CVEs published January 15, 2025
203 CVEs were published on January 15, 2025: 15 critical, 79 high. 3 are now in CISA KEV.
- Published
- 203
- Critical
- 15
- High
- 79
- Medium
- 93
- Low
- 4
- Unrated
- 12
- Now in CISA KEV
- 3
- Fix available
- 47
Most affected products
- Linux
- 32
- Google Chrome
- 13
- Fanli2012 native-php-cms
- 10
- Apple iOS and iPadOS
- 3
- Mattermost
- 3
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 3
- Observium
- 3
- Dell Display Manager
- 2
- NitroPack – Performance, Page Speed & Cache Plugin for Core…
- 2
- addonsorg PDF for WPForms + Drag and Drop Template Builder
- 1
Critical 15
- CVE-2025-22146Improper authentication on SAML SSO process allows user impersonation in sentrygetsentry sentry · sentry
- CVE-2024-44136This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2025-22782WordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Remote Code Execution (RCE) vulnerabilityWeb Ready Now WR Price List Manager For Woocommerce
- CVE-2025-22785WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerabilityComMotion Course Booking System
- CVE-2024-12084Rsync: heap buffer overflow in rsync due to improper checksum length handlingrsync · Red Hat Enterprise Linux +1
- CVE-2024-57802netrom: check buffer length before accessing itLinux
- CVE-2024-36476RDMA/rtrs: Ensure 'ib_sge list' is accessibleLinux
- CVE-2024-57882mptcp: fix TCP options overflow.Linux
- CVE-2024-12297Frontend Authorization Logic Disclosure VulnerabilityMoxa EDS-508A Series · Moxa PT-508 Series +8
- CVE-2024-9636Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalationpickplugins Post Grid and Gutenberg Blocks – ComboBlocks
- CVE-2024-48126HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.
- CVE-2024-57726SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce
- CVE-2024-57727SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re
- CVE-2025-22968An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions
- CVE-2025-23061Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.mongoosejs Mongoose · mongoose
High 79
- CVE-2025-0492D-Link DIR-823X FUN_00412244 null pointer dereferenceD-Link DIR-823X
- CVE-2024-40771The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27856The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-0501Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)Amazon WorkSpaces Client
- CVE-2025-0500Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clientsAmazon WorkSpaces Client · Amazon AppStream 2.0 Client +1
- CVE-2024-52005The sideband payload is passed unfiltered to the terminal in gitgit
- CVE-2024-7085Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM).OpenText™ Solutions Business Manager
- CVE-2020-8094Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)Bitdefender Antivirus Free
- CVE-2024-8603A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6B&R Industrial Automation Automation Runtime · B&R Industri…
- CVE-2025-22317WordPress Gallery Images Ape plugin <= 2.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityGallery Ape Photo Gallery – Image Gallery by Ape
- CVE-2025-22736WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerabilitySaad Iqbal User Management
- CVE-2025-22750WordPress Post Carousel & Slider plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityPatel Post Carousel & Slider
- CVE-2025-22751WordPress Partners Plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityfarinspace Partners
- CVE-2025-22752WordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerabilityWesternDeal GSheetConnector for Forminator Forms
- CVE-2025-22753WordPress turboSMTP Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityturboSMTP
- CVE-2025-22754WordPress Amber Plugin <=1.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityBerkman Klein Center Amber
- CVE-2025-22755WordPress WP Headmaster Plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitybavington WP Headmaster
- CVE-2025-22760WordPress CodeBard Help Desk plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCodeBard Help Desk
- CVE-2025-22764WordPress WP Post Corrector Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityvipul Jariwala WP Post Corrector
- CVE-2025-22765WordPress WP Order By Plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityweiluri WP Order By
- CVE-2025-22766WordPress Zarinpal Paid Download Plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMasoud Amini Zarinpal Paid Download
- CVE-2025-22776WordPress WP Bulletin Board Plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilitycodebycarter WP Bulletin Board
- CVE-2025-22778WordPress Lijit Search Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydamniel Lijit Search
- CVE-2025-22784WordPress Background Control plugin <= 1.0.5 - CSRF to Arbitrary File Deletion vulnerabilityswedish boy Background Control
- CVE-2025-22786WordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-22793WordPress Bold pagos en linea Plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityBold pagos en linea
- CVE-2025-22795WordPress Multilang Contact Form Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilitydigitaldonkey Multilang Contact Form
