# CVEs published 2025-01-21

283 CVEs were published on January 21, 2025: 26 critical, 94 high. Days are UTC.

- [CVE-2024-13091](https://cve.now/CVE-2024-13091.md): WPBot Pro Wordpress Chatbot \<= 13.5.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8, QuantumCloud WPBot Pro Wordpress Chatbot)
- [CVE-2024-49749](https://cve.now/CVE-2024-49749.md): In DGifSlurp of dgif\_lib.c, there is a possible out of bounds write due to an integer overflow. (CVSS 8.8, Google Android)
- [CVE-2024-49748](https://cve.now/CVE-2024-49748.md): In gatts\_process\_primary\_service\_req of gatt\_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 9.8, Google Android)
- [CVE-2024-49747](https://cve.now/CVE-2024-49747.md): In gatts\_process\_read\_by\_type\_req of gatt\_sr.cc, there is a possible out of bounds write due to a logic error in the code. (CVSS 9.8, Google Android)
- [CVE-2024-49745](https://cve.now/CVE-2024-49745.md): In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-49744](https://cve.now/CVE-2024-49744.md): In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsa (CVSS 7.8, Google Android)
- [CVE-2024-49742](https://cve.now/CVE-2024-49742.md): In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due (CVSS 7.8, Google Android)
- [CVE-2024-49738](https://cve.now/CVE-2024-49738.md): In writeInplace of Parcel.cpp, there is a possible out of bounds write. (CVSS 7.8, Google Android)
- [CVE-2024-49737](https://cve.now/CVE-2024-49737.md): In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID du (CVSS 7.8, Google Android)
- [CVE-2024-49736](https://cve.now/CVE-2024-49736.md): In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the cod (CVSS 5.5, Google Android)
- [CVE-2024-49735](https://cve.now/CVE-2024-49735.md): In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Google Android)
- [CVE-2024-49734](https://cve.now/CVE-2024-49734.md): In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to t (CVSS 7.5, Google Android)
- [CVE-2024-49733](https://cve.now/CVE-2024-49733.md): In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the (CVSS 5.5, Google Android)
- [CVE-2024-49732](https://cve.now/CVE-2024-49732.md): In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a miss (CVSS 7.8, Google Android)
- [CVE-2024-49724](https://cve.now/CVE-2024-49724.md): In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a (CVSS 7.0, Google Android)
- [CVE-2024-43771](https://cve.now/CVE-2024-43771.md): In gatts\_process\_read\_req of gatt\_sr.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2024-43770](https://cve.now/CVE-2024-43770.md): In gatts\_process\_find\_info of gatt\_sr.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2024-43765](https://cve.now/CVE-2024-43765.md): In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2024-43763](https://cve.now/CVE-2024-43763.md): In build\_read\_multi\_rsp of gatt\_sr.cc, there is a possible denial of service due to a logic error in the code. (CVSS 6.5, Google Android)
- [CVE-2024-43096](https://cve.now/CVE-2024-43096.md): In build\_read\_multi\_rsp of gatt\_sr.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2024-43095](https://cve.now/CVE-2024-43095.md): In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-34730](https://cve.now/CVE-2024-34730.md): In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2023-40132](https://cve.now/CVE-2023-40132.md): In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missin (CVSS 7.8, Google Android)
- [CVE-2023-40108](https://cve.now/CVE-2023-40108.md): In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2023-50733](https://cve.now/CVE-2023-50733.md): A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices. (CVSS 8.6)
- [CVE-2024-45479](https://cve.now/CVE-2024-45479.md): Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost (CVSS 9.1, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2024-45478](https://cve.now/CVE-2024-45478.md): Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input (CVSS 4.8, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2024-51941](https://cve.now/CVE-2024-51941.md): Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts (CVSS 8.8, Apache Software Foundation Apache Ambari)
- [CVE-2025-23196](https://cve.now/CVE-2025-23196.md): Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition (CVSS 8.8, Apache Software Foundation Apache Ambari)
- [CVE-2025-23195](https://cve.now/CVE-2025-23195.md): Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie (CVSS 7.5, Apache Software Foundation Apache Ambari)
- [CVE-2025-21571](https://cve.now/CVE-2025-21571.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.3, Oracle VM VirtualBox)
- [CVE-2025-21570](https://cve.now/CVE-2025-21570.md): Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). (CVSS 6.1, Oracle Life Sciences Argus Safety)
- [CVE-2025-21569](https://cve.now/CVE-2025-21569.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). (CVSS 6.6, Oracle Hyperion Data Relationship Management)
- [CVE-2025-21568](https://cve.now/CVE-2025-21568.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). (CVSS 4.5, Oracle Hyperion Data Relationship Management)
