# CVEs published 2025-02-04

148 CVEs were published on February 4, 2025: 18 critical, 35 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-53962](https://cve.now/CVE-2024-53962.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53963](https://cve.now/CVE-2024-53963.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53966](https://cve.now/CVE-2024-53966.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53964](https://cve.now/CVE-2024-53964.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53965](https://cve.now/CVE-2024-53965.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-0413](https://cve.now/CVE-2025-0413.md): Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Parallels Desktop)
- [CVE-2024-11468](https://cve.now/CVE-2024-11468.md): Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. (CVSS 7.8, Omnissa Horizon Client for MacOS)
- [CVE-2023-39943](https://cve.now/CVE-2023-39943.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2023-40222](https://cve.now/CVE-2023-40222.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Heap-based Buffer Overflow (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2024-11467](https://cve.now/CVE-2024-11467.md): Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. (CVSS 7.8, Omnissa Horizon Client for MacOS)
- [CVE-2024-13722](https://cve.now/CVE-2024-13722.md): Checkmk NagVis Reflected Cross-site Scripting (CVSS 5.4, Checkmk NagVis)
- [CVE-2024-13723](https://cve.now/CVE-2024-13723.md): Checkmk NagVis Remote Code Execution (CVSS 7.2, Checkmk NagVis)
- [CVE-2024-8125](https://cve.now/CVE-2024-8125.md): A remote code vulnerability has been discovered in OpenText™ Content Management. (CVSS 5.4, OpenText™ Content Management)
- [CVE-2024-53266](https://cve.now/CVE-2024-53266.md): Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse (CVSS 4.3, discourse)
- [CVE-2024-53851](https://cve.now/CVE-2024-53851.md): Partial denial of service via inline oneboxes in Discourse (CVSS 4.3, discourse)
- [CVE-2024-53994](https://cve.now/CVE-2024-53994.md): Potential bypass of chat permissions in Discourse (CVSS 4.3, discourse)
- [CVE-2024-55948](https://cve.now/CVE-2024-55948.md): Anonymous cache poisoning via XHR requests in Discourse (CVSS 8.2, discourse)
- [CVE-2024-56197](https://cve.now/CVE-2024-56197.md): Users can see other user's tagged PMs in Discourse (CVSS 2.2, discourse)
- [CVE-2024-56328](https://cve.now/CVE-2024-56328.md): HTMLi(XSS without CSP) via Onebox urls in Discourse (CVSS 6.5, discourse)
- [CVE-2025-22601](https://cve.now/CVE-2025-22601.md): Client Side Path Traversal using activate account route in Discourse (CVSS 3.1, discourse)
- [CVE-2025-22602](https://cve.now/CVE-2025-22602.md): Stored DOM-based XSS (without CSP) via video placeholders in Discourse (CVSS 6.5, discourse)
- [CVE-2025-23023](https://cve.now/CVE-2025-23023.md): Anonymous cache poisoning via request headers in Discourse (CVSS 8.2, discourse)
- [CVE-2024-45657](https://cve.now/CVE-2024-45657.md): IBM Security Verify Access incorrect privilege assignment (CVSS 5.0, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-35138](https://cve.now/CVE-2024-35138.md): IBM Security Verify Access cross-site request forgery (CVSS 6.5, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-43187](https://cve.now/CVE-2024-43187.md): IBM Security Verify Access information disclosure (CVSS 5.9, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-45658](https://cve.now/CVE-2024-45658.md): IBM Security Verify Access information disclosure (CVSS 2.7, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-40700](https://cve.now/CVE-2024-40700.md): IBM Security Verify Access cross-site scripting (CVSS 6.1, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2025-0509](https://cve.now/CVE-2025-0509.md): Signing Checks Bypass (CVSS 7.3, sparkle-project Sparkle)
- [CVE-2025-0630](https://cve.now/CVE-2025-0630.md): Western Telematic Inc NPS Series, DSM Series, CPM Series External Control of File Name or Path (CVSS 6.0, Western Telematic Network Power Switch · Western Telematic…)
- [CVE-2025-24963](https://cve.now/CVE-2025-24963.md): Browser mode serves arbitrary files in vitest (CVSS 5.9, vitest-dev vitest · @vitest/browser)
- [CVE-2025-24964](https://cve.now/CVE-2025-24964.md): Remote Code Execution when accessing a malicious website while Vitest API server is listening (CVSS 9.7, vitest-dev vitest · vitest)
