# CVEs published 2025-01-15

203 CVEs were published on January 15, 2025: 15 critical, 79 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-0476](https://cve.now/CVE-2025-0476.md): Mobile crash via file with specially crafted filename (CVSS 4.3, Mattermost)
- [CVE-2025-0215](https://cve.now/CVE-2025-0215.md): UpdraftPlus - Backup/Restore \<= 1.24.12 - Reflected Cross-Site Scripting (CVSS 6.1, davidanderson UpdraftPlus: WP Backup & Migration Plugin)
- [CVE-2025-0492](https://cve.now/CVE-2025-0492.md): D-Link DIR-823X FUN\_00412244 null pointer dereference (CVSS 8.7, D-Link DIR-823X)
- [CVE-2025-0491](https://cve.now/CVE-2025-0491.md): Fanli2012 native-php-cms cat\_dodel.php sql injection (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0490](https://cve.now/CVE-2025-0490.md): Fanli2012 native-php-cms article\_dodel.php sql injection (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0489](https://cve.now/CVE-2025-0489.md): Fanli2012 native-php-cms friendlink\_dodel.php sql injection (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0488](https://cve.now/CVE-2025-0488.md): Fanli2012 native-php-cms product\_list.php sql injection (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0487](https://cve.now/CVE-2025-0487.md): Fanli2012 native-php-cms cat\_edit.php sql injection (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0486](https://cve.now/CVE-2025-0486.md): Fanli2012 native-php-cms login.php sql injection (CVSS 6.9, Fanli2012 native-php-cms)
- [CVE-2025-0485](https://cve.now/CVE-2025-0485.md): Fanli2012 native-php-cms sysconfig\_doedit.php cross site scripting (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0484](https://cve.now/CVE-2025-0484.md): Fanli2012 native-php-cms Backend sysconfig\_doedit.php improper authorization (CVSS 6.9, Fanli2012 native-php-cms)
- [CVE-2025-22146](https://cve.now/CVE-2025-22146.md): Improper authentication on SAML SSO process allows user impersonation in sentry (CVSS 9.1, getsentry sentry · sentry)
- [CVE-2024-54470](https://cve.now/CVE-2024-54470.md): A logic issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2024-54535](https://cve.now/CVE-2024-54535.md): A path handling issue was addressed with improved logic. (CVSS 4.0, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40854](https://cve.now/CVE-2024-40854.md): A memory initialization issue was addressed with improved memory handling. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40839](https://cve.now/CVE-2024-40839.md): This issue was addressed through improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-40771](https://cve.now/CVE-2024-40771.md): The issue was addressed with improved memory handling. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-27856](https://cve.now/CVE-2024-27856.md): The issue was addressed with improved checks. (CVSS 7.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-44136](https://cve.now/CVE-2024-44136.md): This issue was addressed through improved state management. (CVSS 9.1, Apple iOS and iPadOS)
- [CVE-2024-54540](https://cve.now/CVE-2024-54540.md): The issue was addressed with improved input sanitization. (CVSS 5.5, Apple Music)
- [CVE-2025-0483](https://cve.now/CVE-2025-0483.md): Fanli2012 native-php-cms jump.php cross site scripting (CVSS 5.3, Fanli2012 native-php-cms)
- [CVE-2025-0482](https://cve.now/CVE-2025-0482.md): Fanli2012 native-php-cms user\_recoverpwd.php default credentials (CVSS 6.9, Fanli2012 native-php-cms)
- [CVE-2025-0481](https://cve.now/CVE-2025-0481.md): D-Link DIR-878 HTTP POST Request dllog.cgi information disclosure (CVSS 6.9, D-Link DIR-878)
- [CVE-2025-0501](https://cve.now/CVE-2025-0501.md): Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol) (CVSS 7.7, Amazon WorkSpaces Client)
