CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- fanli2012 native-php-cmsFanli2012 native-php-cms login.php sql injection6.9 Medium
- fanli2012 native-php-cmsFanli2012 native-php-cms sysconfig_doedit.php cross site scripting5.3 Medium
- fanli2012 native-php-cmsFanli2012 native-php-cms Backend sysconfig_doedit.php improper authorization6.9 Medium
- getsentry sentryImproper authentication on SAML SSO process allows user impersonation in sentry9.1 Critical
- apple ipados, macos, visionos +3 more +5 moreA path handling issue was addressed with improved logic. This issue is fixed in watchOS 11.1,...4.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved checks. This issue is fixed in iOS 18.1 and iPadOS 18.1...4.6 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA memory initialization issue was addressed with improved memory handling. This issue is fixed in...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed through improved state management. This issue is fixed in iOS 17.5 and...2.4 Low
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5,...7.8 High
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed through improved state management. This issue is fixed in iOS 17.5 and...4.6 Medium
- apple musicThe issue was addressed with improved input sanitization. This issue is fixed in Apple Music 1.5...4.3 Medium
- fanli2012 native-php-cmsFanli2012 native-php-cms jump.php cross site scripting5.3 Medium
- fanli2012 native-php-cmsFanli2012 native-php-cms user_recoverpwd.php default credentials6.9 Medium
- d-link dir-878, dlink dir-878 firmware +1 moreD-Link DIR-878 HTTP POST Request dllog.cgi information disclosure6.9 Medium
- amazon workspaces clientIssue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)7.7 High
- amazon dcv client, appstream 2.0 client, workspaces client +2 moreIssue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients7.7 High
- craftercmsTransmission of Private Resources into a New Sphere in Crafter Engine6.9 Medium
- gitThe sideband payload is passed unfiltered to the terminal in git7.5 High
- wuzhicmswuzhicms config.php test server-side request forgery5.3 Medium
- desktopMaliciously crafted remote URLs could lead to credential leak in GitHub Desktop6.6 Medium
- mattermost, mattermost server +1 moreInsufficient Input Validation on Post Props6.5 Medium
- mattermost, mattermost server +1 moreInsufficient Input Validation on Post Props6.5 Medium
- opentext™ solutions business manager (sbm)Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM).8.2 High
- bitdefender antivirus free 2020, antivirus 2020 +1 moreUntrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)8.8 High
- mattermost, mattermost mobile +1 moreInsufficient Input Validation on Post Props6.5 Medium
- mattermost, mattermost mobile +1 moreInsufficient Input Validation on Post Props6.5 Medium
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-0038.8 High
- mattermost, mattermost server +1 moreWebApp crash via improper validation of proto style in attachments6.5 Medium
- b&r industrial automation automation runtime, mapp view +1 moreA “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used...8.2 High
- ays pro poll makerWordPress Poll Maker plugin <= 5.5.6 - Broken Access Control vulnerability6.5 Medium
- agile logix free google mapsWordPress Free Google Maps plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gallery ape photo gallery – image gallery by apeWordPress Gallery Images Ape plugin <= 2.2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- atanas krachev seo bulk editorWordPress SEO Bulk Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- faizaan gagan course migration for learndashWordPress Course Migration for LearnDash plugin 1.0.2 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- mojofywp product carousel for woocommerce – woorousellWordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- silverplugins217 build private store for woocommerceWordPress Build Private Store For Woocommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- infomaniak network vod infomaniakWordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerability4.3 Medium
- saad iqbal user managementWordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability8.8 High
- data443 risk migitation, inc. posts footer managerWordPress Posts Footer Manager Plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- alimir wp ulikeWordPress WP ULike plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- magepeopleteam wptravellyWordPress WpTravelly Plugin <= 1.8.5 - Broken Access Control vulnerability5.3 Medium
- mohsin rasool twitter bootstrap collapse aka accordian shortcodeWordPress Twitter Bootstrap Collapse aka Accordian Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- falldeaf wp viewstlWordPress WP ViewSTL plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bjoerne navigation du lapin blancWordPress Navigation Du Lapin Blanc plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rob von bothmer / seodev s-dev seoWordPress S-DEV SEO plugin <= 1.88 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hirehive job plugin, zartis hirehive job plugin +1 moreWordPress HireHive Job Plugin plugin <= 2.9.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- setmore theme – custom post typesWordPress SetMore Theme – Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- tor morten jensen foundation columnsWordPress Foundation Columns plugin <= 0.8 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- patel post carousel & sliderWordPress Post Carousel & Slider plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- awothemes social media engineWordPress Social Media Engine plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…