- [CVE-2025-0960](https://cve.now/CVE-2025-0960.md): AutomationDirect C-more EA9 HMI Classic Buffer Overflow (CVSS 9.3, AutomationDirect C-more EA9 HMI EA9-T6CL · AutomationDir… +8)
- [CVE-2025-24968](https://cve.now/CVE-2025-24968.md): Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine (CVSS 8.8, yogeshojha rengine)
- [CVE-2025-24967](https://cve.now/CVE-2025-24967.md): Stored XSS on Admin Panel When Deleting a User in reNgine (CVSS 7.4, yogeshojha rengine)
- [CVE-2025-24966](https://cve.now/CVE-2025-24966.md): HTML Injection in reNgine (CVSS 5.3, yogeshojha rengine)
- [CVE-2025-24971](https://cve.now/CVE-2025-24971.md): OS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDrop (CVSS 9.5, DumbWareio DumbDrop)
- [CVE-2025-0451](https://cve.now/CVE-2025-0451.md): Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to eng (CVSS 6.3, Google Chrome)
- [CVE-2025-0445](https://cve.now/CVE-2025-0445.md): Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 5.4, Google Chrome)
- [CVE-2025-0444](https://cve.now/CVE-2025-0444.md): Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 6.3, Google Chrome)
- [CVE-2025-24373](https://cve.now/CVE-2025-24373.md): Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips (CVSS 6.3, wpovernight woocommerce-pdf-invoices-packing-slips)
- [CVE-2024-48019](https://cve.now/CVE-2024-48019.md): Apache Doris: allows admin users to read arbitrary files through the REST API (CVSS 5.4, Apache Software Foundation Apache Doris)
- [CVE-2025-25039](https://cve.now/CVE-2025-25039.md): Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface (CVSS 4.7, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2025-23060](https://cve.now/CVE-2025-23060.md): Sensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM) (CVSS 6.6, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2025-23059](https://cve.now/CVE-2025-23059.md): Sensitive Information Disclosure in HPE Aruba Networking ClearPass Policy Manager (CVSS 6.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2025-23058](https://cve.now/CVE-2025-23058.md): Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface (CVSS 8.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2025-0364](https://cve.now/CVE-2025-0364.md): BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE (CVSS 9.8, BigAntSoft BigAnt Server)
- [CVE-2024-45659](https://cve.now/CVE-2024-45659.md): IBM Security Verify Access information disclosure (CVSS 5.3, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-9644](https://cve.now/CVE-2024-9644.md): Four-Faith F3x36 bapply.cgi Auth Bypass (CVSS 9.8, Four-Faith F3x36)
- [CVE-2024-9643](https://cve.now/CVE-2024-9643.md): Four-Faith F3x36 Hidden Debug Credentials (CVSS 9.8, Four-Faith F3x36)
- [CVE-2024-23690](https://cve.now/CVE-2024-23690.md): EOL Netgear FVS336Gv2 and FVS336Gv3 Telnet Configuration Backup Command Injection (CVSS 7.2, Netgear FVS336Gv3 · Netgear FVS336Gv2)
- [CVE-2025-22794](https://cve.now/CVE-2025-22794.md): WordPress World Cup Predictor Plugin \<= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ianhaycox World Cup Predictor)
- [CVE-2025-22730](https://cve.now/CVE-2025-22730.md): WordPress Ksher plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 6.5, ksher thailand Ksher)
- [CVE-2025-22675](https://cve.now/CVE-2025-22675.md): WordPress Alert Box Block plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Alert Box Block – Display notice/alerts in the fro…)
- [CVE-2025-22674](https://cve.now/CVE-2025-22674.md): WordPress Product Blocks for WooCommerce plugin \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Get Bowtied Product Blocks for WooCommerce)
- [CVE-2025-22664](https://cve.now/CVE-2025-22664.md): WordPress Survey Maker Plugin \<= 5.1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro Survey Maker)
- [CVE-2025-22662](https://cve.now/CVE-2025-22662.md): WordPress SendPulse Email Marketing Newsletter plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SendPulse Email Marketing Newsletter)
- [CVE-2025-22653](https://cve.now/CVE-2025-22653.md): WordPress Music Press Pro plugin \<=1.4.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tuyennv Music Press Pro)
- [CVE-2025-22643](https://cve.now/CVE-2025-22643.md): WordPress OnePress theme \<= 2.3.11 - Broken Access Control vulnerability (CVSS 4.3, famethemes OnePress)
- [CVE-2025-22642](https://cve.now/CVE-2025-22642.md): WordPress Dynamic Conditions plugin \<= 1.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, rtowebsites Dynamic Conditions)
