CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- labredescefetrj wegiaWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'listar_permissoes.php' parameter 'msg_e'6.4 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Installation var default permission4.8 Medium
- google chromeType Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to...8.8 High
- labredescefetrj wegiaWeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'9.4 Critical
- labredescefetrj wegiaWeGIA Cross-Site Scripting (XSS) Reflected endpoint `configuracao_geral.php` parameter `msg`6.4 Medium
- labredescefetrj wegiaWeGIA SQL Injection (Blind Time-Based) endpoint 'dependente_listar_um.php' parameter 'id_dependente'9.4 Critical
- drupal profile private, profile private project private +1 moreProfile Private - Critical - Unsupported - SA-CONTRIB-2025-0025.3 Medium
- linux, linux kernel +1 moresoc: imx8m: Probe the SoC driver as platform driver5.5 Medium
- linux, linux kernel +1 moreMIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Adding array index check to prevent memory corruption7.8 High
- linux, linux kernel +1 morenetfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level5.5 Medium
- linux, linux kernel +1 moreACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +5 more +7 morequota: flush quota_release_work upon quota writeback5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 morenfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur9.8 Critical
- linux, linux kernel +1 moredrm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check5.5 Medium
- linux, linux kernel +1 moredrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check5.5 Medium
- linux, linux kernel +1 moredrm/sti: avoid potential dereference of error pointers5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Fix handling of plane refcount7.8 High
- linux, linux kernel +1 morebtrfs: add a sanity check for btrfs root in btrfs_search_slot()5.5 Medium
- linux, linux kernel +1 morekunit: Fix potential null dereference in kunit_device_driver_test()5.5 Medium
- linux, linux kernel +1 morekunit: string-stream: Fix a UAF bug in kunit_init_suite()7.8 High
- linux, linux kernel +1 moremtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information5.5 Medium
- dell vxrail hci, vxrail d560 firmware, vxrail d560f firmware +40 more +42 moreDell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password...7.5 High
- google androidIn DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic...7.8 High
- drupal email tfa, email tfa project tfa +1 moreEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-0018.8 High
- silabs.com simplicity sdkEmberZNet malformed MAC layer packet leads to denial of service6.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +5 more +7 morenet/sched: netem: account for backlog updates from child qdisc5.5 Medium
- kingsoft wps office, wps office +1 moreKingsoft WPS Office TCC code injection4.8 Medium
- cisco common services platform collector, common services platform collector software, crosswork network controller +2 moreCisco Common Services Platform Collector Cross-Site Scripting Vulnerability5.4 Medium
- cisco common services platform collector, common services platform collector software, crosswork network controller +2 moreCisco Common Services Platform Collector Cross-Site Scripting Vulnerability5.4 Medium
- cisco common services platform collector, common services platform collector software, crosswork network controller +2 moreCisco Common Services Platform Collector Cross-Site Scripting Vulnerability5.4 Medium
- cisco thousandeyes endpoint agentCisco ThousandEyes Endpoint Agent Certificate Validation Vulnerability4.8 Medium
- cisco crosswork network controller, crosswork network change automation +1 moreCisco Crosswork Network Controller Stored Cross-Site Scripting Vulnerability4.8 Medium
- stonith404 pingvin-shareArbitrary File Overwrite via HTTP POST in Pingvin Share9.8 Critical
- eugeny tabbyTabby has a TCC Bypass via Misconfigured Node Fuses8.6 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve allows path traversal attacks5.3 Medium
- redisbloomRedisBloom Integer Overflow Remote Code Execution Vulnerability8.8 High
- redisearchRediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCE7.0 High
- redistimeseriesRedisTimeSeries Integer Overflow Remote Code Execution Vulnerability7.0 High
- dell vxrail hci, vxrail d560 firmware, vxrail d560f firmware +40 more +42 moreDell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password...7.5 High
- webwirkung shipping via planzer for woocommerceShipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids6.1 Medium
- dearhive dear flipbook – pdf flipbook, 3d flipbook, pdf embed, pdf viewerDear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpswings ultimate gift cards for woocommerce, wp swings gift cards for woocommerce pro +1 moreUltimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch7.5 High
- chief gnome garden gnome packageGarden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload8.8 High
- wpchill modula image gallery, modula image gallery – photo grid & video gallery +1 moreModula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload8.8 High
- levelfourstorefront shopping cart & ecommerce storeShopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates5.3 Medium
- apache software foundation airflow fab provider, apache apache-airflow-providers-fab +1 moreApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli8.1 High
- apache openmeetingsApache OpenMeetings: Deserialisation of untrusted data in cluster mode9.8 Critical
- vivo minigamecenterMinigameCenter information leakage vulnerability6.3 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php7.5 High
- Show moreLoading…