Unauthenticated/Unauthorized Access - 15320 CVEs (Page 24/128)

About “Unauthenticated/Unauthorized Access”

A curated feed of “Unauthenticated/Unauthorized Access”-related CVEs appears below. We currently track 15320 CVEs for this tag (all time). In the last 365 days, 3827 were published. Average CVSS is 7.4 (all time; 7.4 over 365d), and 61% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-862 - Missing Authorization, CWE-306 - Missing Authentication for Critical Function, CWE-639 - Authorization Bypass Through User-Controlled Key.

In our taxonomy this topic maps to a HIGH impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2025-10-21

Low

CVE-2025-61755

Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.16 and 21.0.8. Difficult to exploi…

CVSS: 3.7 CWE: CWE-862 - Missing Authorization View on NVD

Medium

CVE-2025-61754

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0. Easily exploitable vulnerability…

CVSS: 6.5 CWE: CWE-267 - Privilege Defined With Unsafe Actions View on NVD

Medium

CVE-2025-61753

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows…

CVSS: 6.1 CWE: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect') View on NVD

High

CVE-2025-61752

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerabili…

CVSS: 7.5 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2025-61751

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected ar…

CVSS: 8.1 CWE: CWE-862 - Missing Authorization View on NVD

Low

CVE-2025-61748

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java…

CVSS: 3.7 CWE: CWE-284 - Improper Access Control View on NVD

Critical

CVE-2025-53072

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerabil…

CVSS: 9.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2025-53066

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8…

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2025-53065

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitabl…

CVSS: 5.4 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2025-53060

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.9.4. Easily exploitable vulnerabil…

CVSS: 6.1 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-53059

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploita…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-53058

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Interfaces). Supported versions that are affected are 12.2.3-12.2.14. Easily explo…

CVSS: 6.1 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-53057

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java S…

CVSS: 5.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-53056

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tech). Supported versions that are affected are 9.2.0.0-9.2.9.4. Easily exploitabl…

CVSS: 6.1 CWE: CWE-285 - Improper Authorization View on NVD

Medium

CVE-2025-53055

CVSS: 6.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2025-53052

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnera…

CVSS: 6.1 CWE: CWE-284 - Improper Access Control View on NVD

High

CVE-2025-53050

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitabl…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2025-53047

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows…

CVSS: 5.8 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2025-53043

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows…

CVSS: 8.1 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2025-53041

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.5-12.2.14. Easily exploitable vulnerability allows una…

CVSS: 6.1 CWE: CWE-284 - Improper Access Control View on NVD

Critical

CVE-2025-53037

CVSS: 9.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2025-53036

CVSS: 8.6 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2025-53035

CVSS: 6.5 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-53034

CVSS: 5.4 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Medium

CVE-2025-50075

Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management System). Supported versions that are a…

CVSS: 6.5 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2025-50074

CVSS: 4.9 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2025-56800

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript…

CVSS: 5.1 CWE: CWE-290 - Authentication Bypass by Spoofing View on NVD

Critical

CVE-2025-60772

Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrat…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2025-61220

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information.

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Critical

CVE-2025-11625

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2025-10640

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional…

CVSS: 9.8 CWE: CWE-602 - Client-Side Enforcement of Server-Side Security View on NVD

Critical

CVE-2025-6542

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

CVSS: 9.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

2025-10-20

Medium

CVE-2025-8884

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers.This issue affects ACE Center…

CVSS: 5.5 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

Critical

CVE-2025-61455

SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, al…

CVSS: 9.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2025-10-18

Medium

CVE-2025-11742

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up t…

CVSS: 4.3 CWE: CWE-862 - Missing Authorization View on NVD

2025-10-17

Medium

CVE-2025-62642

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenti…

CVSS: 5.8 CWE: CWE-862 - Missing Authorization View on NVD

Medium

CVE-2025-62508

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handli…

CVSS: 6.5 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Critical

CVE-2025-56221

A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.

CVSS: 9.8 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts View on NVD

Medium

CVE-2025-62421

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentica…

CVSS: 5.4 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2025-59043

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2025-48044

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Po…

CVSS: 8.6 CWE: CWE-863 - Incorrect Authorization View on NVD

Critical

CVE-2025-6950

An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for…

CVSS: 9.9 CWE: CWE-798 - Use of Hard-coded Credentials View on NVD

High

CVE-2025-6892

An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API…

CVSS: 8.7 CWE: CWE-863 - Incorrect Authorization View on NVD

2025-10-16

Critical

CVE-2025-62586

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.

CVSS: 9.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Critical

CVE-2025-34516

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to servi…

CVSS: 9.8 CWE: CWE-1392 - Use of Default Credentials View on NVD

Critical

CVE-2025-34513

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilev…

CVSS: 9.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

Medium

CVE-2025-34512

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2025-56699

SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arbitrary SQL commands via the sender param…

CVSS: 5.4 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2025-10-15

Medium

CVE-2025-58133

Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.