- [CVE-2025-0500](https://cve.now/CVE-2025-0500.md): Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients (CVSS 7.7, Amazon WorkSpaces Client · Amazon AppStream 2.0 Client +1)
- [CVE-2025-0502](https://cve.now/CVE-2025-0502.md): Transmission of Private Resources into a New Sphere in Crafter Engine (CVSS 6.9, CrafterCMS)
- [CVE-2024-52005](https://cve.now/CVE-2024-52005.md): The sideband payload is passed unfiltered to the terminal in git (CVSS 7.5, git)
- [CVE-2025-0480](https://cve.now/CVE-2025-0480.md): wuzhicms config.php test server-side request forgery (CVSS 5.3, wuzhicms)
- [CVE-2025-23040](https://cve.now/CVE-2025-23040.md): Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop (CVSS 6.6, desktop)
- [CVE-2025-20088](https://cve.now/CVE-2025-20088.md): Insufficient Input Validation on Post Props (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-20086](https://cve.now/CVE-2025-20086.md): Insufficient Input Validation on Post Props (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-7085](https://cve.now/CVE-2024-7085.md): Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM). (CVSS 8.2, OpenText™ Solutions Business Manager)
- [CVE-2020-8094](https://cve.now/CVE-2020-8094.md): Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422) (CVSS 8.8, Bitdefender Antivirus Free)
- [CVE-2025-21083](https://cve.now/CVE-2025-21083.md): Insufficient Input Validation on Post Props (CVSS 6.5, Mattermost)
- [CVE-2025-20036](https://cve.now/CVE-2025-20036.md): Insufficient Input Validation on Post Props (CVSS 6.5, Mattermost)
- [CVE-2025-21088](https://cve.now/CVE-2025-21088.md): WebApp crash via improper validation of proto style in attachments (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-8603](https://cve.now/CVE-2024-8603.md): A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6 (CVSS 8.2, B&R Industrial Automation Automation Runtime · B&R Industri…)
- [CVE-2024-56295](https://cve.now/CVE-2024-56295.md): WordPress Poll Maker plugin \<= 5.5.6 - Broken Access Control vulnerability (CVSS 6.5, Ays Pro Poll Maker)
- [CVE-2025-22317](https://cve.now/CVE-2025-22317.md): WordPress Gallery Images Ape plugin \<= 2.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Gallery Ape Photo Gallery – Image Gallery by Ape)
- [CVE-2025-22329](https://cve.now/CVE-2025-22329.md): WordPress Free Google Maps plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Agile Logix Free Google Maps)
- [CVE-2025-22346](https://cve.now/CVE-2025-22346.md): WordPress Course Migration for LearnDash plugin 1.0.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Faizaan Gagan Course Migration for LearnDash)
- [CVE-2025-22587](https://cve.now/CVE-2025-22587.md): WordPress SEO Bulk Editor plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atanas Krachev SEO Bulk Editor)
- [CVE-2025-22724](https://cve.now/CVE-2025-22724.md): WordPress Product Carousel For WooCommerce – WoorouSell plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MojofyWP Product Carousel For WooCommerce – WoorouSell)
- [CVE-2025-22729](https://cve.now/CVE-2025-22729.md): WordPress VOD Infomaniak plugin \<= 1.5.9 - Broken Access Control vulnerability (CVSS 4.3, Infomaniak Network VOD Infomaniak)
- [CVE-2025-22731](https://cve.now/CVE-2025-22731.md): WordPress Build Private Store For Woocommerce plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, silverplugins217 Build Private Store For Woocommerce)
- [CVE-2025-22734](https://cve.now/CVE-2025-22734.md): WordPress Posts Footer Manager Plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Data443 Risk Mitigation Posts Footer Manager)
- [CVE-2025-22736](https://cve.now/CVE-2025-22736.md): WordPress User Management plugin \<= 1.2 - Privilege Escalation vulnerability (CVSS 8.8, Saad Iqbal User Management)
- [CVE-2025-22737](https://cve.now/CVE-2025-22737.md): WordPress WpTravelly Plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam WpTravelly)
