Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
871 results · page 7 of 18
May 13, 2025Animate versions 24.0.8, 23.0.11 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service.CVE-2025-30329 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 24.0.8, 23.0.11 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Animate versions 24.0.8, 23.0.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context oCVE-2025-30328 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 24.0.8, 23.0.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm.CVE-2025-47270 · Other software · nimiq · reported by GitHubHigh 7.5
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service (DoS) attack due to uncontrolled memory allocation. Specifically, the implementation of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enforcing an upper bound. Since this length is a `u32`, a peer can trigger allocations of up to 4 GB, potentially leading to memory exhaustion and node crashes. As Discovery messages are regularly exchanged for peer discovery, this vulnerability can be exploited repeatedly. The patch for this vulnerability is formally released as part of v1.1.0. The patch implements a limit to the discovery message size of 1 MB and also resizes the message buffer size incrementally as the data is read. No known workarounds are available.
- Product
- core-rs-albatross
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu macvlan should enforce a minimal mtu of 68, evenCVE-2022-49776 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu macvlan should enforce a minimal mtu of 68, even at link creation. This patch avoids the current behavior (which could lead to crashes in ipv6 stack if the link is brought up) $ ip link add macvlan1 link eno1 mtu 8 type macvlan # This should fail ! $ ip link sh dev macvlan1 5: macvlan1@eno1: <BROADCAST,MULTICAST> mtu 8 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 02:47:6c:24:74:82 brd ff:ff:ff:ff:ff:ff $ ip link set macvlan1 mtu 67 Error: mtu less than device minimum. $ ip link set macvlan1 mtu 68 $ ip link set macvlan1 mtu 8 Error: mtu less than device minimum.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 24, 2025Animate: Server-Side Request Forgery (SSRF)CVE-2025-46443 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <= 0.5.
- Product
- Animate
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Greenshift – animation and page builder blocks: Arbitrary file uploadsCVE-2025-3616 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
- Product
- Greenshift – animation and page builder blocks
- Affected
- 11.4 to 11.4.5
- What to do
- Affects 11.4 to 11.4.5. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 20, 2025In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.CVE-2025-43964 · Other software · LibRaw · reported by MITRELow 2.9
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.
- Product
- LibRaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter.CVE-2025-3512 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 4.8
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgopenwall.com
Apr 9, 2025Nimbata Call Tracking: Cross-Site Request Forgery (CSRF)CVE-2025-32616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nimbata Nimbata Call Tracking nimbata-call-tracking allows Stored XSS.This issue affects Nimbata Call Tracking: from n/a through <= 1.7.4.
- Product
- Nimbata Call Tracking
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Nimbata Call Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-27202 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-27201 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the CVE-2025-27200 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conCVE-2025-27199 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
- Product
- Minimalistic Event Manager
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025gifplayer is a customizable jquery plugin to play and stop animated gifs.CVE-2025-31128 · Other software · rubentd · reported by GitHubMedium 6.9
gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 0.3.7.
- Product
- gifplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages.CVE-2025-3019 · Other software · KNIME · reported by security@knime.comMedium 5.3
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data. The issues are caused by a bug https://github.com/Baroshem/nuxt-security/issues/610 in the widely used nuxt-security module. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.3 or later * 1.12.4 or later
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remoCVE-2025-2402 · Other software · KNIME · reported by security@knime.comHigh 8.8
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.2 or later * 1.12.3 or later * 1.11.3 or later * 1.10.3 or later
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component.CVE-2025-2787 · Other software · KNIME · reported by security@knime.comHigh 8.7
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower. Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: * 1.13.3 or above * 1.12.4 or above * 1.11.4 or above * 1.10.4 or above *
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2025A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified as critical.CVE-2018-25109 · Other software · Nintendo · reported by VulDBMedium 5.4
A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified as critical. Affected by this vulnerability is an unknown functionality of the component Letter Trigram Handler. The manipulation leads to memory corruption. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Animal Crossing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhunter-r.com
Mar 20, 2025In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions,CVE-2024-9099 · Other software · lunary-ai · reported by security@huntr.devHigh 8.1
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts.CVE-2024-10954 · Other software · binary-husky · reported by security@huntr.devHigh 8.8
In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.
- Product
- binary-husky/gpt_academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025MinimogWP – The High Converting eCommerce: Local File InclusionCVE-2024-13790 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.7.0 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- MinimogWP – The High Converting eCommerce
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update MinimogWP – The High Converting eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordchangelog.thememove.comthemeforest.net
Mar 18, 2025IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls.CVE-2024-56347 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.6
IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls.CVE-2024-56346 · Other software · IBM · reported by psirt@us.ibm.comCritical 10
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-0433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
- Affected
- up to 2.0.7.1
- What to do
- Affects up to 2.0.7.1. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
- Affected
- up to 2.0.7.2
- What to do
- Affects up to 2.0.7.2. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmaster-addons.complugins.trac.wordpress.org
Mar 3, 2025Animation Addons for Elementor Pro: Unauthorized arbitrary plugin installationCVE-2025-1639 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
- Product
- Animation Addons for Elementor Pro
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Animation Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 24, 2025Minimum Password Strength: Cross-Site Request Forgery (CSRF)CVE-2025-27339 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength minimum-password-strength allows Cross Site Request Forgery.This issue affects Minimum Password Strength: from n/a through <= 1.2.0.
