Detections
Analytics

CVEs

Tenable maintains a list of Common Vulnerabilities and Exposures (CVEs) and their affected products. Tenable augments the data to include related Tenable Plugins that detect each vulnerability. 292422 CVEs are indexed from NVD.

RSS Feeds

Search

Vulnerability Watch ›

  • CVE-2025-31324
    criticalVulnerability of Interest

    Exploitation has been observed and an emergency out-of-band patch from SAP has been released to address this critical vulnerability. Immediate patching is recommended.

  • CVE-2025-32433
    criticalVulnerability of Interest

    Proof-of-concept code has been released, successful exploitation could allow for complete takeover.

  • CVE-2025-34028
    criticalVulnerability Being Monitored

    Public exploit code is now available. Immediate patching is recommended

Newest ›

  • CVE-2025-22883
    No Score

    Delta Electronics ISPSoft Versions 3.19 and prior are vulnerable to an out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code when parsing DVP files.

  • CVE-2025-22884
    No Score

    Delta Electronics ISPSoft Versions 3.19 and prior are vulnerable to a stack-based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when parsing DVP files.

  • CVE-2025-22882
    No Score

    Delta Electronics ISPSoft Versions 3.19 and prior are vulnerable to a stack-based buffer overflow vulnerability that could allow an attacker to leverage debugging logic to execute arbitrary code when parsing CBDGL files.

  • CVE-2025-3953
    medium

    The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings.

  • CVE-2025-3471
    medium

    The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

  • CVE-2025-46782
    No Score

    Rejected reason: Not used

  • CVE-2025-46781
    No Score

    Rejected reason: Not used

  • CVE-2025-46780
    No Score

    Rejected reason: Not used

  • CVE-2025-46779
    No Score

    Rejected reason: Not used

  • CVE-2025-46778
    No Score

    Rejected reason: Not used

Updated ›

  • CVE-2025-46782
    No Score

    Rejected reason: Not used

  • CVE-2025-46781
    No Score

    Rejected reason: Not used

  • CVE-2025-46780
    No Score

    Rejected reason: Not used

  • CVE-2025-46779
    No Score

    Rejected reason: Not used

  • CVE-2025-46778
    No Score

    Rejected reason: Not used

  • CVE-2025-46560
    medium

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.

  • CVE-2025-3953
    medium

    The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings.

  • CVE-2025-3928
    high

    Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.

  • CVE-2025-3910
    medium

    A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.

  • CVE-2025-3501
    high

    A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.