- [CVE-2025-22738](https://cve.now/CVE-2025-22738.md): WordPress WP ULike plugin \<= 4.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Alimir WP ULike)
- [CVE-2025-22742](https://cve.now/CVE-2025-22742.md): WordPress WP ViewSTL plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, falldeaf WP ViewSTL)
- [CVE-2025-22743](https://cve.now/CVE-2025-22743.md): WordPress Twitter Bootstrap Collapse aka Accordian Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Shor…)
- [CVE-2025-22744](https://cve.now/CVE-2025-22744.md): WordPress S-DEV SEO plugin \<= 1.88 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Seodev S-DEV SEO)
- [CVE-2025-22745](https://cve.now/CVE-2025-22745.md): WordPress Navigation Du Lapin Blanc plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bjoerne Navigation Du Lapin Blanc)
- [CVE-2025-22746](https://cve.now/CVE-2025-22746.md): WordPress HireHive Job Plugin plugin \<= 2.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zartis HireHive Job Plugin)
- [CVE-2025-22747](https://cve.now/CVE-2025-22747.md): WordPress Foundation Columns plugin \<= 0.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tormorten Foundation Columns)
- [CVE-2025-22748](https://cve.now/CVE-2025-22748.md): WordPress SetMore Theme – Custom Post Types plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SetMore Theme – Custom Post Types)
- [CVE-2025-22749](https://cve.now/CVE-2025-22749.md): WordPress Social Media Engine plugin \<= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemesCraft.co Social Media Engine)
- [CVE-2025-22750](https://cve.now/CVE-2025-22750.md): WordPress Post Carousel & Slider plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Patel Post Carousel & Slider)
- [CVE-2025-22751](https://cve.now/CVE-2025-22751.md): WordPress Partners Plugin \<= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, farinspace Partners)
- [CVE-2025-22752](https://cve.now/CVE-2025-22752.md): WordPress GSheetConnector for Forminator Forms Plugin \<= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WesternDeal GSheetConnector for Forminator Forms)
- [CVE-2025-22753](https://cve.now/CVE-2025-22753.md): WordPress turboSMTP Plugin \<= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, turboSMTP)
- [CVE-2025-22754](https://cve.now/CVE-2025-22754.md): WordPress Amber Plugin \<=1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Berkman Klein Center Amber)
- [CVE-2025-22755](https://cve.now/CVE-2025-22755.md): WordPress WP Headmaster Plugin \<= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bavington WP Headmaster)
- [CVE-2025-22758](https://cve.now/CVE-2025-22758.md): WordPress Elementor AI Addons plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Harnani Elementor AI Addons)
- [CVE-2025-22759](https://cve.now/CVE-2025-22759.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Post and Page Builder by BoldGrid)
- [CVE-2025-22760](https://cve.now/CVE-2025-22760.md): WordPress CodeBard Help Desk plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodeBard Help Desk)
- [CVE-2025-22761](https://cve.now/CVE-2025-22761.md): WordPress Ajax Contact Form plugin \<= 1.4.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Olaf Lederer Ajax Contact Form)
- [CVE-2025-22762](https://cve.now/CVE-2025-22762.md): WordPress Octrace Support Pro plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WordPress HelpDesk & Support Ticket System Plugin – Octrace…)
- [CVE-2025-22764](https://cve.now/CVE-2025-22764.md): WordPress WP Post Corrector Plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, vipul Jariwala WP Post Corrector)
- [CVE-2025-22765](https://cve.now/CVE-2025-22765.md): WordPress WP Order By Plugin \<= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, weiluri WP Order By)
