CVEs published February 12, 2025
262 CVEs were published on February 12, 2025: 25 critical, 87 high. 2 are now in CISA KEV.
- Published
- 262
- Critical
- 25
- High
- 87
- Medium
- 143
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 41
Most affected products
- Q-Free MaxTime
- 43
- Intel(R) Processors
- 9
- Linux
- 7
- GitLab
- 6
- Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- 6
- Intel(R) System Security Report and System Resources Defens…
- 6
- ywoa
- 5
- NVIDIA nvJPEG2000
- 4
- pihome-shc PiHome
- 4
- SourceCodester Best Church Management Software
- 4
Critical 25
- CVE-2022-31631PDO::quote() may return unquoted stringPHP Group PHP
- CVE-2025-25200Koa has Inefficient Regular Expression Complexitykoajs koa · koa
- CVE-2025-25182Stroom Authentication/Authorization Bypass when using AWS ALBgchq stroom
- CVE-2025-26361A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26359A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2Q-Free MaxTime
- CVE-2025-26347A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.Q-Free MaxTime
- CVE-2025-26345A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.Q-Free MaxTime
- CVE-2025-26344A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to versionQ-Free MaxTime
- CVE-2025-26342A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2Q-Free MaxTime
- CVE-2025-26341A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2Q-Free MaxTime
- CVE-2025-26339A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 aQ-Free MaxTime
- CVE-2025-1100A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatedQ-Free MaxTime
- CVE-2024-10960Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploadsthemefusecom Brizy – Page Builder
- CVE-2024-32838Apache Fineract: SQL injection vulnerabilities in offices API endpointApache Software Foundation Apache Fineract
- CVE-2024-13365Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File UploadLogin Security, FireWall, Malware removal by CleanTalk
- CVE-2024-12213WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_registerhttp://apusthemes.com/ WP Job Board Pro
- CVE-2024-13421Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administratorcontempoinc Real Estate 7 WordPress
- CVE-2024-57602An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.alextselegidis/easyappointments
- CVE-2024-57604An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.github.com/mayswind/ezbookkeeping
- CVE-2025-25343Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.
- CVE-2025-25349PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.
- CVE-2025-25351PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.
- CVE-2025-25742D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the S
- CVE-2025-25744D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynam
- CVE-2025-25746D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSe
High 87
- CVE-2024-41168Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticatIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-36262Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabIntel(R) System Security Report and System Resources Defens…
- CVE-2023-49618Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poIntel(R) System Security Report and System Resources Defens…
- CVE-2023-49615Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potenIntel(R) System Security Report and System Resources Defens…
- CVE-2023-49603Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabIntel(R) System Security Report and System Resources Defens…
- CVE-2023-48267Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poIntel(R) System Security Report and System Resources Defens…
- CVE-2024-39356NULL pointer dereference in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unaIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-39805Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to potenIntel(R) DSA software
- CVE-2023-31276Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600Intel(R) Server Board S2600WF, Intel(R) Server Board S2600S…
- CVE-2024-28127Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privIntel(R) Processors
- CVE-2024-29214Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enaIntel(R) Processors
- CVE-2024-24582Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable eIntel(R) processors
- CVE-2023-34440Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privIntel(R) Processors
- CVE-2023-43758Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privIntel(R) processors
- CVE-2024-38307Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potenIntel(R) AMT and Intel(R) Standard Manageability
- CVE-2024-31155Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation Intel(R) Processors
- CVE-2024-36274Out-of-bounds write in the Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet Adapter Complete Driver Pack before versions 29.1 may aIntel(R) 800 Series Ethernet Driver for Intel(R) Ethernet A…
- CVE-2024-37355Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege viaIntel(R) Graphics software
- CVE-2024-31858Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enIntel(R) QuickAssist Technology software
- CVE-2025-0110PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig PluginPalo Alto Networks PAN-OS OpenConfig Plugin
- CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0108PAN-OS: Authentication Bypass in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-12673An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allowLenovo Vantage
- CVE-2025-0937Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard NamespaceHashiCorp Nomad
- CVE-2025-1146CrowdStrike Falcon Sensor for Linux TLS IssueCrowdStrike Falcon sensor for Linux · CrowdStrike Falcon… +1
