Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,428 results · page 16 of 49

Feb 12, 2025A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attCVE-2025-26343 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26342 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26341 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacCVE-2025-26340 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticCVE-2025-26339 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker tCVE-2025-1102 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker tCVE-2025-1101 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to CVE-2025-1100 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 6, 2025Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injecCVE-2023-5878 · Other software · Honeywell · reported by psirt@honeywell.comCritical 9.4
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to R322.3, R330.2 or the most recent version of this product2.
Product
OneWireless Network Wireless Device Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record process.honeywell.com
Feb 3, 2025Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as accounCVE-2024-56903 · Other software · reported by MITREHigh 8.1
Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2025Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includingCVE-2024-56902 · Other software · reported by MITREHigh 7.5
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2025A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily createCVE-2024-56901 · Other software · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2025Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less.CVE-2024-56898 · Other software · reported by MITREHigh 8.8
Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 31, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-10867 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Frictionless: Stored Cross-Site ScriptingCVE-2024-13396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionless_form' shortcode[s] in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frictionless
Affected
up to 0.0.23
What to do
Affects up to 0.0.23. Update Frictionless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Remote Code ExecutionCVE-2024-11600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Unauthorized loss of dataCVE-2024-11583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025Passwordless WP – Login with your glance or fingerprint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through <= 1.1.6.
Product
Passwordless WP – Login with your glance or fingerprint
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Passwordless WP – Login with your glance or fingerprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library byCVE-2025-0696 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 5.3
A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
Product
Frozen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Jan 27, 2025An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the compoCVE-2025-0695 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 5.3
An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
Product
Frozen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Jan 14, 2025H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function.CVE-2024-57482 · Other software · H3c · reported by MITRECritical 9.8
H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
Product
N12 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jan 14, 2025H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function.CVE-2024-57471 · Other software · H3c · reported by MITRECritical 9.8
H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
Product
N12 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jan 14, 2025A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39757 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39603 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39359 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-39357 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-36493 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505.CVE-2024-34544 · Other software · Wavlink · reported by talos-cna@cisco.comCritical 9.1
A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Wavlink AC3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 14, 2025Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Authentication BypassCVE-2024-12919 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.7
What to do
Affects up to 2.13.7. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-22144 · Other software · NamelessMC · reported by GitHubCritical 9
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Nameless
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 13, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-22142 · Other software · NamelessMC · reported by GitHubMedium 6.3
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Nameless
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 7, 2025Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command executiCVE-2024-54007 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system.
Product
HPE Aruba Networking 501 Wireless Client Bridge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Jan 7, 2025Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command executiCVE-2024-54006 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system.
Product
HPE Aruba Networking 501 Wireless Client Bridge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.
Product
SSL Wireless SMS Notification
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025CoCart – Headless ecommerce: Missing AuthorizationCVE-2023-47241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.
Product
CoCart – Headless ecommerce
Affected
up to 3.11.2
What to do
Affects up to 3.11.2. Update CoCart – Headless ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024SSL Wireless SMS Notification: Incorrect Privilege AssignmentCVE-2024-56220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.
Product
SSL Wireless SMS Notification
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2024The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regulCVE-2024-12838 · Other software · Changing Information Technology · reported by twcert@cert.org.twHigh 8.8
The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators.
Product
CGFIDO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 27, 2024In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errorCVE-2024-56597 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Dec 20, 2024An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs.CVE-2023-31280 · Other software · Sierra Wireless · reported by security@sierrawireless.comMedium 5.3
An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial Number in addition to the warranty status when the Serial Number or IMEI is used to look up warranty status.
Product
AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.sierrawireless.com
Dec 20, 2024The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has notCVE-2023-31279 · Other software · Sierra Wireless · reported by security@sierrawireless.comHigh 8.1
The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This could enable an attacker to configure, manage, and execute AT commands on an unsuspecting user’s devices.
Product
AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.sierrawireless.com
Dec 20, 2024A command injection is possible through the user interface, allowing arbitrary command execution as the root user.CVE-2020-13712 · Other software · Sierra Wireless · reported by security@sierrawireless.comHigh 7.8
A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected. MG90 running MGOS 4.2.1 or earlier is affected.
Product
MGOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.sierrawireless.com
Dec 18, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Sensitive Information ExposureCVE-2024-11291 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityCVE-2024-49111 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityCVE-2024-49109 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure VulnerabilityCVE-2024-49103 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityCVE-2024-49101 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure VulnerabilityCVE-2024-49099 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure VulnerabilityCVE-2024-49098 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityCVE-2024-49094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityCVE-2024-49081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.