Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2025-43200Media4.2
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- CVE-2025-1055Media5.6
Una vulnerabilidad en el controlador K7RKScan.sys, parte de la suite K7 Security Anti-Malware, permite a un usuario local con privilegios bajos enviar solicitudes IOCTL manipuladas para finalizar una amplia gama de procesos que se ejecutan con privilegios administrativos o de nivel de sistema, con la excepción de aquellos protegidos inherentemente por el sistema operativo. Esta falla se deriva de la falta de control de acceso en el manejador IOCTL del controlador, lo que permite a usuarios sin privilegios realizar acciones privilegiadas en el espacio del kernel. La explotación exitosa puede provocar una denegación de servicio al interrumpir servicios críticos o aplicaciones privilegiadas.
- CVE-2025-33073Alta8.8
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
- CVE-2025-33053Alta8.8
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
- CVE-2025-47827Media4.6
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- CVE-2025-21479Alta8.6
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- CVE-2025-27038Alta7.5
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
- CVE-2025-21480Alta8.6
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- CVE-2025-5419Alta8.8
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-5086Crítica9.0
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
- CVE-2025-49113Crítica9.9
Roundcube Webmail anterior a 1.5.10 y 1.6.x anterior a 1.6.11 permite la ejecución remota de código por usuarios autenticados porque el parámetro _from en una URL no se valida en program/actions/settings/upload.php, lo que lleva a la deserialización de objetos PHP.
- CVE-2025-48928Media4.0
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
- CVE-2025-48927Media5.3
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- CVE-2025-34026Alta7.5
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
- CVE-2025-4008Alta8.8
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
- CVE-2025-32709Alta7.8
Desreferencia de puntero nulo en Windows Ancillary Function Driver for WinSock permite a un atacante autorizado elevar privilegios localmente.
- CVE-2025-32706Alta7.8
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- CVE-2025-32701Alta7.8
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- CVE-2025-30400Alta7.8
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
- CVE-2025-30397Alta7.5
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
This product uses the NVD API but is not endorsed or certified by the NVD.