Updated 51 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,111 results · page 5 of 23

Feb 12, 2026WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functiCVE-2025-40905 · Other software · DBOOK · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.3
WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
Product
WWW::OAuth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org perldoc.perl.org
Feb 11, 2026Orbisius Random Name Generator: Stored Cross-Site ScriptingCVE-2026-1893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbisius Random Name Generator
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Orbisius Random Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Extended Random Number Generator: Stored Cross-Site ScriptingCVE-2026-0681 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Extended Random Number Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update Extended Random Number Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Grand Blog: Server-Side Request Forgery (SSRF)CVE-2026-24961 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a through < 3.1.5.
Product
Grand Blog
What to do
Update Grand Blog to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method.CVE-2026-1814 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.8
Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.
Product
InsightVM/Nexpose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atredis.com
Jan 26, 2026Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server.CVE-2025-59093 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.5
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.
Product
Kaba exos 9300
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 22, 2026An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random valuesCVE-2025-9290 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
Product
Omada Software Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.omadanetworks.com support.omadanetworks.com
Jan 22, 2026Grand Spa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.
Product
Grand Spa
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Grand Spa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Magazine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.
Product
Grand Magazine
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Grand Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Tour: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67952 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.
Product
Grand Tour
What to do
Update Grand Tour to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Restaurant Theme Elements for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a through <= 2.1.1.
Product
Grand Restaurant Theme Elements for Elementor
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Grand Restaurant Theme Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 12, 2026Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.CVE-2025-71063 · Other software · mrvladus · reported by MITREHigh 8.2
Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.
Product
Errands
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org github.com
Jan 8, 2026Grand Restaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.
Product
Grand Restaurant
Fixed in
7.0.9
What to do
Update Grand Restaurant to 7.0.9 or newer.
Full record and what to do →NVD record patchstack.com
Jan 1, 2026Branda: Privilege escalationCVE-2025-14998 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
Branda
Affected
up to 3.4.24
What to do
Affects up to 3.4.24. Update Branda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 30, 2025inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all CVE-2025-66723 · Other software · Inmusicbrands · reported by MITREHigh 7.5
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.
Product
Engine DJ Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com inmusicbrands.com
Dec 24, 2025Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request vCVE-2019-25244 · Other software · BTicino S.p.A. · reported by VulnCheckMedium 5.1
Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request validation. Attackers can exploit cross-site request forgery to change passwords and inject stored cross-site scripting payloads through unvalidated GET parameters.
Product
Legrand BTicino Driver Manager F454
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bticino.com exploit-db.com
Dec 24, 2025Brands for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68519 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Blind SQL Injection.This issue affects Brands for WooCommerce: from n/a through <= 3.8.6.3.
Product
Brands for WooCommerce
Affected
up to 3.8.6.3
What to do
Affects up to 3.8.6.3. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 22, 2025Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.CVE-2025-26379 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
Product
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov johnsoncontrols.com
Dec 16, 2025systeminformation is a System and OS information library for node.js.CVE-2025-68154 · Other software · sebhildebrandt · reported by GitHubHigh 8.1
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
Product
systeminformation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 12, 2025Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT toCVE-2025-54981 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Product
Apache StreamPark
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Dec 11, 2025Premmerce Brands for WooCommerce: Unauthorized modification of dataCVE-2025-12783 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify brand permalink settings.
Product
Premmerce Brands for WooCommerce
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Premmerce Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated creCVE-2024-58300 · Other software · Siklu · reported by VulnCheckHigh 8.7
Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a network request. Attackers can send a specific hex-encoded command to port 12777 to obtain username and password, enabling direct SSH access to the device.
Product
MultiHaul TG series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siklu.com exploit-db.com
Dec 8, 2025In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code.CVE-2025-48589 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Dec 7, 2025A security flaw has been discovered in Grandstream GXP1625 1.0.7.4.CVE-2025-14186 · Other software · Grandstream · reported by VulDBLow 2
A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpn_ip results in basic cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Product
GXP1625
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com vuldb.com
Nov 24, 2025Perfect Brands for WooCommerce: Time-based SQL InjectionCVE-2025-10144 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Perfect Brands for WooCommerce
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Perfect Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 18, 2025A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component.CVE-2025-61661 · Other software · GNU · reported by Red HatMedium 4.8
A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.