- CVE-2025-25283parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memoryjkroso parse-duration · parse-duration
- CVE-2025-25205Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matchingadvplyr audiobookshelf
- CVE-2025-25199BCryptGenerateSymmetricKey memory leakmicrosoft go-crypto-winnative · github.com/microsoft/go-cry…
- CVE-2025-25198mailcow: dockerized vulnerable to password reset poisoningmailcow-dockerized
- CVE-2024-11629Telerik Document Processing RTF Export of Arbitrary File PathProgress Software Progress® Telerik® Document Processing Li…
- CVE-2024-11343Telerik Document Processing Path TraversalProgress Software Telerik Document Processing Libraries
- CVE-2025-0332Progress UI for WinForms decompression path traversal vulnerabilityProgress Software Progress® Telerik® UI for WinForms
- CVE-2025-0556Telerik Report Server Clear Text Transmission of Agent CommandsProgress Software Telerik Report Server
- CVE-2024-12251Improper neutralization special element in hyperlinksProgress Software Telerik UI for WinUI
- CVE-2025-0376Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-1244Emacs: shell injection vulnerability in gnu emacs via custom "man" uri schemeemacs · Red Hat Enterprise Linux 7 Extended Lifecycle Su… +2
- CVE-2025-21699gfs2: Truncate address space when flipping GFS2_DIF_JDATA flagLinux
- CVE-2024-57952Revert "libfs: fix infinite directory reads for offset dir"Linux
- CVE-2025-26378A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticaQ-Free MaxTime
- CVE-2025-26377A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticaQ-Free MaxTime
- CVE-2025-26375A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticaQ-Free MaxTime
- CVE-2025-26372A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26371A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26370A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26369A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26368A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26366A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26365A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26364A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26363A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26362A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11Q-Free MaxTime
- CVE-2025-26356A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 aQ-Free MaxTime
- CVE-2025-26354A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allowsQ-Free MaxTime
- CVE-2025-26349A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatQ-Free MaxTime
- CVE-2025-21697drm/v3d: Ensure job pointer is set to NULL after job completionLinux
- CVE-2024-57951hrtimers: Handle CPU state correctly on hotplugLinux
- CVE-2025-26343A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthQ-Free MaxTime
- CVE-2025-26340A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenQ-Free MaxTime
- CVE-2024-12386WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletionkevonadonis WP Abstracts
- CVE-2024-13480LTL Freight Quotes – For Customers of FedEx Freight <= 3.4.1 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – For Customers of Fed…
- CVE-2024-13532Small Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injectionenituretechnology Small Package Quotes – Purolator Edition
- CVE-2024-13477LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – Unishippers Edition
- CVE-2025-0511Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameteruscnanbu Welcart e-Commerce
- CVE-2024-12296Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_optionsApusTheme Apus Framework
- CVE-2024-13531ShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injectionenituretechnology ShipEngine Shipping Quotes
- CVE-2024-13475Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injectionenituretechnology Small Package Quotes – UPS Edition
- CVE-2024-13490LTL Freight Quotes – XPO Edition <= 4.3.7 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – XPO Edition
- CVE-2024-13435Ebook Downloader <= 1.0 - Unauthenticated SQL Injectioniwcontribution Ebook Downloader
- CVE-2024-13473LTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – Worldwide Express Ed…
- CVE-2024-13528Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcodewpcodefactory Customer Email Verification for WooCommerce
- CVE-2024-12315Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directorysmackcoders Export All Posts, Products, Orders, Refunds & U…
- CVE-2024-13600Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directoryahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…
- CVE-2024-13714All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Uploadallimages All-Images.ai – IA Image Bank and Custom Image cr…
- CVE-2024-13654ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options DeletionMVPThemes ZoxPress - The All-In-One WordPress News Theme
- CVE-2024-13656Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options DeletionMVPThemes Click Mag - Viral WordPress News Magazine/Blog Th…
- CVE-2024-13653ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateMVPThemes ZoxPress - The All-In-One WordPress News Theme
- CVE-2024-13800Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateBrainstorm Force ConvertPlus
- CVE-2025-23359NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where aNVIDIA Container Toolkit · NVIDIA GPU Operator
- CVE-2024-34520An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows
- CVE-2024-46922An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400.
- CVE-2024-46923An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400.
- CVE-2024-51123An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via
- CVE-2024-51376Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFi
- CVE-2024-51440An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.