- [CVE-2025-22766](https://cve.now/CVE-2025-22766.md): WordPress Zarinpal Paid Download Plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Masoud Amini Zarinpal Paid Download)
- [CVE-2025-22769](https://cve.now/CVE-2025-22769.md): WordPress Multifox theme \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Creative Brahma Multifox)
- [CVE-2025-22773](https://cve.now/CVE-2025-22773.md): WordPress Htaccess File Editor \<= 1.0.19 - Broken Authentication vulnerability (CVSS 5.3, WP Chill Htaccess File Editor)
- [CVE-2025-22776](https://cve.now/CVE-2025-22776.md): WordPress WP Bulletin Board Plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codebycarter WP Bulletin Board)
- [CVE-2025-22778](https://cve.now/CVE-2025-22778.md): WordPress Lijit Search Plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, damniel Lijit Search)
- [CVE-2025-22779](https://cve.now/CVE-2025-22779.md): WordPress WP News Sliders plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 4.3, codeaffairs WP News Sliders)
- [CVE-2025-22780](https://cve.now/CVE-2025-22780.md): WordPress wp-pano Plugin \<= 1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Andrey wp-pano)
- [CVE-2025-22781](https://cve.now/CVE-2025-22781.md): WordPress Nativery Plugin plugin \<= 0.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nativery)
- [CVE-2025-22782](https://cve.now/CVE-2025-22782.md): WordPress WR Price List Manager For Woocommerce plugin \<= 1.0.8 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Web Ready Now WR Price List Manager For Woocommerce)
- [CVE-2025-22784](https://cve.now/CVE-2025-22784.md): WordPress Background Control plugin \<= 1.0.5 - CSRF to Arbitrary File Deletion vulnerability (CVSS 8.6, swedish boy Background Control)
- [CVE-2025-22785](https://cve.now/CVE-2025-22785.md): WordPress Course Booking System plugin \<= 6.0.6 - SQL Injection vulnerability (CVSS 9.3, ComMotion Course Booking System)
- [CVE-2025-22786](https://cve.now/CVE-2025-22786.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.2.6 - Local File Inclusion vulnerability (CVSS 7.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-22787](https://cve.now/CVE-2025-22787.md): WordPress Button Block plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 4.3, bPlugins Button Block)
- [CVE-2025-22788](https://cve.now/CVE-2025-22788.md): WordPress CoDesigner plugin \<= 4.29 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Codexpert CoDesigner)
- [CVE-2025-22793](https://cve.now/CVE-2025-22793.md): WordPress Bold pagos en linea Plugin \<= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bold pagos en linea)
- [CVE-2025-22795](https://cve.now/CVE-2025-22795.md): WordPress Multilang Contact Form Plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, digitaldonkey Multilang Contact Form)
- [CVE-2025-22797](https://cve.now/CVE-2025-22797.md): WordPress Gallery and Lightbox plugin \<= 1.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Oğulcan Özügenç Gallery and Lightbox)
- [CVE-2025-22798](https://cve.now/CVE-2025-22798.md): WordPress Responsive jQuery Slider plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CHR Designer Responsive jQuery Slider)
- [CVE-2025-22799](https://cve.now/CVE-2025-22799.md): WordPress Neon Product Designer Plugin \<= 2.2.0 - SQL Injection vulnerability (CVSS 8.5, vertim Neon Product Designer)
- [CVE-2024-47140](https://cve.now/CVE-2024-47140.md): A cross-site scripting (xss) vulnerability exists in the add\_alert\_check page of Observium CE 24.4.13528. (CVSS 8.7, Observium)
- [CVE-2024-47002](https://cve.now/CVE-2024-47002.md): A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. (CVSS 8.7, Observium)
- [CVE-2024-45061](https://cve.now/CVE-2024-45061.md): A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. (CVSS 8.7, Observium)