- [CVE-2025-22641](https://cve.now/CVE-2025-22641.md): WordPress FM Notification Bar plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Prem Tiwari FM Notification Bar)
- [CVE-2025-24677](https://cve.now/CVE-2025-24677.md): WordPress Post/Page Copying Tool to Export and Import post/page for Cross site Migration Plugin \<= 2.0.3 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, wpspin Post/Page Copying Tool)
- [CVE-2025-24648](https://cve.now/CVE-2025-24648.md): WordPress Admin and Site Enhancements (ASE) Plugin \<= 7.6.2.1 - Privilege Escalation vulnerability (CVSS 7.5, Bowo Admin and Site Enhancements)
- [CVE-2025-24602](https://cve.now/CVE-2025-24602.md): WordPress WP24 Domain Check plugin \<= 1.10.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP24 Domain Check)
- [CVE-2025-24599](https://cve.now/CVE-2025-24599.md): WordPress Newsletters plugin \<= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tribulant Software Newsletters)
- [CVE-2025-24598](https://cve.now/CVE-2025-24598.md): WordPress WP Mailster plugin \<= 1.8.17.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brandtoss WP Mailster)
- [CVE-2025-23645](https://cve.now/CVE-2025-23645.md): WordPress Find Content IDs plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Optimize Worldwide Find Content IDs)
- [CVE-2025-22700](https://cve.now/CVE-2025-22700.md): WordPress Traveler Code plugin \< 3.1.3 - Subscriber+ Arbitrary SQL Execution vulnerability (CVSS 8.5, shinetheme Traveler Code)
- [CVE-2025-22699](https://cve.now/CVE-2025-22699.md): WordPress Traveler Code plugin \< 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerability (CVSS 9.0, shinetheme Traveler Code)
- [CVE-2025-22697](https://cve.now/CVE-2025-22697.md): WordPress Responsive Blocks plugin \<= 1.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CyberChimps Responsive Blocks)
- [CVE-2025-22696](https://cve.now/CVE-2025-22696.md): WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.4, WPDeveloper Document Block – Upload & Embed Docs)
- [CVE-2025-22206](https://cve.now/CVE-2025-22206.md): Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla (CVSS 4.7, joomsky.com JS Jobs component for Joomla)
- [CVE-2025-0825](https://cve.now/CVE-2025-0825.md): CRLF injection in Cpp-httplib (CVSS 6.9, cpp-httplib)
- [CVE-2025-1015](https://cve.now/CVE-2025-1015.md): Unsanitized address book fields (CVSS 5.4, Mozilla Thunderbird)
- [CVE-2025-1020](https://cve.now/CVE-2025-1020.md): Memory safety bugs fixed in Firefox 135 and Thunderbird 135 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1017](https://cve.now/CVE-2025-1017.md): Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1016](https://cve.now/CVE-2025-1016.md): Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-0510](https://cve.now/CVE-2025-0510.md): Address of e-mail sender can be spoofed by malicious email (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2025-1014](https://cve.now/CVE-2025-1014.md): Certificate length was not properly checked (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1013](https://cve.now/CVE-2025-1013.md): Potential opening of private browsing tabs in normal browsing windows (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1019](https://cve.now/CVE-2025-1019.md): Fullscreen notification not properly displayed (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1012](https://cve.now/CVE-2025-1012.md): Use-after-free during concurrent delazification (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1011](https://cve.now/CVE-2025-1011.md): A bug in WebAssembly code generation could result in a crash (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1018](https://cve.now/CVE-2025-1018.md): Fullscreen notification is not displayed when fullscreen is re-requested (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1010](https://cve.now/CVE-2025-1010.md): Use-after-free in Custom Highlight (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1009](https://cve.now/CVE-2025-1009.md): Use-after-free in XSLT (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11623](https://cve.now/CVE-2024-11623.md): Stored XSS in authentik (CVSS 4.8, goauthentik authentik)
- [CVE-2024-13699](https://cve.now/CVE-2024-13699.md): Qi Addons For Elementor \<= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-27137](https://cve.now/CVE-2024-27137.md): Apache Cassandra: unrestricted deserialization of JMX authentication credentials (CVSS 5.3, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2025-24860](https://cve.now/CVE-2025-24860.md): Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions (CVSS 5.4, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2025-0890](https://cve.now/CVE-2025-0890.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version (CVSS 9.8, Zyxel VMG4325-B10A firmware)