- [CVE-2025-21567](https://cve.now/CVE-2025-21567.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.3, Oracle MySQL Server)
- [CVE-2025-21566](https://cve.now/CVE-2025-21566.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-21565](https://cve.now/CVE-2025-21565.md): Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). (CVSS 7.5, Oracle Agile PLM Framework)
- [CVE-2025-21564](https://cve.now/CVE-2025-21564.md): Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). (CVSS 8.1, Oracle Agile PLM Framework)
- [CVE-2025-21563](https://cve.now/CVE-2025-21563.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). (CVSS 4.3, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2025-21562](https://cve.now/CVE-2025-21562.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). (CVSS 4.3, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2025-21561](https://cve.now/CVE-2025-21561.md): Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). (CVSS 5.4, Oracle PeopleSoft Enterprise SCM Purchasing)
- [CVE-2025-21560](https://cve.now/CVE-2025-21560.md): Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). (CVSS 6.5, Oracle Agile PLM Framework)
- [CVE-2025-21559](https://cve.now/CVE-2025-21559.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-21558](https://cve.now/CVE-2025-21558.md): Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc (CVSS 5.4, Oracle Primavera P6 Enterprise Project Portfolio Management)
- [CVE-2025-21557](https://cve.now/CVE-2025-21557.md): Vulnerability in Oracle Application Express (component: General). (CVSS 5.4, Oracle Application Express)
- [CVE-2025-21556](https://cve.now/CVE-2025-21556.md): Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). (CVSS 9.9, Oracle Agile PLM Framework)
- [CVE-2025-21555](https://cve.now/CVE-2025-21555.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-21554](https://cve.now/CVE-2025-21554.md): Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). (CVSS 5.3, Oracle Communications Order and Service Management)
- [CVE-2025-21553](https://cve.now/CVE-2025-21553.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 4.2, Oracle Database Server)
- [CVE-2025-21552](https://cve.now/CVE-2025-21552.md): Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Orchestrator)
- [CVE-2025-21551](https://cve.now/CVE-2025-21551.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: File system). (CVSS 6.0, Oracle Solaris)
- [CVE-2025-21550](https://cve.now/CVE-2025-21550.md): Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web (CVSS 6.1, Oracle Financial Services Behavior Detection Platform)
- [CVE-2025-21549](https://cve.now/CVE-2025-21549.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2025-21548](https://cve.now/CVE-2025-21548.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (CVSS 6.4, Oracle MySQL Connectors)
- [CVE-2025-21547](https://cve.now/CVE-2025-21547.md): Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). (CVSS 9.1, Oracle Hospitality OPERA)
- [CVE-2025-21546](https://cve.now/CVE-2025-21546.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 3.8, Oracle MySQL Server)
- [CVE-2025-21545](https://cve.now/CVE-2025-21545.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). (CVSS 7.5, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-21544](https://cve.now/CVE-2025-21544.md): Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). (CVSS 5.4, Oracle Communications Order and Service Management)
- [CVE-2025-21543](https://cve.now/CVE-2025-21543.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21542](https://cve.now/CVE-2025-21542.md): Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). (CVSS 6.3, Oracle Communications Order and Service Management)
- [CVE-2025-21541](https://cve.now/CVE-2025-21541.md): Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). (CVSS 5.4, Oracle Workflow)
- [CVE-2025-21540](https://cve.now/CVE-2025-21540.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 5.4, Oracle MySQL Server)
- [CVE-2025-21539](https://cve.now/CVE-2025-21539.md): Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). (CVSS 5.4, Oracle PeopleSoft Enterprise FIN eSettlements)
- [CVE-2025-21538](https://cve.now/CVE-2025-21538.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21537](https://cve.now/CVE-2025-21537.md): Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). (CVSS 5.4, Oracle PeopleSoft Enterprise FIN Cash Management)
- [CVE-2025-21536](https://cve.now/CVE-2025-21536.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21535](https://cve.now/CVE-2025-21535.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2025-21534](https://cve.now/CVE-2025-21534.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21533](https://cve.now/CVE-2025-21533.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.5, Oracle VM VirtualBox)
- [CVE-2025-21532](https://cve.now/CVE-2025-21532.md): Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). (CVSS 7.8, Oracle Analytics Desktop)
