Ivanti Endpoint Manager is an endpoint management solution designed to aid IT departments in managing their infrastructure.

Ivanti Endpoint Manager

Ivanti Endpoint Manager Windows Agent is a software component installed on Windows devices that communicates with the Ivanti Endpoint Manager core server. This agent allows for managing, updating, deploying software, applying security settings and patches, and performing real-time monitoring and analytics of the device.

Ivanti Endpoint Manager Windows Agent

Ivanti Endpoint Manager Linux Agent is a software tool that, when installed on Linux devices, communicates with the Ivanti Endpoint Manager core server. This tool allows IT administrators to manage, monitor, and update Linux devices remotely. Tasks such as software deployment, security compliance, patch management, and real-time analytics can be performed through this agent.

Ivanti Endpoint Manager Linux Agent

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required. 

CVE-2025-10573 

Linux

Linux Kernel

Windows

Windows Cumulative Update

Next.js is a popular React-based framework for building server-side rendered and statically generated web applications. It provides a powerful set of features including automatic code splitting, optimized performance, and built-in routing.

Next.js

Rejected reason: This CVE is a duplicate of CVE-2025-55182.

CVE-2025-66478

GitHub Advisory Database

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

React is a JavaScript library for building user interfaces. It is maintained by Facebook and a community of individual developers and companies.

React Server Components

A plugin for Vite that enables React Server Components (RSC) support, allowing developers to use server-side rendering capabilities in their React applications built with Vite.

Vite RSC Plugin

Waku is a minimalist, Vite-powered React framework designed specifically to support React Server Components (RSC) with a lightweight architecture, serving as a simpler alternative to comprehensive frameworks.

Waku

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVE-2025-55182

Grafana is an open-source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics and time-series database (TSDB) data.

Grafana

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true

CVE-2025-41115

Chainguard

GoLang

Minimus

VulnCheck NVD++

Wolfi

A web application firewall (WAF) solution that protects web applications and APIs from threats and vulnerabilities through machine learning and AI-powered security. FortiWeb provides protection against OWASP Top 10 threats, zero-day attacks, and bot-based attacks while maintaining high performance and low latency. It offers both cloud-based and on-premises deployment options with features like API protection, automated machine learning, and virtual patching.

Fortinet FortiWeb

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVE-2025-64446

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sddr55: Reject out-of-bound new_pba

Discovered by Atuin - Automated Vulnerability Discovery Engine.

new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.

Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.

CVE-2025-40345

Debian

Debian Security Tracker

It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).
A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

GHSA-5j59-xgg2-r9c4

### Impact
`@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9
### Patches
Upgrade immediately to `@vitejs/plugin-rsc@0.5.7` or later.

GHSA-cpqf-f22c-r95x

### Impact
`@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4
### Patches
Upgrade immediately to `@vitejs/plugin-rsc@0.5.7` or later.

GHSA-c6m7-q6pr-c64r

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file.

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2025-10573	CRITICAL	9.6	Ivanti Endpoint Manager	cpe:2.3:a:ivanti:endpoint_manager	Non	Oui	Dec 09, 2025
CVE-2025-66478	CRITICAL	10	Next.js	next	Non	Oui	Dec 03, 2025
CVE-2025-55182	CRITICAL	10	JavaScript	@vitejs/plugin-rsc	Oui	Oui	Dec 03, 2025
CVE-2025-41115	CRITICAL	10	Grafana	grafana-12.2	Non	Oui	Nov 21, 2025
CVE-2025-64446	CRITICAL	9.8	Fortinet FortiWeb	cpe:2.3:a:fortinet:fortiweb	Oui	Oui	Nov 14, 2025

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2025-40345	N/A	N/A	Linux Debian	linux	Non	Oui	Dec 12, 2025
GHSA-5j59-xgg2-r9c4	HIGH	7.5	Next.js	next	Non	Oui	Dec 12, 2025
GHSA-cpqf-f22c-r95x	HIGH	7.5	Vite RSC Plugin	@vitejs/plugin-rsc	Non	Oui	Dec 12, 2025
GHSA-c6m7-q6pr-c64r	MEDIUM	5.3	Vite RSC Plugin	@vitejs/plugin-rsc	Non	Oui	Dec 12, 2025
CVE-2025-14442	MEDIUM	5.3	WordPress	secure-copy-content-protection	Non	Oui	Dec 12, 2025

Base de données de vulnérabilités Wiz

Explorer par technologie

Filtres populaires

Profil élevé

Dernier

Les vulnérabilités en chiffres

Le bon, le mauvais et le vulnérable

Ressources Wiz supplémentaires

PEACH

Prêt(e) à voir Wiz en action ?