Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
697 results · page 6 of 14
May 16, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.2
- What to do
- Affects up to 3.7.0.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Bon Toolkit: Stored Cross-Site ScriptingCVE-2025-4589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bon Toolkit
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Bon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 12, 2025IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to impropeCVE-2025-3632 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improper memory allocation of an excessive size.
- Product
- 4769 Developers Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit.CVE-2025-46332 · Other software · vercel · reported by GitHubMedium 6.5
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the flag names, flag descriptions, available options and their labels (e.g. true, false), and default flag values. This issue has been patched in flags@4.0.0, users of flags and @vercel/flags should also migrate to flags@4.0.0.
- Product
- flags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025WPMasterToolKit (WPMTK) – All in one: Directory TraversalCVE-2025-3300 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- WPMasterToolKit (WPMTK) – All in one
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update WPMasterToolKit (WPMTK) – All in one to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 22, 2025affiliate-toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-46231 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.
- Product
- affiliate-toolkit
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Travelfic Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Stored XSS.This issue affects Travelfic Toolkit: from n/a through <= 1.2.1.
- Product
- Travelfic Toolkit
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.1
- What to do
- Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-30309 · Other software · Adobe · reported by AdobeMedium 5.5
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- XMPWorker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-30308 · Other software · Adobe · reported by AdobeMedium 5.5
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- XMPWorker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-30307 · Other software · Adobe · reported by AdobeMedium 5.5
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- XMPWorker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-30306 · Other software · Adobe · reported by AdobeMedium 5.5
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- XMPWorker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-30305 · Other software · Adobe · reported by AdobeMedium 5.5
XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- XMPWorker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.
- Product
- Bulk NoIndex & NoFollow Toolkit
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Agency Toolkit: Missing AuthorizationCVE-2025-31863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Agency Toolkit: from n/a through <= 1.0.24.
- Product
- Agency Toolkit
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30796 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.14.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.14
- What to do
- Affects up to 3.0.14. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.0.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.5.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2025An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-dCVE-2025-1468 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
- Product
- CODESYS Runtime Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.CVE-2025-25293 · Other software · SAML-Toolkits · reported by GitHubHigh 7.7
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
- Product
- ruby-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgithub.blog
Mar 12, 2025ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.CVE-2025-25292 · Other software · SAML-Toolkits · reported by GitHubCritical 9.3
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.
- Product
- ruby-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgithub.blog
Mar 12, 2025ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.CVE-2025-25291 · Other software · SAML-Toolkits · reported by GitHubCritical 9.3
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
- Product
- ruby-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgithub.blog
Mar 11, 2025ThemeEgg ToolKit: Unrestricted Upload of File with Dangerous TypeCVE-2025-28915 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through <= 1.2.9.
- Product
- ThemeEgg ToolKit
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update ThemeEgg ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Arbitrary file uploadsCVE-2024-13882 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcoderevolution.rowordfence.com
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Unauthorized access, modification, and loss of dataCVE-2024-13816 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete posts, list and delete batches, list assistant uploaded files, delete personas, delete forms, delete templates, and clear logs. The vulnerability was partially patched in version 2.3.5.
- Product
- Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcoderevolution.rowordfence.com
Mar 1, 2025TemplatesNext ToolKit: Stored Cross-Site ScriptingCVE-2024-13559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TemplatesNext ToolKit
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update TemplatesNext ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to CVE-2024-53879 · Other software · NVIDIA · reported by psirt@nvidia.comLow 2.8
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to CVE-2024-53878 · Other software · NVIDIA · reported by psirt@nvidia.comLow 2.8
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed CVE-2024-53877 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELFCVE-2024-53876 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53875 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53874 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF fileCVE-2024-53873 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53872 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELFCVE-2024-53871 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53870 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025AWcode Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.
- Product
- AWcode Toolkit
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update AWcode Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of dataCVE-2024-13554 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder posts.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.13
- What to do
- Affects up to 3.0.13. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2025NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container iCVE-2025-23359 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.3
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comthehackernews.com
Feb 11, 2025Distribution is a toolkit to pack, ship, store, and deliver container content.CVE-2025-24976 · Other software · distribution · reported by GitHubMedium 6.6
Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a JSON web token (JWT). The issue lies in how the JSON web key (JWK) verification is performed. When a JWT contains a JWK header without a certificate chain, the code only checks if the KeyID (`kid`) matches one of the trusted keys, but doesn't verify that the actual key material matches. A fix for the issue is available at commit 5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd and expected to be a part of version 3.0.0-rc.3. There is no way to work around this issue without patching if the system requires token authentication.
- Product
- distribution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-10867 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Remote Code ExecutionCVE-2024-11600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Unauthorized loss of dataCVE-2024-11583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
- Product
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2025NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the hostCVE-2024-0137 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.
- Product
- NVIDIA Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and CVE-2024-0136 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.6
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- NVIDIA Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary.CVE-2024-0135 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.6
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- NVIDIA Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025The Ultimate WordPress Toolkit – WP Extended: Time-based SQL InjectionCVE-2024-13184 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.12
- What to do
- Affects up to 3.0.12. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2025Caido is a web security auditing toolkit.CVE-2025-23039 · Other software · caido · reported by GitHubMedium 5.2
Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- caido
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Kopa Nictitate Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kopatheme Kopa Nictitate Toolkit kopa-nictitate-toolkit allows Stored XSS.This issue affects Kopa Nictitate Toolkit: from n/a through <= 1.0.2.
- Product
- Kopa Nictitate Toolkit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Kopa Nictitate Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.