CVEs published January 21, 2025
283 CVEs were published on January 21, 2025: 26 critical, 94 high.
- Published
- 283
- Critical
- 26
- High
- 94
- Medium
- 150
- Low
- 3
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 57
Most affected products
- Oracle MySQL Server
- 26
- Linux
- 25
- Google Android
- 23
- Oracle JD Edwards EnterpriseOne Tools
- 14
- reputeinfosystems ARPrice
- 5
- Oracle Agile PLM Framework
- 4
- Oracle MySQL Cluster · Oracle MySQL Server
- 4
- Apache Software Foundation Apache Ambari
- 3
- JetBrains TeamCity
- 3
- NotFound Hero Mega Menu - Responsive WordPress Menu Plugin
- 3
Critical 26
- CVE-2024-13091WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File UploadQuantumCloud WPBot Pro Wordpress Chatbot
- CVE-2024-49748In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2024-49747In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the code.Google Android
- CVE-2024-45479Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhostApache Software Foundation Apache Ranger · org.apache.range…
- CVE-2025-21556Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services).Oracle Agile PLM Framework
- CVE-2025-21547Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).Oracle Hospitality OPERA
- CVE-2025-21535Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2025-21524Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-24024Mjolnir v1.9.0 accepts commands from any roommatrix-org mjolnir
- CVE-2025-22723WordPress Barcode Scanner and Inventory manager plugin <= 1.6.7 - Arbitrary File Upload vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…
- CVE-2024-32555WordPress Easy Real Estate plugin <= 2.2.6 - Privilege Escalation vulnerabilityInspiryThemes Easy Real Estate
- CVE-2025-22553WordPress Multiple Carousel Plugin <= 2.0 - SQL Injection vulnerabilitydhananjaysingh Multiple Carousel
- CVE-2024-51919WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerabilityradykal Fancy Product Designer
- CVE-2024-51888WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerabilityfavethemes Homey Login Register
- CVE-2024-51818WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerabilityradykal Fancy Product Designer
- CVE-2024-49688WordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerabilityreputeinfosystems ARPrice
- CVE-2024-49655WordPress ARPrice plugin <= 4.1.3 - Unauthenticated SQL Injection vulnerabilityreputeinfosystems ARPrice
- CVE-2025-21663net: stmmac: dwmac-tegra: Read iommu stream id from device treeLinux
- CVE-2024-57936RDMA/bnxt_re: Fix max SGEs for the Work RequestLinux
- CVE-2024-57932gve: guard XDP xmit NDO on existence of xdp queuesLinux
- CVE-2023-27112pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php.
- CVE-2023-27113pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php.
- CVE-2024-24421A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows
- CVE-2024-42936The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modifi
- CVE-2024-54794The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.
- CVE-2024-55959Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
High 94
- CVE-2024-49749In DGifSlurp of dgif_lib.c, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2024-49745In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2024-49744In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsaGoogle Android
- CVE-2024-49742In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings dueGoogle Android
- CVE-2024-49738In writeInplace of Parcel.cpp, there is a possible out of bounds write.Google Android
- CVE-2024-49737In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID duGoogle Android
- CVE-2024-49735In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion.Google Android
- CVE-2024-49734In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to tGoogle Android
- CVE-2024-49732In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missGoogle Android
- CVE-2024-49724In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a Google Android
- CVE-2024-43771In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-43770In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-43765In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack.Google Android
- CVE-2024-43096In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-43095In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code.Google Android
- CVE-2024-34730In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code.Google Android
- CVE-2023-40132In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missinGoogle Android
- CVE-2023-50733A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices.
