Security Warnings — Week: 2025-W46

Fortinet FortiWeb Path Traversal Vulnerability

2025-11-14 CVE-2025-64446

highFortinet CVE 2025-W46

Gladinet Triofox Improper Access Control Vulnerability

2025-11-12 CVE-2025-12480

highGladinet CVE 2025-W46

Microsoft Windows Race Condition Vulnerability

2025-11-12 CVE-2025-62215

highMicrosoft CVE 2025-W46

WatchGuard Firebox Out-of-Bounds Write Vulnerability

2025-11-12 CVE-2025-9242

highWatchGuard CVE 2025-W46

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

2025-11-11 CVE-2025-40211

highMicrosoft MSRC 2025-W46

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

2025-11-11 CVE-2025-62222

highMicrosoft MSRC 2025-W46

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause u

2025-11-11 CVE-2025-60753

mediumMicrosoft MSRC 2025-W46

Azure Application Gateway Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-64656

criticalMicrosoft MSRC 2025-W46

Azure Application Gateway Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-64657

criticalMicrosoft MSRC 2025-W46

Azure Monitor Agent Remote Code Execution Vulnerability

2025-11-11 CVE-2025-59504

highMicrosoft MSRC 2025-W46

Azure Monitor Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-62207

highMicrosoft MSRC 2025-W46

blk-mq: fix potential deadlock while nr_requests grown

2025-11-11 CVE-2025-40146

mediumMicrosoft MSRC 2025-W46

btrfs: avoid potential out-of-bounds in btrfs_encode_fh()

2025-11-11 CVE-2025-40205

highMicrosoft MSRC 2025-W46

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-cont

2025-11-11 CVE-2025-60876

criticalMicrosoft MSRC 2025-W46

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

2025-11-11 CVE-2025-40107

mediumMicrosoft MSRC 2025-W46

Configuration Manager Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-47179

mediumMicrosoft MSRC 2025-W46

containerd affected by a local privilege escalation via wide permissions on CRI directory

2025-11-11 CVE-2024-25621

highMicrosoft MSRC 2025-W46

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

2025-11-11 CVE-2025-40194

mediumMicrosoft MSRC 2025-W46

crypto: hisilicon/qm - request reserved interrupt for virtual function

2025-11-11 CVE-2025-40136

mediumMicrosoft MSRC 2025-W46

crypto: rng - Ensure set_ent is always present

2025-11-11 CVE-2025-40109

mediumMicrosoft MSRC 2025-W46

Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-59512

highMicrosoft MSRC 2025-W46

CVE-2025-12816

2025-11-11 CVE-2025-12816

highMicrosoft MSRC 2025-W46

CVE-2025-12969

2025-11-11 CVE-2025-12969

mediumMicrosoft MSRC 2025-W46

CVE-2025-12970

2025-11-11 CVE-2025-12970

highMicrosoft MSRC 2025-W46

CVE-2025-12977

2025-11-11 CVE-2025-12977

highMicrosoft MSRC 2025-W46

Denial of service vulnerability in HAProxy mjson library

2025-11-11 CVE-2025-11230

highMicrosoft MSRC 2025-W46

DirectX Graphics Kernel Denial of Service Vulnerability

2025-11-11 CVE-2025-60723

mediumMicrosoft MSRC 2025-W46

DirectX Graphics Kernel Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-59506

highMicrosoft MSRC 2025-W46

DirectX Graphics Kernel Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-60716

highMicrosoft MSRC 2025-W46

DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension

2025-11-11 CVE-2025-11933

mediumMicrosoft MSRC 2025-W46

drm/vmwgfx: Fix a null-ptr access in the cursor snooper

2025-11-11 CVE-2025-40110

mediumMicrosoft MSRC 2025-W46

drm/vmwgfx: Fix Use-after-free in validation

2025-11-11 CVE-2025-40111

mediumMicrosoft MSRC 2025-W46

Dynamics 365 Field Service (online) Spoofing Vulnerability

2025-11-11 CVE-2025-62210

highMicrosoft MSRC 2025-W46

Dynamics 365 Field Service (online) Spoofing Vulnerability

2025-11-11 CVE-2025-62211

highMicrosoft MSRC 2025-W46

Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-64655

highMicrosoft MSRC 2025-W46

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

2025-11-11 CVE-2025-40198

highMicrosoft MSRC 2025-W46

ext4: detect invalid INLINE_DATA + EXTENTS flag combination

2025-11-11 CVE-2025-40167

mediumMicrosoft MSRC 2025-W46

ext4: guard against EA inode refcount underflow in xattr update

2025-11-11 CVE-2025-40190

highMicrosoft MSRC 2025-W46

ext4: verify orphan file size is not too big

2025-11-11 CVE-2025-40179

mediumMicrosoft MSRC 2025-W46

Forward Secrecy Violation in WolfSSL TLS 1.3

2025-11-11 CVE-2025-11935

highMicrosoft MSRC 2025-W46

GDI+ Remote Code Execution Vulnerability

2025-11-11 CVE-2025-60724

criticalMicrosoft MSRC 2025-W46

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

2025-11-11 CVE-2025-64660

highMicrosoft MSRC 2025-W46

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

2025-11-11 CVE-2025-62453

mediumMicrosoft MSRC 2025-W46

Glib: integer overflow in in g_escape_uri_string()

2025-11-11 CVE-2025-13601

highMicrosoft MSRC 2025-W46

Grub2: grub2: out-of-bounds write via malicious usb device

2025-11-11 CVE-2025-61661

mediumMicrosoft MSRC 2025-W46

Grub2: missing unregister call for gettext command may lead to use-after-free

2025-11-11 CVE-2025-61662

mediumMicrosoft MSRC 2025-W46

Grub2: missing unregister call for normal commands may lead to use-after-free

2025-11-11 CVE-2025-61663

mediumMicrosoft MSRC 2025-W46

Grub2: missing unregister call for normal_exit command may lead to use-after-free

2025-11-11 CVE-2025-61664

mediumMicrosoft MSRC 2025-W46

Grub2: use-after-free in grub_file_close()

2025-11-11 CVE-2025-54771

mediumMicrosoft MSRC 2025-W46

Grub2: use-after-free in net_set_vlan

2025-11-11 CVE-2025-54770

mediumMicrosoft MSRC 2025-W46

Host Process for Windows Tasks Elevation of Privilege Vulnerability

2025-11-11 CVE-2025-60710

highMicrosoft MSRC 2025-W46

Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify

2025-11-11 CVE-2025-11934

lowMicrosoft MSRC 2025-W46

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

2025-11-11 CVE-2025-66382

lowMicrosoft MSRC 2025-W46

Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt

2025-11-11 CVE-2025-11931

highMicrosoft MSRC 2025-W46

ipmi: Rework user message limit handling

2025-11-11 CVE-2025-40202

mediumMicrosoft MSRC 2025-W46

ipv6: use RCU in ip6_output()

2025-11-11 CVE-2025-40158

highMicrosoft MSRC 2025-W46

ipv6: use RCU in ip6_xmit()

2025-11-11 CVE-2025-40135

highMicrosoft MSRC 2025-W46

kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

2025-11-11 CVE-2025-40201

highMicrosoft MSRC 2025-W46

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

2025-11-11 CVE-2025-64432

mediumMicrosoft MSRC 2025-W46

KubeVirt Arbitrary Container File Read

2025-11-11 CVE-2025-64433

mediumMicrosoft MSRC 2025-W46