- CVE-2024-56940An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file upl
- CVE-2025-25743D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.
- CVE-2025-26520Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter.Cacti
Medium, low and unrated 150
- CVE-2025-1229olajowon Loggrove page os command injectionolajowon Loggrove
- CVE-2025-1228olajowon Loggrove Logfile Update page path traversalolajowon Loggrove
- CVE-2024-31068Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial Intel(R) Processors
- CVE-2023-48366Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabIntel(R) System Security Report and System Resources Defens…
- CVE-2024-36293Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user toIntel(R) Processors with Intel(R) SGX
- CVE-2024-39271Improper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software beforeIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software
- CVE-2024-36285Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticatedIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-41166Stack-based buffer overflow in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-40887Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticatIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-39606Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…
- CVE-2024-37020Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an aIntel(R) Xeon(R) Processors
- CVE-2024-39365Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows before version 2024.2 Intel(R) oneAPI DPC++/C++ Compiler software for Windows
- CVE-2024-42405Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to Intel(R) Quartus(R) Prime Software
- CVE-2024-36283Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potentIntel(R) Thread Director Visualizer software
- CVE-2024-32941NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potentially enable denial oIntel(R) MLC software
- CVE-2024-47006Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may aIntel(R) RealSense D400 Series
- CVE-2024-32942Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentIntel(R) DSA installer for Windows
- CVE-2024-36280Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to potIntel(R) High Level Synthesis Compiler software
- CVE-2024-39372Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated user to potentially eIntel(R) XTU software for Windows
- CVE-2025-20097Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 maIntel(R) Server M50FCP Family and Intel(R) Server D50DNP Fa…
- CVE-2023-29164Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP,Intel(R) Server Board S2600WF, Intel(R) Server Board S2600S…
- CVE-2024-39355Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of seIntel(R) Processors
- CVE-2024-25571Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable deniaIntel(R) SPS firmware before SPS_E5_06.01.04.059.0
- CVE-2024-28047Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information discloIntel(R) Processors
- CVE-2024-31157Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable iIntel(R) Processors
- CVE-2024-39279Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enableIntel(R) processors
- CVE-2024-26021Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentiallyIntel(R) AMT and Intel(R) Standard Manageability
- CVE-2024-30211Improper access control in some Intel(R) ME driver pack installer engines before version 2422.6.2.0 may allow an authenticated user to potenIntel(R) ME driver pack installer engines
- CVE-2024-21859Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable informationIntel(R) Processors
- CVE-2024-39779Stack-based buffer overflow in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticateIntel(R) Ethernet Connection I219 Series
- CVE-2024-39797Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticated usIntel(R) Ethernet Connection I219 Series
- CVE-2024-24852Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated userIntel(R) Ethernet Adapter Complete Driver Pack
- CVE-2024-36291Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated uIntel(R) Chipset Software Installation Utility
- CVE-2024-32938Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentIntel(R) MPI Library for Windows software
- CVE-2024-39284Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable escaIntel(R) Advisor software
- CVE-2024-39813Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially enable escalation of EPCT software
- CVE-2024-41917Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticIntel(R) Battery Life Diagnostic Tool software
- CVE-2024-39286Incorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R) 800 Series Ethernet Driver before version 1.15.4 mIntel(R) 800 Series Ethernet Driver
- CVE-2024-42492Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.000BIOS and System Firmware Update Package for Intel(R) Server…
- CVE-2024-21830Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalatIntel(R) VPL software
- CVE-2024-41934Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of Intel(R) GPA software
- CVE-2024-42419Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentIntel(R) GPA and Intel(R) GPA Framework software installers
- CVE-2024-42410Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via locaIntel(R) Graphics Drivers
- CVE-2024-38310Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalatioIntel(R) Graphics Driver software installers