- [CVE-2024-12084](https://cve.now/CVE-2024-12084.md): Rsync: heap buffer overflow in rsync due to improper checksum length handling (CVSS 9.8, rsync · Red Hat Enterprise Linux +1)
- [CVE-2024-11322](https://cve.now/CVE-2024-11322.md): CyberPower PowerPanel Business Unauthenticated Restart DoS (CVSS 7.5, C4.yberPower PowerPanel Business)
- [CVE-2024-57857](https://cve.now/CVE-2024-57857.md): RDMA/siw: Remove direct link to net\_device (CVSS 7.8, Linux)
- [CVE-2024-57844](https://cve.now/CVE-2024-57844.md): drm/xe: Fix fault on fd close after unbind (no CVSS, Linux)
- [CVE-2024-57841](https://cve.now/CVE-2024-57841.md): net: fix memory leak in tcp\_conn\_request() (CVSS 5.5, Linux)
- [CVE-2024-57802](https://cve.now/CVE-2024-57802.md): netrom: check buffer length before accessing it (CVSS 9.4, Linux)
- [CVE-2024-57801](https://cve.now/CVE-2024-57801.md): net/mlx5e: Skip restore TC rules for vport rep without loaded flag (CVSS 7.8, Linux)
- [CVE-2024-57795](https://cve.now/CVE-2024-57795.md): RDMA/rxe: Remove the direct link to net\_device (CVSS 7.8, Linux)
- [CVE-2024-54031](https://cve.now/CVE-2024-54031.md): netfilter: nft\_set\_hash: unaligned atomic read on struct nft\_set\_ext (no CVSS, Linux)
- [CVE-2024-53681](https://cve.now/CVE-2024-53681.md): nvmet: Don't overflow subsysnqn (no CVSS, Linux)
- [CVE-2024-39282](https://cve.now/CVE-2024-39282.md): net: wwan: t7xx: Fix FSM command timeout issue (CVSS 7.8, Linux)
- [CVE-2024-36476](https://cve.now/CVE-2024-36476.md): RDMA/rtrs: Ensure 'ib\_sge list' is accessible (CVSS 9.8, Linux)
- [CVE-2025-21629](https://cve.now/CVE-2025-21629.md): net: reenable NETIF\_F\_IPV6\_CSUM offload for BIG TCP packets (CVSS 8.2, Linux)
- [CVE-2024-57903](https://cve.now/CVE-2024-57903.md): net: restrict SO\_REUSEPORT to inet sockets (no CVSS, Linux)
- [CVE-2024-57902](https://cve.now/CVE-2024-57902.md): af\_packet: fix vlan\_get\_tci() vs MSG\_PEEK (CVSS 7.3, Linux)
- [CVE-2024-57901](https://cve.now/CVE-2024-57901.md): af\_packet: fix vlan\_get\_protocol\_dgram() vs MSG\_PEEK (CVSS 7.3, Linux)
- [CVE-2024-57900](https://cve.now/CVE-2024-57900.md): ila: serialize calls to nf\_register\_net\_hooks() (CVSS 7.8, Linux)
- [CVE-2024-57899](https://cve.now/CVE-2024-57899.md): wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (CVSS 7.6, Linux)
- [CVE-2024-57898](https://cve.now/CVE-2024-57898.md): wifi: cfg80211: clear link ID from bitmap during link delete after clean up (no CVSS, Linux)
- [CVE-2024-57897](https://cve.now/CVE-2024-57897.md): drm/amdkfd: Correct the migration DMA map direction (no CVSS, Linux)
- [CVE-2024-57896](https://cve.now/CVE-2024-57896.md): btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (CVSS 7.8, Linux)
- [CVE-2024-57895](https://cve.now/CVE-2024-57895.md): ksmbd: set ATTR\_CTIME flags when setting mtime (CVSS 7.1, Linux)
- [CVE-2024-57893](https://cve.now/CVE-2024-57893.md): ALSA: seq: oss: Fix races at processing SysEx messages (CVSS 7.8, Linux)
- [CVE-2024-57892](https://cve.now/CVE-2024-57892.md): ocfs2: fix slab-use-after-free due to dangling pointer dqi\_priv (CVSS 7.8, Linux)
- [CVE-2024-57891](https://cve.now/CVE-2024-57891.md): sched\_ext: Fix invalid irq restore in scx\_ops\_bypass() (no CVSS, Linux)
- [CVE-2024-57890](https://cve.now/CVE-2024-57890.md): RDMA/uverbs: Prevent integer overflow issue (CVSS 5.5, Linux)
- [CVE-2024-57889](https://cve.now/CVE-2024-57889.md): pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (no CVSS, Linux)
- [CVE-2024-57888](https://cve.now/CVE-2024-57888.md): workqueue: Do not warn when cancelling WQ\_MEM\_RECLAIM work from !WQ\_MEM\_RECLAIM worker (no CVSS, Linux)
- [CVE-2024-57887](https://cve.now/CVE-2024-57887.md): drm: adv7511: Fix use-after-free in adv7533\_attach\_dsi() (CVSS 7.8, Linux)
- [CVE-2024-57886](https://cve.now/CVE-2024-57886.md): mm/damon/core: fix new damon\_target objects leaks on damon\_commit\_targets() (no CVSS, Linux)
