CVEs published January 27, 2025
242 CVEs were published on January 27, 2025: 29 critical, 61 high. 1 is now in CISA KEV.
- Published
- 242
- Critical
- 29
- High
- 61
- Medium
- 139
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 114
Most affected products
- Apple macOS
- 44
- Apple iOS and iPadOS · Apple iPadOS +4
- 11
- Apple iOS and iPadOS · Apple macOS +2
- 8
- cacti
- 6
- Apple iOS and iPadOS · Apple iPadOS +3
- 5
- Apple iOS and iPadOS · Apple macOS
- 3
- Apple Safari · Apple iOS and iPadOS +4
- 3
- Dyn Business Panel
- 3
- IBM Security Directory Integrator · IBM Security Verify Dir…
- 3
- IBM Sterling File Gateway
- 3
Critical 29
- CVE-2025-24130The issue was addressed with improved checks.Apple macOS
- CVE-2025-24126An input validation issue was addressed.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-54523The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-54542An authentication issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-24146This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2024-54512The issue was addressed by removing the relevant flags.Apple iOS and iPadOS · Apple watchOS
- CVE-2025-24102The issue was addressed with improved checks.Apple iPadOS · Apple macOS
- CVE-2024-54507A type confusion issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24118The issue was addressed with improved memory handling.Apple iPadOS · Apple macOS
- CVE-2024-54530The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24093A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24085A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24103This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-24154An out-of-bounds write was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-24109A downgrade issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2024-48841Remote Code Execution (RCE) VulnerabilitiesABB FLXEON
- CVE-2025-22604Cacti has Authenticated RCE via multi-line SNMP responsescacti
- CVE-2025-24671WordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerabilityPdfcrowd Dev Team Save as PDF
- CVE-2025-24667WordPress Small Package Quotes Plugin <= 5.2.17 - SQL Injection vulnerabilityenituretechnology Small Package Quotes – Worldwide Express…
- CVE-2025-24665WordPress Small Package Quotes Plugin <= 2.4.8 - SQL Injection vulnerabilityenituretechnology Small Package Quotes – Unishippers Edition
- CVE-2025-24664WordPress LTL Freight Quotes Plugin <= 5.0.20 - SQL Injection vulnerabilityenituretechnology LTL Freight Quotes – Worldwide Express Ed…
- CVE-2025-24612WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerabilityIhor Kit Shipping for Nova Poshta
- CVE-2025-24601WordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerabilityThimPress FundPress
- CVE-2024-55227A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scdolibarr/dolibarr
- CVE-2024-55228A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts dolibarr/dolibarr
- CVE-2024-57052An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file
- CVE-2024-57548CMSimple 5.16 allows the user to edit log.php file via print page.
- CVE-2024-57590TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote att
- CVE-2024-57595DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc_client_pin.cgi, which allows remote atta
High 61
- CVE-2025-24150A privacy issue was addressed with improved handling of files.Apple Safari · Apple iOS and iPadOS +1
- CVE-2025-24107A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-54543The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-54522The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-54509An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2025-24120This issue was addressed by improved management of object lifetimes.Apple macOS
- CVE-2025-24177A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2024-54499A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24176A permissions issue was addressed with improved validation.Apple macOS
- CVE-2025-24137A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24156An integer overflow was addressed through improved input validation.Apple macOS
- CVE-2025-24159A validation issue was addressed with improved logic.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24135This issue was addressed with improved message validation.Apple macOS
- CVE-2025-24174The issue was addressed with improved checks.Apple macOS
- CVE-2025-24139The issue was addressed with improved checks.Apple macOS