- [CVE-2025-21531](https://cve.now/CVE-2025-21531.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21530](https://cve.now/CVE-2025-21530.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). (CVSS 4.3, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-21529](https://cve.now/CVE-2025-21529.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21528](https://cve.now/CVE-2025-21528.md): Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc (CVSS 4.3, Oracle Primavera P6 Enterprise Project Portfolio Management)
- [CVE-2025-21527](https://cve.now/CVE-2025-21527.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21526](https://cve.now/CVE-2025-21526.md): Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc (CVSS 5.4, Oracle Primavera P6 Enterprise Project Portfolio Management)
- [CVE-2025-21525](https://cve.now/CVE-2025-21525.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21524](https://cve.now/CVE-2025-21524.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21523](https://cve.now/CVE-2025-21523.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21522](https://cve.now/CVE-2025-21522.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-21521](https://cve.now/CVE-2025-21521.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 7.5, Oracle MySQL Server)
- [CVE-2025-21520](https://cve.now/CVE-2025-21520.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). (CVSS 1.8, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21519](https://cve.now/CVE-2025-21519.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2025-21518](https://cve.now/CVE-2025-21518.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21517](https://cve.now/CVE-2025-21517.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 4.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21516](https://cve.now/CVE-2025-21516.md): Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). (CVSS 8.1, Oracle Customer Care)
- [CVE-2025-21515](https://cve.now/CVE-2025-21515.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 8.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21514](https://cve.now/CVE-2025-21514.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21513](https://cve.now/CVE-2025-21513.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21512](https://cve.now/CVE-2025-21512.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21511](https://cve.now/CVE-2025-21511.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 7.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21510](https://cve.now/CVE-2025-21510.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 7.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21509](https://cve.now/CVE-2025-21509.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21508](https://cve.now/CVE-2025-21508.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21507](https://cve.now/CVE-2025-21507.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21506](https://cve.now/CVE-2025-21506.md): Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). (CVSS 8.1, Oracle Project Foundation)
- [CVE-2025-21505](https://cve.now/CVE-2025-21505.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21504](https://cve.now/CVE-2025-21504.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21503](https://cve.now/CVE-2025-21503.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21502](https://cve.now/CVE-2025-21502.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 4.8, Oracle Java SE)
- [CVE-2025-21501](https://cve.now/CVE-2025-21501.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-21500](https://cve.now/CVE-2025-21500.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-21499](https://cve.now/CVE-2025-21499.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21498](https://cve.now/CVE-2025-21498.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). (CVSS 5.3, Oracle HTTP Server)
- [CVE-2025-21497](https://cve.now/CVE-2025-21497.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-21495](https://cve.now/CVE-2025-21495.md): Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). (CVSS 4.4, Oracle MySQL Enterprise Firewall)
- [CVE-2025-21494](https://cve.now/CVE-2025-21494.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.1, Oracle MySQL Server)
- [CVE-2025-21493](https://cve.now/CVE-2025-21493.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2025-21492](https://cve.now/CVE-2025-21492.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21491](https://cve.now/CVE-2025-21491.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21490](https://cve.now/CVE-2025-21490.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21489](https://cve.now/CVE-2025-21489.md): Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). (CVSS 6.1, Oracle Advanced Outbound Telephony)
- [CVE-2024-21245](https://cve.now/CVE-2024-21245.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-24024](https://cve.now/CVE-2025-24024.md): Mjolnir v1.9.0 accepts commands from any room (CVSS 9.1, matrix-org mjolnir)
- [CVE-2025-23369](https://cve.now/CVE-2025-23369.md): Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation (CVSS 7.6, GitHub Enterprise Server)