- [CVE-2024-57885](https://cve.now/CVE-2024-57885.md): mm/kmemleak: fix sleeping function called from invalid context at print message (no CVSS, Linux)
- [CVE-2024-57884](https://cve.now/CVE-2024-57884.md): mm: vmscan: account for free pages to prevent infinite Loop in throttle\_direct\_reclaim() (no CVSS, Linux)
- [CVE-2024-57883](https://cve.now/CVE-2024-57883.md): mm: hugetlb: independent PMD page table shared count (CVSS 7.8, Linux)
- [CVE-2024-57882](https://cve.now/CVE-2024-57882.md): mptcp: fix TCP options overflow. (CVSS 9.8, Linux)
- [CVE-2024-5198](https://cve.now/CVE-2024-5198.md): OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the drive (CVSS 3.3, OpenVPN ovpn-dco · OpenVPN-GUI)
- [CVE-2024-11029](https://cve.now/CVE-2024-11029.md): Freeipa: administrative user data leaked through systemd journal (CVSS 5.5, freeipa · Red Hat Enterprise Linux)
- [CVE-2024-13215](https://cve.now/CVE-2024-13215.md): Elementor Addon Elements \<= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup (CVSS 4.3, wpvibes Addon Elements for Elementor)
- [CVE-2024-11851](https://cve.now/CVE-2024-11851.md): NitroPack \<= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update (CVSS 4.3, NitroPack – Performance, Page Speed & Cache Plugin for Core…)
- [CVE-2024-12593](https://cve.now/CVE-2024-12593.md): PDF for WPForms + Drag and Drop Template Builder \<= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf\_dotab Shortcode (CVSS 6.4, addonsorg PDF for WPForms + Drag and Drop Template Builder)
- [CVE-2024-11848](https://cve.now/CVE-2024-11848.md): NitroPack \<= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 8.1, NitroPack – Performance, Page Speed & Cache Plugin for Core…)
- [CVE-2025-0193](https://cve.now/CVE-2025-0193.md): Stored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 Series (CVSS 5.2, Moxa MGate 5121 Series · Moxa MGate 5122 Series +1)
- [CVE-2025-0448](https://cve.now/CVE-2025-0448.md): Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2025-0447](https://cve.now/CVE-2025-0447.md): Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation (CVSS 8.8, Google Chrome)
- [CVE-2025-0446](https://cve.now/CVE-2025-0446.md): Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage (CVSS 4.3, Google Chrome)
- [CVE-2025-0443](https://cve.now/CVE-2025-0443.md): Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage (CVSS 8.8, Google Chrome)
- [CVE-2025-0442](https://cve.now/CVE-2025-0442.md): Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in (CVSS 6.5, Google Chrome)
- [CVE-2025-0441](https://cve.now/CVE-2025-0441.md): Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensit (CVSS 6.5, Google Chrome)
- [CVE-2025-0440](https://cve.now/CVE-2025-0440.md): Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2025-0439](https://cve.now/CVE-2025-0439.md): Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to p (CVSS 6.5, Google Chrome)
- [CVE-2025-0438](https://cve.now/CVE-2025-0438.md): Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption v (CVSS 8.8, Google Chrome)
- [CVE-2025-0437](https://cve.now/CVE-2025-0437.md): Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 6.5, Google Chrome)
- [CVE-2025-0436](https://cve.now/CVE-2025-0436.md): Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2025-0435](https://cve.now/CVE-2025-0435.md): Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2025-0434](https://cve.now/CVE-2025-0434.md): Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, Google Chrome)
- [CVE-2024-35280](https://cve.now/CVE-2024-35280.md): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiD (CVSS 5.1, Fortinet FortiDeceptor)
- [CVE-2024-12297](https://cve.now/CVE-2024-12297.md): Frontend Authorization Logic Disclosure Vulnerability (CVSS 9.2, Moxa EDS-508A Series · Moxa PT-508 Series +8)
