Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
627 results · page 2 of 13
Mar 20, 2026Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful vCVE-2026-31836 · Other software · bluewave-labs · reported by GitHubHigh 8.1
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful vCVE-2026-30829 · Other software · bluewave-labs · reported by GitHubMedium 5.3
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026WaveSurfer-WP: Stored Cross-Site ScriptingCVE-2026-1909 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's audio shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on the 'src' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WaveSurfer-WP
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update WaveSurfer-WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026GoldWave 5.70 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting malicious input in the File Open URL dialog.CVE-2020-37066 · Other software · GoldWave · reported by VulnCheckHigh 8.4
GoldWave 5.70 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting malicious input in the File Open URL dialog. Attackers can generate a specially crafted text file with Unicode-encoded shellcode to trigger a stack-based overflow and execute commands when the file is opened.
- Product
- GoldWave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgoldwave.com
Jan 6, 2026InWave Jobs: Missing AuthorizationCVE-2025-39477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.
- Product
- InWave Jobs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update InWave Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads.CVE-2025-10933 · Other software · silabs.com · reported by product-security@silabs.comMedium 5.3
An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads.
- Product
- Z-Wave Protocol Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: ALSA: wavefront: Fix integer overflow in sample size validation The wavefront_send_sample(CVE-2025-68344 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ALSA: wavefront: Fix integer overflow in sample size validation The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem Fix by using unsigned comparison to avoid integer overflow.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 16, 2025WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server.CVE-2025-65076 · Other software · WaveStore · reported by cvd@cert.plHigh 8.6
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root privileges. This issue was fixed in version 6.44.44
- Product
- WaveStore Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server.CVE-2025-65075 · Other software · WaveStore · reported by cvd@cert.plMedium 5.1
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete files, with the permissions of dvr user, on the server using path traversal in the alog script. This issue was fixed in version 6.44.44
- Product
- WaveStore Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server.CVE-2025-65074 · Other software · WaveStore · reported by cvd@cert.plHigh 8.6
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version 6.44.44
- Product
- WaveStore Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass.CVE-2025-12843 · Other software · waveterm · reported by help@fluidattacks.comMedium 6.9
Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2.
- Product
- waveterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Dec 11, 2025In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36925 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the AdCVE-2025-63362 · Other software · Waveshare · reported by MITRECritical 9.8
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.
- Product
- Rs232/485 TO Wifi ETH (b) Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comotsecverse.github.io
Dec 4, 2025Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the ACVE-2025-63361 · Other software · Waveshare · reported by MITREMedium 5.7
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.
- Product
- Rs232/485 TO Wifi ETH (b) Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comotsecverse.github.io
Dec 4, 2025A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.0CVE-2025-63363 · Other software · Waveshare · reported by MITREHigh 7.5
A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to execute de-authentication attacks, allowing crafted deauthentication and disassociation frames to be broadcast without authentication or encryption.
- Product
- Rs232/485 TO Wifi ETH (b) Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comotsecverse.github.io
Dec 4, 2025Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit AdmCVE-2025-63364 · Other software · Waveshare · reported by MITREHigh 7.5
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext.
- Product
- Rs232/485 TO Wifi ETH (b) Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comotsecverse.github.io
Nov 19, 2025WavePlayer: Does not have authorization in an AJAX actionCVE-2025-12057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
- Product
- WavePlayer
- Fixed in
- 3.8.0
- What to do
- Update WavePlayer to 3.8.0 or newer.
Nov 18, 2025A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform.CVE-2025-37163 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.
- Product
- HPE Aruba Networking Management Software (Airwave)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device.CVE-2025-10693 · Other software · silabs.com · reported by product-security@silabs.comHigh 7.6
When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025.6.1.
- Product
- Silicon Labs Z-Wave SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthCVE-2025-57176 · Other software · Ceragon Networks / Siklu Communication · reported by MITREMedium 6.5
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.
- Product
- EtherHaul and MultiHaul Series microwave antennas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution.CVE-2025-10203 · Other software · Digilent · reported by security@ni.comHigh 8.5
Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .DWF3WORK file. This vulnerability affects Digilent WaveForms 3.24.3 and prior versions.
