CVEs published January 22, 2025
171 CVEs were published on January 22, 2025: 10 critical, 111 high.
- Published
- 171
- Critical
- 10
- High
- 111
- Medium
- 49
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- senols AI Puffer – Your AI engine for WordPress
- 4
- I-O DATA DEVICE UD-LT2
- 3
- rubengc GamiPress – Gamification plugin to reward points, a…
- 3
- cilium · github.com/cilium/cilium
- 2
- David Jeffrey Contact Form 7 Round Robin Lead Distribution
- 2
- Google Chrome
- 2
- Jenkins Project Jenkins Azure Service Fabric Plugin · org.j…
- 2
- Traffic Alert and Collision Avoidance System (TCAS) II Coll…
- 2
- a.ankit ReadMe Creator
- 1
- Ala Falaki a Gateway for Pasargad Bank on WooCommerce
- 1
Critical 10
- CVE-2025-20156Cisco Meeting Management Client-Server Privilege Escalation VulnerabilityCisco Meeting Management
- CVE-2025-23914WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerabilityMuzaara Google Ads Report
- CVE-2025-23953WordPress user files plugin <= 2.4.2 - Arbitrary File Upload vulnerabilityScriptonite user files
- CVE-2025-23942WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerabilityngocuct0912 WP Load Gallery
- CVE-2025-23932WordPress Quick Count Plugin <= 3.00 - PHP Object Injection vulnerabilityMarko-M Quick Count
- CVE-2025-23931WordPress WordPress Local SEO plugin <= 2.3 - SQL Injection vulnerabilityOliver Fuhrmann WordPress Local SEO
- CVE-2025-23921WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerabilitysh1zen Multi Uploader for Gravity Forms
- CVE-2025-23918WordPress Smallerik File Browser plugin <= 1.1 - Arbitrary File Upload vulnerabilityEnrico Sandoli Smallerik File Browser
- CVE-2024-12857AdForest <= 5.1.8 - Authentication Bypassscriptsbundle AdForest
- CVE-2023-37777A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier.
High 111
- CVE-2025-0612Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2025-0611Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-11166Traffic Alert and Collision Avoidance System (TCAS) II has an External Control of System or Configuration Setting vulnerabilityTraffic Alert and Collision Avoidance System (TCAS) II Coll…
- CVE-2025-24399Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insJenkins Project Jenkins OpenId Connect Authentication Plugi…
- CVE-2025-24398Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF pJenkins Project Jenkins Bitbucket Server Integration Plugin…
- CVE-2025-20165Cisco BroadWorks SIP Denial of Service VulnerabilityCisco BroadWorks
- CVE-2024-31903IBM Sterling B2B Integrator Standard Edition code executionIBM Sterling B2B Integrator Standard Edition
- CVE-2025-0638Routinator crashes when illegal characters are present in manifest file namesNLnet Labs Routinator
- CVE-2025-23809WordPress Blue Wrench Video Widget Plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySunil Nanda Blue Wrench Video Widget
- CVE-2025-23882WordPress WP Download Codes Plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilitymisanthrop WP Download Codes
- CVE-2025-23846WordPress Flexible Blogtitle Plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitythaikolja Flexible Blogtitle
- CVE-2025-23812WordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Jeffrey Contact Form 7 Round Robin Lead Distribution
- CVE-2025-23768WordPress InFunding plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityinwavethemes InFunding
- CVE-2025-23746WordPress CMC MIGRATE plugin <= 0.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEdem CMC MIGRATE
- CVE-2025-23709WordPress Formatted post plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerabilitykiroro Formatted post
- CVE-2025-23643WordPress ReadMe Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitya.ankit ReadMe Creator
- CVE-2025-23506WordPress WP IMAP Auth plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityimsoftware WP IMAP Auth
- CVE-2025-23475WordPress History timeline plugin <= 0.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfireantology History timeline
- CVE-2025-23462WordPress FWD Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAnil Jailta FWD Slider
- CVE-2025-23449WordPress Simple shortcode buttons plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydavidpuc Simple shortcode buttons
- CVE-2025-22772WordPress Mapbox for WP Advanced Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitystephanemartinw Mapbox for WP Advanced
- CVE-2025-23966WordPress a Gateway for Pasargad Bank on WooCommerce Plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityAla Falaki a Gateway for Pasargad Bank on WooCommerce
- CVE-2025-23959WordPress Good Old Gallery Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityLinus Lundahl Good Old Gallery
- CVE-2025-23949WordPress Improved Sale Badges – Free Version Plugin <= 1.0.1 - Local File Inclusion vulnerabilitydzeriho Improved Sale Badges – Free Version
