Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

4,938 results · page 46 of 99

Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users wCVE-2025-31282 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Product
Trend Vision One
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com
Apr 1, 2025A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized aCVE-2025-28132 · Other software · Nagios · reported by MITREMedium 4.6
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf.
Product
Nagios Network Analyzer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nagios.com
Apr 1, 2025A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actionsCVE-2025-28131 · Other software · Nagios · reported by MITREMedium 4.6
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability.
Product
Network Analyzer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nagios.com
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "reCVE-2025-21902 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Apr 1, 2025Kento WordPress Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
Product
Kento WordPress Stats
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kento WordPress Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service conditionCVE-2025-2794 · Other software · Kentico · reported by VulnCheckHigh 8.7
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Mar 27, 2025A vulnerability was found in Kentico CMS up to 13.0.178.CVE-2025-2878 · Other software · Kentico · reported by VulDBMedium 4.8
A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vuldb.com
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permCVE-2024-55070 · Other software · Mealie · reported by MITRELow 3.1
A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions.
Product
Mealie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com m10x.de
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orderCVE-2024-55073 · Other software · Mealie · reported by MITREHigh 7.6
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
Product
Mealie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com m10x.de
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orderCVE-2024-55072 · Other software · Mealie · reported by MITREMedium 5.4
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
Product
Mealie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com m10x.de
Mar 27, 2025HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.CVE-2025-0273 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 26, 2025HCL SX does not set the secure attribute on authorization tokens or session cookies.CVE-2024-30155 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
Product
HCL SX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 24, 2025Kentico Xperience Path Traversal VulnerabilityCVE-2025-2749 · Other software · Kentico · reported by VulnCheckExploitedHigh 7.2
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Product
Kentico Xperience
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com labs.watchtowr.com
Mar 24, 2025The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This CVE-2025-2748 · Other software · Kentico · reported by VulnCheckMedium 6.1
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com
Mar 24, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Mar 24, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2746 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Mar 21, 2025Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exeCVE-2025-30472 · Other software · Corosync · reported by MITRECritical 9
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
Product
Corosync
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corosync.org github.com
Mar 21, 2025golang-jwt is a Go implementation of JSON Web Tokens.CVE-2025-30204 · Other software · golang-jwt · reported by GitHubHigh 7.5
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Product
jwt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 21, 2025Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.CVE-2024-53351 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
Product
Pipecd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Mar 21, 2025Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.CVE-2024-53350 · Other software · Kubeslice · reported by MITREHigh 7.4
Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.
Product
Kubeslice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Mar 21, 2025Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes comCVE-2024-53349 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.4
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster
Product
Kuadrant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Mar 21, 2025Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2025-30168 · Other software · parse-community · reported by GitHubMedium 6.9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2.
Product
parse-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.parseplatform.org github.com
Mar 20, 2025DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.CVE-2025-26853 · Other software · Descor · reported by MITRECritical 10
DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.
Product
Infocad FM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record descor.com infocadfm.com
Mar 20, 2025A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permiCVE-2024-8489 · Other software · modelscope · reported by security@huntr.devHigh 8.8
A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the `api/file` endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.
Product
modelscope/agentscope
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com
Mar 20, 2025A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc.CVE-2024-8026 · Other software · netease-youdao · reported by security@huntr.devHigh 8.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.
Product
netease-youdao/qanything
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Mar 20, 2025A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2.CVE-2024-7476 · Other software · lunary-ai · reported by security@huntr.devMedium 4.3
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.
Product
lunary-ai/lunary
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 20, 2025A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougaCVE-2024-12720 · Other software · huggingface · reported by security@huntr.devHigh 7.5
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
Product
huggingface/transformers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 20, 2025lunary-ai/lunary is vulnerable to broken access control in the latest version.CVE-2024-10272 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.
Product
lunary-ai/lunary
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 19, 2025fast-jwt provides fast JSON Web Token (JWT) implementation.CVE-2025-30144 · Other software · nearform · reported by GitHubMedium 6.5
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential attack where a malicious actor crafts a JWT with an iss claim structured as ['https://attacker-domain/', 'https://valid-iss']. Due to the permissive validation, the JWT will be deemed valid. Furthermore, if the application relies on external libraries like get-jwks that do not independently validate the iss claim, the attacker can leverage this vulnerability to forge a JWT that will be accepted by the victim application. Essentially, the attacker can insert their own domain into the iss array, alongside the legitimate issuer, and bypass the intended security checks. This issue is fixed in 5.0.6.
