A cloud-native network security solution that provides enterprise-grade security features including firewall, IPS, antivirus, and VPN capabilities for cloud environments. WatchGuard Firebox Cloud is designed to protect workloads running in public cloud platforms like AWS and Azure, offering unified security management and policy enforcement across hybrid infrastructures.

WatchGuard Firebox

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.

CVE-2025-14733

Linux

Linux Kernel

SonicWall SMA 8200v Appliance is a secure remote access solution that provides employees and partners with policy-enforced access to critical network resources. It offers SSL VPN connectivity for both managed and unmanaged devices, supporting a wide range of operating systems and browsers.

SonicWall SMA 8200v Appliance

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

CVE-2025-40602

Windows

Windows Cumulative Update

React is a JavaScript library for building user interfaces. It is maintained by Facebook and a community of individual developers and companies.

React Server Components

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVE-2025-67779

GitHub Advisory Database

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVE-2025-55184

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

CVE-2025-55183

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

CVE-2025-14946

Red Hat

Red Hat Errata

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.

CVE-2025-14455

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.

CVE-2025-12361

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-14151

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and including, 1.0.345 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2025-14733	CRITICAL	9.3	WatchGuard Firebox	cpe:2.3:o:watchguard:fireware	Oui	Oui	Dec 19, 2025
CVE-2025-40602	MEDIUM	6.6	SonicWall SMA 8200v Appliance	cpe:2.3:a:sonicwall:sma8200v	Oui	Oui	Dec 18, 2025
CVE-2025-67779	HIGH	7.5	React Server Components	react-server-dom-parcel	Non	Oui	Dec 12, 2025
CVE-2025-55184	HIGH	7.5	React Server Components	react-server-dom-parcel	Non	Oui	Dec 11, 2025
CVE-2025-55183	MEDIUM	5.3	React Server Components	react-server-dom-parcel	Non	Oui	Dec 11, 2025

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2025-14946	MEDIUM	4.8	Linux Red Hat	nbdfuse	Non	Non	Dec 19, 2025
CVE-2025-14455	MEDIUM	5.4	WordPress	final-tiles-grid-gallery-lite	Non	Oui	Dec 19, 2025
CVE-2025-12361	MEDIUM	4.3	WordPress	mycred	Non	Oui	Dec 19, 2025
CVE-2025-14151	MEDIUM	6.1	WordPress	wp-slimstat	Non	Oui	Dec 19, 2025
CVE-2025-11747	MEDIUM	6.4	WordPress	colibri-page-builder	Non	Oui	Dec 19, 2025

Base de données de vulnérabilités Wiz

Explorer par technologie

Filtres populaires

Profil élevé

Dernier

Les vulnérabilités en chiffres

Le bon, le mauvais et le vulnérable

Ressources Wiz supplémentaires

PEACH

Prêt(e) à voir Wiz en action ?