CVEs published February 18, 2025
162 CVEs were published on February 18, 2025: 24 critical, 44 high.
- Published
- 162
- Critical
- 24
- High
- 44
- Medium
- 90
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- LabRedesCefetRJ WeGIA
- 13
- denx U-Boot
- 6
- grub2 · Red Hat Enterprise Linux +1
- 6
- LuxSoft The LuxCal Web Calendar
- 4
- Cordaware bestinformed Web
- 3
- undsgn Uncode
- 3
- xmlsoft libxml2
- 3
- 1clickmigration 1 Click Migration & Backup: Free WordPress…
- 2
- ChurchCRM
- 2
- FormCraft
- 2
Critical 24
- CVE-2025-26605SQL Injection endpoint 'deletar_cargo.php' parameter 'id_cargo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26606SQL Injection endpoint 'informacao_adicional.php' parameter 'id_descricao' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26607SQL Injection endpoint 'documento_excluir.php' parameter 'id_funcionario' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26608SQL Injection endpoint 'dependente_docdependente.php' parameter 'id_dependente', 'id_doc' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26609SQL Injection endpoint 'familiar_docfamiliar.php' parameter 'id_dependente', 'id_doc' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26610SQL Injection endpoint 'restaurar_produto_desocultar.php' parameter 'id_produto' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26611SQL Injection endpoint 'remover_produto.php' parameter 'id_produto' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26612SQL Injection endpoint 'adicionar_almoxarife.php' parameter 'id_almoxarifado', 'id_funcionario' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26613OS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26614SQL Injection endpoint 'deletar_documento.php' parameter 'id_cargo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26615Path Traversal endpoint 'examples.php' parameter 'src' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26616Path Traversal endpoint 'exportar_dump.php' parameter 'file' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-26617SQL Injection endpoint 'historico_paciente.php' parameter 'id_fichamedica' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-22654WordPress Simplified Plugin Plugin <= 1.0.6 - Arbitrary File Upload vulnerabilitykodeshpa Simplified
- CVE-2024-56000WordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerabilitySeventhQueen K Elements
- CVE-2025-24895SAML Response Signature Verification Bypass in CIE.AspNetCore.Authenticationitalia cie-aspnetcore · CIE.AspNetCore.Authentication
- CVE-2025-24894SAML Response Signature Verification Bypass in SPID.AspNetCore.Authenticationitalia spid-aspnetcore · SPID.AspNetCore.Authentication
- CVE-2025-1023SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpChurchCRM
- CVE-2024-12860CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeoverscriptsbundle CarSpot – Dealership Wordpress Classified The…
- CVE-2024-13725Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusioninfusionsoft Keap Official Opt-in Forms
- CVE-2024-39327Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate
- CVE-2024-55460A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allow
- CVE-2024-57045A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authen
- CVE-2025-25467Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a
High 44
- CVE-2025-22663WordPress Paid Videochat Turnkey Site plugin <= 7.2.12 - Arbitrary File Deletion vulnerabilityvideowhisper Paid Videochat Turnkey Site
- CVE-2025-22657WordPress Atarim plugin <= 4.0.9 - Arbitrary Content Deletion vulnerabilityVito Peleg Atarim
- CVE-2025-22656WordPress Cookie Monster Plugin <= 1.2.2 - Local File Inclusion vulnerabilityOscar Alvarez Cookie Monster
- CVE-2025-22639WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerabilityTechspawn Distance Rate Shipping for WooCommerce
- CVE-2025-26604Possibility to retrieve bot token by malicious module developers in Discord-Bot-Framework-KernelDiscord-Agora Kernel
- CVE-2025-25305SSL validation for outgoing requests in Home Assistant Core and used libs not correcthome-assistant core · homeassistant
- CVE-2025-25284Path Traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS ImplementationZOO-Project
- CVE-2025-21703netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()Linux
- CVE-2025-21702pfifo_tail_enqueue: Drop new packet when sch->limit == 0Linux
- CVE-2025-0817FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadFormCraft
- CVE-2024-13681Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembedundsgn Uncode
- CVE-2025-0521Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scriptingsaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2024-13797PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode ExecutionPressLayouts PressMart - Modern Elementor WooCommerce WordP…
- CVE-2025-0981Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldChurchCRM
- CVE-2025-0425Local Privilege Escalation via Config ManipulationCordaware bestinformed Infoclient
- CVE-2025-0422Authenticated Remote Code Execution via ScriptVarCordaware bestinformed Web
- CVE-2024-13704Super Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scriptingthemepoints Super Testimonial – Testimonial & Customer Revi…
- CVE-2024-57964Insecure Loading of Dynamic Link Libraries in HVAC Energy Saving ProgramHitachi HVAC Energy Saving Program
- CVE-2024-57963Insecure Loading of Dynamic Link Libraries in USB-CONVERTERCABLE DRIVERHitachi USB-CONVERTERCABLE DRIVER
- CVE-2024-13315Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options UpdateShopwarden – Automated WooCommerce monitoring & testing
- CVE-2024-13556Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injectionwecantrack Affiliate Links – Link Cloaking and Management
- CVE-2024-13677GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeoveristmoplugins GetBookingsWP – Appointments Booking Calendar…
- CVE-2024-13622File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directoryimagisol File Uploads Addon for WooCommerce
- CVE-2024-12314Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoningmegaoptim Rapid Cache
- CVE-2024-13852Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Updatebackie Option Editor
- CVE-2024-13684Reset <= 1.6 - Cross-Site Request Forgery to Database Resetshubhamgrover7256 Reset
- CVE-2025-25222The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrLuxSoft The LuxCal Web Calendar
- CVE-2025-25221The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.LuxSoft The LuxCal Web Calendar
- CVE-2024-50608An issue was discovered in Fluent Bit 3.1.9.