Product
fast-jwt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record datatracker.ietf.org github.com
Mar 19, 2025Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a PredictabCVE-2025-26486 · Other software · Beta80 · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6
Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a Predictable Salt vulnerabilities in Beta80 "Life 1st Identity Manager" enable an attacker with access to password hashes to bruteforce user passwords or find a collision to ultimately while attempting to gain access to a target application that uses "Life 1st Identity Manager" as a service for authentication. This issue affects Life 1st: 1.5.2.14234.
Product
Life 1st
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record euvd.enisa.europa.eu cvcn.gov.it
Mar 17, 2025SolarWinds Service Desk is affected by a broken access control vulnerability.CVE-2025-26393 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.4
SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthorized data manipulation.
Product
Service Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com
Mar 17, 2025Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php.CVE-2025-2202 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esMedium 6.9
Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
Product
ajax.php plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 17, 2025Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin.CVE-2025-2201 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esMedium 6.9
Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information about other users such as public IP addresses, messages with other users and more.
Product
IcProgreso plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 13, 2025A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.CVE-2025-2230 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 8.5
A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.
Product
Intellispace Cardiovascular (ISCV)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov philips.com
Mar 13, 2025A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations.CVE-2025-2229 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 8.5
A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations.
Product
Intellispace Cardiovascular (ISCV)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov philips.com
Mar 10, 2025Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs.CVE-2025-1296 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.5
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
Product
Nomad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com
Mar 4, 2025Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend databasCVE-2024-50706 · Other software · Uniguest · reported by MITRECritical 9.8
Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend database.
Product
Tripleplay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record uniguest.com uniguest.com
Mar 3, 2025In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities iCVE-2025-27371 · Other software · IETF · reported by MITREMedium 6.9
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
Product
RFC 7523
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eprint.iacr.org github.com
Mar 2, 2025Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure.CVE-2025-25953 · Other software · Serosoft · reported by MITREMedium 6.5
Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information.
Product
Academia Student Information System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 27, 2025Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.CVE-2025-25570 · Other software · reported by MITRECritical 9.8
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 27, 2025Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows AuthenticCVE-2024-9334 · Other software · E-Kent · reported by iletisim@usom.gov.trHigh 8.2
Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass. This issue affects Pallium Vehicle Tracking: before 17.10.2024.
Product
Pallium Vehicle Tracking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Feb 27, 2025A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validatiCVE-2024-0392 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.4
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user, potentially compromising account settings and data integrity. The vulnerability only affects a limited set of state-changing operations, and successful exploitation requires social engineering to trick a user with access to the management console into performing the malicious action.
Product
WSO2 Enterprise Integrator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Feb 27, 2025An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the CVE-2024-2321 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.6
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations. Exploitation requires an attacker to obtain a valid refresh token of an admin user. Since refresh tokens generally have a longer expiration time, this could lead to prolonged unauthorized access to API resources, impacting data confidentiality and integrity.
Product
WSO2 API Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Feb 26, 2025An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.CVE-2025-22868 · Other software · golang.org/x/oauth2 · reported by security@golang.orgHigh 7.5
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
Product
golang.org/x/oauth2/jws
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record go.dev go.dev
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe The reference taken by 'of_find_deCVE-2022-49216 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe The reference taken by 'of_find_device_by_node()' must be released when not needed anymore. Add put_device() call to fix this.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 25, 2025A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.CVE-2025-1091 · Other software · Tenable · reported by vulnreport@tenable.comMedium 4.3
A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.
Product
Tenable Identity Exposure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com
Feb 25, 2025Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other useCVE-2024-12368 · Other software · Odoo · reported by security@odoo.comHigh 8.1
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Product
Odoo Community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 24, 2025A flaw in Gliffy results in broken authentication through the reset functionality of the application.CVE-2024-5174 · Other software · Gliffy · reported by security@puppet.comMedium 5.3
A flaw in Gliffy results in broken authentication through the reset functionality of the application.
Product
Gliffy Online
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.perforce.com
Feb 18, 2025Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens.CVE-2025-26620 · Other software · DuendeSoftware · reported by GitHubMedium 6.3
Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected. Duende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods: `HttpContext.GetClientAccessTokenAsync()` and `IClientCredentialsTokenManagementService.GetAccessTokenAsync()`. There are overloads of both of these methods that accept a `TokenRequestParameters` object that customizes token request parameters. However, concurrent requests with varying `TokenRequestParameters` will result in the same token for all concu
Product
foss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 18, 2025Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection.CVE-2025-26058 · Other software · Webkul · reported by MITREMedium 4.2
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
Product
Qloapps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.