- CVE-2024-31153Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentiaIntel(R) QuickAssist Technology software
- CVE-2023-32277Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potentialIntel(R) QAT software
- CVE-2024-29223Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentialIntel(R) QuickAssist Technology software
- CVE-2025-0113Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker ContainersPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-1227ywoa AddressDao.xml selectList sql injectionywoa
- CVE-2025-0109PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-1226ywoa setup.jsp improper authorizationywoa
- CVE-2025-1225ywoa WXCallBack Interface XMLParse.java extract xml external entity referenceywoa
- CVE-2025-1224ywoa UserMapper.xml listNameBySql sql injectionywoa
- CVE-2025-1216ywoa OaNoticeMapper.xml selectNoticeList sql injectionywoa
- CVE-2025-1215vim main.c memory corruptionvim
- CVE-2025-25201Improper Validation of Admin Key in PIV Smartcardnitrokey-3-firmware
- CVE-2025-1214pihome-shc PiHome Role-Based Access Control user_accounts.php authorizationpihome-shc PiHome
- CVE-2024-6097Absolute Path Traversal VulnerabilityProgress Software Progress® Telerik® Reporting
- CVE-2025-1213pihome-shc PiHome index.php cross site scriptingpihome-shc PiHome
- CVE-2025-1210code-projects Wazifa System control.php sql injectioncode-projects Wazifa System
- CVE-2025-1209code-projects Wazifa System search_resualts.php searchuser cross site scriptingcode-projects Wazifa System
- CVE-2025-25184Possible Log Injection in Rack::CommonLoggerrack
- CVE-2024-11628Prototype Pollution in Progress® Telerik® Kendo UI for VueProgress Software Progress® Telerik® Kendo UI for Vue
- CVE-2025-1208code-projects Wazifa System Profile.php cross site scriptingcode-projects Wazifa System
- CVE-2024-12629Prototype Pollution in Progress® Telerik® KendoReactProgress Software Telerik KendoReact
- CVE-2025-1207phjounin TFTPD64 DNS denial of servicephjounin TFTPD64
- CVE-2024-9870Unintended Proxy or Intermediary ('Confused Deputy') in GitLabGitLab
- CVE-2025-0516Incorrect Authorization in GitLabGitLab
- CVE-2024-12379Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-1212Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLabGitLab
- CVE-2025-1042Files or Directories Accessible to External Parties in GitLabGitLab
- CVE-2025-1206Codezips Gym Management System viewdetailroutine.php sql injectionCodezips Gym Management System
- CVE-2025-1202SourceCodester Best Church Management Software edit_slider.php sql injectionSourceCodester Best Church Management Software
- CVE-2025-1201SourceCodester Best Church Management Software profile_crud.php sql injectionSourceCodester Best Church Management Software
- CVE-2024-23563HCL Connections Docs is vulnerable to a sensitive information disclosureHCL Software Connections Docs
- CVE-2025-1200SourceCodester Best Church Management Software slider_crud.php sql injectionSourceCodester Best Church Management Software
- CVE-2025-26376A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticaQ-Free MaxTime
- CVE-2025-26374A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allQ-Free MaxTime
- CVE-2025-26373A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 alloQ-Free MaxTime
- CVE-2025-26367A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authQ-Free MaxTime
- CVE-2025-26360A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to versioQ-Free MaxTime
- CVE-2025-26358A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an Q-Free MaxTime
- CVE-2025-26357A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticateQ-Free MaxTime
- CVE-2025-26355A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticateQ-Free MaxTime
- CVE-2025-26353A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote aQ-Free MaxTime
- CVE-2025-26352A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated Q-Free MaxTime
- CVE-2025-26351A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated Q-Free MaxTime
- CVE-2025-26350A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.1Q-Free MaxTime
- CVE-2025-21696mm: clear uffd-wp PTE/PMD state on mremap()Linux
- CVE-2025-21695platform/x86: dell-uart-backlight: fix serdev raceLinux
- CVE-2025-26348A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu eQ-Free MaxTime
- CVE-2025-21694fs/proc: fix softlockup in __read_vmcore (part 2)Linux
- CVE-2025-26346A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMQ-Free MaxTime
- CVE-2025-1102A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatQ-Free MaxTime
- CVE-2025-1101A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatQ-Free MaxTime
- CVE-2025-1199SourceCodester Best Church Management Software role_crud.php sql injectionSourceCodester Best Church Management Software
- CVE-2025-1197code-projects Real Estate Property Management System load_user-profile.php sql injectioncode-projects Real Estate Property Management System
- CVE-2024-10322Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthemefusecom Brizy – Page Builder
- CVE-2025-1196code-projects Real Estate Property Management System search.php cross site scriptingcode-projects Real Estate Property Management System
- CVE-2025-1195code-projects Real Estate Property Management System EditCategory cross site scriptingcode-projects Real Estate Property Management System
