Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,632 results · page 23 of 73
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field The bpf_verifier_state.loop_entrCVE-2025-38060 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field The bpf_verifier_state.loop_entry state should be copied by copy_verifier_state(). Otherwise, .loop_entry values from unrelated states would poison env->cur_state. Additionally, env->stack should not contain any states with .loop_entry != NULL. The states in env->stack are yet to be verified, while .loop_entry is set for states that reached an equivalent state. This means that env->cur_state->loop_entry should always be NULL after pop_stack(). See the selftest in the next commit for an example of the program that is not safe yet is accepted by verifier w/o this fix. This change has some verification performance impact for selftests: File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) ---------------------------------- ---------------------------- --------- --------- -------------- ---------- ---------- ------------- arena_htab.bpf.o arena_htab_llvm 717 426 -291 (-40.59%) 57 37 -20 (-35.09%) a
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure CVE-2025-38037 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2]. Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE(). [1] BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0: vxlan_xmit+0xb29/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2: vxlan_xmit+0xadf/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f Reported by Kernel Co
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 12, 2025The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup fileCVE-2025-49200 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it.CVE-2025-49199 · Other software · SICK AG · reported by psirt@sick.deHigh 8.8
The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025A service supports the use of a deprecated and unsafe TLS version.CVE-2025-49196 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the device.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The application fails to implement several security headers.CVE-2025-49193 · Other software · SICK AG · reported by psirt@sick.deMedium 4.2
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).
- Product
- Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The web application is vulnerable to clickjacking attacks.CVE-2025-49192 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution.CVE-2025-49191 · Other software · SICK AG · reported by psirt@sick.deMedium 4.8
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The application is vulnerable to Server-Side Request Forgery (SSRF).CVE-2025-49190 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.CVE-2025-49188 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existingCVE-2025-49187 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-CVE-2025-49186 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- Product
- Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The web application is susceptible to cross-site-scripting attacks.CVE-2025-49185 · Other software · SICK AG · reported by psirt@sick.deMedium 5.5
The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.CVE-2025-49184 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.
- Product
- Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor).CVE-2024-41505 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor).
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" CVE-2024-41503 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" (search) function.
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) sCVE-2024-41502 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) section when creating or editing either a legal or a natural person.
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the backup name field may allow OS command injection.CVE-2025-4653 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL.CVE-2025-26395 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.1
SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required.
- Product
- SolarWinds Observability Self-Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects.CVE-2025-43698 · Other software · Salesforce · reported by security@salesforce.comCritical 9.1
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the paCVE-2025-46041 · Other software · Anchorcms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).
- Product
- Anchor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2025Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block.CVE-2025-49619 · Other software · Skyvern · reported by MITREHigh 8.5
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Product
- Skyvern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcristibtz.github.iogithub.com
Jun 6, 2025Calculated Fields Form: Cross-Site Request Forgery (CSRF)CVE-2025-49291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
- Product
- Calculated Fields Form
- Affected
- up to 5.3.58
- What to do
- Affects up to 5.3.58. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025ACF: Yandex Maps Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30930 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unreal Themes ACF: Yandex Maps Field acf-yandex-maps-field allows Stored XSS.This issue affects ACF: Yandex Maps Field: from n/a through <= 1.1.
- Product
- ACF: Yandex Maps Field
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update ACF: Yandex Maps Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025FancyBox for: Does not escape captions and titles attributes before using them to populate galleries' caption fieldsCVE-2025-3662 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
- Product
- FancyBox for
- Fixed in
- 3.3.6
- What to do
- Update FancyBox for to 3.3.6 or newer.
May 30, 2025An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields.CVE-2025-48912 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 23, 2025The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file.CVE-2025-41378 · Other software · Intellian Technologies · reported by cve-coordination@incibe.esMedium 6.9
The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel.
- Product
- Iridium Certus 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored CrossCVE-2025-1420 · Other software · Proget · reported by cvd@cert.plLow 2.4
Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
- Product
- Proget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field.CVE-2025-4951 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.6
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018
- Product
- AppSpider Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names.CVE-2025-22233 · Other software · Spring · reported by security@vmware.comLow 3.1
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation. For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields. Credit This issue was
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13382 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.64
- What to do
- Update Calculated Fields Form to 5.2.64 or newer.
May 15, 2025Custom Field Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Field Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Field Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.CVE-2025-44110 · Other software · Fluxbb · reported by MITREMedium 5.4
FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.
- Product
- Fluxbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying tCVE-2025-43003 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.
- Product
- SAP S/4HANA (Private Cloud & On-Premise)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.CVE-2025-46749 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a nuCVE-2025-37862 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_find_special_field and although pidff_init_fields should return an error earlier if one of the required reports is missing, future modifications could change this logic and resurface this possible null pointer dereference again. LKML bug report: https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 9, 2025Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS).CVE-2025-4376 · Other software · Sparx Systems · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166Medium 5.3
Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro Cloud Server: earlier than 6.0.165.
- Product
- Pro Cloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025In the Linux kernel, the following vulnerability has been resolved: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads Fix niu_try_msix() tCVE-2025-37833 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads Fix niu_try_msix() to not cause a fatal trap on sparc systems. Set PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST on the struct pci_dev to work around a bug in the hardware or firmware. For each vector entry in the msix table, niu chips will cause a fatal trap if any registers in that entry are read before that entries' ENTRY_DATA register is written to. Testing indicates writes to other registers are not sufficient to prevent the fatal trap, however the value does not appear to matter. This only needs to happen once after power up, so simply rebooting into a kernel lacking this fix will NOT cause the trap. NON-RESUMABLE ERROR: Reporting on cpu 64 NON-RESUMABLE ERROR: TPC [0x00000000005f6900] <msix_prepare_msi_desc+0x90/0xa0> NON-RESUMABLE ERROR: RAW [4010000000000016:00000e37f93e32ff:0000000202000080:ffffffffffffffff NON-RESUMABLE ERROR: 0000000800000000:0000000000000000:0000000000000000:0000000000000000] NON-RESUMABLE ERROR: handle [0x4010000000000016] stick [0x00000e37f93e32ff] NON-RESUMABLE ERROR: type [precise nonresumable] NON-RESUMABL
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 7, 2025Custom Checkout Fields for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through <= 1.8.3.
- Product
- Custom Checkout Fields for WooCommerce
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Custom Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Memory corruption during concurrent access to server info object due to unprotected critical field.CVE-2024-45562 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption during concurrent access to server info object due to unprotected critical field.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage withCVE-2025-3020 · Other software · Wiesemann & Theis · reported by info@cert.vde.comMedium 5.4
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
- Product
- ERP-Gateway 12x Digital Input, 6x Digital Relais
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the direcCVE-2022-49879 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir(). ------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 29, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-12273 · WordPress plugins & themes · reported by WPScanLow 3.5
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 24, 2025Checkout Field Visibility for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39391 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
- Product
- Checkout Field Visibility for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Checkout Field Visibility for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modifCVE-2025-31327 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP Field Logistics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.CVE-2025-29181 · Other software · Foxcms · reported by MITREHigh 7.2
FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
- Product
- Foxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4CVE-2025-3760 · Other software · Liferay · reported by security@liferay.comMedium 4.8
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifiCVE-2025-22108 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.6
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supported is 32 with the value 0. CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB fragments can approach or exceed the maximum supported by the chip. Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd field. Without this patch, the out-of-range bd_cnt value will corrupt the TX BD and may cause TX timeout. The next patch will check for values exceeding 32.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-biCVE-2025-22079 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.