd
CVE-2025-32093

Syatem admin profile modification by delegated granular administration role

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-2475

Unauthorized Bot Login Using Credentials

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-24839

Unauthorized AI bot activation via Wrangler plugin

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-54255

Acrobat Reader | Violation of Secure Design Principles (CWE-657)

Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass impacting integrity. An attacker does not have to be authenticated. Exploitation of this issue does not require user interaction, and scope is unchanged.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Acrobat Acrobat Dc Acrobat Reader and 3 more
CVE-2025-54251

Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.

CVSS 3.1 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Adobe
Products
Experience Manager
CVE-2024-33659

BiosGuard Buffer Overflow and TOCTOU Vulnerability

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code at SMM level, also impacting Confidentiality, Integrity, and Availability.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-42444

TOCTOU Race Condition between DMA and SMM

APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-33660

Potential Firmware update without integrity check

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-42442

Runtime Service Access outside SMRAM

APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-33658

Buffer Overflow Vulnerability In OFBD

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Successful exploitation of this vulnerability may lead to privilege escalation and potentially arbitrary code execution, and impact Integrity.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-2315

SMM arbitrary code execution in Overclock

APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-42446

TOCTOU in SmmWhea

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2024-54084

SMM Arbitrary Write via TOCTOU Vulnerability

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2025-22834

ThirdPartyVideo SetVariable Vulnerability

AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2025-33045

Legacy Serial Redirection SMRAM Vulnerabilities

APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to information disclosure, arbitrary data writing, and impact Confidentiality, Integrity, and Availability.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2025-22830

SmiFlash Race Condition Vulnerability

APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V