Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

2,193 results · page 9 of 44

Apr 1, 2025Memory safety bugs present in Firefox 136 and Thunderbird 136.CVE-2025-3034 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Apr 1, 2025Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8.CVE-2025-3030 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 26, 2025An authenticated attacker can compromise the availability of the device via the networkCVE-2025-2820 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6Medium 6.5
An authenticated attacker can compromise the availability of the device via the network
Product
Product family GLx and CWx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Mar 26, 2025There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process.CVE-2025-2819 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6Medium 6.6
There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
Product
GT-SoftControl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Mar 10, 2025Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown CVE-2025-26696 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 10, 2025When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emailCVE-2025-26695 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 4, 2025Memory safety bugs present in Firefox 135 and Thunderbird 135.CVE-2025-1943 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.2
Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 4, 2025Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7.CVE-2025-1938 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 4, 2025Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7.CVE-2025-1937 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 3, 2025ViperBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This issue affects ViperBar: from n/a through <= 2.0.
Product
ViperBar
Affected
up to 2.0
What to do
Affects up to 2.0. Update ViperBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Userbase Access Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Userbase Access Control userbase-access-control allows Reflected XSS.This issue affects Userbase Access Control: from n/a through <= 1.0.
Product
Userbase Access Control
Affected
up to 1.0
What to do
Affects up to 1.0. Update Userbase Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other CVE-2025-25724 · Other software · libarchive · reported by MITREMedium 4
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
Product
libarchive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Feb 27, 2025GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.CVE-2024-55160 · Other software · G-fast · reported by MITRECritical 9.8
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.
Product
Gfast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() In an attempt to log CVE-2022-49542 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() In an attempt to log message 0126 with LOG_TRACE_EVENT, the following hard lockup call trace hangs the system. Call Trace: _raw_spin_lock_irqsave+0x32/0x40 lpfc_dmp_dbg.part.32+0x28/0x220 [lpfc] lpfc_cmpl_els_fdisc+0x145/0x460 [lpfc] lpfc_sli_cancel_jobs+0x92/0xd0 [lpfc] lpfc_els_flush_cmd+0x43c/0x670 [lpfc] lpfc_els_flush_all_cmd+0x37/0x60 [lpfc] lpfc_sli4_async_event_proc+0x956/0x1720 [lpfc] lpfc_do_work+0x1485/0x1d70 [lpfc] kthread+0x112/0x130 ret_from_fork+0x1f/0x40 Kernel panic - not syncing: Hard LOCKUP The same CPU tries to claim the phba->port_list_lock twice. Move the cfg_log_verbose checks as part of the lpfc_printf_vlog() and lpfc_printf_log() macros before calling lpfc_dmp_dbg(). There is no need to take the phba->port_list_lock within lpfc_dmp_dbg().
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state The EXT4_FC_REPLAY bCVE-2022-49348 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state The EXT4_FC_REPLAY bit in sbi->s_mount_state is used to indicate that we are in the middle of replay the fast commit journal. This was actually a mistake, since the sbi->s_mount_info is initialized from es->s_state. Arguably s_mount_state is misleadingly named, but the name is historical --- s_mount_state and s_state dates back to ext2. What should have been used is the ext4_{set,clear,test}_mount_flag() inline functions, which sets EXT4_MF_* bits in sbi->s_mount_flags. The problem with using EXT4_FC_REPLAY is that a maliciously corrupted superblock could result in EXT4_FC_REPLAY getting set in s_mount_state. This bypasses some sanity checks, and this can trigger a BUG() in ext4_es_cache_extent(). As a easy-to-backport-fix, filter out the EXT4_FC_REPLAY bit for now. We should eventually transition away from EXT4_FC_REPLAY to something like EXT4_MF_REPLAY.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 11, 2025Windows Kerberos Denial of Service VulnerabilityCVE-2025-21350 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Windows Kerberos Denial of Service Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 7, 2025ReverbNation Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.
Product
ReverbNation Widgets
Affected
up to 2.1
What to do
Affects up to 2.1. Update ReverbNation Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Memory safety bugs present in Firefox 134 and Thunderbird 134.CVE-2025-1020 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 4, 2025Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6.CVE-2025-1017 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 4, 2025Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6.CVE-2025-1016 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 4, 2025The Thunderbird Address Book URI fields contained unsanitized links.CVE-2025-1015 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 4, 2025Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040.CVE-2025-0510 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 29, 2025RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.CVE-2024-57437 · Other software · Ruoyi · reported by MITREMedium 6.5
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.
Product
Ruoyi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitee.com github.com
Jan 28, 2025Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability.CVE-2025-24800 · Other software · polytope-labs · reported by GitHubCritical 9.3
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.
Product
hyperbridge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2025Daily Proverb: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jd7777 Daily Proverb daily-proverb allows Stored XSS.This issue affects Daily Proverb: from n/a through <= 2.0.3.
Product
Daily Proverb
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Daily Proverb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_countCVE-2024-57890 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 14, 2025Windows Kerberos Security Feature Bypass VulnerabilityCVE-2025-21299 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Kerberos Security Feature Bypass Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 14, 2025Windows Kerberos Information Disclosure VulnerabilityCVE-2025-21242 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Windows Kerberos Information Disclosure Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 14, 2025Windows Kerberos Denial of Service VulnerabilityCVE-2025-21218 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Kerberos Denial of Service Vulnerability
Product
Windows Server 2012
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 10, 2025An issue was discovered in REDCap 14.9.6.CVE-2025-23113 · Other software · Vanderbilt · reported by MITRELow 3.4
An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger a logout request and terminates their session, or redirect to a phishing website. This vulnerability stems from the absence of CSRF protections on the logout functionality.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 10, 2025An issue was discovered in REDCap 14.9.6.CVE-2025-23112 · Other software · Vanderbilt · reported by MITREMedium 6.1
An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 10, 2025An issue was discovered in REDCap 14.9.6.CVE-2025-23111 · Other software · Vanderbilt · reported by MITREMedium 4.7
An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 10, 2025An issue was discovered in REDCap 14.9.6.CVE-2025-23110 · Other software · Vanderbilt · reported by MITREMedium 6.1
An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 9, 2025A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey TitleCVE-2024-56377 · Other software · Vanderbilt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload (which has been injected into all survey fields) is executed, potentially enabling the execution of arbitrary web scripts.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Jan 9, 2025A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the mesCVE-2024-56376 · Other software · Vanderbilt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the message field. When a user click on the received message, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Product
REDCap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Jan 7, 2025Memory safety bugs present in Firefox 133 and Thunderbird 133.CVE-2025-0247 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 7, 2025Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5.CVE-2025-0243 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.1
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 7, 2025Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5.CVE-2025-0242 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Unrestricted Upload of File with Dangerous TypeCVE-2024-56064 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 22, 2024A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the nCVE-2024-56314 · Other software · Vanderbilt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Dec 22, 2024A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into tCVE-2024-56313 · Other software · Vanderbilt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Dec 22, 2024A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts CVE-2024-56312 · Other software · Vanderbilt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a user clicks on the project Dashboard name, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Dec 22, 2024REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack.CVE-2024-56311 · Other software · Vanderbilt · reported by MITREHigh 8.8
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Dec 22, 2024REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack.CVE-2024-56310 · Other software · Vanderbilt · reported by MITREHigh 8.8
REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com evms.edu
Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.
Product
LeaderBoard
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024PowerBI Embed Reports: Stored Cross-Site ScriptingCVE-2024-11901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerBI Embed Reports
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update PowerBI Embed Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.