Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,780 results · page 25 of 76
Jun 6, 2025Domain For Sale: Stored Cross-Site ScriptingCVE-2025-5239 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Domain For Sale
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update Domain For Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTMLCVE-2024-57783 · Other software · alexpinel · reported by MITREHigh 8.1
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.
- Product
- Dot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value.CVE-2025-3895 · Other software · Jan Syski · reported by cvd@cert.plCritical 9.1
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators). Version 5.20 of MegaBIP fixes this issue.
- Product
- MegaBIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025TablePress: DOM-Based Stored Cross-Site ScriptingCVE-2025-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer' data-attributes in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TablePress
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddatatables.netgithub.com
May 22, 2025Hot Random Image: Path TraversalCVE-2025-4419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside of the originally intended directory.
- Product
- Hot Random Image
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 22, 2025Hot Random Image: Stored Cross-Site ScriptingCVE-2025-4405 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Hot Random Image
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2025DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functCVE-2025-47929 · Other software · DumbWareio · reported by GitHubLow 2.1
DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability.
- Product
- DumbDrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM nodCVE-2025-48051 · Other software · Lichess · reported by MITREMedium 4.7
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
- Product
- Lila
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.CVE-2025-48050 · Other software · Cure53 · reported by MITREHigh 7.5
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions CVE-2024-48869 · Other software · reported by secure@intel.comMedium 5.7
Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software Guard Extensions (Intel(R) SGX) may allow a privileged user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025SQL injection vulnerability in DomainsPRO 1.2.CVE-2025-40628 · Other software · DomainsPRO · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in DomainsPRO 1.2. This vulnerability could allow an attacker to retrieve, create, update and delete databases via the “d” parameter in the “/article.php” endpoint.
- Product
- DomainsPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability.CVE-2025-22249 · Other software · VMware · reported by security@vmware.comHigh 8.2
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.
- Product
- Vmware Aria Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request bodCVE-2024-56523 · Other software · Radware · reported by MITRECritical 9.1
Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method.
- Product
- Cloud WAF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordradware.comkb.cert.org
May 7, 2025Submission DOM tracking for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47626 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through <= 2.1.
- Product
- Submission DOM tracking for Contact Form 7
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Submission DOM tracking for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025phpgt/Dom provides access to modern DOM APIs.CVE-2025-46820 · Websites & servers · phpgt · reported by GitHubHigh 7.1
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the GitHub API to push malicious code or rewrite release commits in your repository. Any downstream user of the repository may be affected, but the token should only be valid for the duration of the workflow run, limiting the time during which exploitation could occur. Version 4.1.8 fixes the issue.
- Product
- Dom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.CVE-2025-47241 · Other software · browser-use · reported by MITREMedium 4
In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
- Product
- browser-use
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: riscv: process: fix kernel info leakage thread_struct's s[12] may contain random kernel meCVE-2022-49852 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: riscv: process: fix kernel info leakage thread_struct's s[12] may contain random kernel memory content, which may be finally leaked to userspace. This is a security hole. Fix it by clearing the s[12] array in thread_struct when fork. As for kthread case, it's better to clear the s[12] array as well.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 30, 2025Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30146 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.CVE-2024-30145 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-30115 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45721 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.CVE-2023-37535 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-37517 · Other software · HCL Software · reported by psirt@hcl.comLow 3.2
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
- Product
- HCL Domino Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-42450 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicationsCVE-2022-42449 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.CVE-2022-27562 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
- Product
- HCL Domino Volt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 24, 2025Landing pages and Domain aliases for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46533 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress landing-pages-and-domain-aliases allows Stored XSS.This issue affects Landing pages and Domain aliases for WordPress: from n/a through <= 0.8.
- Product
- Landing pages and Domain aliases for
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update Landing pages and Domain aliases for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification.CVE-2025-27820 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
- Product
- Apache HttpComponents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.CVE-2025-2703 · Other software · Grafana · reported by security@grafana.comMedium 6.8
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsonarsource.com
Apr 21, 2025Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.CVE-2025-2517 · Other software · OpenText · reported by security@opentext.comLow 2.3
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
- Product
- ArcSight Enterprise Security Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued foCVE-2025-43918 · Other software · SSL.com · reported by MITREMedium 6.4
SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.
- Product
- SSL.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgnews.ycombinator.com
Apr 16, 2025A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versiCVE-2025-31340 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.9
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote aCVE-2025-31339 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiMedium 5.3
An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtaCVE-2025-31338 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiMedium 6.9
A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_CVE-2025-22036 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the following race condition situation. <CPU 0> <CPU 1> mpage_read_folio <<bh on stack>> do_mpage_readpage exfat_get_block bh_read __bh_read get_bh(bh) submit_bh wait_on_buffer ... end_buffer_read_sync __end_buffer_read_notouch unlock_buffer <<keep going>> ... ... ... ... <<bh is not valid out of mpage_read_folio>> . . another_function <<variable A on stack>> put_bh(bh) atomic_dec(bh->b_count) * stack corruption here * This patch returns -EAGAIN if a folio does not have buffers when bh_read needs to be called. By doing this, the caller can fallback to functions like block_read_full_folio(), create a buffer_head
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 16, 2025Listdom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
- Product
- Listdom
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenCVE-2025-31363 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338).CVE-2025-3495 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code.
- Product
- COMMGR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.comcisa.gov
Apr 8, 2025Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.CVE-2025-29810 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU CVE-2025-22011 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume: root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhci_suspend finished [ 70.727730] xhci_plat_suspend finished [ 70.755624] bcm2835-power bcm2835-power: Power grafx off [ 70.761127] USB: Set power to 0 [ 74.653040] USB: Failed to set power to 1 (-110) This seems to be caused because of the mixed usage of raspberrypi-power and bcm2835-power at the same time. So avoid the usage of the VPU firmware power-domain driver, which prevents the VPU crash.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 7, 2025Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and CVE-2024-11071 · Other software · Cyberdigm · reported by 09832df1-09c1-45b4-8a85-16c601d30febHigh 7.7
Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.
- Product
- DestinyECM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values.CVE-2024-57835 · Other software · TANIGUCHI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.5
Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure
- Product
- Amon2::Auth::Site::LINE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Apr 3, 2025Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulneraCVE-2025-29987 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.
- Product
- DD OS 8.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025XV Random Quotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31903 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through <= 2.0.0.
- Product
- XV Random Quotes
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability.CVE-2025-1660 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Navisworks Freedom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 1, 2025A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability.CVE-2025-1659 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Navisworks Freedom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 1, 2025A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability.CVE-2025-1658 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Navisworks Freedom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 1, 2025XV Random Quotes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30971 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows SQL Injection.This issue affects XV Random Quotes: from n/a through <= 2.0.0.
- Product
- XV Random Quotes
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remoCVE-2025-2402 · Other software · KNIME · reported by security@knime.comHigh 8.8
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.2 or later * 1.12.3 or later * 1.11.3 or later * 1.10.3 or later
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SCVE-2025-1219 · Websites & servers · PHP Group · reported by security@php.netMedium 6.3
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.