- CVE-2025-23948WordPress Background animation blocks Plugin <= 2.1.5 - Local File Inclusion vulnerabilityWebarea Background animation blocks
- CVE-2025-23944WordPress WOOEXIM Plugin <= 5.0.0 - PHP Object Injection vulnerabilitybulktheme WOOEXIM
- CVE-2025-23938WordPress Image Gallery Box by CRUDLab Plugin <= 1.0.3 - Local File Inclusion vulnerabilityImage Gallery Box by CRUDLab
- CVE-2025-23910WordPress Menus Plus+ Plugin <= 1.9.6 - SQL Injection vulnerabilitykeighl Menus Plus+
- CVE-2025-23874WordPress WP Block Pack plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityFalconTheme Team WP Block Pack
- CVE-2025-23867WordPress WordPress File Search Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymarkcoker WordPress File Search
- CVE-2025-23866WordPress EU DSGVO Helper Plugin <= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityE. Marten EU DSGVO Helper
- CVE-2025-23811WordPress WP2APP Plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityghasemy14 WP2APP
- CVE-2025-23806WordPress Ultimate Subscribe Plugin <=1.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityThemeFarmer Ultimate Subscribe
- CVE-2025-23803WordPress Snippy Plugin <= 1.4.1 - CSRF to Cross Site Scripting (XSS) vulnerabilityRik Schennink Snippy
- CVE-2025-23798WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityElbowRobo Mass Messaging in BuddyPress
- CVE-2025-23784WordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - SQL Injection vulnerabilityDavid Jeffrey Contact Form 7 Round Robin Lead Distribution
- CVE-2025-23781WordPress WM Options Import Export plugin <= 1.0.1 - Sensitive Data Exposure vulnerabilityWeb Mumbai WM Options Import Export
- CVE-2025-23774WordPress WPDB to Sql plugin <= 1.2 - Sensitive Data Exposure vulnerabilityNiket Joshi WPDB to Sql
- CVE-2025-23770WordPress Fast Tube plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCaspie Fast Tube
- CVE-2025-23769WordPress Content Mirror plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydreamsofmatter Content Mirror
- CVE-2025-23758WordPress pootle button plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitypootlepress Pootle button
- CVE-2025-23732WordPress Easy Filtering plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityfranciscopalacios Easy Filtering
- CVE-2025-23706WordPress Jet Skinner for BuddyPress plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitymilordk Jet Skinner for BuddyPress
- CVE-2025-23701WordPress Lime Developer Login plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitylimesquare Lime Developer Login
- CVE-2025-23700WordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityyonisink yCyclista
- CVE-2025-23697WordPress Podčlánková inzerce plugin <= 2.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywebdeal Podčlánková inzerce
- CVE-2025-23696WordPress Staging CDN plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRonan Mockett Staging CDN
- CVE-2025-23695WordPress CtyGrid Hyp3rL0cal Search plugin <= 0.1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitykinlane CtyGrid Hyp3rL0cal Search
- CVE-2025-23686WordPress Admin Menu Organizer plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityphpdevca Admin Menu Organizer
- CVE-2025-23683WordPress MACME plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityxdxdVSxdxd MACME
- CVE-2025-23682WordPress Preloader Quotes plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityBhuvnesh Gupta Preloader Quotes
- CVE-2025-23681WordPress REDIRECTION PLUS plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitytahminajannat REDIRECTION PLUS
- CVE-2025-23679WordPress FP RSS Category Excluder plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityFlourish Pixel FP RSS Category Excluder
- CVE-2025-23678WordPress LocalGrid plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMd Imranur Rahman LocalGrid
- CVE-2025-23676WordPress LH Email plugin <= 1.12 - Reflected Cross Site Scripting (XSS) vulnerabilityshawfactor LH Email
- CVE-2025-23674WordPress Bit.ly linker plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityandygauk Bit.ly linker
- CVE-2025-23672WordPress Instant Appointment plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitytenteeglobal Instant Appointment
- CVE-2025-23631WordPress Content Planner plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySarah Lewis Content Planner
- CVE-2025-23630WordPress Cyber Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityIrshad A.Khan Cyber Slider
- CVE-2025-23625WordPress Unique UX plugin <= 0.9.2 - Reflected Cross Site Scripting (XSS) vulnerabilityawcode Unique UX
- CVE-2025-23611WordPress WH Cache & Security plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitywebhue WH Cache & Security