- CVE-2024-50609An issue was discovered in Fluent Bit 3.1.9.
- CVE-2024-51505An issue was discovered in Atos Eviden IDRA before 2.7.1.
- CVE-2024-56171libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlscxmlsoft libxml2
- CVE-2024-56883Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control.
- CVE-2024-57046A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the aut
- CVE-2024-57254An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesydenx U-Boot
- CVE-2024-57255An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of denx U-Boot
- CVE-2024-57256An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafteddenx U-Boot
- CVE-2024-57258Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, denx U-Boot
- CVE-2024-57259sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory lidenx U-Boot
- CVE-2025-24928libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c.xmlsoft libxml2
- CVE-2025-25475A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-25893An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol
- CVE-2025-25894An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters.
- CVE-2025-25895An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter.
Medium, low and unrated 94
- CVE-2024-13508Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parametermasaakitanaka Booking Package
- CVE-2025-26624Local Privilege Escalation in Rufus 4.6 and previous versionspbatard rufus
- CVE-2024-13743Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewonderplugin Wonder Video Embed
- CVE-2025-22650WordPress Smartarget.online Integration plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityErez Hadas-Sonnenschein Smartarget
- CVE-2025-22645WordPress Real Estate Manager plugin <= 7.3 - Captcha Bypass Vulnerability vulnerabilityRameez Iqbal Real Estate Manager
- CVE-2025-27016WordPress Drivr Lite – Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerabilityawsm.in Drivr Lite – Google Drive Plugin
- CVE-2025-27013WordPress MediCenter theme < 14.7 - Sensitive Data Exposure vulnerabilityQuanticaLabs MediCenter - Health Medical Clinic
- CVE-2025-0622Grub2: command/gpg: use-after-free due to hooks not being removed on module unloadgrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45783Grub2: fs/hfs+: refcount can be decremented twicegrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45781Grub2: fs/ufs: oob write in the heapgrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45776Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.grub2 · Red Hat Enterprise Linux +1
- CVE-2024-45775Grub2: commands/extcmd: missing check for failed allocationgrub2 · Red Hat Enterprise Linux +1
- CVE-2025-26623Use After Free in Exiv2exiv2
- CVE-2025-26603heap-use-after-free in function str_to_reg in vim/vimvim
- CVE-2025-26465Openssh: machine-in-the-middle attack if verifyhostkeydns is enabledOpenSSH · Red Hat Enterprise Linux +2
- CVE-2024-45774Grub2: reader/jpeg: heap oob write during jpeg parsinggrub2 · Red Hat Enterprise Linux +1
- CVE-2025-21608Forged packets over MQTT can show up in direct messages in Meshtastic firmwaremeshtastic firmware
- CVE-2024-4028Keycloak-core: stored xss in keycloak when creating a items in admin consolekeycloak · Red Hat Build of Keycloak +2
- CVE-2025-25300smartbanner.js rel noopener XSS vulnerabilityain smartbanner.js · smartbanner.js
- CVE-2025-26620Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access TokensDuendeSoftware foss · Duende.AccessTokenManagement
- CVE-2024-49589Foundry artifacts denial of servicecom.palantir.artifacts:artifacts
- CVE-2025-22207[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentJoomla! Project Joomla! CMS
- CVE-2024-13689Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_mediasundsgn Uncode Core
- CVE-2025-1269Open Redirect in HAVELSAN's Open Source Project Liman MYSHAVELSAN Liman MYS
- CVE-2025-1414Memory safety bugs fixed in Firefox 135.0.1Mozilla Firefox
- CVE-2025-1035Path Traversal in Komtera Technolgies' KLog ServerKomtera Technolgies KLog Server
- CVE-2024-13783FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.phpFormCraft
- CVE-2024-13691Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMediaundsgn Uncode
- CVE-2024-13667Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-descriptionundsgn Uncode
- CVE-2024-13369Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id ParameterGoodLayers Tour Master - Tour Booking, Travel, Hotel
- CVE-2024-13395Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingkerryoco Threepress
- CVE-2024-13316Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creationakashmalik Scratch & Win – Giveaways and Contests. Boost su…
- CVE-2024-13718Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modificationwpdesk Flexible Wishlist for WooCommerce – Ecommerce Wishli…
- CVE-2025-0424Multiple Authenticated Stored Cross-Site ScriptingCordaware bestinformed Web
- CVE-2025-0423Multiple Unauthenticated Stored Cross-Site ScriptingCordaware bestinformed Web
- CVE-2024-13575Web Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingmagazine3 Web Stories Enhancer – Level Up Your Web Stories
- CVE-2025-0864Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scriptingrealmag777 Active Products Tables for WooCommerce. Use cons…
- CVE-2024-13795Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation MessageEcwid by Lightspeed Ecommerce Shopping Cart
- CVE-2024-13465aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingkodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2024-11895Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingvcita Online Payments – Get Paid with PayPal, Square & Stri…
