Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
922 results · page 7 of 19
Aug 27, 2025Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability.CVE-2025-43730 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A local unauthenticated user could potentially exploit this vulnerability leading to Elevation of Privileges and Information disclosure.
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61.CVE-2025-57797 · Other software · PFU Limited · reported by vultures@jpcert.or.jpHigh 8.5
Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authenticated local attacker may escalate privileges and execute an arbitrary command.
- Product
- ScanSnap Manager installers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code coCVE-2025-8447 · Other software · GitHub · reported by product-cna@github.comHigh 7
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Aug 20, 2025WP Discord Post Plus – Supports Unlimited Channels: Cross-Site Request Forgery (CSRF)CVE-2025-49896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.
- Product
- WP Discord Post Plus – Supports Unlimited Channels
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Discord Post Plus – Supports Unlimited Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2025** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.CVE-2025-53192 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Commons OGNL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 18, 2025ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file systCVE-2025-54234 · Websites & servers · Adobe · reported by AdobeLow 2.7
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.CVE-2025-54472 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it. The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0. Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.14.1. 2.
- Product
- Apache bRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 8, 2025A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conducCVE-2025-52914 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conductCVE-2025-52913 · Other software · reported by MITRECritical 9.8
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote MicrosoCVE-2025-55077 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
- Product
- ERP Pro 9 SaaS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Aug 7, 2025A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (CVE-2025-47188 · Other software · reported by MITREMedium 6.5
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI.CVE-2025-48394 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center.
- Product
- G4 PDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions.CVE-2025-53077 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 6.5
An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability.
- Product
- DMS(Data Management Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025Brizy – Page Builder: Limited file uploadsCVE-2025-4370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.
- Product
- Brizy – Page Builder
- Affected
- up to 2.6.20
- What to do
- Affects up to 2.6.20. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54768 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
- Product
- LPAR2RRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comlpar2rrd.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54766 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54765 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 23, 2025A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (CVE-2025-47187 · Other software · reported by MITREHigh 7.5
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to perform a file upload attack due to missing authentication mechanisms. A successful exploit could allow an attacker to upload arbitrary WAV files, which may potentially exhaust the phone’s storage without affecting the phone's availability or operation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite coCVE-2025-6230 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.8
A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
- Product
- Vantage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.CVE-2024-58258 · Other software · SugarCRM · reported by MITREHigh 7.2
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
- Product
- SugarCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comseclists.org
Jul 11, 2025An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with hCVE-2025-52989 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration. A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration. This issue affects: Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO, * 24.2-EVO versions before 24.2R2-S1-EVO * 24.4-EVO versions before 24.4R2-EVO.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Jul 9, 2025Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of servCVE-2025-35983 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 6.5
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. This issue affects Controller 7000: 9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
- Product
- Controller 7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Jul 4, 2025Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1CVE-2025-32918 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.3
Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port nuCVE-2024-51980 · Other software · Brother Industries, Ltd · reported by cve@rapid7.comMedium 5.3
An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.
- Product
- HL-L8260CDN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.contentstack.iogithub.com
Jun 24, 2025A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 couldCVE-2025-27828 · Other software · reported by MITREHigh 7.1
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts with a limited impact on the confidentiality and the integrity.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an informatiCVE-2025-27827 · Other software · reported by MITREHigh 7.1
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper handling of session data. A successful exploit requires user interaction and could allow an attacker to access sensitive information, leading to unauthorized access to active chat rooms, reading chat data, and sending messages during an active chat session.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.CVE-2025-3090 · Other software · MB connect line · reported by info@cert.vde.comHigh 8.2
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Jun 23, 2025Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack CVE-2025-23092 · Other software · reported by MITREHigh 7.2
Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to upload arbitrary files and execute unauthorized commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traveCVE-2025-48026 · Other software · reported by MITREHigh 7.5
A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and obtain sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits.CVE-2025-5485 · Other software · SinoTrack · reported by ics-cert@hq.dhs.govHigh 8.8
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences.
- Product
- IOT PC Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govsinotrackgps.com
Jun 12, 2025Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to CVE-2025-35978 · Other software · Fujitsu Client Computing Limited · reported by vultures@jpcert.or.jpMedium 6.9
Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.
- Product
- UpdateNavi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordazby.fmworld.netjvn.jp
May 22, 2025Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara EnterpriseCVE-2025-3945 · Other software · Tridium · reported by psirt@honeywell.comHigh 7.2
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
- Product
- Niagara Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.niagara-community.comhoneywell.com
May 21, 2025A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of fCVE-2025-20113 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.1
A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due to insufficient server-side validation of user-supplied parameters in API or HTTP requests. An attacker could exploit this vulnerability by submitting a crafted API or HTTP request to an affected system. A successful exploit could allow the attacker to access, modify, or delete data beyond the sphere of their intended access level, including obtaining potentially sensitive information stored in the system.
- Product
- Cisco Unified Contact Center Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 20, 2025OpenFlow discovery protocol can exhaust resources because it is not rate limitedCVE-2025-48016 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
OpenFlow discovery protocol can exhaust resources because it is not rate limited
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can caCVE-2025-30193 · Other software · PowerDNS · reported by security@open-xchange.comHigh 7.5
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.10 version. A workaround is to restrict the maximum number of queries on incoming TCP connections to a safe value, like 50, via the setMaxTCPQueriesPerConnection setting. We would like to thank Renaud Allard for bringing this issue to our attention.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Unauthorized modification of dataCVE-2025-3455 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriCVE-2025-3463 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allCVE-2025-3462 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Limited Code ExecutionCVE-2025-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter).
- Product
- NEX-Forms – Ultimate Form Builder – Contact forms and much more
- Affected
- up to 8.9.1
- What to do
- Affects up to 8.9.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Limited privilege escalationCVE-2025-3438 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.4
- What to do
- Affects up to 4.17.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025Flynax Bridge: Limited Privilege EscalationCVE-2025-4179 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors.
- Product
- Flynax Bridge
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Flynax Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025Verification SMS with TargetSMS: Limited Remote Code ExecutionCVE-2025-3776 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().
- Product
- Verification SMS with TargetSMS
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Verification SMS with TargetSMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 15, 2025Unlimited Timeline: Missing AuthorizationCVE-2025-27008 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Unlimited Timeline: from n/a through < 1.6.1.
- Product
- Unlimited Timeline
- What to do
- Update Unlimited Timeline to the newest version.
Apr 11, 2025OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123".CVE-2025-32107 · Network & remote access · TP-Link Corporation Limited · reported by vultures@jpcert.or.jpHigh 8
OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device.
- Product
- Deco BE65 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allowsCVE-2024-38865 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 6
Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for an event to originate from a host with the same contact group or from an event generated with an unknown host.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2025-1663 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 1.5.142
- What to do
- Affects up to 1.5.142. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025An issue was discovered on Mitel ICP VoIP 3100 devices.CVE-2003-20001 · Other software · reported by MITREMedium 5.6
An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an external call comes in, the system incorrectly divulges information about the call and any SMDR records generated by the system. The information provided includes the service type, extension number and other parameters, related to the call activity.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordolografix.orgpacketstorm.news
Mar 31, 2025Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238.CVE-2025-30672 · Other software · TOBYINK · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. This affects the Mite distribution itself, and other distributions that contain code generated by Mite.
- Product
- Mite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.perl.orgmetacpan.org
Mar 28, 2025Unlimited: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31073 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.
- Product
- Unlimited
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update Unlimited to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack.CVE-2025-29311 · Other software · Opennetworking · reported by MITREHigh 7.5
Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.