- CVE-2024-51941Apache Ambari: Remote Code Injection in Ambari Metrics and AMS AlertsApache Software Foundation Apache Ambari
- CVE-2025-23196Apache Ambari: Code Injection Vulnerability in Ambari Alert DefinitionApache Software Foundation Apache Ambari
- CVE-2025-23195Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/OozieApache Software Foundation Apache Ambari
- CVE-2025-21571Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-21565Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install).Oracle Agile PLM Framework
- CVE-2025-21564Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services).Oracle Agile PLM Framework
- CVE-2025-21549Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2025-21545Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-21532Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install).Oracle Analytics Desktop
- CVE-2025-21521Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).Oracle MySQL Server
- CVE-2025-21516Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests).Oracle Customer Care
- CVE-2025-21515Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21511Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21510Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21506Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation).Oracle Project Foundation
- CVE-2025-23369Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper ValidationGitHub Enterprise Server
- CVE-2025-24019YesWiki vulnerable to authenticated arbitrary file deletionyeswiki · yeswiki/yeswiki
- CVE-2025-24458In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationJetBrains YouTrack
- CVE-2025-23994WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerabilityEstatebud – Properties & Listings
- CVE-2025-23580WordPress BizLibrary plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMatthew BizLibrary
- CVE-2025-23551WordPress SexBundle plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityrazvypp SexBundle
- CVE-2025-23489WordPress WP-Announcements plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityBrian Messenlehner WP-Announcements
- CVE-2025-23477WordPress Realty Workstation plugin <= 1.0.45 - Broken Access Control vulnerabilityrealtyworkstation Realty Workstation
- CVE-2025-23461WordPress Social2Blog plugin <= 0.2.990 - Reflected Cross Site Scripting (XSS) vulnerabilityxkollsoftware Social2Blog
- CVE-2025-23454WordPress Nature FlipBook WordPress Plugin plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityflashmaniac Nature FlipBook
- CVE-2025-24018YesWiki Vulnerable to Authenticated Stored XSSyeswiki · yeswiki/yeswiki
- CVE-2025-24017YesWiki Vulnerable to Unauthenticated DOM Based XSSyeswiki · yeswiki/yeswiki
- CVE-2025-0377HashiCorp go-slug Vulnerable to Zip Slip AttackHashiCorp Shared library · github.com/hashicorp/go-slug
- CVE-2024-53829Cross-Site Request Forgery in CodeChecker APIEricsson CodeChecker · codechecker
- CVE-2025-24001WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerabilityNgô Thắng IT PPO Call To Actions
- CVE-2025-23998WordPress UltraLight theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityraratheme UltraLight
- CVE-2025-22733WordPress My auctions allegro Plugin <= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerabilitywphocus My auctions allegro
- CVE-2025-22719WordPress VikAppointments Services Booking Calendar plugin <= 1.2.16 - CSRF to Stored XSS vulnerabilitye4jvikwp VikAppointments Services Booking Calendar
- CVE-2025-22717WordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerabilityJoe Dolson My Tickets
- CVE-2025-22716WordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerabilityTaskbuilder
- CVE-2025-22711WordPress Image Source Control Lite Plugin <= 2.29.0 - Reflected Cross Site Scripting (XSS) vulnerabilityThomas Maier Image Source Control
- CVE-2025-22710WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerabilitystoreapps Smart Manager
- CVE-2025-22709WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySoft8Soft Verge3D
- CVE-2025-22706WordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityiova.mihai Social Pug: Author Box
- CVE-2025-22763WordPress Brizy Pro Plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNotFound Brizy Pro
- CVE-2025-22735WordPress Tag Cloud Plugin - Tag Groups plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilitySteve Burge WordPress Tag Cloud Plugin – Tag Groups
- CVE-2025-22322WordPress Private Messages for UserPro plugin <= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDeluxeThemes Private Messages for UserPro
- CVE-2025-22318WordPress Standard Box Sizes plugin <= 1.6.13 - Broken Access Control vulnerabilityenituretechnology Standard Box Sizes – for WooCommerce
- CVE-2025-22311WordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerabilityDeluxeThemes Private Messages for UserPro
- CVE-2024-49700WordPress ARPrice plugin <= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityreputeinfosystems ARPrice
- CVE-2024-49699WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerabilityreputeinfosystems ARPrice
- CVE-2024-49666WordPress ARPrice plugin <= 4.1.3 - SQL Injection vulnerabilityreputeinfosystems ARPrice
- CVE-2024-49333WordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerabilityNotFound Hero Mega Menu - Responsive WordPress Menu Plugin
- CVE-2024-49303WordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerabilityNotFound Hero Mega Menu - Responsive WordPress Menu Plugin