- CVE-2024-54537This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2024-54468The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2024-54517The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24169A logging issue was addressed with improved data redaction.Apple Safari · Apple macOS
- CVE-2024-54557A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-24129A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24365vaultwarden allows escalation of privilege via variable confusion in OrgHeaders traitdani-garcia vaultwarden
- CVE-2025-24364vaultwarden allows RCE in the admin paneldani-garcia vaultwarden
- CVE-2025-24357vLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorvllm-project vllm · vllm
- CVE-2024-12740Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision SoftwareNI Vision Development Module · NI FlexRIO +5
- CVE-2025-24367Cacti allows Arbitrary File Creation leading to RCEcacti
- CVE-2024-54146Cacti has a SQL Injection vulnerability when view host templatecacti
- CVE-2025-24783Apache Cocoon: continuations may not be privateApache Software Foundation Apache Cocoon · org.apache.co… +1
- CVE-2025-23982WordPress Fare Calculator plugin <= 1.1 - CSRF to Stored Cross-Site Scripting vulnerabilityGopi krishnan Fare Calculator
- CVE-2025-24734WordPress Better Find and Replace plugin <= 1.6.7 - Privilege Escalation vulnerabilityCodeSolz Better Find and Replace
- CVE-2025-24708WordPress WP Dynamics CRM plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityCRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elem…
- CVE-2025-24680WordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityWPExperts.io WP Multistore Locator
- CVE-2025-24626WordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerabilitycodepeople Music Store
- CVE-2025-24593WordPress Edwiser Bridge plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityWisdmLabs Edwiser Bridge
- CVE-2025-23756WordPress LawPress plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityivanchernyakov LawPress – Law Firm Website Management
- CVE-2025-23754WordPress The Loops plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityUlrich Sossou The Loops
- CVE-2025-23752WordPress CGD Arrange Terms plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityClifton Griffin CGD Arrange Terms
- CVE-2025-23574WordPress CubePM plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityJonathan Lau CubePM
- CVE-2025-23531WordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydavidfcarr RSVPMaker Volunteer Roles
- CVE-2025-22513WordPress Simple Locator Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityKyle Phillips Simple Locator
- CVE-2025-24685WordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerabilityIhor Kit Morkva UA Shipping
- CVE-2025-23792WordPress Passwordless WP – Login with your glance or fingerprint Plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Busters Passwordless WP – Login with your glance or fing…
- CVE-2025-23457WordPress Shipdeo plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityshipdeoplugin Shipdeo
- CVE-2022-4975Rhacs: cross-site scripting in portalRed Hat Advanced Cluster Security
- CVE-2024-13094WP Triggers Lite <= 2.5.3 - Reflected XSSWP Triggers Lite
- CVE-2024-13057Dyn Business Panel <= 1.0.0 - Stored XSS via CSRFDyn Business Panel
- CVE-2024-13056Dyn Business Panel <= 1.0.0 - Reflected XSSDyn Business Panel
- CVE-2024-13055Dyn Business Panel <= 1.0.0 - Reflected XSSDyn Business Panel
- CVE-2024-13052Dental Optimizer Patient Generator App <= 1.0 - Reflected XSSDental Optimizer Patient Generator App
- CVE-2024-12773Altra Side Menu <= 2.0 - Admin+ SQL InjectionAltra Side Menu
- CVE-2024-12321WC Affiliate <= 2.3.9 - Reflected XSSWC Affiliate
- CVE-2024-48416Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding.
- CVE-2024-48418In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any
- CVE-2024-48419Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead.
- CVE-2024-48420Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic.
- CVE-2024-56316In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to c
- CVE-2024-57276In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability.
- CVE-2024-57373Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of
- CVE-2024-57546An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.
- CVE-2024-57547Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the F
- CVE-2024-57549CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request.
