CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- casid jteHTML templates containing Javascript template strings are subject to XSS in jte6.1 Medium
- silabs.com sisdkMalformed packet leads to denial of service in APS layer4.3 Medium
Umbraco.Headless.Client.NetNuGetThe Umbraco Heartcore headless client library uses a vulnerable Refit dependency packageNo score- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.5.4 Medium
- notaryproject notation-goTimestamp signature generation lacks certificate revocation check in notion-go4.0 Medium
- notaryproject notation-goProcess crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go3.3 Low
- offis dcmtkAn improper array index validation vulnerability exists in the determineMinMax functionality of...8.4 High
- offis dcmtkAn improper array index validation vulnerability exists in the nowindow functionality of OFFIS...8.4 High
- enituretechnology distance based shipping calculatorWordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- saleswonder team tobias wp2leadsWordPress WP2LEADS Plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- saad iqbal post smtpWordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability4.3 Medium
- wp scripts food store – online food delivery & pickupWordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- infosoft consultant order audit log for woocommerceWordPress Order Audit Log for WooCommerce plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- n3wnormal lucidlmsWordPress LucidLMS plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- convoy media category libraryWordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- smart agenda agendaWordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerability7.1 High
- faktor vier f4 post treeWordPress F4 Post Tree Plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- trustist reviewerWordPress TRUSTist REVIEWer Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- yamna khawaja knr author list widgetWordPress Axact Author List Widget Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- arete-it post and page reactionsWordPress Post And Page Reactions Plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mdjekic inline tweetsWordPress Inline Tweets plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- grandslambert featured page widgetWordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- anshul sojatia scan external linksWordPress Scan External Links Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- marcus downing site pinWordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- intelligence lab scanventoryWordPress Scanventory Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- detlef stöver wpex replace db urlsWordPress WPEX Replace DB Urls Plugin <= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- givewpWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability9.8 Critical
- apache cloudstackApache CloudStack: Unauthorised access to annotations4.3 Medium
registrycrates.ioregistry is unmaintainedNo scoregrcovcrates.iogrcov has an out of bounds write triggered by crafted coverage dataNo scorefast-float2crates.iofast-float2 has a segmentation fault due to lack of bound checkNo scorefast-floatcrates.iofast-fault has a segmentation fault due to lack of bound checkNo score- imagination technologies graphics ddkGPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write7.8 High
- imagination technologies graphics ddkGPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore6.7 Medium
- imagination technologies graphics ddkGPU DDK - rgxfw_hwperf_config OOB read & write4.4 Medium
- imagination technologies graphics ddkGPU DDK - psContext->eDM gives OOB write4.1 Medium
- imagination technologies graphics ddkGPU DDK - OOB read into fwlog due to unchecked block count7.1 High
- imagination technologies graphics ddkGPU DDK - Out of bounds read into fwlog due to unchecked loop bounds7.1 High
- imagination technologies graphics ddkGPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write8.8 High
- unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 moreEmail Subscribers < 5.7.45 - Admin+ Stored XSS4.8 Medium
- unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 moreEmail Subscribers < 5.7.45 - Admin+ Stored XSS4.8 Medium
- unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 moreEmail Subscribers < 5.7.45 - Admin+ Stored XSS4.8 Medium
- codepeople appointment booking calendar, unknown appointment booking calendar plugin and scheduling plugin +1 moreBookingPress < 1.1.23 - Unauthenticated Export File Download7.5 High
- unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 moreEmail Subscribers < 5.7.45 - Admin+ Stored XSS4.8 Medium
- luxion keyshot, keyshot viewer +1 moreLuxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability7.8 High
- liujianview gymxmjpaliujianview gymxmjpa MenberConntroller.java MenberDaoInpl sql injection5.3 Medium
- liujianview gymxmjpaliujianview gymxmjpa MembertypeController.java MembertypeDaoImpl sql injection5.3 Medium
- liujianview gymxmjpaliujianview gymxmjpa LoosController.java LoosDaoImpl sql injection5.3 Medium
- liujianview gymxmjpaliujianview gymxmjpa EquipmentController.java EquipmentDaoImpl sql injection5.3 Medium
- liujianview gymxmjpaliujianview gymxmjpa SubjectController.java SubjectDaoImpl sql injection5.3 Medium
- Show moreLoading…