Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability.  In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVE-2025-53770

The NVIDIA Container Toolkit is a set of libraries that provide capabilities for leveraging the full potentials of NVIDIA GPUs within containers. It allows GPU-accelerated applications to be defined as Docker containers, functioning as a lightweight, stand-alone, executable package.

NVIDIA Container Toolkit

NVIDIA GPU Operator is a Kubernetes operator that simplifies and automates the management of NVIDIA GPUs in containerized environments. It handles the deployment and configuration of GPU drivers, device plugins, and monitoring tools on Kubernetes clusters. The GPU Operator enables seamless integration of GPU-accelerated workloads in cloud-native applications, making it easier for developers and administrators to leverage NVIDIA GPUs for AI, machine learning, and high-performance computing tasks.

NVIDIA GPU Operator

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.

CVE-2025-23267

Linux

Linux Kernel

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

CVE-2025-23266

Chainguard

Red Hat

Red Hat Errata

Wolfi

SugarCRM is a customer relationship management (CRM) system, providing sales force automation, marketing campaigns, customer support, collaboration, and other tools to manage customer data.

SugarCRM

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.

CVE-2025-25034

Windows

Windows Cumulative Update

Teleport is an open-source security tool that provides developers and system administrators with secure access to infrastructure resources such as servers (SSH) and Kubernetes clusters (K8s). It enforces role-based access control, supports various authentication methods, and captures audit logs for user sessions and actions. Teleport's focus on secure access, access control, and auditing makes it an essential solution for managing and securing modern infrastructure.

Teleport

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

CVE-2025-49825

GoLang

GitHub Advisory Database

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2025-6495

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This attack affects only Chrome/Edge browsers

CVE-2025-4566

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.

CVE-2025-4370

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled.

CVE-2025-3075

The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-53770	CRITICAL	9.8	N/A	N/A	Sì	Sì	Jul 20, 2025
CVE-2025-23267	HIGH	8.5	NVIDIA Container Toolkit	cpe:2.3:a:nvidia:nvidia_gpu_operator	No	Sì	Jul 17, 2025
CVE-2025-23266	CRITICAL	9	NVIDIA Container Toolkit	nvidia-container-toolkit	No	Sì	Jul 17, 2025
CVE-2025-25034	CRITICAL	9.3	SugarCRM	cpe:2.3:a:sugarcrm:sugarcrm	No	Sì	Jun 20, 2025
CVE-2025-49825	CRITICAL	9.8	Teleport	cpe:2.3:a:goteleport:teleport	No	Sì	Jun 17, 2025

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-6495	HIGH	7.5	WordPress	bricks	No	Sì	Jul 29, 2025
CVE-2025-4566	MEDIUM	6.4	WordPress	elementor	No	Sì	Jul 29, 2025
CVE-2025-4370	MEDIUM	5.3	WordPress	brizy	No	Sì	Jul 29, 2025
CVE-2025-3075	MEDIUM	6.4	WordPress	elementor	No	Sì	Jul 29, 2025
CVE-2025-7811	MEDIUM	6.4	WordPress	streamweasels-youtube-integration	No	Sì	Jul 29, 2025

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?