Detections
Analytics

CVEs

Tenable maintains a list of Common Vulnerabilities and Exposures (CVEs) and their affected products. Tenable augments the data to include related Tenable Plugins that detect each vulnerability. 320106 CVEs are indexed from NVD.

RSS Feeds

Search

Vulnerability Watch ›

  • CVE-2025-58034
    highVulnerability of Interest

    Exploitation of this Fortinet FortiWeb vulnerability has been observed. Patches have been released and should be applied as soon as possible.

  • CVE-2025-64446
    criticalVulnerability of Interest

    Exploitation of this Fortinet FortiWeb vulnerability has been observed. Patches have been released and should be applied as soon as possible.

  • CVE-2025-61757
    criticalVulnerability of Interest

    Exploitation of this Oracle Identity Manager remote code execution vulnerability has been observed. Immediate patching is recommended.

  • CVE-2025-20362
    highVulnerability of Interest

    CISA has released updated patch guidance and urges immediate patching for these Cisco vulnerabilities which have been exploited in the wild.

  • CVE-2025-20333
    criticalVulnerability of Interest

    CISA has released updated patch guidance and urges immediate patching for these Cisco vulnerabilities which have been exploited in the wild.

  • CVE-2025-41115
    criticalVulnerability Being Monitored

    This maximum severity flaw affecting Grafana could allow for privilege escalation. Immediate patching is recommended.

  • CVE-2025-60673
    mediumVulnerability Being Monitored

    While these D-Link flaws have not been exploited, they impact end of life devices. No patches will be released and affected models should be replaced with supported devices

  • CVE-2025-60672
    mediumVulnerability Being Monitored

    While these D-Link flaws have not been exploited, they impact end of life devices. No patches will be released and affected models should be replaced with supported devices

Newest ›

  • CVE-2025-64693
    critical

    Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege.

  • CVE-2025-62691
    critical

    Security Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege.

  • CVE-2025-59485
    medium

    Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege.

  • CVE-2025-59372
    medium

    A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

  • CVE-2025-59371
    high

    An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

  • CVE-2025-59370
    high

    A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

  • CVE-2025-59369
    medium

    A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

  • CVE-2025-59368
    medium

    An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

  • CVE-2025-59366
    critical

    An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.

  • CVE-2025-59365
    medium

    A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Updated ›

  • CVE-2025-9803
    critical

    lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.

  • CVE-2025-66187
    No Score

    Rejected reason: Not used

  • CVE-2025-66186
    No Score

    Rejected reason: Not used

  • CVE-2025-66185
    No Score

    Rejected reason: Not used

  • CVE-2025-66184
    No Score

    Rejected reason: Not used

  • CVE-2025-66183
    No Score

    Rejected reason: Not used

  • CVE-2025-66182
    No Score

    Rejected reason: Not used

  • CVE-2025-66181
    No Score

    Rejected reason: Not used

  • CVE-2025-66180
    No Score

    Rejected reason: Not used

  • CVE-2025-66179
    No Score

    Rejected reason: Not used