- CVE-2024-11376s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scriptingclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2024-13523MemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scriptingshenyanzhi MemorialDay
- CVE-2024-13438SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear CacheSpeedSize Image & Video AI-Optimizer
- CVE-2024-45320Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw FUJIFILM Business Innovation DocuPrint CP225w · FUJIFILM… +2
- CVE-2024-13582Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinglabibahmed42 Simple Pricing Tables For WPBakery Page Builder
- CVE-2024-136091 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php1clickmigration 1 Click Migration & Backup: Free WordPress…
- CVE-2024-13464Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingphotonicgnostic Library Bookshelves
- CVE-2024-13565Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parametershaonback2 Simple Map No Api
- CVE-2024-135551 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation1clickmigration 1 Click Migration & Backup: Free WordPress…
- CVE-2024-13848Reaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingjakob42 Reaction Buttons
- CVE-2024-13687Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Updatelabibahmed42 Team Builder – Meet the Team
- CVE-2024-13573Zigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsoftdiscover Zigaform – Form Builder Lite
- CVE-2024-13535Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosuremarcoingraiti Actionwear products sync
- CVE-2024-13576Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingadityapatadia Gumlet Video
- CVE-2024-12525Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinghomeasap Easy MLS Listings Import
- CVE-2024-13588Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingkenkwasnicki Simplebooklet PDF Viewer and Embedder
- CVE-2024-13577CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingcatssoft CATS Job Listings
- CVE-2024-13540WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosuremdalabar WooODT Lite – Delivery & pickup date time location…
- CVE-2024-12813Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingpixelgrade Open Hours – Easy Opening Hours
- CVE-2025-0796Mortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Resetkevin-brent WPrequal
- CVE-2024-13579WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingplatcom WP-Asambleas
- CVE-2024-13595Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injectionpantherius Simple Signup Form
- CVE-2024-13501WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeveerwest WP-FormAssembly
- CVE-2024-13578WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingzjhzxhz WP-BibTeX
- CVE-2025-0805Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scriptingmlcalc Mortgage Calculator / Loan Calculator
- CVE-2024-13538BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosutedevsmip BigBuy Dropshipping Connector for WooCommerce
- CVE-2024-13581Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingsupporthost Simple Charts
- CVE-2024-13587Zigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingsoftdiscover Zigaform – Price Calculator & Cost Estimation…
- CVE-2024-13522magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scriptingmagayo Lottery Results
- CVE-2025-1390pam_cap: Fix potential configuration parsing errorOpenAnolis Anolis OS
- CVE-2024-13740ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosuremetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-13741ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgerymetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2025-25224The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerabilityLuxSoft The LuxCal Web Calendar
- CVE-2025-25223The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloaLuxSoft The LuxCal Web Calendar
- CVE-2022-41545The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via ba
- CVE-2024-39328Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0.
- CVE-2024-56882Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-57055Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain serv
- CVE-2024-57056Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could b
- CVE-2024-57257A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.denx U-Boot
- CVE-2025-22919A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a cra
- CVE-2025-22920A heap buffer overflow vulnerability in FFmpeg before commit 4bf784c allows attackers to trigger a memory corruption via supplying a crafted
- CVE-2025-22921FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
- CVE-2025-25468FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.
- CVE-2025-25469FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.
- CVE-2025-25471FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c.
- CVE-2025-25472A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file.
- CVE-2025-25473FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.
- CVE-2025-25474DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.
- CVE-2025-25891A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters.
- CVE-2025-25892A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters.
- CVE-2025-25896A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters.
- CVE-2025-26058Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection.
- CVE-2025-27113libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.xmlsoft libxml2