FortiMail is a comprehensive and robust email security platform designed by Fortinet. It uses sophisticated detection methods to identify and block malicious and unsolicited emails.

Fortimail

FortiNDR is a Network Detection and Response solution developed by Fortinet. It uses artificial intelligence and machine learning to detect and respond to advanced threats and anomalies in network traffic. FortiNDR provides real-time threat intelligence, automated incident response, and forensic analysis capabilities to help organizations improve their security posture.

FortiNDR

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.8, FortiNDR versions 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, 7.0.0 through 7.0.6, FortiCamera versions 2.1.0 through 2.1.3, 2.0 all versions, 1.1 all versions, allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

CVE-2025-32756

Linux

Linux Kernel

SAP Visual Composer is a graphical modeling tool for creating web-based applications without coding. It allows users to design user interfaces, define data flows, and create business logic using drag-and-drop functionality. This tool is part of the SAP NetWeaver platform and is primarily used for rapid application development within SAP environments.

SAP Visual Composer

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVE-2025-42999

Windows

Windows Cumulative Update

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

CVE-2025-31324

Commvault ContentStore is the main installation directory and runtime environment where all Commvault software components (like CommServe, MediaAgents, agents, and Command Center) are installed. It acts as the platform foundation for Commvault data protection and management services across the system.

Commvault

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.

CVE-2025-34028

CBL Marine is an open source distro, created by Microsoft. Mainly used in Azure cloud and Microsoft Internally.

CBL Mariner

Erlang/OTP is a programming platform and runtime environment designed primarily for building concurrent, distributed, and fault-tolerant systems. It provides lightweight processes, message-passing concurrency, and built-in tools and libraries for managing application structure, reliability, and scalability.

Erlang OTP

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Linux openSUSE

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Project Photon OS is an open-source, minimal Linux container host that is optimized for cloud-native applications, cloud platforms, and VMware infrastructure.

Linux Photon

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVE-2025-32433

Alpine

Alpine Security Tracker

CBL-Mariner

Debian

Debian Security Tracker

Photon

Photon Security Advisory

Ubuntu

Ubuntu Security Tracker

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4 and Firefox ESR < 128.10.1.

CVE-2025-4921

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4 and Firefox ESR < 128.10.1.

CVE-2025-4920

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

CVE-2025-47273

Anaconda

PHP is a general-purpose scripting language that is especially suited for web development.

**Overview**
Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
**Am I Affected?**
You are affected by this vulnerability if you meet the following pre-conditions:
1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.  
3. Session storage configured with CookieStore.
**Fix**
Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.
**Acknowledgement**
Okta would like to thank Félix Charette for discovering this vulnerability.

GHSA-9fwj-9mjf-rhj3

Composer

GitHub Advisory Database

**Overview**
Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
**Am I Affected?**
You are affected by this vulnerability if you meet the following pre-conditions:
1. Applications using the Auth0 WordPress Plugin with version <=5.2.1
2. Auth0 WordPress Plugin uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0. 
3. Session storage configured with CookieStore.
**Fix**
Upgrade Auth0/wordpress plugin to v5.3.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.
**Acknowledgement**
Okta would like to thank Félix Charette for discovering this vulnerability.

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
CVE-2025-32756	CRITICAL	9.8	Fortimail	cpe:2.3:a:fortinet:fortimail	Sí	Sí	May 13, 2025
CVE-2025-42999	CRITICAL	9.1	SAP Visual Composer		Sí	Sí	May 13, 2025
CVE-2025-31324	CRITICAL	9.8	SAP Visual Composer		Sí	Sí	Apr 24, 2025
CVE-2025-34028	CRITICAL	10	Commvault	cpe:2.3:a:commvault:commvault	Sí	Sí	Apr 22, 2025
CVE-2025-32433	CRITICAL	10	CBL Mariner	N/A	No	Sí	Apr 16, 2025

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
CVE-2025-4921	N/A	N/A	Linux Debian	firefox-esr	No	No	May 17, 2025
CVE-2025-4920	N/A	N/A	Linux Debian	firefox-esr	No	No	May 17, 2025
CVE-2025-47273	HIGH	7.7	Linux Debian	setuptools	No	Sí	May 17, 2025
GHSA-9fwj-9mjf-rhj3	CRITICAL	9.1	PHP	auth0/login	No	Sí	May 17, 2025
GHSA-2f4r-34m4-3w8q	CRITICAL	9.1	PHP	auth0/wordpress	No	Sí	May 17, 2025

Base de datos de vulnerabilidades de Wiz

Explorar por tecnología

Filtros populares

Alto perfil

Último

Vulnerabilidades en cifras

Lo bueno, lo malo y lo vulnerable

Recursos adicionales de Wiz

¿Listo para ver a Wiz en acción?