- [CVE-2025-24020](https://cve.now/CVE-2025-24020.md): WeGIA Open Redirect vulnerability (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2025-22150](https://cve.now/CVE-2025-22150.md): Undici Uses Insufficiently Random Values (CVSS 6.8, nodejs undici · undici)
- [CVE-2025-24019](https://cve.now/CVE-2025-24019.md): YesWiki vulnerable to authenticated arbitrary file deletion (CVSS 7.1, yeswiki · yeswiki/yeswiki)
- [CVE-2025-24461](https://cve.now/CVE-2025-24461.md): In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint (CVSS 6.5, JetBrains TeamCity)
- [CVE-2025-24460](https://cve.now/CVE-2025-24460.md): In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-24459](https://cve.now/CVE-2025-24459.md): In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page (CVSS 4.6, JetBrains TeamCity)
- [CVE-2025-24458](https://cve.now/CVE-2025-24458.md): In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration (CVSS 7.1, JetBrains YouTrack)
- [CVE-2025-24457](https://cve.now/CVE-2025-24457.md): In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs (CVSS 5.5, JetBrains YouTrack)
- [CVE-2025-24456](https://cve.now/CVE-2025-24456.md): In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping (CVSS 6.7, JetBrains Hub)
- [CVE-2025-23996](https://cve.now/CVE-2025-23996.md): WordPress AnyRoad plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AnyRoad)
- [CVE-2025-23994](https://cve.now/CVE-2025-23994.md): WordPress Estatebud – Properties & Listings plugin \<= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability (CVSS 7.1, Estatebud – Properties & Listings)
- [CVE-2025-22722](https://cve.now/CVE-2025-22722.md): WordPress Widget Options plugin \<= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability (CVSS 4.3, Marketing Fire Widget Options)
- [CVE-2025-22721](https://cve.now/CVE-2025-22721.md): WordPress ApplyOnline plugin \<= 2.6.7.1 - Broken Access Control vulnerability (CVSS 4.3, Farhan Noor ApplyOnline)
- [CVE-2025-22661](https://cve.now/CVE-2025-22661.md): WordPress Online Payments plugin \<= 3.20.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, vcita Online Payments – Get Paid with PayPal, Square & Stri…)
- [CVE-2025-22276](https://cve.now/CVE-2025-22276.md): WordPress Related Post Shortcode Plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, enguerranws Related Post Shortcode)
- [CVE-2025-22267](https://cve.now/CVE-2025-22267.md): WordPress Weaver Themes Shortcode Compatibility Plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpweaver Weaver Themes Shortcode Compatibility)
- [CVE-2025-23580](https://cve.now/CVE-2025-23580.md): WordPress BizLibrary plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matthew BizLibrary)
- [CVE-2025-23551](https://cve.now/CVE-2025-23551.md): WordPress SexBundle plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, razvypp SexBundle)
- [CVE-2025-23489](https://cve.now/CVE-2025-23489.md): WordPress WP-Announcements plugin \<= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Brian Messenlehner WP-Announcements)
- [CVE-2025-23477](https://cve.now/CVE-2025-23477.md): WordPress Realty Workstation plugin \<= 1.0.45 - Broken Access Control vulnerability (CVSS 8.2, realtyworkstation Realty Workstation)
- [CVE-2025-23461](https://cve.now/CVE-2025-23461.md): WordPress Social2Blog plugin \<= 0.2.990 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, xkollsoftware Social2Blog)
- [CVE-2025-23454](https://cve.now/CVE-2025-23454.md): WordPress Nature FlipBook WordPress Plugin plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, flashmaniac Nature FlipBook)
- [CVE-2025-24018](https://cve.now/CVE-2025-24018.md): YesWiki Vulnerable to Authenticated Stored XSS (CVSS 7.6, yeswiki · yeswiki/yeswiki)
- [CVE-2024-45687](https://cve.now/CVE-2024-45687.md): HTTP Server incorrectly accepting disallowed characters within header values (CVSS 2.4, Payara Platform Payara Server · Payara Platform Payara Micro)
- [CVE-2025-24017](https://cve.now/CVE-2025-24017.md): YesWiki Vulnerable to Unauthenticated DOM Based XSS (CVSS 7.6, yeswiki · yeswiki/yeswiki)
- [CVE-2025-24012](https://cve.now/CVE-2025-24012.md): Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability (CVSS 4.6, Umbraco-CMS · Umbraco.Cms.StaticAssets +1)
- [CVE-2025-24011](https://cve.now/CVE-2025-24011.md): Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes (CVSS 5.3, Umbraco-CMS · Umbraco.Cms)
- [CVE-2025-0377](https://cve.now/CVE-2025-0377.md): HashiCorp go-slug Vulnerable to Zip Slip Attack (CVSS 7.5, HashiCorp Shared library · github.com/hashicorp/go-slug)
- [CVE-2024-53829](https://cve.now/CVE-2024-53829.md): Cross-Site Request Forgery in CodeChecker API (CVSS 8.2, Ericsson CodeChecker · codechecker)
- [CVE-2025-24001](https://cve.now/CVE-2025-24001.md): WordPress PPO Call To Actions plugin \<= 0.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ngô Thắng IT PPO Call To Actions)
- [CVE-2025-23998](https://cve.now/CVE-2025-23998.md): WordPress UltraLight theme \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, raratheme UltraLight)
