CVE News Feed

• CVE-2025-64490 - SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

  CVE ID :CVE-2025-64490
  Published : Nov. 8, 2025, 12:22 a.m. | 34 minutes ago
  Description :SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64489 - SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

  CVE ID :CVE-2025-64489
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64488 - SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

  CVE ID :CVE-2025-64488
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.
  Severity: 8.6 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64486 - calibre is vulnerable to arbitrary code execution when opening FB2 files

  CVE ID :CVE-2025-64486
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
  Severity: 9.3 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64485 - CVAT: Mounted share file overwrite via crafted request

  CVE ID :CVE-2025-64485
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12911 - Google Chrome UI Spoofing Vulnerability

  CVE ID :CVE-2025-12911
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12910 - Google Chrome Passkeys Debug Log Information Disclosure

  CVE ID :CVE-2025-12910
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12909 - Google Chrome Devtools Cross-Origin Data Leaking Vulnerability

  CVE ID :CVE-2025-12909
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12908 - Google Chrome Android Domain Spoofing Vulnerability

  CVE ID :CVE-2025-12908
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12907 - "Google Chrome Devtools Code Execution Vulnerability"

  CVE ID :CVE-2025-12907
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12906 - Google Chrome Permissions UI Spoofing Vulnerability

  CVE ID :CVE-2025-12906
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-12905 - Google Chrome HTML Page Mark of the Web Bypass

  CVE ID :CVE-2025-12905
  Published : Nov. 8, 2025, 12:15 a.m. | 41 minutes ago
  Description :Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64437 - KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

  CVE ID :CVE-2025-64437
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
  Severity: 5.0 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64436 - KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

  CVE ID :CVE-2025-64436
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.
  Severity: 6.9 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64435 - KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

  CVE ID :CVE-2025-64435
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.
  Severity: 5.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64434 - KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing

  CVE ID :CVE-2025-64434
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
  Severity: 4.7 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-64433 - KubeVirt Arbitrary Container File Read

  CVE ID :CVE-2025-64433
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM. Specifically, if a malicious user has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within the virt-launcher pod's file system. Since libvirt can treat regular files as block devices, any file on the pod's file system that is symlinked in this way can be mounted into the VM and subsequently read. Although a security mechanism exists where VMs are executed as an unprivileged user with UID 107 inside the virt-launcher container, limiting the scope of accessible resources, this restriction is bypassed due to a second vulnerability. The latter causes the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. As a result, an attacker can gain access to and read arbitrary files located within the virt-launcher pod's file system or on a mounted PVC from within the guest VM. This vulnerability is fixed in 1.5.3 and 1.6.1.
  Severity: 6.5 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-37736 - Elastic Cloud Enterprise Improper Authorization

  CVE ID :CVE-2025-37736
  Published : Nov. 7, 2025, 11:15 p.m. | 1 hour, 41 minutes ago
  Description :Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name}
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-63420 - CrushFTP Stored Cross-Site Scripting Vulnerability

  CVE ID :CVE-2025-63420
  Published : Nov. 7, 2025, 10:15 p.m. | 2 hours, 41 minutes ago
  Description :A stored cross-site scripting (XSS) vulnerability in the CrushFTP 11.3.7_50 Admin Panel (Reports / 'Who Created Folder') allows authenticated attackers with permissions to create folders to inject malicious HTML/JavaScript.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-60574 - tQuadra CMS LFI Vulnerability

  CVE ID :CVE-2025-60574
  Published : Nov. 7, 2025, 10:15 p.m. | 2 hours, 41 minutes ago
  Description :A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...