- CVE-2025-23610WordPress Ultimate Events plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityTehsmash Ultimate Events
- CVE-2025-23609WordPress Tagesteller plugin <= v.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityHelle1 Tagesteller
- CVE-2025-23607WordPress CAMOO SMS plugin <= 3.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCamoo Sarl CAMOO SMS
- CVE-2025-23606WordPress Calendi plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitysebkay Calendi
- CVE-2025-23605WordPress Call To Action Popup plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitylampd Call To Action Popup
- CVE-2025-23604WordPress Rezdy Reloaded plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityMaeve Lander Rezdy Reloaded
- CVE-2025-23603WordPress Group category creator plugin <= 1.3.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMohammadJafar Khajeh Group category creator
- CVE-2025-23602WordPress EELV Newsletter plugin <= 4.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEurope Ecologie Les Verts EELV Newsletter
- CVE-2025-23601WordPress Tab My Content plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitypatrice Tab My Content
- CVE-2025-23597WordPress Rio Photo Gallery plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitysabareesha Rio Photo Gallery
- CVE-2025-23592WordPress dForms plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityanimexxx dForms
- CVE-2025-23589WordPress ContentOptin Lite plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitymarkugwuanyi ContentOptin Lite
- CVE-2025-23583WordPress Explara Membership plugin <= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityExplara Membership
- CVE-2025-23578WordPress Custom CSS Addons plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityBastien Ho Custom CSS Addons
- CVE-2025-23562WordPress XLSXviewer plugin <= 2.1.1 - Arbitrary File Deletion vulnerabilitypitinca XLSXviewer
- CVE-2025-23548WordPress Responsivity plugin <= 0.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityBilal TAS Responsivity
- CVE-2025-23535WordPress REAL WordPress Sidebar plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilitymartin_ziegert REAL WordPress Sidebar
- CVE-2025-23512WordPress Team 118GROUP Agent plugin <= 1.6.0 - Arbitrary Content Deletion vulnerabilityTeam 118GROUP Agent
- CVE-2025-23509WordPress HyperComments plugin <= 0.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilitysiteheart HyperComments
- CVE-2025-23507WordPress Blrt WP Embed plugin <= 1.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityBlrt WP Embed
- CVE-2025-23503WordPress Customizable Captcha and Contact us plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityosolwordpress Customizable Captcha and Contact Us
- CVE-2025-23500WordPress Simple Custom post type custom field plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityfaaiq Simple Custom post type custom field
- CVE-2025-23498WordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityContentLocalized Translation.Pro
- CVE-2025-23495WordPress WooCommerce Order Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityChetan Khandla WooCommerce Order Search
- CVE-2024-13496GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameterrubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2024-13499GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Functionrubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2024-13495GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Functionrubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2025-0429AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_formssenols AI Puffer – Your AI engine for WordPress
- CVE-2025-0428AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_promptssenols AI Puffer – Your AI engine for WordPress
- CVE-2025-22450Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier.I-O DATA DEVICE UD-LT2
- CVE-2025-20617Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE aI-O DATA DEVICE UD-LT2
- CVE-2024-11218Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfilebuildah · Red Hat Enterprise Linux +2
- CVE-2025-23083With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created.NodeJS Node
- CVE-2023-36998The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in
- CVE-2023-37013Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP inter
- CVE-2023-37014Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37015Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37016Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37017Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37018Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37019Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37020Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37021Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37022Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler.