- [CVE-2025-23997](https://cve.now/CVE-2025-23997.md): WordPress Tamara Checkout plugin \< 1.9.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tamara Solution Tamara Checkout)
- [CVE-2025-22825](https://cve.now/CVE-2025-22825.md): WordPress Flexible PDF Coupons plugin \< 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdesk Flexible PDF Coupons)
- [CVE-2025-22733](https://cve.now/CVE-2025-22733.md): WordPress My auctions allegro Plugin \<= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wphocus My auctions allegro)
- [CVE-2025-22732](https://cve.now/CVE-2025-22732.md): WordPress Ad Blocking Detector plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Admiral Ad Blocking Detector)
- [CVE-2025-22727](https://cve.now/CVE-2025-22727.md): WordPress MailChimp Subscribe Form plugin \<= 4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginOps MailChimp Subscribe Forms)
- [CVE-2025-22723](https://cve.now/CVE-2025-22723.md): WordPress Barcode Scanner and Inventory manager plugin \<= 1.6.7 - Arbitrary File Upload vulnerability (CVSS 9.1, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2025-22719](https://cve.now/CVE-2025-22719.md): WordPress VikAppointments Services Booking Calendar plugin \<= 1.2.16 - CSRF to Stored XSS vulnerability (CVSS 7.1, e4jvikwp VikAppointments Services Booking Calendar)
- [CVE-2025-22718](https://cve.now/CVE-2025-22718.md): WordPress FAT Event Lite plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, roninwp FAT Event Lite)
- [CVE-2025-22717](https://cve.now/CVE-2025-22717.md): WordPress My Tickets plugin \<= 2.0.9 - Broken Access Control vulnerability (CVSS 7.5, Joe Dolson My Tickets)
- [CVE-2025-22716](https://cve.now/CVE-2025-22716.md): WordPress Taskbuilder Plugin \<= 3.0.6 - SQL Injection vulnerability (CVSS 8.5, Taskbuilder)
- [CVE-2025-22711](https://cve.now/CVE-2025-22711.md): WordPress Image Source Control Lite Plugin \<= 2.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Thomas Maier Image Source Control)
- [CVE-2025-22710](https://cve.now/CVE-2025-22710.md): WordPress Smart Manager Plugin \<= 8.52.0 - SQL Injection vulnerability (CVSS 7.6, storeapps Smart Manager)
- [CVE-2025-22709](https://cve.now/CVE-2025-22709.md): WordPress Verge3D Publishing and E-Commerce Plugin \<= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Soft8Soft Verge3D)
- [CVE-2025-22706](https://cve.now/CVE-2025-22706.md): WordPress Social Pug: Author Box plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iova.mihai Social Pug: Author Box)
- [CVE-2025-22262](https://cve.now/CVE-2025-22262.md): WordPress Bonjour Bar plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WittyFolk Bonjour Bar)
- [CVE-2024-32555](https://cve.now/CVE-2024-32555.md): WordPress Easy Real Estate plugin \<= 2.2.6 - Privilege Escalation vulnerability (CVSS 9.8, InspiryThemes Easy Real Estate)
- [CVE-2025-22763](https://cve.now/CVE-2025-22763.md): WordPress Brizy Pro Plugin \<= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound Brizy Pro)
- [CVE-2025-22735](https://cve.now/CVE-2025-22735.md): WordPress Tag Cloud Plugin - Tag Groups plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Steve Burge WordPress Tag Cloud Plugin – Tag Groups)
- [CVE-2025-22553](https://cve.now/CVE-2025-22553.md): WordPress Multiple Carousel Plugin \<= 2.0 - SQL Injection vulnerability (CVSS 9.3, dhananjaysingh Multiple Carousel)
- [CVE-2025-22322](https://cve.now/CVE-2025-22322.md): WordPress Private Messages for UserPro plugin \<= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DeluxeThemes Private Messages for UserPro)
- [CVE-2025-22318](https://cve.now/CVE-2025-22318.md): WordPress Standard Box Sizes plugin \<= 1.6.13 - Broken Access Control vulnerability (CVSS 7.5, enituretechnology Standard Box Sizes – for WooCommerce)
- [CVE-2025-22311](https://cve.now/CVE-2025-22311.md): WordPress Private Messages for UserPro plugin \<= 4.10.0 - Local File Inclusion vulnerability (CVSS 7.5, DeluxeThemes Private Messages for UserPro)
- [CVE-2024-56277](https://cve.now/CVE-2024-56277.md): WordPress Poll Maker Plugin \< 5.5.5 - HTML Injection vulnerability (CVSS 5.3, Ays Pro Poll Maker)
- [CVE-2024-51919](https://cve.now/CVE-2024-51919.md): WordPress Fancy Product Designer plugin \<= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 9.0, radykal Fancy Product Designer)
- [CVE-2024-51888](https://cve.now/CVE-2024-51888.md): WordPress Homey Login Register Plugin \<= 2.4.0 - Privilege Escalation vulnerability (CVSS 9.8, favethemes Homey Login Register)
- [CVE-2024-51818](https://cve.now/CVE-2024-51818.md): WordPress Fancy Product Designer plugin \<= 6.4.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, radykal Fancy Product Designer)
- [CVE-2024-49700](https://cve.now/CVE-2024-49700.md): WordPress ARPrice plugin \<= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, reputeinfosystems ARPrice)
- [CVE-2024-49699](https://cve.now/CVE-2024-49699.md): WordPress ARPrice plugin \<= 4.1.3 - PHP Object Injection vulnerability (CVSS 8.8, reputeinfosystems ARPrice)