- [CVE-2024-13351](https://cve.now/CVE-2024-13351.md): Social proof testimonials and reviews by Repuso \<= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 7.2, neran Reviews Widgets for Google & 45+ platforms by Repuso)
- [CVE-2024-12818](https://cve.now/CVE-2024-12818.md): WP Smart TV \<= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, robdavenport WP Smart TV)
- [CVE-2024-12403](https://cve.now/CVE-2024-12403.md): Image Gallery – Responsive Photo Gallery \<= 1.0.5 - Reflected Cross-Site Scripting (CVSS 6.1, realwebcare Awesome Responsive Photo Gallery – Image & Vide…)
- [CVE-2024-12423](https://cve.now/CVE-2024-12423.md): Contact Form 7 Redirect & Thank You Page \<= 1.0.7 - Reflected Cross-Site Scripting (CVSS 6.1, scottpaterson Business Essentials for Contact Form)
- [CVE-2024-10775](https://cve.now/CVE-2024-10775.md): Piotnet Addons For Elementor \<= 2.4.32 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2024-9636](https://cve.now/CVE-2024-9636.md): Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation (CVSS 9.8, pickplugins Post Grid and Gutenberg Blocks – ComboBlocks)
- [CVE-2024-4227](https://cve.now/CVE-2024-4227.md): gSOAP: Vulnerable to specially crafted unencrypted SDC messages (CVSS 7.5, Genivia gSOAP)
- [CVE-2024-7322](https://cve.now/CVE-2024-7322.md): Dos in ZigBee device due to unsolicited encrypted rejoin response (CVSS 5.8, silabs.com EmberZNet)
- [CVE-2025-0356](https://cve.now/CVE-2025-0356.md): NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands v (CVSS 7.2, NEC WX1500HP · NEC WX3600HP)
- [CVE-2025-0355](https://cve.now/CVE-2025-0355.md): Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and (CVSS 7.5, NEC WG2600HS · NEC WF1200CR +7)
- [CVE-2025-0354](https://cve.now/CVE-2025-0354.md): Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1 (CVSS 4.8, NEC WG2600HS · NEC WG2600HP4 +4)
- [CVE-2024-11870](https://cve.now/CVE-2024-11870.md): Event Registration Calendar By vcita \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Event Registration Calendar By vcita)
- [CVE-2024-13394](https://cve.now/CVE-2024-13394.md): ViewMedica 9 \<= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, swarminteractive ViewMedica)
- [CVE-2024-55577](https://cve.now/CVE-2024-55577.md): Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. (CVSS 7.0, The Dimensional Gate Linux Ratfor)
- [CVE-2025-22394](https://cve.now/CVE-2025-22394.md): Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. (CVSS 6.7, Dell Display Manager)
- [CVE-2025-21101](https://cve.now/CVE-2025-21101.md): Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. (CVSS 6.6, Dell Display Manager)
- [CVE-2024-13334](https://cve.now/CVE-2024-13334.md): Car Demon \<= 1.8.1 - Reflected Cross-Site Scripting (CVSS 6.1, theverylastperson Car Demon)
- [CVE-2025-0343](https://cve.now/CVE-2025-0343.md): Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. (CVSS 7.5, Swift Project Swift ASN1)
- [CVE-2024-36751](https://cve.now/CVE-2024-36751.md): An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. (CVSS 6.5, parse-uri · parseuri)
- [CVE-2024-39967](https://cve.now/CVE-2024-39967.md): Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command. (CVSS 6.5)
- [CVE-2024-41453](https://cve.now/CVE-2024-41453.md): A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or H (CVSS 4.8)
- [CVE-2024-41454](https://cve.now/CVE-2024-41454.md): An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers (CVSS 6.5)
- [CVE-2024-48121](https://cve.now/CVE-2024-48121.md): The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. (CVSS 6.5)
- [CVE-2024-48122](https://cve.now/CVE-2024-48122.md): Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to ro (CVSS 6.7)
- [CVE-2024-48123](https://cve.now/CVE-2024-48123.md): An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted s (CVSS 8.4)