- [CVE-2024-40891](https://cve.now/CVE-2024-40891.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel V (CVSS 8.8, KEV, Zyxel VMG4325-B10A firmware)
- [CVE-2024-40890](https://cve.now/CVE-2024-40890.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B (CVSS 8.8, KEV, Zyxel VMG4325-B10A firmware)
- [CVE-2025-23015](https://cve.now/CVE-2025-23015.md): Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (CVSS 8.8, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2024-13529](https://cve.now/CVE-2024-13529.md): SocialV - Social Network and Community BuddyPress Theme \<= 2.0.15 - Missing Authorization to Arbitrary File Download (CVSS 6.5, iqonicdesign SocialV - Social Network and Community BuddyPr…)
- [CVE-2024-13510](https://cve.now/CVE-2024-13510.md): ShopSite \<= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, ShopSite)
- [CVE-2024-13733](https://cve.now/CVE-2024-13733.md): SKT Blocks – Gutenberg based Page Builder \<= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sonalsinha21 SKT Blocks – Gutenberg based Page Builder)
- [CVE-2024-13356](https://cve.now/CVE-2024-13356.md): DSGVO All in one for WP \<= 4.6 - Cross-Site Request Forgery to Account Deletion (CVSS 6.5, mlfactory DSGVO All in one for WP)
- [CVE-2024-13403](https://cve.now/CVE-2024-13403.md): WPForms Lite \<= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter (CVSS 6.4, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2024-10239](https://cve.now/CVE-2024-10239.md): fld-\>used\_bytes without sanity check causes stack overflow (CVSS 7.2, SMCI MBD-X12DPG-OA6)
- [CVE-2024-10238](https://cve.now/CVE-2024-10238.md): fld-\>used\_bytes without sanity check causes stack overflow (CVSS 7.2, SMCI MBD-X12DPG-OA6)
- [CVE-2024-10237](https://cve.now/CVE-2024-10237.md): SMC BMC Firmware Image Authentication Design Issue (CVSS 7.2, SMCI MBD-X12DPG-OA6)
- [CVE-2025-20907](https://cve.now/CVE-2025-20907.md): Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2025-20906](https://cve.now/CVE-2025-20906.md): Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20905](https://cve.now/CVE-2025-20905.md): Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2025-20904](https://cve.now/CVE-2025-20904.md): Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2025-22205](https://cve.now/CVE-2025-22205.md): Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla (CVSS 7.5, www.admiror-design-studio.com Admiror Gallery component for…)
- [CVE-2024-12046](https://cve.now/CVE-2024-12046.md): Medical Addon for Elementor \<= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode (CVSS 4.3, nicheaddons Medical Addon for Elementor)
- [CVE-2024-13514](https://cve.now/CVE-2024-13514.md): B Slider- Gutenberg Slider Block for WP \<= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode (CVSS 4.3, bplugins bSlider – Create Responsive Image, Post, Product,…)
- [CVE-2025-22204](https://cve.now/CVE-2025-22204.md): Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions \< 12.0.0 for Joomla (CVSS 9.8, regularlabs.com Sourcerer for Joomla)
- [CVE-2025-20902](https://cve.now/CVE-2025-20902.md): Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's pri (CVSS 5.1, Samsung Mobile Media Controller)
- [CVE-2025-20901](https://cve.now/CVE-2025-20901.md): Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. (CVSS 4.4, Samsung Mobile Blockchain Keystore)
- [CVE-2025-20900](https://cve.now/CVE-2025-20900.md): Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. (CVSS 6.3, Samsung Mobile Blockchain Keystore)
- [CVE-2025-20899](https://cve.now/CVE-2025-20899.md): Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 (CVSS 4.0, Samsung Mobile PushNotification)
- [CVE-2025-20898](https://cve.now/CVE-2025-20898.md): Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profil (CVSS 4.6, Samsung Mobile Samsung Members)
- [CVE-2025-20897](https://cve.now/CVE-2025-20897.md): Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows (CVSS 6.8, Samsung Mobile Secure Folder)
- [CVE-2025-20896](https://cve.now/CVE-2025-20896.md): Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive informat (CVSS 4.0, Samsung Mobile EasySetup)