- [CVE-2024-49688](https://cve.now/CVE-2024-49688.md): WordPress ARPrice plugin \<= 4.1.3 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.8, reputeinfosystems ARPrice)
- [CVE-2024-49666](https://cve.now/CVE-2024-49666.md): WordPress ARPrice plugin \<= 4.1.3 - SQL Injection vulnerability (CVSS 8.5, reputeinfosystems ARPrice)
- [CVE-2024-49655](https://cve.now/CVE-2024-49655.md): WordPress ARPrice plugin \<= 4.1.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, reputeinfosystems ARPrice)
- [CVE-2024-49333](https://cve.now/CVE-2024-49333.md): WordPress Hero Menu plugin \<= 1.16.5 - SQL Injection vulnerability (CVSS 8.5, NotFound Hero Mega Menu - Responsive WordPress Menu Plugin)
- [CVE-2024-49303](https://cve.now/CVE-2024-49303.md): WordPress Hero Menu plugin \<= 1.16.5 - SQL Injection vulnerability (CVSS 8.5, NotFound Hero Mega Menu - Responsive WordPress Menu Plugin)
- [CVE-2024-49300](https://cve.now/CVE-2024-49300.md): WordPress Hero Menu plugin \<= 1.16.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound Hero Mega Menu - Responsive WordPress Menu Plugin)
- [CVE-2024-57946](https://cve.now/CVE-2024-57946.md): virtio-blk: don't keep queue frozen during system suspend (CVSS 5.5, Linux)
- [CVE-2025-21664](https://cve.now/CVE-2025-21664.md): dm thin: make get\_first\_thin use rcu-safe list first function (CVSS 7.8, Linux)
- [CVE-2025-21663](https://cve.now/CVE-2025-21663.md): net: stmmac: dwmac-tegra: Read iommu stream id from device tree (CVSS 10.0, Linux)
- [CVE-2025-21662](https://cve.now/CVE-2025-21662.md): net/mlx5: Fix variable not being completed when function returns (no CVSS, Linux)
- [CVE-2025-21661](https://cve.now/CVE-2025-21661.md): gpio: virtuser: fix missing lookup table cleanups (CVSS 7.8, Linux)
- [CVE-2025-21660](https://cve.now/CVE-2025-21660.md): ksmbd: fix unexpectedly changed path in ksmbd\_vfs\_kern\_path\_locked (no CVSS, Linux)
- [CVE-2025-21659](https://cve.now/CVE-2025-21659.md): netdev: prevent accessing NAPI instances from another namespace (CVSS 8.1, Linux)
- [CVE-2025-21658](https://cve.now/CVE-2025-21658.md): btrfs: avoid NULL pointer dereference if no valid extent tree (CVSS 5.5, Linux)
- [CVE-2025-21657](https://cve.now/CVE-2025-21657.md): sched\_ext: Replace rq\_lock() to raw\_spin\_rq\_lock() in scx\_ops\_bypass() (no CVSS, Linux)
- [CVE-2025-21656](https://cve.now/CVE-2025-21656.md): hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur (no CVSS, Linux)
- [CVE-2024-57945](https://cve.now/CVE-2024-57945.md): riscv: mm: Fix the out of bound issue of vmemmap address (CVSS 7.8, Linux)
- [CVE-2024-57944](https://cve.now/CVE-2024-57944.md): iio: adc: ti-ads1298: Add NULL check in ads1298\_init (CVSS 5.5, Linux)
- [CVE-2024-57943](https://cve.now/CVE-2024-57943.md): exfat: fix the new buffer was not zeroed before writing (CVSS 7.8, Linux)
- [CVE-2024-57942](https://cve.now/CVE-2024-57942.md): netfs: Fix ceph copy to cache on write-begin (no CVSS, Linux)
- [CVE-2024-57941](https://cve.now/CVE-2024-57941.md): netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (no CVSS, Linux)
- [CVE-2024-57940](https://cve.now/CVE-2024-57940.md): exfat: fix the infinite loop in exfat\_readdir() (no CVSS, Linux)
- [CVE-2024-57939](https://cve.now/CVE-2024-57939.md): riscv: Fix sleeping in invalid context in die() (CVSS 5.5, Linux)
- [CVE-2024-57938](https://cve.now/CVE-2024-57938.md): net/sctp: Prevent autoclose integer overflow in sctp\_association\_init() (CVSS 5.5, Linux)
- [CVE-2024-57936](https://cve.now/CVE-2024-57936.md): RDMA/bnxt\_re: Fix max SGEs for the Work Request (CVSS 9.8, Linux)
- [CVE-2024-57935](https://cve.now/CVE-2024-57935.md): RDMA/hns: Fix accessing invalid dip\_ctx during destroying QP (no CVSS, Linux)
- [CVE-2024-57934](https://cve.now/CVE-2024-57934.md): fgraph: Add READ\_ONCE() when accessing fgraph\_array\[\] (CVSS 4.7, Linux)
- [CVE-2024-57933](https://cve.now/CVE-2024-57933.md): gve: guard XSK operations on the existence of queues (CVSS 5.5, Linux)
- [CVE-2024-57932](https://cve.now/CVE-2024-57932.md): gve: guard XDP xmit NDO on existence of xdp queues (CVSS 9.8, Linux)
- [CVE-2024-57931](https://cve.now/CVE-2024-57931.md): selinux: ignore unknown extended permissions (no CVSS, Linux)
- [CVE-2024-57930](https://cve.now/CVE-2024-57930.md): tracing: Have process\_string() also allow arrays (no CVSS, Linux)
- [CVE-2025-0615](https://cve.now/CVE-2025-0615.md): Input validation vulnerability in Qualifio's Wheel of Fortune (CVSS 5.3, Qualifio Wheel of fortune)
- [CVE-2025-0614](https://cve.now/CVE-2025-0614.md): Input validation vulnerability in Qualifio's Wheel of Fortune (CVSS 5.3, Qualifio Wheel of fortune)
- [CVE-2024-13444](https://cve.now/CVE-2024-13444.md): wp-greet \<= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, tuxlog wp-greet)
- [CVE-2024-11226](https://cve.now/CVE-2024-11226.md): FireCask Like & Share Button \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (CVSS 6.4, alexmoss FireCask Like & Share Button)