- CVE-2025-22799WordPress Neon Product Designer Plugin <= 2.2.0 - SQL Injection vulnerabilityvertim Neon Product Designer
- CVE-2024-47140A cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528.Observium
- CVE-2024-47002A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528.Observium
- CVE-2024-45061A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528.Observium
- CVE-2024-11322CyberPower PowerPanel Business Unauthenticated Restart DoSC4.yberPower PowerPanel Business
- CVE-2024-57857RDMA/siw: Remove direct link to net_deviceLinux
- CVE-2024-57801net/mlx5e: Skip restore TC rules for vport rep without loaded flagLinux
- CVE-2024-57795RDMA/rxe: Remove the direct link to net_deviceLinux
- CVE-2024-39282net: wwan: t7xx: Fix FSM command timeout issueLinux
- CVE-2025-21629net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packetsLinux
- CVE-2024-57902af_packet: fix vlan_get_tci() vs MSG_PEEKLinux
- CVE-2024-57901af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEKLinux
- CVE-2024-57900ila: serialize calls to nf_register_net_hooks()Linux
- CVE-2024-57899wifi: mac80211: fix mbss changed flags corruption on 32 bit systemsLinux
- CVE-2024-57896btrfs: flush delalloc workers queue before stopping cleaner kthread during unmountLinux
- CVE-2024-57895ksmbd: set ATTR_CTIME flags when setting mtimeLinux
- CVE-2024-57893ALSA: seq: oss: Fix races at processing SysEx messagesLinux
- CVE-2024-57892ocfs2: fix slab-use-after-free due to dangling pointer dqi_privLinux
- CVE-2024-57887drm: adv7511: Fix use-after-free in adv7533_attach_dsi()Linux
- CVE-2024-57883mm: hugetlb: independent PMD page table shared countLinux
- CVE-2024-11848NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateNitroPack – Performance, Page Speed & Cache Plugin for Core…
- CVE-2025-0447Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalationGoogle Chrome
- CVE-2025-0443Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2025-0438Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption vGoogle Chrome
- CVE-2025-0436Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2025-0434Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2024-13351Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scriptingneran Reviews Widgets for Google & 45+ platforms by Repuso
- CVE-2024-4227gSOAP: Vulnerable to specially crafted unencrypted SDC messagesGenivia gSOAP
- CVE-2025-0356NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands vNEC WX1500HP · NEC WX3600HP
- CVE-2025-0355Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and NEC WG2600HS · NEC WF1200CR +7
- CVE-2024-55577Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier.The Dimensional Gate Linux Ratfor
- CVE-2025-0343Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions.Swift Project Swift ASN1
- CVE-2024-48123An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted s
- CVE-2024-48125An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol req
- CVE-2024-50953An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message.
- CVE-2024-50954The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages.
- CVE-2024-57011TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setSc
- CVE-2024-57012TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setSched
- CVE-2024-57013TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setSch
- CVE-2024-57014TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setSc
- CVE-2024-57015TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setSched
- CVE-2024-57016TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAc
- CVE-2024-57017TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAc
- CVE-2024-57018TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAc
- CVE-2024-57019TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnA
- CVE-2024-57020TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWi
- CVE-2024-57021TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFi
- CVE-2024-57022TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFi
- CVE-2024-57728SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a
- CVE-2025-22964DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inp
- CVE-2025-22976SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly
- CVE-2025-23013In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.Yubico pam-u2f
Medium, low and unrated 109
- CVE-2025-0476Mobile crash via file with specially crafted filenameMattermost
- CVE-2025-0215UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scriptingdavidanderson UpdraftPlus: WP Backup & Migration Plugin
- CVE-2025-0491Fanli2012 native-php-cms cat_dodel.php sql injectionFanli2012 native-php-cms
- CVE-2025-0490Fanli2012 native-php-cms article_dodel.php sql injectionFanli2012 native-php-cms
- CVE-2025-0489Fanli2012 native-php-cms friendlink_dodel.php sql injectionFanli2012 native-php-cms
- CVE-2025-0488Fanli2012 native-php-cms product_list.php sql injectionFanli2012 native-php-cms
- CVE-2025-0487Fanli2012 native-php-cms cat_edit.php sql injectionFanli2012 native-php-cms
- CVE-2025-0486Fanli2012 native-php-cms login.php sql injectionFanli2012 native-php-cms
