CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- linux, linux kernel +1 morewifi: mac80211: fix mbss changed flags corruption on 32 bit systems7.6 High
- linux, linux kernel +1 morewifi: cfg80211: clear link ID from bitmap during link delete after clean up3.3 Low
- linux, linux kernel +1 moredrm/amdkfd: Correct the migration DMA map direction5.5 Medium
- linux, linux kernel +1 morebtrfs: flush delalloc workers queue before stopping cleaner kthread during unmount7.8 High
- linux, linux kernel +1 moreksmbd: set ATTR_CTIME flags when setting mtime7.1 High
- linux, linux kernel +1 moreALSA: seq: oss: Fix races at processing SysEx messages7.8 High
- linux, linux kernel +1 moreocfs2: fix slab-use-after-free due to dangling pointer dqi_priv7.8 High
- linux, linux kernel +1 moresched_ext: Fix invalid irq restore in scx_ops_bypass()5.5 Medium
- linux, linux kernel +1 moreRDMA/uverbs: Prevent integer overflow issue5.5 Medium
- linux, linux kernel +1 morepinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking5.5 Medium
- linux, linux kernel +1 moreworkqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker5.5 Medium
- linux, linux kernel +1 moredrm: adv7511: Fix use-after-free in adv7533_attach_dsi()7.8 High
- linux, linux kernel +1 moremm/damon/core: fix new damon_target objects leaks on damon_commit_targets()5.5 Medium
- linux, linux kernel +1 moremm/kmemleak: fix sleeping function called from invalid context at print message5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moremm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()5.5 Medium
- linux, linux kernel +1 moremm: hugetlb: independent PMD page table shared count7.8 High
- linux, linux kernel +1 moremptcp: fix TCP options overflow.9.8 Critical
- openvpn ovpn-dco, openvpn-gui, ovpn-dco-win +2 moreOpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O...3.3 Low
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup4.3 Medium
- red hat enterprise linux 10, enterprise linux 9, openshift container platform 4 +2 more +4 moreUsers: `root` appended to group listings7.1 High
- nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimizationNitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update4.3 Medium
- addonsorg pdf for wpforms + drag and drop template builderPDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode6.4 Medium
- nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimizationNitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update8.1 High
- moxa mgate 5121 series, mgate 5122 series, mgate 5123 series +2 moreStored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 Series5.2 Medium
- fortinet fortideceptorA improper neutralization of input during web page generation ('cross-site scripting') in...5.1 Medium
- moxa eds-508a series, pt-508 series, pt-510 series +7 more +9 moreFrontend Authorization Logic Disclosure Vulnerability9.2 Critical
- neran reviews widgets for google & 45+ platforms by repusoSocial proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting7.2 High
- robdavenport wp smart tvWP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- realwebcare awesome responsive photo gallery – image & video lightbox galleryImage Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scripting6.1 Medium
- scottpaterson business essentials for contact form 7Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scripting6.1 Medium
- piotnetdotcom piotnet addons for elementorPiotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- pickplugins post grid and gutenberg blocks – comboblocksPost Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation9.8 Critical
- genivia gsoapgSOAP: Vulnerable to specially crafted unencrypted SDC messages7.5 High
- siemens sentron 3na com fuse, silabs.com emberznet +1 moreDos in ZigBee device due to unsolicited encrypted rejoin response5.8 Medium
- nec corporation wx1500hp, wx3600hp +1 moreNEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a...7.2 High
- nec corporation gb1200pe, wf1200cr, wg1200cr +6 more +8 moreMissing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver...7.5 High
- nec corporation wg2600hm4, wg2600hp4, wg2600hs +3 more +5 moreCross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier,...4.8 Medium
- vcita event registration calendar by vcitaEvent Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- swarminteractive viewmedica 9ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- the dimensional gate co. linux ratforStack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. When the...7.0 High
- dell display managerDell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU)...6.7 Medium
- dell display managerDell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local...6.6 Medium
- theverylastperson car demonCar Demon <= 1.8.1 - Reflected Cross-Site Scripting6.1 Medium
assimpOSS-FuzzHeap-buffer-overflow in Assimp::FBXExporter::WriteObjectsNo score- automattic mongooseMongoose search injection vulnerability9.0 Critical
- yubico pam-u2fIn Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product...7.3 High
- No product listedSQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary...7.1 High
- dlink dwr-m972v firmwareAn issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH...9.8 Critical
- ddsn cm3 acora content management systemSQL Injection vulnerability in DDSN Net Pty Ltd (DDSN Interactive) DDSN Interactive cm3 Acora CMS...8.1 High
- google chromeInappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a...4.3 Medium
- Show moreLoading…