Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 16 of 47
Aug 14, 2025Kalium: Cross-Site Request Forgery (CSRF)CVE-2025-53347 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Premium Addons for KingComposer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49036 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.
- Product
- Premium Addons for KingComposer
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Premium Addons for KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 11, 2025Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php.CVE-2012-10038 · Other software · Auxilium · reported by VulnCheckCritical 9.3
Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.
- Product
- RateMyPet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Aug 10, 2025A vulnerability was found in oitcode samarium up to 0.9.6.CVE-2025-8798 · Other software · oitcode · reported by VulDBMedium 5.5
A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product of the component Create Product Page. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- samarium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability classified as critical was found in CesiumLab Web up to 4.0.CVE-2025-8744 · Other software · CesiumLab · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in CesiumLab Web up to 4.0. This vulnerability affects unknown code of the file /lodmodels/. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.CVE-2025-36020 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.CVE-2025-53544 · Other software · TriliumNext · reported by GitHubHigh 7.5
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file anCVE-2025-53395 · Other software · reported by MITREHigh 7.7
Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs because of untrusted DLL search path behavior in ReflectMonitor.exe.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmacrium.commacrium.com
Aug 4, 2025Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup filCVE-2025-53394 · Other software · reported by MITREHigh 7.7
Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and proceeds to mount it, Reflect launches the renamed executable (e.g., explorer.exe), which is under attacker control. This occurs because of insufficient validation of companion files referenced during backup mounting.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmacrium.commacrium.com
Jul 31, 2025A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bCVE-2013-10043 · Other software · Astium · reported by VulnCheckCritical 9.5
A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise.
- Product
- VoIP PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Jul 28, 2025A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860.CVE-2025-32731 · Other software · MedDream · reported by talos-cna@cisco.comMedium 6.1
A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 28, 2025A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840.CVE-2025-27724 · Other software · MedDream · reported by talos-cna@cisco.comCritical 9.3
A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead to elevated capabilities. An attacker can upload a malicious file to trigger this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 28, 2025An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840.CVE-2025-26469 · Other software · MedDream · reported by talos-cna@cisco.comCritical 9.3
An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially crafted application can decrypt credentials stored in a configuration-related registry key. An attacker can execute a malicious script or application to exploit this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 28, 2025A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860.CVE-2025-24485 · Other software · MedDream · reported by talos-cna@cisco.comMedium 5.8
A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 24, 2025This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.CVE-2025-22165 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.9
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
- Product
- Sourcetree for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.CVE-2025-7398 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.6
Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.
- Product
- Brocade ASCG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025Google Chromium ANGLE and GPU Improper Input Validation VulnerabilityCVE-2025-6558 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium
- On CISA’s list since
- Jul 22, 2025 (federal fix deadline Aug 12, 2025)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Jul 11, 2025Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-47964 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2025-47963 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.CVE-2025-47182 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Premium Age Verification / Restriction for: Arbitrary file read and writeCVE-2025-7401 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible.
- Product
- Premium Age Verification / Restriction for
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Premium Age Verification / Restriction for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 6, 2025A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162.CVE-2025-7098 · Other software · Comodo · reported by VulDBLow 2.9
A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component File Name Handler. The manipulation of the argument name/folder leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Internet Security Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jul 6, 2025A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162.CVE-2025-7097 · Other software · Comodo · reported by VulDBHigh 8.2
A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Internet Security Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jul 6, 2025A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162.CVE-2025-7096 · Other software · Comodo · reported by VulDBHigh 8.2
A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Internet Security Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jul 6, 2025A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162.CVE-2025-7095 · Other software · Comodo · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Internet Security Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jul 4, 2025Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-11937 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.10.69
- What to do
- Affects up to 4.10.69. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 2, 2025Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-49713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2025-49741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Google Chromium V8 Type Confusion VulnerabilityCVE-2025-6554 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.1
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Jul 2, 2025 (federal fix deadline Jul 23, 2025)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Jun 20, 2025Tealium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50018 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affects Tealium: from n/a through <= 2.1.20.
- Product
- Tealium
- Affected
- up to 2.1.20
- What to do
- Affects up to 2.1.20. Update Tealium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start We should call CVE-2022-50017 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 18, 2025In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerabilityCVE-2025-1088 · Other software · Grafana · reported by security@grafana.comLow 2.7
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the programCVE-2025-3473 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.7
IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection.CVE-2025-4678 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-4774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.8
- What to do
- Affects up to 4.11.8. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2025WC MyParcel Belgium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48279 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.
- Product
- WC MyParcel Belgium
- What to do
- Update WC MyParcel Belgium to the newest version.
Jun 6, 2025WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6.
- Product
- WPDM – Premium Packages
- Affected
- up to 6.0.6
- What to do
- Affects up to 6.0.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2025Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityCVE-2025-5419 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Jun 5, 2025 (federal fix deadline Jun 26, 2025)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
May 30, 2025Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP.CVE-2025-48883 · Other software · chrome-php · reported by GitHubMedium 5.3
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding manually to their selectors if they are unable to upgrade.
- Product
- chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNCVE-2025-46352 · Other software · Consilium Safety · reported by ics-cert@hq.dhs.govCritical 9.3
The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNC. This password cannot be altered, allowing anyone with knowledge of it to gain remote access to the panel. Such access could enable an attacker to operate the panel remotely, potentially putting the fire panel into a non-functional state and causing serious safety issues.
- Product
- CS5000 Fire Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govconsiliumsafety.com
May 29, 2025The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel.CVE-2025-41438 · Other software · Consilium Safety · reported by ics-cert@hq.dhs.govCritical 9.3
The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited.
- Product
- CS5000 Fire Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govconsiliumsafety.com
May 27, 2025IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.CVE-2025-25029 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.CVE-2025-25026 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2025-25025 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Spotlight - Social Media Feeds (Premium): Insertion of Sensitive Information Into Sent DataCVE-2025-39498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7.1.
- Product
- Spotlight - Social Media Feeds (Premium)
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Spotlight - Social Media Feeds (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code.CVE-2025-41380 · Other software · Intellian Technologies · reported by cve-coordination@incibe.esMedium 6.1
Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string.
- Product
- Iridium Certus 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025The Intellian C700 web panel allows you to add firewall rules.CVE-2025-41379 · Other software · Intellian Technologies · reported by cve-coordination@incibe.esMedium 6.3
The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID used to create the database entry may be different from the JSON ID. If the rule needs to be deleted later, the system will use the JSON ID and therefore fail. This can be exploited by an attacker to create rules that cannot be deleted unless the device is reset to factory defaults.
- Product
- Iridium Certus 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file.CVE-2025-41378 · Other software · Intellian Technologies · reported by cve-coordination@incibe.esMedium 6.9
The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel.
- Product
- Iridium Certus 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025JP Students Result Management System Premium: Unrestricted Upload of File with Dangerous TypeCVE-2025-31916 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.
- Product
- JP Students Result Management System Premium
- What to do
- Update JP Students Result Management System Premium to the newest version.
May 22, 2025Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.CVE-2025-47181 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Edge (Chromium-based) Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.