Export limit exceeded: 16509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,824

Export CSV
CVE-2025-41421

Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client

Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft Teamviewer
Products
Windows Full Client Host and 3 more
CVE-2025-41666

Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-41667

Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script

A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-41668

Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-41682

Credential Disclosure via Insecure Storage on Charge Controller

An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Bender
Products
Cc612 Cc613 Icc13xx and 1 more
CVE-2025-41690

Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Endress+hauser
Products
Proline 10
CVE-2025-41701

Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Twincat
CVE-2025-42897

Information Disclosure vulnerability in SAP Business One (SLD)

Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unauthorized information. As a result, it has a low impact on the confidentiality of the application but no impact on the integrity and availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business One
CVE-2025-42904

Information Disclosure vulnerability in Application Server ABAP

Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Application Server Java
CVE-2025-42928

Deserialization Vulnerability in SAP jConnect - SDK for ASE

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

CVSS 3.1 · 9.1 Critical EPSS 9.8% KEV · Not listed
Vendors
Sap
Products
Jconnect
CVE-2025-42933

Insecure Storage of Sensitive Information in SAP Business One (SLD)

When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business One
CVE-2025-42944

Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.

CVSS 3.1 · 10 Critical EPSS 3.0% KEV · Not listed
Vendors
Sap
Products
Netweaver Sap Netweaver
CVE-2025-42963

Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )

A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42964

Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42966

Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability of the application.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42980

Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42994

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42995

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-42996

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confidentiality, integrity and availibility of the application.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—