Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,376 results · page 126 of 348
Mar 13, 2025Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow CVE-2025-2080 · Other software · Optigo Networks · reported by ics-cert@hq.dhs.govCritical 9.3
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
- Product
- Visual BACnet Capture Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025CRM and Lead Management by vcita: Unauthorized modification of dataCVE-2024-13703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable plugin widgets.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2025A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3.CVE-2025-2217 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3. This affects the function ProcessRequest of the file /getAdyData.ashx. The manipulation of the argument showid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3.CVE-2025-2216 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova.CVE-2025-26701 · Other software · Percona · reported by MITRECritical 10
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
- Product
- Monitoring and Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCVE-2025-26633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
- Product
- Windows
- On CISA’s list since
- Mar 11, 2025 (federal fix deadline Apr 1, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comvicarius.io
Mar 11, 2025Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.CVE-2025-21199 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
- Product
- Azure Agent for Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Pimcore is an open source data and experience management platform.CVE-2025-27617 · Other software · pimcore · reported by GitHubMedium 6.3
Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Umbraco is a free and open source .NET content management system.CVE-2025-27602 · Other software · umbraco · reported by GitHubMedium 4.9
Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Umbraco is a free and open source .NET content management system.CVE-2025-27601 · Other software · umbraco · reported by GitHubMedium 4.3
Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.CVE-2025-26706 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
- Product
- GoldenDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.CVE-2025-26705 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
- Product
- GoldenDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.CVE-2025-26704 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
- Product
- GoldenDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.CVE-2025-26703 · Other software · ZTE · reported by psirt@zte.com.cnMedium 4.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
- Product
- GoldenDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.CVE-2025-26707 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
- Product
- GoldenDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS).CVE-2025-27431 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025This issue was addressed through improved state management.CVE-2022-48610 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 10, 2025A double free issue was addressed with improved memory management.CVE-2022-43454 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A double free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 10, 2025A cookie management issue was addressed with improved state management.CVE-2024-54467 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 10, 2025A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0.CVE-2025-2147 · Other software · Beijing Zhide Intelligent Internet Technology · reported by VulDBMedium 6.9
A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Modern Farm Digital Integrated Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.CVE-2025-27254 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 9, 2025A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1.CVE-2025-2115 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7.CVE-2025-2114 · Other software · Shenzhen Sixun Software · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the component Reset Password Interface. The manipulation of the argument OperId leads to improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Sixun Shanghui Group Business Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2025VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2024-11640 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- VikRentCar Car Rental Management System
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2025operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that caCVE-2025-27839 · Other software · Tangem · reported by MITRELow 3.2
operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible.
- Product
- SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025School Management System for: Privilege escalationCVE-2024-9658 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email and password through the mj_smgt_update_user() and mj_smgt_add_admission() functions, along with a local file inclusion vulnerability. This makes it possible for authenticated attackers, with student-level access and above, to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account. This was escalated four months ago after no response to our initial outreach, yet it still vulnerable.
- Product
- School Management System for
- Affected
- up to 93.0.0
- What to do
- Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 7, 2025School Management System for: Reflected Cross-Site ScriptingCVE-2024-12611 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- School Management System for
- Affected
- up to 93.0.0
- What to do
- Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 7, 2025School Management System for: Unauthorized loss of dataCVE-2024-12610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for unauthenticated attackers to delete arbitrary posts.
- Product
- School Management System for
- Affected
- up to 93.0.0
- What to do
- Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 7, 2025School Management System for: SQL InjectionCVE-2024-12609 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the mj_smgt_view_student_attendance() function. This makes it possible for authenticated attackers, with Student-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- School Management System for
- Affected
- up to 92.0.0
- What to do
- Affects up to 92.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 7, 2025School Management System for: SQL InjectionCVE-2024-12607 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_event_task' AJAX action in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- School Management System for
- Affected
- up to 92.0.0
- What to do
- Affects up to 92.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 6, 2025An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field duCVE-2025-25497 · Other software · reported by MITREHigh 8.1
An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.netsweeper.compacketstorm.news
Mar 6, 2025fleetdm/fleet is an open source device management, built on osquery.CVE-2025-27509 · Other software · fleetdm · reported by GitHubCritical 9.3
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows CrossCVE-2025-0877 · Other software · AtaksAPP · reported by iletisim@usom.gov.trMedium 4.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting (XSS). This issue affects Reservation Management System: before 4.2.3.
- Product
- Reservation Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 5, 2025Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.CVE-2024-48246 · Other software · Janobe · reported by MITREMedium 5.4
Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.
- Product
- Vehicle Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control.CVE-2024-31525 · Other software · reported by MITREHigh 7.2
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Mar 5, 2025A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a crCVE-2025-20208 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.6
A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco TelePresence Management Suite (TMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Mar 4, 2025NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BCVE-2024-0114 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.1
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- NVIDIA Hopper HGX 8-GPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0.CVE-2025-1959 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0. Affected is an unknown function of the file /change_s_pwd.php. The manipulation of the argument login_id/login_key leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof aCVE-2025-1969 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process
- Product
- Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Mar 4, 2025A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remCVE-2020-3122 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to obtain sensitive network information.
- Product
- Cisco IronPort Security Management Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbst.cloudapps.cisco.com
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27402 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27401 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27156 · Other software · Enalean · reported by GitHubMedium 4.1
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27150 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2025-27521 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-58048 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-58046 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because usCVE-2025-27221 · Other software · ruby-lang · reported by MITRELow 3.2
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
- Product
- URI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Mar 3, 2025In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.CVE-2025-27220 · Other software · ruby-lang · reported by MITREMedium 4
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Mar 3, 2025In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability.CVE-2025-27219 · Other software · ruby-lang · reported by MITREMedium 5.8
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.