- CVE-2025-1192SourceCodester Multi Restaurant Table Reservation System select-menu.php sql injectionSourceCodester Multi Restaurant Table Reservation System
- CVE-2025-1230Cross-Site Scripting (XSS) vulnerability in PrestashopPrestashop
- CVE-2025-1191SourceCodester Multi Restaurant Table Reservation System approve-reject.php sql injectionSourceCodester Multi Restaurant Table Reservation System
- CVE-2025-1190code-projects Job Recruitment load_user-profile.php cross site scriptingcode-projects Job Recruitment
- CVE-2025-11891000 Projects Attendance Tracking Management System chart1.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-13437Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Updatechuhpl Book a Room
- CVE-2024-13459FuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingjeremyshapiro FuseDesk
- CVE-2024-13456Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingnmedia Easy Quiz Maker
- CVE-2025-0506Rise Blocks – A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parametereaglethemes Rise Blocks – A Complete Gutenberg Page Builder
- CVE-2025-1188Codezips Gym Management System updateroutine.php sql injectionCodezips Gym Management System
- CVE-2025-1187code-projects Police FIR Record Management System Delete Record stack-based overflowcode-projects Police FIR Record Management System
- CVE-2024-13814Global Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionLCweb Global Gallery - WordPress Responsive Gallery
- CVE-2025-1186dayrui XunRuiCMS Api.php deserializationdayrui XunRuiCMS
- CVE-2023-49780Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier.Extra Innovation acmailer CGI
- CVE-2024-13794Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosurejohndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall
- CVE-2024-13821WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulationwpdevelop Booking Calendar
- CVE-2025-1185pihome-shc PiHome ajax.php sql injectionpihome-shc PiHome
- CVE-2025-1184pihome-shc PiHome ajax.php sql injectionpihome-shc PiHome
- CVE-2025-1183CodeZips Gym Management System more-userprofile.php sql injectionCodeZips Gym Management System
- CVE-2024-13601Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Referenceahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…
- CVE-2024-13374WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name DisclosureJoomUnited WP Table Manager
- CVE-2024-13658NGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpo-hr NGG Smart Image Search
- CVE-2024-13665Admire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingsonalsinha21 Admire Extra
- CVE-2024-12164WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Resetcreativewerkdesigns WPSyncSheets For WPForms – Google Sheet…
- CVE-2024-11746Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsamdani GS Brands for WooCommerce
- CVE-2024-13769Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingThemeREX Puzzles | WP Magazine / Review with Store WordPres…
- CVE-2024-13541aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionaDirectory – WP Business Directory Plugin and Classified Ad…
- CVE-2024-13701Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingLiveticker
- CVE-2024-13749StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingera404 StaffList
- CVE-2025-0808Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletionpropertyhive Houzez Property Feed
- CVE-2024-13539AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosurevividcolorsjp AForms Eats
- CVE-2024-13554The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulationwpextended The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-29172Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability.Dell BSAFE SSL-J
- CVE-2024-29171Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability.Dell BSAFE SSL-J
- CVE-2024-53880NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparoundNVIDIA Triton Inference Server
- CVE-2024-0145NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based buffer overflow issue by means of a specially crNVIDIA nvJPEG2000
- CVE-2024-0144NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2NVIDIA nvJPEG2000
- CVE-2024-0143NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted NVIDIA nvJPEG2000
- CVE-2025-1243Field in api-go proxy not transformed before version 1.44.1Temporal Technologies api-go library · go.temporal.io/api
- CVE-2024-0142NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted NVIDIA nvJPEG2000
- CVE-2024-21971Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, rAMD Ryzen™ 5000 Series Desktop Processors · AMD Ryzen™… +25
- CVE-2024-34521A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows a
- CVE-2024-51122Cross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arb
- CVE-2024-54160dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not saniLF Projects OpenSearch
- CVE-2024-56938LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.
- CVE-2024-56939LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.
- CVE-2024-57601Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the lealextselegidis/easyappointments
- CVE-2024-57603An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.github.com/mayswind/ezbookkeeping
- CVE-2024-57605Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /
- CVE-2025-25741D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in th