CVE-2025-14733

Overview

WatchGuard
Fireware OS

19 Dec 2025

Published

20 Dec 2025

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

36.33%

MITRE

KEV

Description

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.

Statistics

1 Post

Last activity: 19 hours ago

Bluesky

Spiegel's crawler @osanpo.bsky.social

＞ Weekly Report: WatchGuard製Fireboxのikedにおける境界外書き込みの脆弱性（CVE-2025-14733）に関する注意喚起 https://www.jpcert.or.jp/wr/2026/wr260107.html#10

0
0
0
19h ago

CVE-2025-66786

Overview

Pending

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack.

Statistics

2 Posts

Last activity: 5 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-66786 - High (7.5)

OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
1
5h ago

CVE-2025-69080

Overview

JanStudio
Gecko

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

Pending

MITRE

KEV

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through 1.9.8.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-69080 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through 1.9.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
9h ago

CVE-2025-47380

Overview

Qualcomm, Inc.
Snapdragon

06 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.02%

MITRE

KEV

Description

Memory corruption while preprocessing IOCTLs in sensors.

Statistics

1 Post

Last activity: 8 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-47380 - High (7.8)

Memory corruption while preprocessing IOCTLs in sensors.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
8h ago

CVE-2025-20762

Overview

MediaTek, Inc.
MT6835, MT6835T, MT6878, MT6878M, MT6897, MT6899, MT6991, MT8676, MT8678, MT8755, MT8792, MT8793, MT8863, MT8873, MT8883

06 Jan 2026

Published

06 Jan 2026

Updated

CVSS

Pending

EPSS

0.21%

MITRE

KEV

Description

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01685181; Issue ID: MSV-4760.

Statistics

1 Post

Last activity: 22 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-20762 - High (7.5)

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-20762/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
22h ago

CVE-2025-15471

Overview

TRENDnet
TEW-713RE

06 Jan 2026

Published

06 Jan 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.15%

MITRE

KEV

Description

A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

1 Post

Last activity: 21 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2025-15471 - Critical (9.8)

A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remote...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
21h ago

CVE-2025-65606

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

A security flaw in the discontinued Totolink EX200 wireless range extender (CVE-2025-65606) allows attackers to gain full system access by triggering an unauthenticated Telnet service with root privileges. Exploitation requires authenticated access to the device's web management interface, and no patch is available, necessitating device replacement and network access restrictions.
https://www.securityweek.com/vulnerability-in-totolink-range-extender-allows-device-takeover/

0
0
0
9h ago

CVE-2025-67366

Overview

Pending

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.

Statistics

1 Post

Last activity: 4 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-67366 - High (7.5)

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from imprope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
4h ago

CVE-2025-68637

Overview

Apache Software Foundation
Apache Uniffle

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS

Pending

EPSS

0.01%

MITRE

KEV

Description

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

Statistics

1 Post

Last activity: 7 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2025-68637 - Critical (9.1)

The Uniffle HTTP client is configured to trust all SSL certificates and

disables hostname verification by default. This insecure configuration
exposes all REST API communication between the Uniffle CLI/client and the
Uniffle Coordinator service t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
7h ago

CVE-2026-21679

Overview

InternationalColorConsortium
iccDEV

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow in CIccLocalizedUnicode::GetText(). This issue has been patched in version 2.3.1.2.

Statistics

1 Post

Last activity: 4 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-21679 - High (8.8)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow in CIccLocalizedUnicode::GetText()....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
4h ago