Veille CVE

Mai 2025

4 CVE sur 10

Critique 2 Élevée 4 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-34026 7.5 Élevée Exploitée

    Versa Concerto · Versa-networks concerto

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

  2. CVE-2025-4008 8.8 Élevée Exploitée

    Smartbedded MeteoBridge · Smartbedded meteobridge vm · Smartbedded meteobridge firmware

    The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

  3. CVE-2025-30400 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2

    Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

  4. CVE-2025-2775 7.5 Élevée Exploitée

    SysAid On-Prem · Sysaid sysaid

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.