Threat database

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.0	EPSS 0.2%	CVE-2025-41255iterate Cyberduck · Incorrect Privilege Assignment High8.0EPSS 0.2%2025-06-25CVE Database V5CVE-2025-41255 Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5. EPSS 0.2%Vulnerability CWE-266	CVE Database V5	2025-06-25
High	7.4	EPSS 0.1%	CVE-2025-41256iterate Cyberduck · Use of Weak Hash High7.4EPSS 0.1%2025-06-25CVE Database V5CVE-2025-41256 Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5. EPSS 0.1%Vulnerability CWE-328	CVE Database V5	2025-06-25

Page 1 of 1