- CVE-2024-49300WordPress Hero Menu plugin <= 1.16.5 - Cross Site Scripting (XSS) vulnerabilityNotFound Hero Mega Menu - Responsive WordPress Menu Plugin
- CVE-2025-21664dm thin: make get_first_thin use rcu-safe list first functionLinux
- CVE-2025-21661gpio: virtuser: fix missing lookup table cleanupsLinux
- CVE-2025-21659netdev: prevent accessing NAPI instances from another namespaceLinux
- CVE-2024-57945riscv: mm: Fix the out of bound issue of vmemmap addressLinux
- CVE-2024-57943exfat: fix the new buffer was not zeroed before writingLinux
- CVE-2024-10936String Locator <= 2.6.6 - Unauthenticated PHP Object Injectioninstawp String locator
- CVE-2023-37024A reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90f
- CVE-2023-37029Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an
- CVE-2023-37032A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5
- CVE-2024-24416The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf
- CVE-2024-24417The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf
- CVE-2024-24418The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf
- CVE-2024-24419The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf
- CVE-2024-24420A reachable assertion in the decode_linked_ti_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)
- CVE-2024-24422The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a stack overfl
- CVE-2024-24423The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf
- CVE-2024-24424A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2
- CVE-2024-24427A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2024-24428A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2024-24442A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers
- CVE-2024-24444Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause
- CVE-2024-24451A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker
- CVE-2024-57036TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function.
- CVE-2024-57536Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status.
- CVE-2024-57539Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.
- CVE-2024-57542Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn.
Medium, low and unrated 163
- CVE-2024-49736In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the codGoogle Android
- CVE-2024-49733In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in theGoogle Android
- CVE-2024-43763In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code.Google Android
- CVE-2023-40108In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check.Google Android
- CVE-2024-45478Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user inputApache Software Foundation Apache Ranger · org.apache.range…
- CVE-2025-21570Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login).Oracle Life Sciences Argus Safety
- CVE-2025-21569Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services).Oracle Hyperion Data Relationship Management
- CVE-2025-21568Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security).Oracle Hyperion Data Relationship Management
- CVE-2025-21567Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21566Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21563Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management).Oracle PeopleSoft Enterprise CC Common Application Objects
- CVE-2025-21562Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management).Oracle PeopleSoft Enterprise CC Common Application Objects
- CVE-2025-21561Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).Oracle PeopleSoft Enterprise SCM Purchasing
- CVE-2025-21560Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit).Oracle Agile PLM Framework
- CVE-2025-21559Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21558Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web AccOracle Primavera P6 Enterprise Project Portfolio Management
- CVE-2025-21557Vulnerability in Oracle Application Express (component: General).Oracle Application Express
- CVE-2025-21555Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21554Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).Oracle Communications Order and Service Management
- CVE-2025-21553Vulnerability in the Java VM component of Oracle Database Server.Oracle Database Server
- CVE-2025-21552Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).Oracle JD Edwards EnterpriseOne Orchestrator
- CVE-2025-21551Vulnerability in the Oracle Solaris product of Oracle Systems (component: File system).Oracle Solaris
- CVE-2025-21550Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: WebOracle Financial Services Behavior Detection Platform
- CVE-2025-21548Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).Oracle MySQL Connectors
- CVE-2025-21546Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21544Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).Oracle Communications Order and Service Management
- CVE-2025-21543Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21542Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).Oracle Communications Order and Service Management
- CVE-2025-21541Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI).Oracle Workflow
- CVE-2025-21540Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21539Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements).Oracle PeopleSoft Enterprise FIN eSettlements
- CVE-2025-21538Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21537Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management).Oracle PeopleSoft Enterprise FIN Cash Management