- [CVE-2025-20895](https://cve.now/CVE-2025-20895.md): Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary appli (CVSS 3.2, Samsung Mobile Galaxy Store)
- [CVE-2025-20894](https://cve.now/CVE-2025-20894.md): Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. (CVSS 4.6, Samsung Mobile Samsung Email)
- [CVE-2025-20893](https://cve.now/CVE-2025-20893.md): Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notific (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2025-20892](https://cve.now/CVE-2025-20892.md): Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2025-20891](https://cve.now/CVE-2025-20891.md): Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attacker (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2025-20890](https://cve.now/CVE-2025-20890.md): Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary cod (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2025-20889](https://cve.now/CVE-2025-20889.md): Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to rea (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2025-20888](https://cve.now/CVE-2025-20888.md): Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2025-20887](https://cve.now/CVE-2025-20887.md): Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrar (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2025-20886](https://cve.now/CVE-2025-20886.md): Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2025-20885](https://cve.now/CVE-2025-20885.md): Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2025-20884](https://cve.now/CVE-2025-20884.md): Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user pro (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2025-20883](https://cve.now/CVE-2025-20883.md): Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profile (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2025-20882](https://cve.now/CVE-2025-20882.md): Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to e (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2025-20881](https://cve.now/CVE-2025-20881.md): Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attack (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2024-13607](https://cve.now/CVE-2024-13607.md): JS Help Desk – The Ultimate Help Desk & Support Plugin \<= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2024-12597](https://cve.now/CVE-2024-12597.md): HT Mega \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block\_css and inner\_css (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-0466](https://cve.now/CVE-2025-0466.md): Sensei LMS \< 4.24.4 - Unauthenticated sensei\_email/sensei\_message Disclosure (CVSS 5.3, Sensei LMS)
- [CVE-2025-0368](https://cve.now/CVE-2025-0368.md): Banner Garden Plugin for WordPress \<= 0.1.3 - Reflected XSS (CVSS 6.1, Banner Garden Plugin for WordPress)
- [CVE-2024-13332](https://cve.now/CVE-2024-13332.md): TransFinanz \<= 1.0.0 - Reflected XSS (CVSS 6.1, TransFinanz)
- [CVE-2024-13331](https://cve.now/CVE-2024-13331.md): WP Dream Carousel \<= 1.0.1b - Reflected XSS (CVSS 6.1, WP Dream Carousel)
- [CVE-2024-13330](https://cve.now/CVE-2024-13330.md): Justrows Free \<= 0.2 - Reflected XSS (CVSS 7.1, JustRows free)
- [CVE-2024-13329](https://cve.now/CVE-2024-13329.md): Solidres \<= 0.9.4 - Reflected XSS (CVSS 7.1, Solidres)
- [CVE-2024-13328](https://cve.now/CVE-2024-13328.md): Giga Messenger Bots \<= 2.3.1 - Reflected XSS (CVSS 6.1, Giga Messenger)
- [CVE-2024-13327](https://cve.now/CVE-2024-13327.md): Musicbox \<= 2.0.3 - Reflected XSS (CVSS 6.1, Musicbox)
- [CVE-2024-13326](https://cve.now/CVE-2024-13326.md): iBuildApp \<= 0.2.0 - Reflected XSS (CVSS 6.1, iBuildApp)
- [CVE-2024-13325](https://cve.now/CVE-2024-13325.md): Glossy \<= 2.3.5 - Reflected XSS (CVSS 6.1, Glossy)
- [CVE-2024-13115](https://cve.now/CVE-2024-13115.md): WP Projects Portfolio with Client Testimonials \<= 3.0 - Stored XSS via CSRF (CVSS 6.1, WP Projects Portfolio with Client Testimonials)
- [CVE-2024-13114](https://cve.now/CVE-2024-13114.md): WP Projects Portfolio with Client Testimonials \<= 3.0 - Reflected XSS (CVSS 6.1, WP Projects Portfolio with Client Testimonials)
- [CVE-2025-24982](https://cve.now/CVE-2025-24982.md): Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. (CVSS 4.3, SWIT Activity Log WinterLock)
- [CVE-2025-22475](https://cve.now/CVE-2025-22475.md): Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Impl (CVSS 3.7, Dell PowerProtect DD)
- [CVE-2024-48445](https://cve.now/CVE-2024-48445.md): An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.