Medium, low and unrated 152
- CVE-2024-28786IBM QRadar SIEM information disclosureIBM QRadar SIEM
- CVE-2022-31749Authenticated arbitrary file read/write in WatchGuard Fireware OSWatchGuard Fireware OS
- CVE-2025-24369Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0Xe x · github.com/Xe/x
- CVE-2024-37526IBM Watson Query on Cloud Pak for Data information disclosureIBM Data Virtualization
- CVE-2024-54519The issue was resolved by sanitizing logging.Apple macOS
- CVE-2025-24096This issue was addressed through improved state management.Apple macOS
- CVE-2025-24106This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2024-54539This issue was addressed through improved state management.Apple macOS
- CVE-2025-24151The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-54488A logic issue was addressed with improved file handling.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2024-44172A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2025-24127The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2024-54518The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24131The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24086The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24100A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-24141An authentication issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2025-24116An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-24161The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24136This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-54549This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-24121A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-24160The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24117This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24140This issue was addressed through improved state management.Apple macOS
- CVE-2025-24101This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-24087The issue was addressed with additional permissions checks.Apple macOS
- CVE-2025-24114A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24143The issue was addressed with improved access restrictions to the file system.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-54497The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-54478An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24092This issue was addressed with improved data protection.Apple macOS
- CVE-2025-24138This issue was addressed through improved state management.Apple macOS
- CVE-2024-54550This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24122A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-24134An information disclosure issue was addressed with improved privacy controls.Apple macOS
- CVE-2025-24163The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24162This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-24123The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-54475A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2025-24158The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-54547The issue was addressed with improved checks.Apple macOS
- CVE-2025-24115A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-24149An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24108An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-24124The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24112The issue was addressed with improved checks.Apple macOS
- CVE-2025-24145A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24153A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24104This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-24128The issue was addressed by adding additional logic.Apple Safari · Apple iOS and iPadOS +1
- CVE-2025-24094A race condition was addressed with additional validation.Apple macOS
- CVE-2024-54516A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-54541This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24152The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24113The issue was addressed with improved UI.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-54536The issue was addressed with improved validation of environment variables.Apple macOS
- CVE-2024-54520A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-0753Axiomatic Bento4 mp42aac ReadPartial heap-based overflowAxiomatic Bento4
- CVE-2025-0751Axiomatic Bento4 mp42aac ReadBits heap-based overflowAxiomatic Bento4
- CVE-2025-0734y_project RuoYi Whitelist getBeanName deserializationy_project RuoYi
- CVE-2025-0733Postman profapi.dll untrusted search pathPostman
- CVE-2025-0732Discord profapi.dll untrusted search pathDiscord
- CVE-2025-24356UDP traffic amplification via fastd's fast reconnect featureneocturne fastd
- CVE-2025-24354imgproxy is vulnerable to SSRF against 0.0.0.0imgproxy · github.com/imgproxy/imgproxy +2
- CVE-2025-23197matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub supportmatrix-org matrix-hookshot
- CVE-2025-24368Cacti has a SQL Injection vulnerability when using tree rules through Automation APIcacti
- CVE-2024-54145Cacti has a SQL Injection vulnerability when request automation devicescacti
- CVE-2025-0730TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query stringsTP-Link TL-SG108E
- CVE-2025-0729TP-Link TL-SG108E clickjackingTP-Link TL-SG108E
- CVE-2024-27256IBM MQ Operator information disclosureIBM MQ Operator
- CVE-2023-52292IBM Sterling File Gateway cross-site scriptingIBM Sterling File Gateway
- CVE-2023-47159IBM Sterling File Gateway information disclosureIBM Sterling File Gateway
- CVE-2024-22316IBM Sterling File Gateway improper access controlIBM Sterling File Gateway
- CVE-2024-37527IBM OpenPages with Watson cross-site scriptingIBM OpenPages with Watson
- CVE-2024-45598Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Pathcacti
- CVE-2024-38320IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosureIBM Storage Protect for Virtual Environments: Data Protecti…
- CVE-2024-38325IBM Storage Defender information disclosureIBM Storage Defender - Resiliency Service
- CVE-2025-24782WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerabilitywpWax Post Grid, Slider & Carousel Ultimate
- CVE-2025-24747WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityfavethemes Houzez
- CVE-2025-24744WordPress Bridge Core plugin <= 3.3 - Broken Access Control vulnerabilityNotFound Bridge Core
- CVE-2025-24743WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerabilityRometheme RTMKit
- CVE-2025-24742WordPress WP Google Maps plugin <= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerabilityWPGMaps WP Go Maps
