Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,408 results · page 71 of 389
May 15, 2025illi Link Party!: Does not have CSRF check in placeCVE-2023-7229 · WordPress plugins & themes · reported by WPScanMedium 5.5
The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not sanitise and escape some parametersCVE-2023-7228 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Marketing Twitter Bot: Does not have CSRF check in some placesCVE-2023-7197 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Marketing Twitter Bot
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Marketing Twitter Bot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Ultimate Noindex Nofollow Tool: Does not have CSRF check in placeCVE-2023-7196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Ultimate Noindex Nofollow Tool
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ultimate Noindex Nofollow Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP-Reply Notify: Does not have a CSRF check in placeCVE-2023-7195 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- WP-Reply Notify
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP-Reply Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025aBitGone CommentSafe: Does not have CSRF check in some placesCVE-2023-7174 · WordPress plugins & themes · reported by WPScanHigh 7.1
The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- aBitGone CommentSafe
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update aBitGone CommentSafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Better Follow Button for Jetpack
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Add SVG Support for Media Uploader | inventivo: Does not sanitize uploaded SVG filesCVE-2023-7088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Add SVG Support for Media Uploader | inventivo
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Add SVG Support for Media Uploader | inventivo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025SVG Uploads Support: Does not sanitize uploaded SVG filesCVE-2023-7086 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- SVG Uploads Support
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update SVG Uploads Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Payment Gateway for Telcell
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WolfNet IDX for: Does not sanitise and escape some of its settingsCVE-2023-6783 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WolfNet IDX for
- Affected
- up to 1.19.1
- What to do
- Affects up to 1.19.1. Update WolfNet IDX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Allow SVG: Does not sanitize uploaded SVG filesCVE-2023-6541 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Allow SVG
- Fixed in
- 1.2.0
- What to do
- Update Allow SVG to 1.2.0 or newer.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not have CSRF check in placeCVE-2023-5934 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.13
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.13 or newer.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5932 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.14
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.14 or newer.
May 15, 2025Advanced Page Visit Counter: Does not sanitise and escape some of its settingsCVE-2023-5529 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Page Visit Counter
- Fixed in
- 8.0.6
- What to do
- Update Advanced Page Visit Counter to 8.0.6 or newer.
May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector
- Fixed in
- 1.4
- What to do
- Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.
May 15, 2025In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.CVE-2025-48050 · Other software · Cure53 · reported by MITREHigh 7.5
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which CVE-2025-2570 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
May 14, 2025Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a storeCVE-2025-47885 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.
- Product
- Jenkins Health Advisor by CloudBees Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to aCVE-2025-43011 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted functionalities or data. This can lead to a high impact on confidentiality with no impact on the integrity or availability of the application.
- Product
- SAP Landscape Transformation (PCL Basis)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.CVE-2025-43009 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on Confidentiality, integrity and availability of the application.
- Product
- SAP Service Parts Management (SPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.CVE-2025-43007 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on confidentiality, integrity and availability of the application.
- Product
- SAP Service Parts Management (SPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script.CVE-2025-26662 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.4
The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted.
- Product
- SAP Data Services Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025LightPress Lightbox: Does not check download links point to validCVE-2025-3649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
- Product
- LightPress Lightbox
- Fixed in
- 2.3.4
- What to do
- Update LightPress Lightbox to 2.3.4 or newer.
May 12, 2025Firelight Lightbox: Does not prevent users with post writing capabilities from executing arbitrary JavascriptCVE-2025-3597 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.15
- What to do
- Update Firelight Lightbox to 2.3.15 or newer.
May 9, 2025In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the CVE-2025-37887 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink command. This happens because the stack variable fw_list is not 0 initialized which results in fw_list.num_fw_slots being a garbage value from the stack. Then the driver tries to access fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end of the array. Fix this by initializing the fw_list and by not failing completely if the devcmd fails because other useful information is printed via devlink dev info even if the devcmd fails.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriCVE-2025-3463 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allCVE-2025-3462 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
- Product
- DriverHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event coCVE-2025-37810 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 5, 2025Newsletter: Does not sanitise and escape some of its settingsCVE-2025-3583 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.7.1
- What to do
- Update Newsletter to 8.7.1 or newer.
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't ownCVE-2023-53084 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes CVE-2023-53054 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes to low power, PM suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new devres each time. This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start(). This can be seen with tracing: - echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable - go to low power - cat /sys/kernel/debug/tracing/trace A new "ADD" entry is found upon each low power cycle: ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ... A second issue is addressed here: - regulator_bulk_enable() is called upon each PM cycle (suspend/resume). - regulator_bulk_disable() never gets called. So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable(). The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happ
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 2, 2025Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compCVE-2025-3927 · Other software · Digigram · reported by cret@cert.orgCritical 9.8
Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices.
- Product
- PYKO-OUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigigram.comkb.cert.org
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3514 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3513 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak When a cxl_nvdimm object goes through a CVE-2022-49896 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak When a cxl_nvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge disabled, or nvdimm device disabled), then any associated regions must also be disabled. As highlighted by the cxl-create-region.sh test [1], a single device may host multiple regions, but the driver was only tracking one region at a time. This leads to a situation where only the last enabled region per nvdimm device is cleaned up properly. Other regions are leaked, and this also causes cxl_memdev reference leaks. Fix the tracking by allowing cxl_nvdimm objects to track multiple region associations.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: io_uring: fix multishot accept request leaks Having REQ_F_POLLED set doesn't guarantee thaCVE-2022-49791 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix multishot accept request leaks Having REQ_F_POLLED set doesn't guarantee that the request is executed as a multishot from the polling path. Fortunately for us, if the code thinks it's multishot issue when it's not, it can only ask to skip completion so leaking the request. Use issue_flags to mark multipoll issues.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCK_RCU_FREE Bind lookup runs under RCU, so ensure that a socket doesn't gCVE-2025-37790 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCK_RCU_FREE Bind lookup runs under RCU, so ensure that a socket doesn't go away in the middle of a lookup.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and doesCVE-2025-37778 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3504 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3503 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 30, 2025SureForms: Does not have proper authorisation checkCVE-2025-3471 · WordPress plugins & themes · reported by WPScanMedium 4.9
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
Apr 29, 2025Bookgy does not provide for proper authorisation control in multiple areas of the application.CVE-2025-40619 · Other software · Bookgy · reported by cve-coordination@incibe.esCritical 9.3
Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles.
- Product
- Bookgy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-12273 · WordPress plugins & themes · reported by WPScanLow 3.5
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 28, 2025DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.CVE-2023-35814 · Other software · DevExpress · reported by MITRELow 3.5
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
- Product
- DevExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comsupportcenter.devexpress.com
Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Tag, Category, and Taxonomy Manager
- Fixed in
- 3.30.0
- What to do
- Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.
Apr 28, 2025WP-Recall: Does not sanitise and escape some of its settingsCVE-2024-9771 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.