- [CVE-2024-13230](https://cve.now/CVE-2024-13230.md): Social Share, Social Login and Social Comments Plugin – Super Socializer \<= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey' (CVSS 5.3, the\_champ Social Share, Social Login and Social Comments Pl…)
- [CVE-2025-0450](https://cve.now/CVE-2025-0450.md): Betheme \<= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2024-52973](https://cve.now/CVE-2024-52973.md): Kibana allocation of resources without limits or throttling leads to crash (CVSS 6.5, Elastic Kibana)
- [CVE-2024-43709](https://cve.now/CVE-2024-43709.md): Elasticsearch allocation of resources without limits or throttling leads to crash (CVSS 6.5, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-37284](https://cve.now/CVE-2024-37284.md): Elastic Defend Improper Handling of Alternate Encoding Leads to Crash (CVSS 5.5, Elastic Defend)
- [CVE-2024-6466](https://cve.now/CVE-2024-6466.md): NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-F (CVSS 5.3, NEC WebSAM DeploymentManager)
- [CVE-2025-23184](https://cve.now/CVE-2025-23184.md): Apache CXF: Denial of Service vulnerability with temporary files (CVSS 5.9, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2024-13404](https://cve.now/CVE-2024-13404.md): Link Library \<= 7.7.2 - Reflected Cross-Site Scripting (CVSS 6.1, jackdewey Link Library)
- [CVE-2024-12104](https://cve.now/CVE-2024-12104.md): Visual Website Collaboration, Feedback & Project Management – Atarim \<= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion (CVSS 5.3, wpfeedback Atarim – Visual Feedback, Review & AI Collaborat…)
- [CVE-2024-12005](https://cve.now/CVE-2024-12005.md): WP-BibTeX \<= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting (CVSS 6.1, zjhzxhz WP-BibTeX)
- [CVE-2025-0371](https://cve.now/CVE-2025-0371.md): Jet Elements \<= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, Crocoblock JetElements)
- [CVE-2024-10936](https://cve.now/CVE-2024-10936.md): String Locator \<= 2.6.6 - Unauthenticated PHP Object Injection (CVSS 8.8, instawp String locator)
- [CVE-2025-23086](https://cve.now/CVE-2025-23086.md): On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector (CVSS 6.1, Brave Desktop Browser)
- [CVE-2024-13536](https://cve.now/CVE-2024-13536.md): 1003 Mortgage Application \<= 1.87 - Unauthenticated Full Path Disclosure (CVSS 5.3, 8blocks 1003 Mortgage Application)
- [CVE-2024-45091](https://cve.now/CVE-2024-45091.md): IBM UrbanCode Deploy information disclosure (CVSS 6.2, IBM UrbanCode Deploy)
- [CVE-2023-27112](https://cve.now/CVE-2023-27112.md): pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php. (CVSS 9.8)
- [CVE-2023-27113](https://cve.now/CVE-2023-27113.md): pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php. (CVSS 9.8)
- [CVE-2023-37024](https://cve.now/CVE-2023-37024.md): A reachable assertion in the Mobile Management Entity (MME) of Magma versions \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90f (CVSS 7.5)
- [CVE-2023-37025](https://cve.now/CVE-2023-37025.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37026](https://cve.now/CVE-2023-37026.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37027](https://cve.now/CVE-2023-37027.md): Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5 (CVSS 5.7)
- [CVE-2023-37028](https://cve.now/CVE-2023-37028.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37029](https://cve.now/CVE-2023-37029.md): Magma versions \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an (CVSS 7.5)
- [CVE-2023-37030](https://cve.now/CVE-2023-37030.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37031](https://cve.now/CVE-2023-37031.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37032](https://cve.now/CVE-2023-37032.md): A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5 (CVSS 7.5)
- [CVE-2023-37033](https://cve.now/CVE-2023-37033.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37034](https://cve.now/CVE-2023-37034.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37035](https://cve.now/CVE-2023-37035.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37036](https://cve.now/CVE-2023-37036.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37037](https://cve.now/CVE-2023-37037.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37038](https://cve.now/CVE-2023-37038.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-37039](https://cve.now/CVE-2023-37039.md): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (CVSS 6.5)
- [CVE-2023-45908](https://cve.now/CVE-2023-45908.md): Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget. (CVSS 6.1)
- [CVE-2024-24416](https://cve.now/CVE-2024-24416.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf (CVSS 7.5)
- [CVE-2024-24417](https://cve.now/CVE-2024-24417.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf (CVSS 7.5)
- [CVE-2024-24418](https://cve.now/CVE-2024-24418.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf (CVSS 7.5)
- [CVE-2024-24419](https://cve.now/CVE-2024-24419.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf (CVSS 7.5)