- CVE-2025-21536Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21534Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema).Oracle MySQL Server
- CVE-2025-21533Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-21531Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21530Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-21529Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).Oracle MySQL Server
- CVE-2025-21528Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web AccOracle Primavera P6 Enterprise Project Portfolio Management
- CVE-2025-21527Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21526Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web AccOracle Primavera P6 Enterprise Project Portfolio Management
- CVE-2025-21525Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2025-21523Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21522Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).Oracle MySQL Server
- CVE-2025-21520Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21519Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21518Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21517Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21514Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21513Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21512Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21509Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21508Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21507Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21505Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).Oracle MySQL Server
- CVE-2025-21504Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21503Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21502Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotOracle Java SE
- CVE-2025-21501Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21500Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21499Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2025-21498Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core).Oracle HTTP Server
- CVE-2025-21497Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21495Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall).Oracle MySQL Enterprise Firewall
- CVE-2025-21494Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21493Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).Oracle MySQL Server
- CVE-2025-21492Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21491Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21490Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21489Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping).Oracle Advanced Outbound Telephony
- CVE-2024-21245Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-24020WeGIA Open Redirect vulnerabilityLabRedesCefetRJ WeGIA
- CVE-2025-22150Undici Uses Insufficiently Random Valuesnodejs undici · undici
- CVE-2025-24461In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpointJetBrains TeamCity
- CVE-2025-24460In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent poolJetBrains TeamCity
- CVE-2025-24459In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageJetBrains TeamCity
- CVE-2025-24457In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsJetBrains YouTrack
- CVE-2025-24456In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mappingJetBrains Hub
- CVE-2025-23996WordPress AnyRoad plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerabilityAnyRoad
- CVE-2025-22722WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerabilityMarketing Fire Widget Options
- CVE-2025-22721WordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerabilityFarhan Noor ApplyOnline
- CVE-2025-22661WordPress Online Payments plugin <= 3.20.0 - Cross Site Scripting (XSS) vulnerabilityvcita Online Payments – Get Paid with PayPal, Square & Stri…
- CVE-2025-22276WordPress Related Post Shortcode Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityenguerranws Related Post Shortcode
- CVE-2025-22267WordPress Weaver Themes Shortcode Compatibility Plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilitywpweaver Weaver Themes Shortcode Compatibility
- CVE-2024-45687HTTP Server incorrectly accepting disallowed characters within header valuesPayara Platform Payara Server · Payara Platform Payara Micro
- CVE-2025-24012Umbraco Backoffice Components Have XSS/HTML Injection VulnerabilityUmbraco-CMS · Umbraco.Cms.StaticAssets +1
- CVE-2025-24011Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesUmbraco-CMS · Umbraco.Cms
- CVE-2025-23997WordPress Tamara Checkout plugin < 1.9.9.1 - Cross Site Scripting (XSS) vulnerabilityTamara Solution Tamara Checkout
- CVE-2025-22825WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerabilitywpdesk Flexible PDF Coupons
- CVE-2025-22732WordPress Ad Blocking Detector plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityAdmiral Ad Blocking Detector
- CVE-2025-22727WordPress MailChimp Subscribe Form plugin <= 4.1 - Cross Site Scripting (XSS) vulnerabilityPluginOps MailChimp Subscribe Forms
- CVE-2025-22718WordPress FAT Event Lite plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityroninwp FAT Event Lite
- CVE-2025-22262WordPress Bonjour Bar plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityWittyFolk Bonjour Bar
- CVE-2024-56277WordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerabilityAys Pro Poll Maker