- Product
- Minimum Password Strength
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Minimum Password Strength to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Animated Text Block: Missing AuthorizationCVE-2025-26883 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.
- Product
- Animated Text Block
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Animated Text Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2025Typed JS: A typewriter style animation: Stored Cross-Site ScriptingCVE-2025-1328 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Typed JS: A typewriter style animation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Typed JS: A typewriter style animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 6, 2025A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03.CVE-2025-1085 · Other software · Animati · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations: Unauthorized modification of dataCVE-2024-12620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'agl_json' AJAX action in all versions up to, and including, 1.4.23. This makes it possible for unauthenticated attackers to update the plugin's settings.
- Product
- AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 23, 2025An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allCVE-2024-55195 · Other software · reported by MITREHigh 7.5
An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allocate too much space.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.CVE-2024-55194 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.CVE-2024-55193 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).CVE-2024-55192 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Background animation blocks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23948 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks background-animation-blocks allows PHP Local File Inclusion.This issue affects Background animation blocks: from n/a through <= 2.1.5.
- Product
- Background animation blocks
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Background animation blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025MyAnime Widget: Cross-Site Request Forgery (CSRF)CVE-2025-23532 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.
- Product
- MyAnime Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MyAnime Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2025Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2025-21135 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSCVE-2024-13287 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.
- Product
- Views SVG Animation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Greenshift – animation and page builder blocks: Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site ScriptingCVE-2024-6155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
- Product
- Greenshift – animation and page builder blocks
- Affected
- up to 9.0.0
- What to do
- Affects up to 9.0.0. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
- Affected
- up to 2.0.6.7
- What to do
- Affects up to 2.0.6.7. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmaster-addons.complugins.trac.wordpress.org
Jan 2, 2025Animated Rotating Words: Cross-Site Request Forgery (CSRF)CVE-2024-38753 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Cross Site Request Forgery.This issue affects Animated Rotating Words: from n/a through <= 5.6.
- Product
- Animated Rotating Words
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animator: Missing AuthorizationCVE-2023-47689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.
- Product
- Animator
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animated Rotating Words: Missing AuthorizationCVE-2023-47187 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Rotating Words: from n/a through <= 5.4.
- Product
- Animated Rotating Words
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024In the Linux kernel, the following vulnerability has been resolved: slab: Fix too strict alignment check in create_cache() On m68k, where the minimum alignmenCVE-2024-56560 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: slab: Fix too strict alignment check in create_cache() On m68k, where the minimum alignment of unsigned long is 2 bytes: Kernel panic - not syncing: __kmem_cache_create_args: Failed to create slab 'io_kiocb'. Error -22 CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-atari-03776-g7eaa1f99261a #1783 Stack from 0102fe5c: 0102fe5c 00514a2b 00514a2b ffffff00 00000001 0051f5ed 00425e78 00514a2b 0041eb74 ffffffea 00000310 0051f5ed ffffffea ffffffea 00601f60 00000044 0102ff20 000e7a68 0051ab8e 004383b8 0051f5ed ffffffea 000000b8 00000007 01020c00 00000000 000e77f0 0041e5f0 005f67c0 0051f5ed 000000b6 0102fef4 00000310 0102fef4 00000000 00000016 005f676c 0060a34c 00000010 00000004 00000038 0000009a 01000000 000000b8 005f668e 0102e000 00001372 0102ff88 Call Trace: [<00425e78>] dump_stack+0xc/0x10 [<0041eb74>] panic+0xd8/0x26c [<000e7a68>] __kmem_cache_create_args+0x278/0x2e8 [<000e77f0>] __kmem_cache_create_args+0x0/0x2e8 [<0041e5f0>] memset+0x0/0x8c [<005f67c0>] io_uring_init+0x54/0xd2 The minimal alignment of an integral type may differ from it
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 20, 2024Maintenance & Coming Soon Redirect Animation: Unauthorized modification of dataCVE-2024-9503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
- Product
- Maintenance & Coming Soon Redirect Animation
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2024Animation Addons for Elementor: Sensitive Information ExposureCVE-2024-12340 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
- Product
- Animation Addons for Elementor
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Animation Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2024Animated Counters: Stored Cross-Site ScriptingCVE-2024-11905 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Animated Counters
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Animated Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 16, 2024Go Animate: Cross-Site Request Forgery (CSRF)CVE-2024-54397 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in antonio.gocaj Go Animate goanimate allows Stored XSS.This issue affects Go Animate: from n/a through <= 1.0.
- Product
- Go Animate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Go Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.