Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
453 results · page 3 of 10
Nov 20, 2025Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.CVE-2025-64655 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
- Product
- Dynamics OmniChannel SDK Storage Containers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1.CVE-2025-40681 · Other software · xCally · reported by cve-coordination@incibe.esMedium 5.1
Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the victim's browser by sending them a malicious URL using the 'failureMessage' parameter in '/login'. This vulnerability can be exploited to steal sentitive user data, such as session cookies , or to perform actions on behalf of the user.
- Product
- Omnichannel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.CVE-2025-25236 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52Medium 5.3
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Nov 10, 2025Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specificCVE-2025-12729 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.2
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 10, 2025Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specificCVE-2025-12728 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.2
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 10, 2025Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestCVE-2025-12447 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.2
Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 10, 2025Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page.CVE-2025-12435 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 6, 2025Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific CVE-2025-11213 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.3
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 6, 2025Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bCVE-2025-11209 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.2
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 30, 2025iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.CVE-2025-50739 · Other software · reported by MITRECritical 9.8
iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comomnitools.app
Oct 13, 2025Omni manages Kubernetes on bare metal, virtual machines, or in a cloud.CVE-2025-61688 · Other software · siderolabs · reported by GitHubHigh 8.6
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.
- Product
- omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Omni manages Kubernetes on bare metal, virtual machines, or in a cloud.CVE-2025-59836 · Other software · siderolabs · reported by GitHubMedium 5.3
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault. This vulnerability is fixed in 1.1.5 and 1.0.2.
- Product
- omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets.CVE-2024-57412 · Other software · reported by MITREHigh 7.5
An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Omni manages Kubernetes on bare metal, virtual machines, or in a cloud.CVE-2025-59824 · Other software · siderolabs · reported by GitHubLow 0.5
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0.
- Product
- omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.CVE-2025-55322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.
- Product
- OmniParser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 throCVE-2025-43748 · Other software · Liferay · reported by security@liferay.comHigh 7.1
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows rouCVE-2025-25235 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 8.6
Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network traffic such as HTTP requests to internal networks.
- Product
- Secure Email Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability.CVE-2025-25229 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52Medium 5.4
Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomnissa.comomnissa.com
Aug 11, 2025Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability.CVE-2025-25231 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.5
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Aug 6, 2025Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bCVE-2025-8582 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Jul 31, 2025NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to tCVE-2025-23289 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to the log files through proxy servers. A successful exploit of this vulnerability might lead to information disclosure.
- Product
- NVIDIA Omniverse Launcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Omnishop: Unauthenticated Registration BypassCVE-2025-6215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
- Product
- Omnishop
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Omnishop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 22, 2025Omnishop: Cross-Site Request Forgery on its /users/delete REST routeCVE-2025-6214 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Omnishop
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Omnishop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 16, 2025Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, CVE-2025-52690 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.1
Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.
- Product
- OmniAccess Stellar Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjro.sgal-enterprise.com
Jul 16, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the CVE-2025-52689 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.8
Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point.
- Product
- OmniAccess Stellar Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.uhg.sgal-enterprise.com
Jul 16, 2025Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the losCVE-2025-52688 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.8
Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.
- Product
- OmniAccess Stellar Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjro.sgal-enterprise.com
Jul 16, 2025Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into theCVE-2025-52687 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Low 2.4
Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).
- Product
- OmniAccess Stellar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordal-enterprise.comcsa.gov.sg
Jun 27, 2025Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53276 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.
- Product
- Omnipress
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.CVE-2025-43701 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.CVE-2025-43700 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check.CVE-2025-43699 · Other software · Salesforce · reported by security@salesforce.comMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects.CVE-2025-43698 · Other software · Salesforce · reported by security@salesforce.comCritical 9.1
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data.CVE-2025-43697 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421.CVE-2025-4701 · Other software · VITA-MLLM · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.
- Product
- Freeze-Omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code.CVE-2025-1087 · Other software · Kong Inc. · reported by 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbCritical 9.3
Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.
- Product
- Insomnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtantosec.com
Apr 17, 2025Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.CVE-2025-25234 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.1
Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.
- Product
- Omnissa Unified Access Gateway (UAG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Apr 16, 2025Omnissa Horizon Client for Windows contains an LPE Vulnerability.CVE-2025-25230 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.8
Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able to elevate privileges.
- Product
- Omnissa Horizon Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Mar 28, 2025OmniLeads Scripts and Tags Manager: Cross-Site Request Forgery (CSRF)CVE-2025-31460 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This issue affects OmniLeads Scripts and Tags Manager: from n/a through <= 1.3.
- Product
- OmniLeads Scripts and Tags Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update OmniLeads Scripts and Tags Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Omnify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28882 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.This issue affects Omnify: from n/a through <= 2.0.3.
- Product
- Omnify
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Omnify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2025Omnipress: Information ExposureCVE-2024-13407 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- Omnipress
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2025A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical.CVE-2025-1353 · Other software · Kong · reported by VulDBHigh 7.3
A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.
- Product
- Insomnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URCVE-2025-0996 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 6, 2025In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolenCVE-2024-39033 · Other software · reported by MITREHigh 7.5
In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process.CVE-2024-11468 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.8
Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.
- Product
- Omnissa Horizon Client for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Feb 4, 2025Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw.CVE-2024-11467 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.8
Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.
- Product
- Omnissa Horizon Client for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Jan 14, 2025ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability.CVE-2024-42911 · Other software · reported by MITREHigh 7.4
ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025WC Price History for Omnibus: Deserialization of Untrusted DataCVE-2025-22510 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024WC Price History for Omnibus: Unauthorized accessCVE-2024-12617 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 17, 2024Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.4.3.
- Product
- Omnipress
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific CVE-2024-8907 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.1
Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.