Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

456new WordPress flaws this week

393,009entries in the database

16,433 results · page 122 of 329

Mar 27, 2025An intent redriction vulnerability exists in the Xiaomi quick App framework application product.CVE-2024-45353 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.
Product
quick app framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trust.mi.com
Mar 27, 2025Export All Posts, Products, Orders, Refunds & Users: PHP Object InjectionCVE-2025-2332 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.13
What to do
Affects up to 2.13. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025An code execution vulnerability exists in the Xiaomi smarthome application product.CVE-2024-45352 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
Product
Xiaomi smarthome application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trust.mi.com
Mar 26, 2025Product Catalog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30524 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.
Product
Product Catalog
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025An authenticated attacker can compromise the availability of the device via the networkCVE-2025-2820 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6Medium 6.5
An authenticated attacker can compromise the availability of the device via the network
Product
Product family GLx and CWx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Mar 26, 2025Custom Product Stickers for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-product-stickers-for-woocommerce allows Reflected XSS.This issue affects Custom Product Stickers for Woocommerce: from n/a through <= 1.9.0.
Product
Custom Product Stickers for Woocommerce
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Custom Product Stickers for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025A code execution vulnerability exists in the Xiaomi Game center application product.CVE-2024-45351 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.8
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
Product
Game center application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trust.mi.com
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: PHP Object InjectionCVE-2025-1913 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-Side Request ForgeryCVE-2025-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Arbitrary file deletionCVE-2025-1911 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Directory TraversalCVE-2025-1769 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Active Products Tables for WooCommerce. Use constructor to create tables: Unauthorized filter callingCVE-2025-1514 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.
Product
Active Products Tables for WooCommerce. Use constructor to create tables
Affected
up to 1.0.6.7
What to do
Affects up to 1.0.6.7. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12109 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Product Labels For Woocommerce (Sale Badges)
Fixed in
1.5.9
What to do
Update Product Labels For Woocommerce (Sale Badges) to 1.5.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10638 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Product Labels For Woocommerce (Sale Badges)
Fixed in
1.5.11
What to do
Update Product Labels For Woocommerce (Sale Badges) to 1.5.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 24, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.CVE-2025-0835 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
Product
Graphics DDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record imaginationtech.com
Mar 24, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages.CVE-2025-0478 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform, altering their behaviour.
Product
Graphics DDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record imaginationtech.com
Mar 20, 2025A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database.CVE-2024-8099 · Other software · vanna-ai · reported by security@huntr.devHigh 8.3
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as `read_csv`, `read_csv_auto`, `read_text`, and `read_blob`, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks.
Product
vanna-ai/vanna
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com
Mar 20, 2025A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version.CVE-2024-11958 · Other software · run-llama · reported by security@huntr.devCritical 9.8
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
Product
run-llama/llama_index
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 19, 2025IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's enviroCVE-2024-45644 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.7
IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
Product
Security ReaQta
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Mar 19, 2025SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone imageCVE-2025-30234 · Other software · MNX · reported by MITREHigh 8.3
SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone image from 2024-07-26).
Product
SmartOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tritondatacenter.com smartos.topicbox.com
Mar 17, 2025An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authenticatCVE-2025-25650 · Other software · reported by MITRECritical 9.1
An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com media.blackhat.com
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x througCVE-2025-0828 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Product
ENOVIA Product Engineering Specialist
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows anCVE-2025-0600 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Product
ENOVIA Collaborative Industry Innovator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com
Mar 15, 2025A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading databaseCVE-2025-1057 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Mar 14, 2025The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target sCVE-2025-27593 · Other software · SICK AG · reported by psirt@sick.deCritical 9.3
The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
Product
SICK DL100-2xxxxxxx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.sick.com github.security.telekom.com
Mar 13, 2025A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability.CVE-2025-1650 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
AutoCAD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Mar 13, 2025A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability.CVE-2025-1649 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
AutoCAD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Mar 13, 2025A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability.CVE-2025-1427 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
AutoCAD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Mar 11, 2025Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-27440 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Product
Zoom Workplace Apps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Mar 11, 2025Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-27439 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Product
Zoom Workplace Apps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Mar 11, 2025Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityCVE-2025-24201 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 10
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Mar 13, 2025 (federal fix deadline Apr 3, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 11, 2025Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-0151 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Product
Zoom Workplace Apps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Mar 11, 2025Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network accCVE-2025-0150 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Workplace Apps for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Mar 11, 2025Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.CVE-2025-0149 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
Product
Zoom Apps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Mar 11, 2025ProductDyno: Reflected Cross-Site ScriptingCVE-2024-13413 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320.
Product
ProductDyno
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update ProductDyno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2025-1661 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.5
What to do
Affects up to 1.3.6.5. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025Product Input Fields for WooCommerce: Arbitrary file uploadsCVE-2024-13359 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
Product
Product Input Fields for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions.CVE-2024-53694 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later
Product
QVPN Device Client for Mac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qnap.com
Mar 7, 2025An exposure of sensitive information vulnerability has been reported to affect product.CVE-2024-13086 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later QuTS hero h5.2.0.2851 build 20240808 and later
Product
QTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qnap.com
Mar 7, 2025Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry.CVE-2025-27519 · Other software · truefoundry · reported by GitHubCritical 9.3
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243.
Product
cognita
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2025Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry.CVE-2025-27518 · Other software · truefoundry · reported by GitHubMedium 6.9
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15.
Product
cognita
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.CVE-2024-12837 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
Product
Graphics DDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record imaginationtech.com
Mar 7, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics outpCVE-2024-12576 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceMedium 5.5
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics output.
Product
Graphics DDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record imaginationtech.com
Mar 5, 2025A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a crCVE-2025-20208 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.6
A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Product
Cisco TelePresence Management Suite (TMS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Mar 5, 2025External XML entity injection allows arbitrary download of files.CVE-2025-24521 · Other software · Keysight · reported by ics-cert@hq.dhs.govMedium 6.9
External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
Product
Ixia Vision Product Family
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ixiacom.com support.ixiacom.com
Mar 5, 2025Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user).CVE-2025-24494 · Other software · Keysight · reported by ics-cert@hq.dhs.govHigh 8.6
Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user). In combination with the 'Upload' functionality this could be used to execute an arbitrary script or possibly an uploaded binary. Remediation in Version 6.7.0, release date: 20-Oct-24.
Product
Ixia Vision Product Family
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ixiacom.com support.ixiacom.com
Mar 5, 2025Path traversal may lead to arbitrary file deletion.CVE-2025-23416 · Other software · Keysight · reported by ics-cert@hq.dhs.govMedium 6.9
Path traversal may lead to arbitrary file deletion. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
Product
Ixia Vision Product Family
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ixiacom.com support.ixiacom.com
Mar 5, 2025Path traversal may lead to arbitrary file download.CVE-2025-21095 · Other software · Keysight · reported by ics-cert@hq.dhs.govMedium 6.9
Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
Product
Ixia Vision Product Family
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ixiacom.com support.ixiacom.com
Mar 5, 2025Recently Purchased Products For Woo: Stored Cross-Site ScriptingCVE-2025-1008 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Recently Purchased Products For Woo
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Recently Purchased Products For Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.CVE-2025-1393 · Other software · Weidmueller · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.
Product
PROCON-WIN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.