Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,394 results · page 61 of 388
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14312 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-13958 · WordPress plugins & themes · reported by WPScanMedium 5.9
The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.40
- What to do
- Update YaMaps for to 0.6.40 or newer.
Dec 29, 2025Plugin Organizer: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13417 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
- Product
- Plugin Organizer
- Fixed in
- 10.2.4
- What to do
- Update Plugin Organizer to 10.2.4 or newer.
Dec 26, 2025The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) proCVE-2025-67013 · Other software · Etlsystems · reported by MITREMedium 6.5
The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
- Product
- D0116s1ula-22454 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cometlsystems.com
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an CVE-2025-68738 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move the location of the queue params to within struct mt7996_vif_link.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: soc: mediatek: mtk-svs: Enable the IRQ later If the system does not come from reset (like CVE-2023-54059 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: soc: mediatek: mtk-svs: Enable the IRQ later If the system does not come from reset (like when is booted via kexec()), the peripheral might triger an IRQ before the data structures are initialised. [ 0.227710] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000f08 [ 0.227913] Call trace: [ 0.227918] svs_isr+0x8c/0x538
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5648: Free V4L2 fwnode data on unbind The V4L2 fwnode data structure doesn'tCVE-2022-50759 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5648: Free V4L2 fwnode data on unbind The V4L2 fwnode data structure doesn't get freed on unbind, which leads to a memleak.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 24, 2025Gravity Forms: Does not properly prevent users from uploading dangerous files through its chunked upload functionalityCVE-2025-13407 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.
- Product
- Gravity Forms
- Fixed in
- 2.9.23.1
- What to do
- Update Gravity Forms to 2.9.23.1 or newer.
Dec 23, 2025In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksCVE-2025-68338 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains. Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 22, 2025Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parCVE-2024-27708 · Other software · Airc · reported by MITRECritical 9.6
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- Product
- Mynet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuratiCVE-2025-61740 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
- Product
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 20, 2025Pure WC Variation Swatches: Does not have an authorization checkCVE-2025-12820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
- Product
- Pure WC Variation Swatches
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Pure WC Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow.CVE-2025-14299 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.1
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
- Product
- Tapo C200 V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Dec 18, 2025The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the veCVE-2025-68161 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.3
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
- Product
- Apache Log4j Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Dec 18, 2025Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.CVE-2025-68462 · Other software · Debian · reported by MITRELow 3.2
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
- Product
- FreedomBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing CVE-2025-65427 · Other software · Dbitnet · reported by MITREMedium 6.5
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations.
- Product
- Dbit N300 T1 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS asCVE-2025-62330 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
- Product
- DevOps Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 15, 2025URL Shortify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13355 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- URL Shortify
- Fixed in
- 1.11.4
- What to do
- Update URL Shortify to 1.11.4 or newer.
Dec 15, 2025URL Shortify: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-12684 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
- Product
- URL Shortify
- Fixed in
- 1.11.3
- What to do
- Update URL Shortify to 1.11.3 or newer.
Dec 15, 2025Royal Addons for Elementor: Does not have proper authorisationCVE-2025-11363 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1037
- What to do
- Update Royal Addons for Elementor to 1.7.1037 or newer.
Dec 14, 2025HelloLeads CRM Form Shortcode: Does not have authorisation and CSRF checkCVE-2025-12696 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
- Product
- HelloLeads CRM Form Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update HelloLeads CRM Form Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025WPS Visitor Counter: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9116 · WordPress plugins & themes · reported by WPScanMedium 5.8
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- WPS Visitor Counter
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update WPS Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios.CVE-2023-29144 · Other software · Malwarebytes · reported by MITRELow 3.3
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
- Product
- Malwarebytes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmalwarebytes.commalwarebytes.com
Dec 12, 2025WooMulti: Does not validate a file parameterCVE-2025-12835 · WordPress plugins & themes · reported by WPScanHigh 7.3
The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.
- Product
- WooMulti
- Affected
- up to 17
- What to do
- Affects up to 17. Update WooMulti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
- Product
- Construction Light
- Fixed in
- 1.6.8
- What to do
- Update Construction Light to 1.6.8 or newer.
Dec 11, 2025It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific caseCVE-2025-67779 · Other software · Meta · reported by cve-assign@fb.comHigh 7.5
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
- Product
- react-server-dom-parcel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the targCVE-2025-13663 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447Medium 5.4
Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.
- Product
- Quartus Prime Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments.CVE-2025-67738 · Other software · Webmin · reported by MITREHigh 8.5
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory whilCVE-2025-67643 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
- Product
- Jenkins Redpen - Pipeline Reporter for Jira Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/CCVE-2025-67642 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
- Product
- Jenkins HashiCorp Vault Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submCVE-2025-67641 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Coverage Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell scriptCVE-2025-67640 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
- Product
- Jenkins Git client Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential foCVE-2025-67638 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unaCVE-2025-67635 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL sCVE-2025-34393 · Network & remote access · Barracuda Networks · reported by VulnCheckCritical 10
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invocation of arbitrary methods or deserialization of untrusted types.
- Product
- RMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.mw-rmm.barracudamsp.combarracuda.com
Dec 10, 2025Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL thatCVE-2025-34392 · Network & remote access · Barracuda Networks · reported by VulnCheckCritical 10
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
- Product
- RMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.mw-rmm.barracudamsp.comlabs.watchtowr.com
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13073 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13072 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 9, 2025The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse autCVE-2025-42875 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.6
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
- Product
- SAP NetWeaver Internet Communication Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Custom Admin Menu: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13071 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Admin Menu
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WPeMatico RSS Feed Fetcher: Does not sanitize and escape some of its settingsCVE-2025-13031 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.13
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.13 or newer.
Dec 7, 2025In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the CVE-2023-53743 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 7, 2025In the Linux kernel, the following vulnerability has been resolved: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN p9_read_work() doesn't set RworkscheCVE-2025-40305 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) if list_empty(&m->req_list). However, if the pipe is full, we need to read more data and this used to work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer if the pipe is still full"). p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before the commit above) triggered the unnecessary wakeup. This wakeup calls p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() will notice EPOLLIN and schedule_work(&m->rq). This no longer happens after the optimization above, change p9_fd_request() to use p9_poll_mux() instead of only checking for EPOLLOUT.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 6, 2025In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroesCVE-2025-40276 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 5, 2025The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets.CVE-2025-66270 · Other software · KDE · reported by MITREMedium 4.7
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
- Product
- KDE Connect protocol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate.CVE-2025-61727 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
- Product
- crypto/x509
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Timetable and Event Schedule by MotoPress: Does not verify a user has access to a specific eventCVE-2025-12954 · WordPress plugins & themes · reported by WPScanLow 2.7
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.4.16
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.4.16 or newer.
Dec 2, 2025donation: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13001 · WordPress plugins & themes · reported by WPScanMedium 4.1
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
- Product
- donation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.