- CVE-2025-0485Fanli2012 native-php-cms sysconfig_doedit.php cross site scriptingFanli2012 native-php-cms
- CVE-2025-0484Fanli2012 native-php-cms Backend sysconfig_doedit.php improper authorizationFanli2012 native-php-cms
- CVE-2024-54470A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-54535A path handling issue was addressed with improved logic.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-40854A memory initialization issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40839This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-54540The issue was addressed with improved input sanitization.Apple Music
- CVE-2025-0483Fanli2012 native-php-cms jump.php cross site scriptingFanli2012 native-php-cms
- CVE-2025-0482Fanli2012 native-php-cms user_recoverpwd.php default credentialsFanli2012 native-php-cms
- CVE-2025-0481D-Link DIR-878 HTTP POST Request dllog.cgi information disclosureD-Link DIR-878
- CVE-2025-0502Transmission of Private Resources into a New Sphere in Crafter EngineCrafterCMS
- CVE-2025-0480wuzhicms config.php test server-side request forgerywuzhicms
- CVE-2025-23040Maliciously crafted remote URLs could lead to credential leak in GitHub Desktopdesktop
- CVE-2025-20088Insufficient Input Validation on Post PropsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-20086Insufficient Input Validation on Post PropsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-21083Insufficient Input Validation on Post PropsMattermost
- CVE-2025-20036Insufficient Input Validation on Post PropsMattermost
- CVE-2025-21088WebApp crash via improper validation of proto style in attachmentsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-56295WordPress Poll Maker plugin <= 5.5.6 - Broken Access Control vulnerabilityAys Pro Poll Maker
- CVE-2025-22329WordPress Free Google Maps plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityAgile Logix Free Google Maps
- CVE-2025-22346WordPress Course Migration for LearnDash plugin 1.0.2 - Server Side Request Forgery (SSRF) vulnerabilityFaizaan Gagan Course Migration for LearnDash
- CVE-2025-22587WordPress SEO Bulk Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityAtanas Krachev SEO Bulk Editor
- CVE-2025-22724WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityMojofyWP Product Carousel For WooCommerce – WoorouSell
- CVE-2025-22729WordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2025-22731WordPress Build Private Store For Woocommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilitysilverplugins217 Build Private Store For Woocommerce
- CVE-2025-22734WordPress Posts Footer Manager Plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityData443 Risk Mitigation Posts Footer Manager
- CVE-2025-22737WordPress WpTravelly Plugin <= 1.8.5 - Broken Access Control vulnerabilitymagepeopleteam WpTravelly
- CVE-2025-22738WordPress WP ULike plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerabilityAlimir WP ULike
- CVE-2025-22742WordPress WP ViewSTL plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityfalldeaf WP ViewSTL
- CVE-2025-22743WordPress Twitter Bootstrap Collapse aka Accordian Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityMohsin Rasool Twitter Bootstrap Collapse aka Accordian Shor…
- CVE-2025-22744WordPress S-DEV SEO plugin <= 1.88 - Cross Site Scripting (XSS) vulnerabilitySeodev S-DEV SEO
- CVE-2025-22745WordPress Navigation Du Lapin Blanc plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilitybjoerne Navigation Du Lapin Blanc
- CVE-2025-22746WordPress HireHive Job Plugin plugin <= 2.9.0 - Cross Site Scripting (XSS) vulnerabilityzartis HireHive Job Plugin
- CVE-2025-22747WordPress Foundation Columns plugin <= 0.8 - Stored Cross Site Scripting (XSS) vulnerabilitytormorten Foundation Columns
- CVE-2025-22748WordPress SetMore Theme – Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerabilitySetMore Theme – Custom Post Types
- CVE-2025-22749WordPress Social Media Engine plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityThemesCraft.co Social Media Engine
- CVE-2025-22758WordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityHarnani Elementor AI Addons
- CVE-2025-22759WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityPost and Page Builder by BoldGrid
- CVE-2025-22761WordPress Ajax Contact Form plugin <= 1.4.1 - Stored Cross Site Scripting (XSS) vulnerabilityOlaf Lederer Ajax Contact Form
- CVE-2025-22762WordPress Octrace Support Pro plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityWordPress HelpDesk & Support Ticket System Plugin – Octrace…
- CVE-2025-22769WordPress Multifox theme <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityCreative Brahma Multifox
- CVE-2025-22773WordPress Htaccess File Editor <= 1.0.19 - Broken Authentication vulnerabilityWP Chill Htaccess File Editor
- CVE-2025-22779WordPress WP News Sliders plugin <= 1.0 - Broken Access Control vulnerabilitycodeaffairs WP News Sliders
- CVE-2025-22780WordPress wp-pano Plugin <= 1.17 - Cross Site Scripting (XSS) vulnerabilityAndrey wp-pano
- CVE-2025-22781WordPress Nativery Plugin plugin <= 0.1.6 - Cross Site Scripting (XSS) vulnerabilityNativery