- [CVE-2024-48125](https://cve.now/CVE-2024-48125.md): An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol req (CVSS 7.5)
- [CVE-2024-48126](https://cve.now/CVE-2024-48126.md): HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access. (CVSS 9.8)
- [CVE-2024-50953](https://cve.now/CVE-2024-50953.md): An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. (CVSS 7.5)
- [CVE-2024-50954](https://cve.now/CVE-2024-50954.md): The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. (CVSS 7.5)
- [CVE-2024-52783](https://cve.now/CVE-2024-52783.md): Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via (CVSS 5.1)
- [CVE-2024-53407](https://cve.now/CVE-2024-53407.md): In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote cont (CVSS 3.3)
- [CVE-2024-55503](https://cve.now/CVE-2024-55503.md): An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD\_INSERT\_LIBRARIES compo (CVSS 3.3)
- [CVE-2024-57011](https://cve.now/CVE-2024-57011.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setSc (CVSS 8.8)
- [CVE-2024-57012](https://cve.now/CVE-2024-57012.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setSched (CVSS 8.8)
- [CVE-2024-57013](https://cve.now/CVE-2024-57013.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setSch (CVSS 8.8)
- [CVE-2024-57014](https://cve.now/CVE-2024-57014.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setSc (CVSS 7.8)
- [CVE-2024-57015](https://cve.now/CVE-2024-57015.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setSched (CVSS 8.8)
- [CVE-2024-57016](https://cve.now/CVE-2024-57016.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAc (CVSS 8.8)
- [CVE-2024-57017](https://cve.now/CVE-2024-57017.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAc (CVSS 8.8)
- [CVE-2024-57018](https://cve.now/CVE-2024-57018.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAc (CVSS 8.8)
- [CVE-2024-57019](https://cve.now/CVE-2024-57019.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnA (CVSS 8.8)
- [CVE-2024-57020](https://cve.now/CVE-2024-57020.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWi (CVSS 8.8)
- [CVE-2024-57021](https://cve.now/CVE-2024-57021.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFi (CVSS 8.8)
- [CVE-2024-57022](https://cve.now/CVE-2024-57022.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFi (CVSS 8.8)
- [CVE-2024-57023](https://cve.now/CVE-2024-57023.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiS (CVSS 6.8)
- [CVE-2024-57024](https://cve.now/CVE-2024-57024.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWi (CVSS 6.8)
- [CVE-2024-57025](https://cve.now/CVE-2024-57025.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiS (CVSS 6.8)
- [CVE-2024-57726](https://cve.now/CVE-2024-57726.md): SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce (CVSS 9.9, KEV)
- [CVE-2024-57727](https://cve.now/CVE-2024-57727.md): SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re (CVSS 9.1, KEV)
- [CVE-2024-57728](https://cve.now/CVE-2024-57728.md): SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a (CVSS 7.2, KEV)
- [CVE-2025-22964](https://cve.now/CVE-2025-22964.md): DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inp (CVSS 8.1)
- [CVE-2025-22968](https://cve.now/CVE-2025-22968.md): An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions (CVSS 9.8)
- [CVE-2025-22976](https://cve.now/CVE-2025-22976.md): SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly (CVSS 7.1)
- [CVE-2025-23013](https://cve.now/CVE-2025-23013.md): In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. (CVSS 7.3, Yubico pam-u2f)
- [CVE-2025-23061](https://cve.now/CVE-2025-23061.md): Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. (CVSS 9.0, mongoosejs Mongoose · mongoose)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.