Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,090 results · page 7 of 22
Jun 25, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-49135 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a `user` role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2025In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.CVE-2025-52926 · Other software · spytrap-org · reported by MITRELow 2.7
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
- Product
- spytrap-adb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.CVE-2025-6170 · Other software · Red Hat · reported by Red HatLow 2.5
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 6, 2025Interactive Regional Map of Africa: Cross-Site Request Forgery (CSRF)CVE-2025-49449 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
- Product
- Interactive Regional Map of Africa
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Interactive Regional Map of Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive UK Regional Map: Cross-Site Request Forgery (CSRF)CVE-2025-49445 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.
- Product
- Interactive UK Regional Map
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Interactive UK Regional Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive Regional Map of Florida: Missing AuthorizationCVE-2025-49441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Regional Map of Florida: from n/a through <= 1.0.
- Product
- Interactive Regional Map of Florida
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Interactive Regional Map of Florida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2025-48381 · Other software · cvat-ai · reported by GitHubMedium 5.3
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.CVE-2025-46741 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 5.7
A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested insCVE-2025-20974 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.1
Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested installation.
- Product
- PackageInstallerCN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 22, 2025xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser.CVE-2025-32965 · Other software · XRPLF · reported by GitHubCritical 9.3
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
- Product
- xrpl.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Basic Interactive World Map: Cross-Site Request Forgery (CSRF)CVE-2025-39517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map allows Cross Site Request Forgery.This issue affects Basic Interactive World Map: from n/a through <= 2.7.
- Product
- Basic Interactive World Map
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Basic Interactive World Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Interactive Geo Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapGeo Interactive Geo Maps interactive-geo-maps allows Reflected XSS.This issue affects Interactive Geo Maps: from n/a through <= 1.6.24.
- Product
- Interactive Geo Maps
- Affected
- up to 1.6.24
- What to do
- Affects up to 1.6.24. Update Interactive Geo Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Interactive US Map: Cross-Site Request Forgery (CSRF)CVE-2025-32661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive US Map interactive-us-map allows Stored XSS.This issue affects Interactive US Map: from n/a through <= 2.7.
- Product
- Interactive US Map
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Interactive US Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 6, 2025Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library fiCVE-2025-32369 · Other software · Kentico · reported by MITREMedium 6.4
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevnet.kentico.comlabs.watchtowr.com
Mar 27, 2025Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.CVE-2025-27793 · Other software · vega · reported by GitHubMedium 5.3
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.
- Product
- vega
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.CVE-2025-26619 · Other software · vega · reported by GitHubMedium 5.3
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
- Product
- vega
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlCVE-2024-54449 · Other software · LogicalDOC · reported by disclosure@synopsys.comHigh 8.7
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
- Product
- LogicalDOC Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyingCVE-2024-12019 · Other software · LogicalDOC · reported by disclosure@synopsys.comHigh 7.1
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
- Product
- LogicalDOC Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact witCVE-2025-27436 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.
- Product
- SAP S/4HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted infoCVE-2025-27430 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability
- Product
- SAP CRM and SAP S/4HANA (Interaction Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input.CVE-2023-43052 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022CVE-2025-27677 · Other software · Printerlogic · reported by MITRECritical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
- Product
- Vasion Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.compierrekim.github.io
Mar 3, 2025GPT Academic provides interactive interfaces for large language models.CVE-2025-25185 · Other software · binary-husky · reported by GitHubHigh 7.5
GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it. Subsequently, when accessing the decompressed file from the server, the soft link will point to the target file on the victim server. The vulnerability allows attackers to read all files on the server.
- Product
- gpt_academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Interactive Page Hierarchy: Missing AuthorizationCVE-2025-23615 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Page Hierarchy: from n/a through <= 1.0.1.
- Product
- Interactive Page Hierarchy
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Interactive Page Hierarchy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Memory corruption may occur in keyboard virtual device due to guest VM interaction.CVE-2024-53032 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption may occur in keyboard virtual device due to guest VM interaction.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025Application does not limit the number or frequency of user interactions, such as the number of incoming requests.CVE-2025-22273 · Other software · CyberArk · reported by cvd@cert.plCritical 9.3
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
- Product
- Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Mounting NFSCVE-2022-49379 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Mounting NFS rootfs was timing out when deferred_probe_timeout was non-zero [1]. This was because ip_auto_config() initcall times out waiting for the network interfaces to show up when deferred_probe_timeout was non-zero. While ip_auto_config() calls wait_for_device_probe() to make sure any currently running deferred probe work or asynchronous probe finishes, that wasn't sufficient to account for devices being deferred until deferred_probe_timeout. Commit 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") tried to fix that by making sure wait_for_device_probe() waits for deferred_probe_timeout to expire before returning. However, if wait_for_device_probe() is called from the kernel_init() context: - Before deferred_probe_initcall() [2], it causes the boot process to hang due to a deadlock. - After deferred_probe_initcall() [3], it blocks kernel_init() from continuing till deferred_probe_timeout expires and beats the point of deferred_probe_timeout that's trying to wait fo
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 20, 2025Mini Course Generator | Embed mini-courses and interactive content: Stored Cross-Site ScriptingCVE-2024-13672 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mini Course Generator | Embed mini-courses and interactive content
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Mini Course Generator | Embed mini-courses and interactive content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2025DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability.CVE-2025-25968 · Other software · Ddsn · reported by MITREMedium 6
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.