- CVE-2023-37023Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler.
- CVE-2024-24429A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a
- CVE-2024-24430A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2024-34235Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2024-55957In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver pac
- CVE-2024-56924A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J
Medium, low and unrated 50
- CVE-2024-12477Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgetsthemefusion Avada (Fusion) Builder
- CVE-2024-9310Traffic Alert and Collision Avoidance System (TCAS) II has a Reliance on Untrusted Inputs in a Security Decision vulnerabilityTraffic Alert and Collision Avoidance System (TCAS) II Coll…
- CVE-2025-0651File symlink abuse might lead to deleting files belonging to SYSTEM userCloudflare WARP
- CVE-2025-23047Cilium vulnerable to information leakage via insecure default Hubble UI CORS headercilium · github.com/cilium/cilium
- CVE-2025-24403A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerateJenkins Project Jenkins Azure Service Fabric Plugin · org.j…
- CVE-2025-24402A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a SeJenkins Project Jenkins Azure Service Fabric Plugin · org.j…
- CVE-2025-24401Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted Jenkins Project Jenkins Folder-based Authorization Strategy…
- CVE-2025-24400Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, aJenkins Project Jenkins Eiffel Broadcaster Plugin · com.axi…
- CVE-2025-24397An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lackiJenkins Project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2025-23028DoS in Cilium agent DNS proxy from crafted DNS responsescilium · github.com/cilium/cilium
- CVE-2024-51457IBM Robotic Process Automation for Cloud Pak cross-site scriptingIBM Robotic Process Automation for Cloud Pak
- CVE-2025-20128ClamAV OLE2 File Format Decryption Denial of Service VulnerabilityCisco Secure Endpoint
- CVE-2024-10929Spectre-BSEArm Cortex-A72 · Arm Cortex-A73 +2
- CVE-2025-23992WordPress Toocheke Companion plugin <= 1.166 - Stored Cross Site Scripting (XSS) vulnerabilityToocheke Companion
- CVE-2025-0604Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloakkeycloak-ldap-federation · Red Hat Build of Keycloak +2
- CVE-2025-23486WordPress Database Sync plugin <= 0.5.1 - Sensitive Data Exposure vulnerabilitytamlyn Database Sync
- CVE-2025-23684WordPress Debug Tool plugin <= 2.2 - Broken Access Control vulnerabilityEugen Bobrowski Debug Tool
- CVE-2025-24027ps_contactinfo has potential XSS due to usage of the nofilter tag in templatePrestaShop ps_contactinfo · prestashop/ps_contactinfo
- CVE-2025-0395When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mesThe GNU C Library glibc
- CVE-2024-13447WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrievalthimpress WP Hotel Booking
- CVE-2022-23439A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafteFortinet FortiTester · Fortinet FortiOS +15
- CVE-2024-13319Themify Builder <= 7.6.5 - Reflected Cross-Site Scriptingthemifyme Themify Builder
- CVE-2024-13360AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgerysenols AI Puffer – Your AI engine for WordPress
- CVE-2024-13361AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Executionsenols AI Puffer – Your AI engine for WordPress
- CVE-2024-12117Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingbfintal Stackable – Page Builder Gutenberg Blocks
- CVE-2024-13406XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scriptingicopydoc XML for Google Merchant Center
- CVE-2025-23237Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE aI-O DATA DEVICE UD-LT2
- CVE-2024-12879WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response CreationQuantumCloud WPBot Pro Wordpress Chatbot
- CVE-2024-13590Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingayecode Ketchup Shortcodes
- CVE-2024-13584Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scriptingvideowhisper Picture Gallery – Frontend Image Uploads, AJAX…
- CVE-2024-13426WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scriptinggamerz WP-Polls
- CVE-2025-0625CampCodes School Management Software Attachment resource injectionCampCodes School Management Software
- CVE-2023-37002Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37003Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37004Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37005Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37006Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37007Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37008Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler.
- CVE-2023-37009Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37010Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37011Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2023-37012Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.
- CVE-2024-24432A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2024-42012GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed.
- CVE-2024-42013In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability.
- CVE-2024-55488A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2024-56914D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.
- CVE-2024-56923Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6org.silverpeas.core:silverpeas-core
- CVE-2025-22980A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form