Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

449new WordPress flaws this week

390,525entries in the database

787 results · page 7 of 16

Jul 7, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles ExCVE-2025-53497 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 5.4
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles Extension allows Stored XSS.This issue affects Mediawiki - RelatedArticles Extension: from 1.43.X before 1.43.2.
Product
Mediawiki - RelatedArticles Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Jul 7, 2025An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered.CVE-2025-6711 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.4
An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.
Product
MongoDB Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Jun 30, 2025A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates.CVE-2025-49521 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
Product
Red Hat Ansible Automation Platform 2.5 for RHEL 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 30, 2025A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command.CVE-2025-49520 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Product
Red Hat Ansible Automation Platform 2.5 for RHEL 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 9, 2025A vulnerability was found in Redash up to 10.1.0/25.1.0.CVE-2025-5874 · Other software · reported by VulDBLow 1.2
A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards."
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 2, 2025An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.CVE-2025-5455 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3High 8.4
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Product
Qt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codereview.qt-project.org
May 29, 2025A logging issue was addressed with improved data redaction.CVE-2025-31199 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
May 21, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.CVE-2025-44895 · Other software · Planet · reported by MITREMedium 6.5
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.
Product
Wgs-804hpt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lafdrew.github.io
May 12, 2025A privacy issue was addressed with improved private data redaction for log entries.CVE-2025-31242 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.3, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
May 12, 2025A logging issue was addressed with improved data redaction.CVE-2025-31213 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.6
A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.
Product
iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
May 12, 2025A privacy issue was addressed with improved private data redaction for log entries.CVE-2025-24142 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 9, 2025SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery (CSRF)CVE-2025-32555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.
Product
SEO, Nutrition and Print for Recipes by Edamam
Affected
up to 3.3
What to do
Affects up to 3.3. Update SEO, Nutrition and Print for Recipes by Edamam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 7, 2025An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.CVE-2025-29478 · Other software · Treasuredata · reported by MITREMedium 5.5
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
Product
Fluent BIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 4, 2025An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.CVE-2025-29477 · Other software · Treasuredata · reported by MITREMedium 5.5
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
Product
Fluent BIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 31, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-30451 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Mar 31, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-30435 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sensitive user data in system logs.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Mar 31, 2025A logging issue was addressed with improved data redaction.CVE-2025-30424 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Deleting a conversation in Messages may expose user contact information in system logging.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 31, 2025A logging issue was addressed with improved data redaction.CVE-2025-24283 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 31, 2025A privacy issue was addressed with improved private data redaction for log entries.CVE-2025-24262 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sensitive user data in system logs.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Mar 31, 2025A privacy issue was addressed with improved private data redaction for log entries.CVE-2025-24218 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. An app may be able to access information about a user's contacts.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Mar 31, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-24217 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 31, 2025A logging issue was addressed with improved data redaction.CVE-2025-24202 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 27, 2025In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llCVE-2023-53003 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Mar 27, 2025In the Linux kernel, the following vulnerability has been resolved: EDAC/highbank: Fix memory leak in highbank_mc_probe() When devres_open_group() fails, it rCVE-2022-49757 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: EDAC/highbank: Fix memory leak in highbank_mc_probe() When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc(). Call edac_mc_free() on the error handling path to avoid a memory leak. [ bp: Massage commit message. ]
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Mar 10, 2025This issue was addressed with improved redaction of sensitive information.CVE-2024-54473 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Mar 5, 2025Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowinCVE-2025-27623 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io
Mar 5, 2025Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowiCVE-2025-27622 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io
Mar 5, 2025REDAXO is a PHP-based CMS.CVE-2025-27412 · Other software · redaxo · reported by GitHubMedium 6.1
REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.
Product
redaxo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 5, 2025REDAXO is a PHP-based CMS.CVE-2025-27411 · Other software · redaxo · reported by GitHubMedium 5.4
REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.
Product
redaxo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 5, 2025VEDA - MultiPurpose: PHP Object InjectionCVE-2024-13787 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backup_and_restore_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
VEDA - MultiPurpose
Affected
up to 4.2
What to do
Affects up to 4.2. Update VEDA - MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 27, 2025ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.CVE-2025-26325 · Other software · Shopxo · reported by MITRECritical 9.8
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.
Product
Shopxo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2025A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial CVE-2025-26309 · Other software · Libming · reported by MITREMedium 6.5
A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Product
Libming
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 18, 2025An issue was discovered in Fluent Bit 3.1.9.CVE-2024-50609 · Other software · Treasuredata · reported by MITREHigh 7.5
An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.
Product
Fluent BIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluentbit.io github.com
Feb 18, 2025An issue was discovered in Fluent Bit 3.1.9.CVE-2024-50608 · Other software · Treasuredata · reported by MITREHigh 7.5
An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.
Product
Fluent BIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluentbit.io github.com
Feb 12, 2025Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages componentCVE-2024-57605 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.
Product
Fuel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hkohi.ca
Jan 30, 2025A Stored Cross-Site Scripting vulnerability has been found in EmbedAI.CVE-2025-0747 · Other software · EmbedAI · reported by cve-coordination@incibe.esHigh 8.6
A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0746 · Other software · EmbedAI · reported by cve-coordination@incibe.esMedium 6.1
A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0745 · Other software · EmbedAI · reported by cve-coordination@incibe.esHigh 7.5
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/<SQL_FILE>" endpoint.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0744 · Other software · EmbedAI · reported by cve-coordination@incibe.esHigh 7.5
an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0743 · Other software · EmbedAI · reported by cve-coordination@incibe.esMedium 5.3
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0742 · Other software · EmbedAI · reported by cve-coordination@incibe.esMedium 5.8
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILE_ID" of the endpoint "/embedai/files/show/<FILE_ID>".
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0741 · Other software · EmbedAI · reported by cve-coordination@incibe.esMedium 5.8
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0740 · Other software · EmbedAI · reported by cve-coordination@incibe.esHigh 8.6
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint "/embedai/chats/load_messages?chat_id=<CHAT_ID>".
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0739 · Other software · EmbedAI · reported by cve-coordination@incibe.esHigh 8.6
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTION_ID" param of the endpoint "/demos/embedai/subscriptions/show/<SUSCBRIPTION_ID>".
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 27, 2025A logging issue was addressed with improved data redaction.CVE-2025-24169 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jan 27, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-24146 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. Deleting a conversation in Messages may expose user contact information in system logging.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jan 27, 2025A privacy issue was addressed with improved private data redaction for log entries.CVE-2025-24145 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An app may be able to view a contact's phone number in system logs.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jan 27, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-24117 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jan 27, 2025This issue was addressed with improved redaction of sensitive information.CVE-2025-24101 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Jan 27, 2025This issue was addressed with improved redaction of sensitive information.CVE-2024-54550 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An app may be able to view autocompleted contact information from Messages and Mail in system logs.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.