- CVE-2025-24741WordPress KB Support plugin <= 1.6.7 - Open Redirection vulnerabilityLOGON KB Support
- CVE-2025-24740WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerabilityThimPress LearnPress
- CVE-2025-24689WordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerabilityJavier Carazo Import and export users and customers
- CVE-2025-24662WordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerabilityLearnDash LMS
- CVE-2025-24653WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerabilityNotFound Admin and Site Enhancements (ASE) Pro
- CVE-2025-24628WordPress reCaptcha by BestWebSoft Plugin <= 1.78 - Captcha Bypass vulnerabilitybestwebsoft Google Captcha
- CVE-2025-24606WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2025-24603WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerabilityDmitry V. (CEO of "UKR Solution") Print Barcode Labels for…
- CVE-2025-24600WordPress RSVPMaker plugin <= 11.4.5 - Broken Access Control vulnerabilitydavidfcarr RSVPMarker
- CVE-2025-24590WordPress picu – Online Photo Proofing Gallery plugin <= 2.4.0 - Broken Access Control vulnerabilitypicu
- CVE-2025-24540WordPress Website Builder by SeedProd plugin <= 6.18.9 - Cross Site Request Forgery (CSRF) vulnerabilityComing Soon Page, Under Construction & Maintenance Mode by…
- CVE-2025-24538WordPress BuddyPress Groups Extras plugin <= 3.6.10 - Cross Site Request Forgery (CSRF) vulnerabilitySlava Abakumov BuddyPress Groups Extras
- CVE-2025-24537WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityStellarWP The Events Calendar
- CVE-2025-23849WordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerabilitybpiwowar PAPERCITE
- CVE-2025-23669WordPress WP Smart Tooltip plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityNurul Amin WP Smart Tooltip
- CVE-2025-23656WordPress Donate visa plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilitySaul Morales Pacheco Donate visa
- CVE-2025-23529WordPress Minterpress plugin <= 1.0.5 - Arbitrary Content Deletion vulnerabilityblokhauswp Minterpress
- CVE-2025-24754WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityfavethemes Houzez
- CVE-2025-24584WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2025-24533WordPress MetaSlider plugin <= 3.92.0 - Cross Site Request Forgery (CSRF) vulnerabilityResponsive Slider by MetaSlider
- CVE-2024-11348Reflected XSS in Eura7 CMSmanagerEura7 CMSmanager
- CVE-2024-55931Token stored in session storageXerox Workplace Suite
- CVE-2025-0696A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embeCesanta Frozen
- CVE-2025-0695An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce Cesanta Frozen
- CVE-2024-12345INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumptionINW Krbyyyzo
- CVE-2025-24814Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted filesApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2024-52012Apache Solr: Configset upload on Windows allows arbitrary path write-accessApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2024-13117Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path TraversalSocial Share Buttons for WordPress
- CVE-2024-13116Crelly Slider < 1.4.7 - Admin+ Stored XSSCrelly Slider
- CVE-2024-13095WP Triggers Lite <= 2.5.3 - Admin+ SQL InjectionWP Triggers Lite
- CVE-2024-12774Altra Side Menu <= 2.0 - Abitrary Menu Deletion via CSRFAltra Side Menu
- CVE-2024-12436WP Customer Area <= 8.2.4 - Bulk Delete via CSRFWP Customer Area
- CVE-2024-12280WP Customer Area <= 8.2.4 - Event Log Deletion via CSRFWP Customer Area
- CVE-2025-24390Missing Cookie FlagsOTRS AG OTRS
- CVE-2025-24389SMTP Password will be shown in cleartext on some SMTP errorsOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-43446Improper check of permissions in Generic InterfaceOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-43445Missing X-Content-Type-Options: nosniff Header Allows MIME Type SniffingOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2023-46187IBM InfoSphere Master Data Management cross-site scriptingIBM InfoSphere Master Data Management
- CVE-2024-28766IBM Security Directory Integrator information disclosureIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-28770IBM Security Directory Integrator information disclosureIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-28771IBM Security Directory Integrator information disclosureIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-26317In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinat
- CVE-2024-48417Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRou
- CVE-2024-48662Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a craf
- CVE-2024-54728Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.
- CVE-2024-56178An issue was discovered in Couchbase Server 7.6.x through 7.6.3.
- CVE-2024-56947An issue in Xiamen Meitu Technology Co., Ltd.
- CVE-2024-56948An issue in KuGou Technology CO.
- CVE-2024-56949An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user inform
- CVE-2024-56950An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted
- CVE-2024-56951An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying
- CVE-2024-56952An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information
- CVE-2024-56953An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a craft
- CVE-2024-56954An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information v
- CVE-2024-56955An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplyi
- CVE-2024-56957An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via su
- CVE-2024-56959An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafte
- CVE-2024-56960An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information v
- CVE-2024-56962An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a
- CVE-2024-56963An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via s
- CVE-2024-56964An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user infor
- CVE-2024-56965An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supp
- CVE-2024-56966An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitiv
- CVE-2024-56967An issue in Cloud Whale Interactive Technology LLC.
- CVE-2024-56968An issue in Shenzhen Intellirocks Tech Co.
- CVE-2024-56969An issue in Pixocial Technology (Singapore) Pte.
- CVE-2024-56971An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive
- CVE-2024-56972An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-57272SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower is vulnerable to Cross Site Scripting (XSS).