Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,323 results · page 22 of 47

Apr 9, 2024WP Activity Log Premium: SQL InjectionCVE-2024-2018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object.
Product
WP Activity Log Premium
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record melapress.com wordfence.com
Apr 9, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-0376 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wrapper Link Widget in all versions up to, and including, 4.10.16 due to insufficient input sanitization and output escaping on user supplied URLs. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.16
What to do
Affects up to 4.10.16. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-29981 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Apr 4, 2024Microsoft Edge (Chromium-based) Webview2 Spoofing VulnerabilityCVE-2024-29049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.1
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based) Extended Stable
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Apr 3, 2024In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authenticated attacker to tCVE-2023-45552 · Other software · Veridiumid · reported by MITREMedium 6.5
In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal.
Product
Veridiumad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.veridiumid.com veridiumid.com
Apr 3, 2024In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unautheCVE-2023-44040 · Other software · Veridiumid · reported by MITREMedium 6.1
In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate.
Product
Veridiumad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.veridiumid.com veridiumid.com
Apr 3, 2024In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection aCVE-2023-44038 · Other software · Veridiumid · reported by MITREMedium 6.5
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack.
Product
Veridiumad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.veridiumid.com veridiumid.com
Apr 3, 2024In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO CVE-2023-44039 · Other software · veridiumid · reported by MITRECritical 9.1
In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.
Product
veridiumad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.veridiumid.com veridiumid.com
Mar 27, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-28860 · Other software · cilium · reported by GitHubHigh 8
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io github.com
Mar 27, 2024Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29924 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Premium Packages allows Reflected XSS.This issue affects Premium Packages: from n/a through 5.8.2.
Product
Premium Packages
Affected
up to 5.8.2
What to do
Affects up to 5.8.2. Update Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 22, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-29057 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Mar 22, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26247 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Mar 20, 2024Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityCVE-2024-26196 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
Product
Microsoft Edge for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Mar 19, 2024Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29106 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.16.
Product
Premium Addons for Elementor
Affected
up to 4.10.16
What to do
Affects up to 4.10.16. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-28250 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 18, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-28249 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 18, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-28248 · Other software · cilium · reported by GitHubHigh 7.2
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. This issue has been patched in Cilium 1.15.2, 1.14.8, and 1.13.13. There are no known workarounds for this issue.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io github.com
Mar 15, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-2399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.10.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable with the premium version of the plugin is also installed.
Product
Premium Addons for Elementor
Affected
up to 4.10.23
What to do
Affects up to 4.10.23. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26246 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.9
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Product
Microsoft Edge for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Mar 14, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-2239 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-2238 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-2237 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-2000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Scroll Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Paytium: Mollie payment forms & donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25099 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-1997 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Premium Addons PRO: Stored Cross-Site ScriptingCVE-2024-1996 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons PRO
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record premiumaddons.com wordfence.com
Mar 13, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-1680 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, Team Members, and Image Scroll widgets in all versions up to, and including, 4.10.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.21
What to do
Affects up to 4.10.21. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-0326 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionality in all versions up to, and including, 4.10.17 due to insufficient input sanitization and output escaping on user supplied links. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.17
What to do
Affects up to 4.10.17. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2024Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited infCVE-2024-2049 · Network & remote access · Citrix · reported by secure@citrix.comMedium 6.5
Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP.
Product
Citrix SD-WAN Standard/Premium Editions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.citrix.com support.citrix.com
Mar 11, 2024codeium-chrome is an open source code completion plugin for the chrome web browser.CVE-2024-28120 · Other software · Exafunction · reported by GitHubMedium 6.5
codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website that will steal the user's Codeium api-key, and thus impersonate the user on the backend autocomplete server. This issue has not been addressed. Users are advised to monitor the usage of their API key.
Product
codeium-chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Mar 5, 2024A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily downloaCVE-2023-45594 · Other software · AiLux · reported by prodsec@nozominetworks.comMedium 6.8
A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download/upload files to/from the file system, with unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
Product
imx6 bundle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com nozominetworks.com
Mar 5, 2024A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http:CVE-2023-45593 · Other software · AiLux · reported by prodsec@nozominetworks.comMedium 6.8
A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
Product
imx6 bundle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com nozominetworks.com
Mar 5, 2024A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” optioCVE-2023-45592 · Other software · AiLux · reported by prodsec@nozominetworks.comMedium 6.8
A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” option and with root privileges) exacerbates the impacts of successful attacks executed against the browser. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
Product
imx6 bundle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com nozominetworks.com
Feb 28, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-1242 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 4.10.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.18
What to do
Affects up to 4.10.18. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dCVE-2023-25926 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.
Product
Security Guardium Key Lifecycle Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 28, 2024 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be autoCVE-2023-25921 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.
Product
Security Guardium Key Lifecycle Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 28, 2024IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the sysCVE-2023-25925 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632.
Product
Security Guardium Key Lifecycle Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 28, 2024IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automCVE-2023-25922 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621.
Product
Security Guardium Key Lifecycle Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 23, 2024Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-26192 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Feb 23, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-26188 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Feb 23, 2024Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-21423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Feb 20, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-25631 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io docs.cilium.io
Feb 20, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-25630 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io github.com
Feb 13, 2024A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium CVE-2024-23816 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
Product
Location Intelligence Perpetual Large
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Feb 10, 2024Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.16.
Product
Premium Addons for Elementor
Affected
up to 4.10.16
What to do
Affects up to 4.10.16. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1.CVE-2023-6564 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Feb 5, 2024GeneratePress Premium: Stored Cross-Site ScriptingCVE-2023-6807 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeneratePress Premium
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update GeneratePress Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record generatepress.com wordfence.com
Feb 1, 2024Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2024-21399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jan 30, 2024Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2024-21388 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.