Citrix ADC is an application delivery controller that analyzes application-specific traffic to distribute, optimize, and secure Layer 4-Layer 7 (L4–L7) network traffic intelligently for web applications.

Citrix ADC VPX

Citrix ADC CPX is a container-based application delivery controller that can be provisioned on a Docker host. Citrix ADC CPX enables customers to leverage Docker engine capabilities and use Citrix ADC load balancing and traffic management features for container-based applications.

Citrix ADC CPX

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers 

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers

(OR)

CR virtual server with type HDX

CVE-2025-7775

Linux

Linux Kernel

Docker Desktop is an application for MacOS and Windows machines, aimed at developers and system administrators. It enables them to build and share containerized applications and microservices. Docker Desktop includes Docker Engine, Docker CLI, Docker Compose, and is fully integrated with the machine’s filesystem and networking.

Docker Desktop

A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the "Expose daemon on tcp://localhost:2375 without TLS" option enabled.
This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

CVE-2025-9074

Windows

Windows Cumulative Update

FortiSIEM is a comprehensive, multi-vendor security information and event management (SIEM) solution designed to provide visibility, correlation, automated response, and remediation in a single, scalable solution.

FortiSIEM

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

CVE-2025-25256

VulnCheck NVD++

NVIDIA Triton Inference Server, part of the NVIDIA AI platform and available with NVIDIA AI Enterprise, is open-source software that standardizes AI model deployment and execution across every workload.

Triton Inference Server

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request. A successful exploit of this vulnerability might lead to information disclosure.

CVE-2025-23334

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request. A successful exploit of this vulnerability might lead to information disclosure.

CVE-2025-23320

Rust is a multi-paradigm programming language focused on performance and safety, especially safe concurrency.

Rust

In matrix-sdk-base before 0.14.1, calling the
`RoomMember::normalized_power_level()` method can cause a panic if a room member
has a power level of `Int::Min`.

RUSTSEC-2025-0065

RustSec Advisory Database

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.
The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.

CVE-2025-59052

GitHub Advisory Database

Red Hat

Red Hat Errata

PHP is a general-purpose scripting language that is especially suited for web development.

### Impact
By exploiting XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. 
Some examples of this include, but are not limited to:
- Obtaining user session tokens.
- Performing administrative actions (when an administrative user is affected).
These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.
#### Description
When an application uses input fields, it is important that user input is adequately filtered for malicious HTML and JavaScript characters. When adequate input validation is not applied, Cross-Site Scripting (XSS) vulnerabilities may arise. These allow malicious actors to inject malicious code into application pages. When a user visits the page, the code is executed in the user's web browser. This allows malicious actors to perform malicious actions in the name of that user. XSS can be divided into three variants: Persistent XSS, Reflective XSS and DOM-based XSS. In Reflective XSS, a malicious actor injects malicious JavaScript code into a URL. Every time the user visits this URL, the JavaScript code is executed in the user’s browser.
#### Applicability 
Due to a lack of input validation, the Shopware application contain XSS vulnerabilities. The JavaScript variable 'activeRouteParameters' lacks input validation, which makes it vulnerable to XSS attacks at the following endpoints:
- /page/cms/*
- /widget/cms/*
The lack of input validation enables malicious actors to inject harmful JavaScript-code into the affected pages. When a user visits the page, the code is executed within the user’s web browser. This enables malicious actors to perform (harmful) actions on behalf of the affected user. No user account is required to exploit this vulnerability.
#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Navigate to the URL below containing the XSS payload:
https://pentest-saas-2025-2.shopware.store/page/cms/'+alert('REQON')+'
2. Observe that a pop-up is shown indicating that the JavaScript code has been executed.
#### Workarounds
For older versions of 6.7, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

GHSA-9v82-vcjx-m76j

Composer

Python is a high-level, general-purpose programming language. Its key feature is the high readability of the code. It supports multiple programming paradigms, including Object-Oriented Programming (OOP) and Functional Programming.

Python

### Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
### Workarounds
Test untrusted input with `link` elements with `rel="attachment"` before processing.
### References
This is related to [GHSA-cfmv-h8fx-85m7](https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-cfmv-h8fx-85m7).

GHSA-9mv7-3c64-mmqw

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-7775	CRITICAL	9.2	Citrix ADC VPX	cpe:2.3:a:citrix:netscaler_application_delivery_controller	Sì	Sì	Aug 26, 2025
CVE-2025-9074	CRITICAL	9.3	Docker Desktop	cpe:2.3:a:docker:desktop	No	Sì	Aug 20, 2025
CVE-2025-25256	CRITICAL	9.8	FortiSIEM	cpe:2.3:a:fortinet:fortisiem	No	Sì	Aug 12, 2025
CVE-2025-23334	HIGH	7.5	Triton Inference Server	cpe:2.3:a:nvidia:triton_inference_server	No	Sì	Aug 06, 2025
CVE-2025-23320	HIGH	7.5	Triton Inference Server	cpe:2.3:a:nvidia:triton_inference_server	No	Sì	Aug 06, 2025

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
RUSTSEC-2025-0065	N/A	N/A	Rust	matrix-sdk-base	No	Sì	Sep 11, 2025
CVE-2025-59052	HIGH	7.1	JavaScript	@nguniversal/common	No	Sì	Sep 10, 2025
GHSA-9v82-vcjx-m76j	HIGH	8.8	PHP	shopware/core	No	Sì	Sep 10, 2025
GHSA-9mv7-3c64-mmqw	HIGH	8.7	Python	xml2rfc	No	Sì	Sep 10, 2025
CVE-2025-54376	HIGH	8.8	N/A	github.com/spectolabs/hoverfly	No	Sì	Sep 10, 2025

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?