- Product
- WaveForms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2025A vulnerability was detected in Mercury KM08-708H GiGA WiFi Wave2 1.1.14.CVE-2025-10392 · Other software · Mercury · reported by VulDBHigh 8.9
A vulnerability was detected in Mercury KM08-708H GiGA WiFi Wave2 1.1.14. This affects an unknown function of the component HTTP Header Handler. The manipulation of the argument Host results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.
- Product
- KM08-708H GiGA WiFi Wave2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2025A vulnerability has been found in Mercury KM08-708H GiGA WiFi Wave2 1.1.CVE-2025-10385 · Other software · Mercury · reported by VulDBHigh 7.4
A vulnerability has been found in Mercury KM08-708H GiGA WiFi Wave2 1.1. Affected by this issue is the function sub_450B2C of the file /goform/mcr_setSysAdm. The manipulation of the argument ChgUserId leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- KM08-708H GiGA WiFi Wave2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8.CVE-2025-40979 · Other software · Grandstream Networks · reported by cve-coordination@incibe.esHigh 7
DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users<user>\AppData\Local\Temp' directory, which could lead to arbitrary code execution and persistence. This vulnerability is only replicable in versions of Windows 11 and does not affect earlier versions.
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrCVE-2025-29534 · Other software · reported by MITREHigh 8.8
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025The web application allows user input to pass unfiltered to a command executed on the underlying operating system.CVE-2025-24938 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0High 8.4
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. Has the potential to inject command while creating a new User from User Management.
- Product
- WaveSuite NOC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025File contents could be read from the local file system by an attacker.CVE-2025-24937 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Critical 9
File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server.
- Product
- WaveSuite NOC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025The web application allows user input to pass unfiltered to a command executed on the underlying operating system.CVE-2025-24936 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Critical 9
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to the application has the potential to execute commands on the operating system under the context of the webserver.
- Product
- WaveSuite NOC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.CVE-2025-48024 · Other software · BlueWave · reported by MITREMedium 5
In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.CVE-2025-47817 · Other software · BlueWave · reported by MITREHigh 8.8
In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.CVE-2025-47245 · Other software · BlueWave · reported by MITREHigh 8.1
In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal).CVE-2025-43946 · Other software · Tcpwave · reported by MITRECritical 9.8
TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal).
- Product
- DDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM.CVE-2025-43922 · Other software · FileWave · reported by MITREHigh 8.1
The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM.
- Product
- FileWave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Review Wave – Google Places Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-39442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.
- Product
- Review Wave – Google Places Reviews
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Review Wave – Google Places Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFCVE-2025-28145 · Other software · Edimax · reported by MITREMedium 6.5
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat.
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc CVE-2025-28144 · Other software · Edimax · reported by MITREMedium 6.5
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function.
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/fCVE-2025-28143 · Other software · Edimax · reported by MITREMedium 6.5
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup.
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formCVE-2025-28142 · Other software · Edimax · reported by MITREMedium 6.5
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare.
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 8, 2025Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.CVE-2025-29821 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
- Product
- Microsoft Dynamics 365 Business Central 2023 Wave 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Arbitrary File ReadCVE-2025-3431 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13776 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 4, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotCVE-2025-28146 · Other software · Edimax · reported by MITRECritical 9.8
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 7, 2025InWave Jobs: Privilege escalationCVE-2025-1315 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- InWave Jobs
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update InWave Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: PHP Object InjectionCVE-2024-13777 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 25, 2025Yawave: SQL InjectionCVE-2025-1648 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Yawave
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Yawave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordatviksecurity.complugins.trac.wordpress.org
Dec 17, 2024Easy Waveform Player: Stored Cross-Site ScriptingCVE-2024-11881 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Waveform Player
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Easy Waveform Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI.CVE-2024-54008 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host.
- Product
- HPE Aruba Networking AirWave Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.CVE-2024-50931 · Other software · Silabs · reported by MITREMedium 4.6
Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.CVE-2024-50930 · Other software · Silabs · reported by MITREHigh 8.8
An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memoryCVE-2024-50929 · Other software · Silabs · reported by MITREMedium 6.2
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS).
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.