- [CVE-2024-24420](https://cve.now/CVE-2024-24420.md): A reachable assertion in the decode\_linked\_ti\_ie function of Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) (CVSS 7.5)
- [CVE-2024-24421](https://cve.now/CVE-2024-24421.md): A type confusion in the nas\_message\_decode function of Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows (CVSS 9.8)
- [CVE-2024-24422](https://cve.now/CVE-2024-24422.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a stack overfl (CVSS 7.5)
- [CVE-2024-24423](https://cve.now/CVE-2024-24423.md): The Linux Foundation Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overf (CVSS 7.5)
- [CVE-2024-24424](https://cve.now/CVE-2024-24424.md): A reachable assertion in the decode\_access\_point\_name\_ie function of Magma \<= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2 (CVSS 7.5)
- [CVE-2024-24427](https://cve.now/CVE-2024-24427.md): A reachable assertion in the amf\_ue\_set\_suci function of Open5GS \<= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted (CVSS 7.5)
- [CVE-2024-24428](https://cve.now/CVE-2024-24428.md): A reachable assertion in the oai\_nas\_5gmm\_decode function of Open5GS \<= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craf (CVSS 7.5)
- [CVE-2024-24442](https://cve.now/CVE-2024-24442.md): A NULL pointer dereference in the ngap\_app::handle\_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers (CVSS 7.5)
- [CVE-2024-24443](https://cve.now/CVE-2024-24443.md): An uninitialized pointer dereference in the ngap\_handle\_pdu\_session\_resource\_setup\_response routine of OpenAirInterface CN5G AMF (oai-cn5g-a (CVSS 6.5)
- [CVE-2024-24444](https://cve.now/CVE-2024-24444.md): Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause (CVSS 7.5)
- [CVE-2024-24445](https://cve.now/CVE-2024-24445.md): OpenAirInterface CN5G AMF (oai-cn5g-amf) \<= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which al (CVSS 6.5)
- [CVE-2024-24451](https://cve.now/CVE-2024-24451.md): A stack overflow in the sctp\_server::sctp\_receiver\_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker (CVSS 7.5)
- [CVE-2024-42936](https://cve.now/CVE-2024-42936.md): The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modifi (CVSS 9.8)
- [CVE-2024-48392](https://cve.now/CVE-2024-48392.md): OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-51417](https://cve.now/CVE-2024-51417.md): An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. (CVSS 6.4, System.Linq.Dynamic.Core)
- [CVE-2024-54792](https://cve.now/CVE-2024-54792.md): A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. (CVSS 6.1)
- [CVE-2024-54794](https://cve.now/CVE-2024-54794.md): The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. (CVSS 9.1)
- [CVE-2024-54795](https://cve.now/CVE-2024-54795.md): SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer functi (CVSS 5.4)
- [CVE-2024-55504](https://cve.now/CVE-2024-55504.md): An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote co (CVSS 5.5)
- [CVE-2024-55958](https://cve.now/CVE-2024-55958.md): Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. (CVSS 4.8)
- [CVE-2024-55959](https://cve.now/CVE-2024-55959.md): Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions. (CVSS 9.1)
- [CVE-2024-56990](https://cve.now/CVE-2024-56990.md): PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php. (CVSS 4.5)
- [CVE-2024-56997](https://cve.now/CVE-2024-56997.md): PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter. (CVSS 4.2)
- [CVE-2024-56998](https://cve.now/CVE-2024-56998.md): PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address. (CVSS 4.2)
- [CVE-2024-57036](https://cve.now/CVE-2024-57036.md): TOTOLINK A810R V4.1.2cu.5032\_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. (CVSS 8.1)
- [CVE-2024-57360](https://cve.now/CVE-2024-57360.md): https://www.gnu.org/software/binutils/ nm \>=2.43 is affected by: Incorrect Access Control. (CVSS 5.5)
- [CVE-2024-57536](https://cve.now/CVE-2024-57536.md): Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard\_status. (CVSS 8.0)
- [CVE-2024-57537](https://cve.now/CVE-2024-57537.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 6.3)
- [CVE-2024-57538](https://cve.now/CVE-2024-57538.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 6.5)
- [CVE-2024-57539](https://cve.now/CVE-2024-57539.md): Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail. (CVSS 8.2)
- [CVE-2024-57540](https://cve.now/CVE-2024-57540.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 6.5)
- [CVE-2024-57541](https://cve.now/CVE-2024-57541.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 5.5)
- [CVE-2024-57542](https://cve.now/CVE-2024-57542.md): Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id\_email\_check\_btn. (CVSS 8.8)
- [CVE-2024-57543](https://cve.now/CVE-2024-57543.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 5.5)
- [CVE-2024-57544](https://cve.now/CVE-2024-57544.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 5.5)
- [CVE-2024-57545](https://cve.now/CVE-2024-57545.md): Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.