Product
grub2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Nov 18, 2025A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader).CVE-2025-54771 · Other software · GNU · reported by Red HatMedium 4.9
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Product
grub2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Nov 17, 2025Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access,CVE-2025-52578 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 5.7
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
Product
High Sec End of Line Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gallagher.com
Nov 10, 2025RandomQuotr: Stored Cross-Site ScriptingCVE-2025-12632 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
RandomQuotr
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update RandomQuotr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record it.wordpress.org wordfence.com
Nov 6, 2025Grand Conference Theme Custom Post Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
Product
Grand Conference Theme Custom Post Type
Fixed in
2.6.4
What to do
Update Grand Conference Theme Custom Post Type to 2.6.4 or newer.
Full record and what to do →NVD record patchstack.com
Nov 5, 2025Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.CVE-2025-21078 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.8
Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.
Product
Smart Switch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Oct 27, 2025TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files.CVE-2025-27222 · Other software · Rocketsoftware · reported by MITREHigh 8.6
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Product
Trufusion Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com rcesecurity.com
Oct 26, 2025Premmerce Brands for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery.This issue affects Premmerce Brands for WooCommerce: from n/a through <= 1.2.13.
Product
Premmerce Brands for WooCommerce
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Premmerce Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1.CVE-2025-12202 · Other software · ajayrandhawa · reported by VulDBLow 2.1
A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Product
User-Management-PHP-MYSQL web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Oct 26, 2025A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1.CVE-2025-12201 · Other software · ajayrandhawa · reported by VulDBLow 2
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Product
User-Management-PHP-MYSQL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Oct 22, 2025In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source porCVE-2025-40780 · Other software · ISC · reported by security-officer@isc.orgHigh 8.6
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Product
BIND 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.isc.org openwall.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.CVE-2025-62651 · Other software · Restaurant Brands International · reported by MITREMedium 6.5
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.CVE-2025-62650 · Other software · Restaurant Brands International · reported by MITREHigh 8.3
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders.CVE-2025-62649 · Other software · Restaurant Brands International · reported by MITREMedium 5.8
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.CVE-2025-62648 · Other software · Restaurant Brands International · reported by MITREMedium 6.4
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API toCVE-2025-62647 · Other software · Restaurant Brands International · reported by MITREMedium 5
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between assoCVE-2025-62646 · Other software · Restaurant Brands International · reported by MITREMedium 5
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative priCVE-2025-62645 · Other software · Restaurant Brands International · reported by MITRECritical 9.9
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticateCVE-2025-62644 · Other software · Restaurant Brands International · reported by MITREMedium 5
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.CVE-2025-62643 · Other software · Restaurant Brands International · reported by MITRELow 3.4
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user accountCVE-2025-62642 · Other software · Restaurant Brands International · reported by MITREMedium 5.8
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.
Product
assistant platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.today bobdahacker.com
Oct 16, 2025A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C.CVE-2025-61330 · Other software · reported by MITREMedium 6.5
A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. The vulnerability stems from the use of a hard-coded weak password for the root account in the /etc/shadow configuration or even the absence of any password at all. Some of these devices have the Telnet service enabled by default, or users can choose to enable the Telnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices have related interfaces called Virtual Servers, which can map the devices to the public network, posing the risk of remote attacks. Therefore, attackers can obtain the highest root privileges of the devices through the Telnet service using the weak password hardcoded in the firmware (or without a password), and remote attacks are possible.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record notion.so
Oct 3, 2025Woo superb slideshow transition gallery with random effect: SQL InjectionCVE-2025-9199 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Woo superb slideshow transition gallery with random effect
Affected
up to 9.1
What to do
Affects up to 9.1. Update Woo superb slideshow transition gallery with random effect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.CVE-2024-58040 · Other software · QWER · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.
Product
Crypt::RandomEncryption
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org perldoc.perl.org
Sep 26, 2025An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdireCVE-2025-45994 · Other software · Arandasoft · reported by MITREHigh 7.5
An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.
Product
Passrecovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arandasoft.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.