CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows Internet Shortcut Files Path Control Remote Code Execution Vulnerability (CVE-2025-33053, CISA KEV Actively Exploited)
[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.
[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.
[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2024-21412) Analysis and Mitigation Guide
[Affected Scope] All supported versions of Windows 10, 11, and Windows Server
[Impact] Attackers can bypass Windows Defender SmartScreen warnings using crafted Internet Shortcut (.url) files to execute arbitrary code
[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic