CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows Internet Shortcut Files Path Control Remote Code Execution Vulnerability (CVE-2025-33053, CISA KEV Actively Exploited)
[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.
[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.
[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.
ownCloud Core WebDAV API Authentication Bypass via Pre-Signed URLs (CVE-2023-49105)
[Affected Scope] ownCloud Core versions from 10.6.0 up to (but excluding) 10.13.1 are affected.
[Impact] Unauthenticated attackers can access, modify, or delete any file if they know the victim's username and the victim has no signing-key configured.
[Mitigation] Immediately upgrade ownCloud Core to version 10.13.1 or higher, and enforce signing-key configurations as a temporary workaround.