Vulnerabilidades exploradas (CISA KEV)

CVE-2025-6554 Alta · 8.1 KEV Alta · 61 Exploit público CWE-843 30/06/2025

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVE-2025-32463 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-829 30/06/2025

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CVE-2025-20281 Crítica · 10.0 KEV Urgente · 73 Exploit público CWE-74 25/06/2025

Cisco Identity Services Engine Injection Vulnerability

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

CVE-2025-6543 Crítica · 9.8 KEV Alta · 65 Exploit público CWE-119 25/06/2025

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVE-2025-32975 Crítica · 10.0 KEV Alta · 61 CWE-287 24/06/2025

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

CVE-2025-48700 Média · 6.1 KEV Alta · 50 CWE-79 23/06/2025

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

CVE-2025-6218 Alta · 7.8 KEV Alta · 62 Exploit público CWE-22 20/06/2025

RARLAB WinRAR Path Traversal Vulnerability

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.

CVE-2025-5777 Alta · 7.5 KEV Urgente · 87 Exploit público Ransomware CWE-908 17/06/2025

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVE-2025-43200 Média · 4.2 KEV Alta · 48 16/06/2025

Apple Multiple Products Unspecified Vulnerability

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CVE-2025-33073 Alta · 8.8 KEV Urgente · 70 Exploit público CWE-284 10/06/2025

Microsoft Windows SMB Client Improper Access Control Vulnerability

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

CVE-2025-33053 Alta · 8.8 KEV Urgente · 74 Exploit público CWE-73 10/06/2025

Microsoft Windows External Control of File Name or Path Vulnerability

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

CVE-2025-47827 Média · 4.6 KEV Alta · 58 Exploit público CWE-347 05/06/2025

IGEL OS Use of a Key Past its Expiration Date Vulnerability

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

CVE-2025-21479 Alta · 8.6 KEV Alta · 56 Exploit público CWE-863 03/06/2025

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CVE-2025-27038 Alta · 7.5 KEV Alta · 51 CWE-416 03/06/2025

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

CVE-2025-21480 Alta · 8.6 KEV Alta · 47 CWE-863 03/06/2025

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

CVE-2025-5419 Alta · 8.8 KEV Alta · 61 Exploit público CWE-125 02/06/2025

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-5086 Crítica · 9.0 KEV Alta · 64 Exploit público CWE-502 02/06/2025

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

CVE-2025-49113 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-502 02/06/2025

Roundcube Webmail: desserialização de dados não confiáveis (CWE-502)

O Roundcube Webmail anterior à 1.5.10 e 1.6.x anterior à 1.6.11 permite execução remota de código por usuários autenticados, porque o parâmetro _from em uma URL não é validado em program/actions/settings/upload.php, levando à desserialização de objetos PHP.