CVSS: 5.3 CWE: CWE-288 - Authentication Bypass Using an Alternate Path or Channel View on NVD

Critical

CVE-2025-56749

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication…

CVSS: 9.4 CWE: CWE-798 - Use of Hard-coded Credentials View on NVD

Medium

CVE-2025-11701

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback functio…

CVSS: 5.3 CWE: CWE-862 - Missing Authorization View on NVD

Medium

CVE-2025-10648

The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in…

CVSS: 5.3 CWE: CWE-862 - Missing Authorization View on NVD

Critical

CVE-2025-10294

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shar…

CVSS: 9.8 CWE: CWE-288 - Authentication Bypass Using an Alternate Path or Channel View on NVD

Medium

CVE-2025-55039

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication…

CVSS: 6.5 CWE: CWE-326 - Inadequate Encryption Strength View on NVD

High

CVE-2024-13991

Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPath` parameter of the `/fileDownload?actio…

CVSS: 8.7 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

Critical

CVE-2023-7304

Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject sh…

CVSS: 9.3 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

2025-10-14

Medium

CVE-2025-54267

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverag…

CVSS: 6.5 CWE: CWE-863 - Incorrect Authorization View on NVD

High

CVE-2025-54263

CVSS: 8.1 CWE: CWE-863 - Incorrect Authorization View on NVD

High

CVE-2025-57618

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the applicati…

CVSS: 7.3 CWE: CWE-24 - Path Traversal: '../filedir' View on NVD

High

CVE-2025-59502

Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2025-59295

Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.

CVSS: 8.8 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

Low

CVE-2025-59294

Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.

CVSS: 2.1 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2025-59288

Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.

CVSS: 5.3 CWE: CWE-347 - Improper Verification of Cryptographic Signature View on NVD

Critical

CVE-2025-59287

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

CVSS: 9.8 CWE: CWE-502 - Deserialization of Untrusted Data View on NVD

Low

CVE-2025-59284

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

CVSS: 3.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2025-59282

Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') View on NVD

Low

CVE-2025-59280

Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network.

CVSS: 3.1 CWE: CWE-287 - Improper Authentication View on NVD

Medium

CVE-2025-59258

Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.

CVSS: 6.2 CWE: CWE-532 - Insertion of Sensitive Information into Log File View on NVD

High

CVE-2025-59250

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

CVSS: 8.1 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2025-59248

Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVSS: 7.5 CWE: CWE-20 - Improper Input Validation View on NVD

Medium

CVE-2025-59244

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

CVSS: 6.5 CWE: CWE-73 - External Control of File Name or Path View on NVD

High

CVE-2025-59243

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59238

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59236

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 8.4 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59235

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS: 7.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2025-59234

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59233

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion') View on NVD

High

CVE-2025-59232

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS: 7.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2025-59231

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion') View on NVD

Medium

CVE-2025-59229

Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.

CVSS: 5.5 CWE: CWE-248 - Uncaught Exception View on NVD

High

CVE-2025-59227

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59226

Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59225

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59224

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59223

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59222

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS: 7.8 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-59221

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

Medium

CVE-2025-59214

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

CVSS: 6.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2025-59213

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.

CVSS: 8.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

High

CVE-2025-59208

Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.

CVSS: 7.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2025-59200

Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.

CVSS: 7.7 CWE: CWE-73 - External Control of File Name or Path View on NVD

Medium

CVE-2025-59190

Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.

CVSS: 5.5 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2025-59189

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

CVSS: 7.4 CWE: CWE-416 - Use After Free View on NVD

Medium

CVE-2025-59185

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

CVSS: 6.5 CWE: CWE-73 - External Control of File Name or Path View on NVD

Medium

CVE-2025-58739

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

CVSS: 6.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2025-58738

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58737

Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58736

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58735

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58734

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58733

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58732

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58731

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58730

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS: 7.0 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-58718

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVSS: 8.8 CWE: CWE-416 - Use After Free View on NVD

Medium

CVE-2025-58717

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

CVSS: 6.5 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2025-55700

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

CVSS: 6.5 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2025-55693

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

CVSS: 7.4 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2025-55687

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Resilient File System (ReFS) allows an unauthorized attacker to elevate privileges locally.

CVSS: 7.4 CWE: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') View on NVD

Medium

CVE-2025-55682

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-841 - Improper Enforcement of Behavioral Workflow View on NVD

Medium

CVE-2025-55679

Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.

CVSS: 5.1 CWE: CWE-20 - Improper Input Validation View on NVD

Medium

CVE-2025-55338

Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-1310 - Missing Ability to Patch ROM Code View on NVD

Medium

CVE-2025-55337

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-841 - Improper Enforcement of Behavioral Workflow View on NVD

High

CVE-2025-55335

Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVSS: 7.4 CWE: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') View on NVD

Medium

CVE-2025-55334

Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.

CVSS: 6.2 CWE: CWE-312 - Cleartext Storage of Sensitive Information View on NVD

Medium

CVE-2025-55333

Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-1023 - Incomplete Comparison with Missing Factors View on NVD

Medium

CVE-2025-55332

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-841 - Improper Enforcement of Behavioral Workflow View on NVD

Medium

CVE-2025-55330

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS: 6.1 CWE: CWE-841 - Improper Enforcement of Behavioral Workflow View on NVD

High

CVE-2025-55326

Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.

CVSS: 7.5 CWE: CWE-416 - Use After Free View on NVD

Medium

CVE-2025-54603

An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users.

CVSS: 6.5 CWE: CWE-284 - Improper Access Control View on NVD