Our Vulnerability Research

Common Vulnerabilities and Exposures

SAP security alert for CVE-2025-24870 indicating a critical threat level for insecure secrets management exposing plaintext credentials and access to banking transactions and enterprise data.

What This Vulnerability Research Portfolio Represents

Discoveries That Matter

Our vulnerability research team reverse engineers your enterprise software to find the 0-days that threaten your infrastructure - before attackers do.

Enterprise Focus

The vulnerabilities below affect systems organizations use: SAP. IBM. Check Point. F5. BMC. Microsoft. Rapid7. Cyberark.

Logos of five technology companies: IBM, Check Point, Microsoft, SAP, and CyberArk on a black background.

Current Research

We identified a wide range of CVEs across various industries - each of the vulnerabilities have been assigned a threat level ranging from critical to low. We pride ourselves in beating others to identify critical CVEs in large infrastructure for orgasations such as IBM and Microsoft.

Sort by Threat level
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
CVE-2025-1982
Threat level
High

Local file inclusion in Ready_ Symfonia eDokumenty allows attackers to read arbitrary files from the server filesystem

See more
CVE-2025-1981
Threat level
Critical

SQL injection in Ready_ Symfonia eDokumenty allows attackers to execute arbitrary SQL queries against the backend database

See more
CVE-2025-1980
Threat level
Critical

Remote code execution in Ready_ Symfonia eDokumenty allows unauthenticated attackers to execute arbitrary commands on the server

See more
CVE-2025-15523
Threat level
Medium

TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app

See more
CVE-2025-14714
Threat level
Low

TCC Bypass via Inherited Permissions in Bundled Interpreter

See more
CVE-2025-1421
Threat level
Low

Remote code execution via CSV injection in Proget Console - activation data containing malicious formulas executes when opened in Excel

See more
CVE-2025-1420
Threat level
Low

Stored XSS via unsanitized activation messages in Proget Console allows attackers to execute JavaScript in victim browsers

See more
CVE-2025-1419
Threat level
Low

Stored cross-site scripting in Proget Console comments allows high-privileged users to inject malicious scripts affecting other administrators

See more
CVE-2025-1418
Threat level
Medium

Authorization bypass in Proget MDM allows low-privileged users to access MDM profiles revealing allowed and blocked device features

See more
CVE-2025-1417
Threat level
Medium

Insecure direct object reference in Proget MDM allows low-privileged users to view sensitive backup data including UUIDs, names, and emails

See more
CVE-2025-1416
Threat level
High

Authorization bypass in Proget MDM allows low-privileged users to retrieve device passwords using UUIDs obtained from other vulnerabilities

See more
CVE-2025-1415
Threat level
Medium

Broken access control in Proget MDM allows low-privileged users to enumerate task and device details including UUIDs via brute-force

See more
CVE-2025-1413
Threat level
High

Dylib hijacking in DaVinci Resolve allows local attackers to execute arbitrary code with application privileges

See more
CVE-2025-13175
Threat level
Medium

Insecure Password Storage in Y Soft SafeQ 6

See more
CVE-2025-10016
Threat level
High

Local privilege escalation vulnerability in Sparkle autoupdate daemon allows local attackers to elevate privileges to root on macOS systems

See more

We map your systems before testing how they break.

That's why critical findings usually show up outside the original scope - attackers don't respect scope documents.

Book a consultation
arrow_right [#333] Created with Sketch.

Security Assessment Services FAQ

Questions enterprise security teams ask before partnering with AFINE for security assessments.

Is AFINE ISO 27001 certified and what compliance frameworks do you support?

Yes, AFINE is ISO 27001 certified. Beyond certification, we maintain operational security excellence built through 10 years of enterprise work. Our security assessment services support DORA, PCI DSS, SOC 2, ISO 27001, TIBER-EU, NESA, and FCA compliance. We've conducted hundreds of assessments for regulated institutions like PKO BP, ING Bank, and BGK.

What certifications and specialized expertise does AFINE team hold?

Every team member holds minimum OSCP or eWPTX certification. Our researchers average 7-10 years offensive security experience with OSCE, OSWE, OSED, OSEP, CRTO, CSSA, CISSP, CISA, and BSCP certifications. We've published CVEs in SAP, Microsoft, CyberArk, Palo Alto, F5, IBM, and other enterprise software.

What makes AFINE different from other penetration testing vendors?

We've published 150+ CVEs in enterprise software and understand how attackers exploit complex systems beyond automated scanning. Our manual testing finds business logic flaws and attack chains others miss. Isabel Group confirmed we "keep finding critical issues where other pentesters have not found them." Our 10-year exclusive focus on banking, critical infrastructure, and healthcare environments means we understand compliance and production system safety.