- CVE-2024-57946virtio-blk: don't keep queue frozen during system suspendLinux
- CVE-2025-21662net/mlx5: Fix variable not being completed when function returnsLinux
- CVE-2025-21660ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_lockedLinux
- CVE-2025-21658btrfs: avoid NULL pointer dereference if no valid extent treeLinux
- CVE-2025-21657sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()Linux
- CVE-2025-21656hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occurLinux
- CVE-2024-57944iio: adc: ti-ads1298: Add NULL check in ads1298_initLinux
- CVE-2024-57942netfs: Fix ceph copy to cache on write-beginLinux
- CVE-2024-57941netfs: Fix the (non-)cancellation of copy when cache is temporarily disabledLinux
- CVE-2024-57940exfat: fix the infinite loop in exfat_readdir()Linux
- CVE-2024-57939riscv: Fix sleeping in invalid context in die()Linux
- CVE-2024-57938net/sctp: Prevent autoclose integer overflow in sctp_association_init()Linux
- CVE-2024-57935RDMA/hns: Fix accessing invalid dip_ctx during destroying QPLinux
- CVE-2024-57934fgraph: Add READ_ONCE() when accessing fgraph_array[]Linux
- CVE-2024-57933gve: guard XSK operations on the existence of queuesLinux
- CVE-2024-57931selinux: ignore unknown extended permissionsLinux
- CVE-2024-57930tracing: Have process_string() also allow arraysLinux
- CVE-2025-0615Input validation vulnerability in Qualifio's Wheel of FortuneQualifio Wheel of fortune
- CVE-2025-0614Input validation vulnerability in Qualifio's Wheel of FortuneQualifio Wheel of fortune
- CVE-2024-13444wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingtuxlog wp-greet
- CVE-2024-11226FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameteralexmoss FireCask Like & Share Button
- CVE-2024-13230Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'the_champ Social Share, Social Login and Social Comments Pl…
- CVE-2025-0450Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSMuffinGroup Betheme
- CVE-2024-52973Kibana allocation of resources without limits or throttling leads to crashElastic Kibana
- CVE-2024-43709Elasticsearch allocation of resources without limits or throttling leads to crashElasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-37284Elastic Defend Improper Handling of Alternate Encoding Leads to CrashElastic Defend
- CVE-2024-6466NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FNEC WebSAM DeploymentManager
- CVE-2025-23184Apache CXF: Denial of Service vulnerability with temporary filesApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2024-13404Link Library <= 7.7.2 - Reflected Cross-Site Scriptingjackdewey Link Library
- CVE-2024-12104Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletionwpfeedback Atarim – Visual Feedback, Review & AI Collaborat…
- CVE-2024-12005WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scriptingzjhzxhz WP-BibTeX
- CVE-2025-0371Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsCrocoblock JetElements
- CVE-2025-23086On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector Brave Desktop Browser
- CVE-2024-135361003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure8blocks 1003 Mortgage Application
- CVE-2024-45091IBM UrbanCode Deploy information disclosureIBM UrbanCode Deploy
- CVE-2023-37025A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37026A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37027Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5
- CVE-2023-37028A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37030A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37031A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37033A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37034A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37035A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37036A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37037A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37038A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-37039A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95
- CVE-2023-45908Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.
- CVE-2024-24443An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-a
- CVE-2024-24445OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which al
- CVE-2024-48392OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-51417An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.System.Linq.Dynamic.Core
- CVE-2024-54792A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel.
- CVE-2024-54795SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer functi
- CVE-2024-55504An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote co
- CVE-2024-55958Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS.
- CVE-2024-56990PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php.
- CVE-2024-56997PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter.
- CVE-2024-56998PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address.
- CVE-2024-57360https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control.
- CVE-2024-57537Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57538Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57540Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57541Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57543Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57544Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.
- CVE-2024-57545Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability.