CVE-2025-65037

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-65048.4In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.  Since CVE-2025-650419.8Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2025-650463.1Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-65058.1Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on LinuxCVE-2025-65079.8A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrarCVE-2025-650737.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide KeCVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabiliCVE-2025-650789.3An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabilitCVE-2025-650796.9A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability