Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-67506 | 9.8 critical | 2.0% | pipeshub | PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta. | 14 Oct |
| CVE-2025-58132 | 6.5 medium | 2.0% | zoom, meeting_software_development_kit, rooms, workplace_desktop | Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. | 8 Oct |
| CVE-2026-53412 | 9.8 critical | 1.0% | zoom, workplace_desktop, workplace_virtual_desktop_infrastructure | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access. | Sat 24 Oct |
| CVE-2026-53407 | 9.8 critical | 0.00% | zoom, workplace | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access. | Sun 25 Oct |
| CVE-2025-64741 | 9.8 critical | 0.00% | zoom, meeting_software_development_kit, workplace | Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. | 18 Oct |
| CVE-2026-53408 | 8.1 high | 0.00% | zoom, meeting_software_development_kit, workplace | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access. | Mon 26 Oct |
| CVE-2026-53418 | 8.1 high | 0.00% | no CPE yet | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access. | 14 Oct |
| CVE-2026-53420 | 8.0 high | 0.00% | no CPE yet | Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. | 14 Oct |
| CVE-2026-30905 | 7.8 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access. | Mon 26 Oct |
| CVE-2025-64740 | 7.8 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access. | 18 Oct |
| CVE-2025-64739 | 7.5 high | 0.00% | zoom, meeting_software_development_kit, rooms, rooms_controller | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. | 18 Oct |
| CVE-2026-4116 | 7.2 high | 0.00% | sonicwall, sma6210_firmware, sma6200_firmware, sma7200_firmware | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication. | Mon 26 Oct |
| CVE-2026-53410 | 7.0 high | 0.00% | zoom, remote_control_for_zoom_contact_center, rooms, workplace_desktop | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. | Sat 24 Oct |
| CVE-2026-53411 | 7.0 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. | Sat 24 Oct |
| CVE-2025-64738 | 5.5 medium | 0.00% | zoom, meeting_software_development_kit, workplace_desktop | External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access. | 18 Oct |
| CVE-2026-30904 | 4.3 medium | 0.00% | zoom, workplace | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access. | Mon 26 Oct |
16 of 16
Download these 16 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.