Vulnerabilidades exploradas (CISA KEV)

CVE-2025-9377 Alta · 7.2 KEV Alta · 56 CWE-78 29/08/2025

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

CVE-2025-55177 Média · 5.4 KEV Alta · 58 Exploit público CWE-863 29/08/2025

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

CVE-2025-57819 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-89 28/08/2025

Sangoma FreePBX Authentication Bypass Vulnerability

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

CVE-2025-7775 Crítica · 9.8 KEV Alta · 66 Exploit público CWE-119 26/08/2025

Citrix NetScaler Memory Overflow Vulnerability

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

CVE-2025-43300 Crítica · 10.0 KEV Alta · 69 Exploit público CWE-787 20/08/2025

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CVE-2025-8875 Alta · 7.8 KEV Alta · 59 Exploit público CWE-502 14/08/2025

N-able N-Central Insecure Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

CVE-2025-8876 Alta · 8.8 KEV Alta · 54 CWE-78 14/08/2025

N-able N-Central Command Injection Vulnerability

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

CVE-2025-8088 Alta · 8.8 KEV Urgente · 72 Exploit público Ransomware CWE-35 08/08/2025

RARLAB WinRAR Path Traversal Vulnerability

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

CVE-2025-54253 Crítica · 10.0 KEV Alta · 69 Exploit público CWE-863 05/08/2025

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

CVE-2025-54948 Crítica · 9.8 KEV Alta · 63 CWE-78 05/08/2025

Trend Micro Apex One OS Command Injection Vulnerability

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

CVE-2025-6205 Crítica · 9.1 KEV Alta · 67 Exploit público CWE-862 04/08/2025

Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.

CVE-2025-6204 Alta · 8.0 KEV Alta · 60 Exploit público CWE-94 04/08/2025

Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.