- Product
- Cm3 Acora Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution.CVE-2025-26604 · Other software · Discord-Agora · reported by GitHubHigh 8.3
Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the nature of arbitrary user-submited code execution, this allows user to execute potentially malicious code to perform damage or extract sensitive information. By loading the module containing the following code and run the command, the bot token can be extracted. Then the attacker can load a blocking module to sabotage the bot (DDoS attack) and the token can be used to make the fake bot act as the real one. If the bot has very high privilege, the attacker basically has full control before the user kicks the bot. Any Discord user that hosts Discord-Bot-Framework-Kernel before commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14 is affected. Users are advised to upgrade. Users unable to upgrade may attempt to limit their discord bot's access via configuration options.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.CVE-2025-0593 · Other software · SICK AG · reported by psirt@sick.deHigh 8.8
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.
- Product
- SICK Lector8xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.CVE-2025-25304 · Other software · vega · reported by GitHubMedium 6.9
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
- Product
- vega
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allCVE-2024-9870 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Feb 11, 2025PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) iCVE-2024-12366 · Other software · Sinaptik AI · reported by cret@cert.orgCritical 9.8
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.
- Product
- PandasAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.getpanda.aidocs.pandas-ai.com
Feb 6, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-24981 · Other software · nuxt-modules · reported by GitHubCritical 9.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxCVE-2025-23217 · Other software · mitmproxy · reported by GitHubHigh 8.2
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mitmproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Jan 28, 2025Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2025-23045 · Other software · cvat-ai · reported by GitHubHigh 8.7
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote MoCVE-2022-3365 · Other software · Emote Interactive · reported by cve@rapid7.comCritical 9.8
Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.
- Product
- Remote Mouse Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025An issue in Cloud Whale Interactive Technology LLC.CVE-2024-56967 · Other software · reported by MITREMedium 6.5
An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and CVE-2025-22964 · Other software · Ddsn · reported by MITREHigh 8.1
DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.
- Product
- Cm3 Acora Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interactionCVE-2025-0061 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3CVE-2024-13274 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Interactive UK Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56267 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive UK Map interactive-uk-map allows Stored XSS.This issue affects Interactive UK Map: from n/a through <= 3.4.8.
- Product
- Interactive UK Map
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Interactive UK Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2024sigstore-java is a sigstore java client for interacting with sigstore infrastructure.CVE-2024-54140 · Other software · sigstore · reported by GitHubLow 2.1
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0.
- Product
- sigstore-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interactiCVE-2024-37574 · Other software · reported by MITREHigh 8.2
The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: PHP Object InjectionCVE-2024-10587 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
- Affected
- up to 3.7.5.1
- What to do
- Affects up to 3.7.5.1. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 27, 2024go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line.CVE-2024-53859 · Other software · cli · reported by GitHubMedium 6.5
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN` environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also advised to regenerate authentication tokens and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise.
- Product
- go-gh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Nov 26, 2024sigstore-java is a sigstore java client for interacting with sigstore infrastructure.CVE-2024-53267 · Other software · sigstore · reported by GitHubMedium 5.5
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.verify(). The verifier may accept a bundle with an unrelated log entry, cryptographically verifying everything but fails to ensure the log entry applies to the artifact in question, thereby "verifying" a bundle without any proof the signing event was logged. This allows the creation of a bundle without fulcio certificate and private key combined with an unrelated but time-correct log entry to fake logging of a signing event. A malicious actor using a compromised identity may want to do this to prevent discovery via rekor's log monitors. The signer's identity will still be available to the verifier. The signature on the bundle must still be on the correct artifact for the verifier to pass. sigstore-gradle-plugin and sigstore-maven-plugin are not affected by this as they only provide signing functionality. This issue has been patched in v1.1.0 release with PR #856. All use
- Product
- sigstore-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000.CVE-2021-38135 · Other software · OpenText · reported by security@opentext.comHigh 8.6
Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000.
- Product
- iManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset CVE-2024-51329 · Other software · idrsdev · reported by MITREHigh 8.8
A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.
- Product
- agile-board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.