- CVE-2025-22787WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerabilitybPlugins Button Block
- CVE-2025-22788WordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerabilityCodexpert CoDesigner
- CVE-2025-22797WordPress Gallery and Lightbox plugin <= 1.0.14 - Cross Site Scripting (XSS) vulnerabilityOğulcan Özügenç Gallery and Lightbox
- CVE-2025-22798WordPress Responsive jQuery Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityCHR Designer Responsive jQuery Slider
- CVE-2024-57844drm/xe: Fix fault on fd close after unbindLinux
- CVE-2024-57841net: fix memory leak in tcp_conn_request()Linux
- CVE-2024-54031netfilter: nft_set_hash: unaligned atomic read on struct nft_set_extLinux
- CVE-2024-53681nvmet: Don't overflow subsysnqnLinux
- CVE-2024-57903net: restrict SO_REUSEPORT to inet socketsLinux
- CVE-2024-57898wifi: cfg80211: clear link ID from bitmap during link delete after clean upLinux
- CVE-2024-57897drm/amdkfd: Correct the migration DMA map directionLinux
- CVE-2024-57891sched_ext: Fix invalid irq restore in scx_ops_bypass()Linux
- CVE-2024-57890RDMA/uverbs: Prevent integer overflow issueLinux
- CVE-2024-57889pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap lockingLinux
- CVE-2024-57888workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM workerLinux
- CVE-2024-57886mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()Linux
- CVE-2024-57885mm/kmemleak: fix sleeping function called from invalid context at print messageLinux
- CVE-2024-57884mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()Linux
- CVE-2024-5198OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driveOpenVPN ovpn-dco · OpenVPN-GUI
- CVE-2024-11029Freeipa: administrative user data leaked through systemd journalfreeipa · Red Hat Enterprise Linux
- CVE-2024-13215Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popupwpvibes Addon Elements for Elementor
- CVE-2024-11851NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient UpdateNitroPack – Performance, Page Speed & Cache Plugin for Core…
- CVE-2024-12593PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcodeaddonsorg PDF for WPForms + Drag and Drop Template Builder
- CVE-2025-0193Stored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 SeriesMoxa MGate 5121 Series · Moxa MGate 5122 Series +1
- CVE-2025-0448Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2025-0446Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2025-0442Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2025-0441Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitGoogle Chrome
- CVE-2025-0440Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2025-0439Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to pGoogle Chrome
- CVE-2025-0437Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2025-0435Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2024-35280A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDFortinet FortiDeceptor
- CVE-2024-12818WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingrobdavenport WP Smart TV
- CVE-2024-12403Image Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scriptingrealwebcare Awesome Responsive Photo Gallery – Image & Vide…
- CVE-2024-12423Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scriptingscottpaterson Business Essentials for Contact Form
- CVE-2024-10775Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosurepiotnetdotcom Piotnet Addons For Elementor
- CVE-2024-7322Dos in ZigBee device due to unsolicited encrypted rejoin responsesilabs.com EmberZNet
- CVE-2025-0354Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1NEC WG2600HS · NEC WG2600HP4 +4
- CVE-2024-11870Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEvent Registration Calendar By vcita
- CVE-2024-13394ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scriptingswarminteractive ViewMedica
- CVE-2025-22394Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability.Dell Display Manager
- CVE-2025-21101Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability.Dell Display Manager
- CVE-2024-13334Car Demon <= 1.8.1 - Reflected Cross-Site Scriptingtheverylastperson Car Demon
- CVE-2024-36751An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.parse-uri · parseuri
- CVE-2024-39967Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command.
- CVE-2024-41453A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or H
- CVE-2024-41454An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers
- CVE-2024-48121The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol.
- CVE-2024-48122Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to ro
- CVE-2024-52783Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via
- CVE-2024-53407In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote cont
- CVE-2024-55503An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES compo
- CVE-2024-57023TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiS
- CVE-2024-57024TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWi
- CVE-2024-57025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiS