CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- linux, linux kernel +1 moreksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked5.5 Medium
- linux, linux kernel +1 morenetdev: prevent accessing NAPI instances from another namespace8.1 High
- linux, linux kernel +1 morebtrfs: avoid NULL pointer dereference if no valid extent tree5.5 Medium
- linux, linux kernel +1 moresched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()5.5 Medium
- linux, linux kernel +1 morehwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur5.5 Medium
- linux, linux kernel +1 moreriscv: mm: Fix the out of bound issue of vmemmap address7.8 High
- linux, linux kernel +1 moreiio: adc: ti-ads1298: Add NULL check in ads1298_init5.5 Medium
- linux, linux kernel +1 moreexfat: fix the new buffer was not zeroed before writing7.8 High
- linux, linux kernel +1 morenetfs: Fix ceph copy to cache on write-begin5.5 Medium
- linux, linux kernel +1 morenetfs: Fix the (non-)cancellation of copy when cache is temporarily disabled5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - bios +1 more +3 moreexfat: fix the infinite loop in exfat_readdir()5.5 Medium
- linux, linux kernel +1 moreriscv: Fix sleeping in invalid context in die()5.5 Medium
- linux, linux kernel +1 morenet/sctp: Prevent autoclose integer overflow in sctp_association_init()5.5 Medium
- linux, linux kernel +1 moreRDMA/bnxt_re: Fix max SGEs for the Work Request9.8 Critical
- linux, linux kernel +1 moreRDMA/hns: Fix accessing invalid dip_ctx during destroying QP5.5 Medium
- linux, linux kernel +1 morefgraph: Add READ_ONCE() when accessing fgraph_array[]4.7 Medium
- linux, linux kernel +1 moregve: guard XSK operations on the existence of queues5.5 Medium
- linux, linux kernel +1 moregve: guard XDP xmit NDO on existence of xdp queues9.8 Critical
- linux, linux kernel +1 moreselinux: ignore unknown extended permissions5.5 Medium
- linux, linux kernel +1 moretracing: Have process_string() also allow arrays5.5 Medium
- qualifio wheel of fortuneInput validation vulnerability in Qualifio's Wheel of Fortune5.3 Medium
- qualifio wheel of fortuneInput validation vulnerability in Qualifio's Wheel of Fortune5.3 Medium
- tuxlog wp-greetwp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- heateor super socializer, the champ social share, social login and social comments plugin – super socializer +1 moreSocial Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'5.3 Medium
- alexmoss firecask like & share buttonFireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter6.4 Medium
- muffingroup bethemeBetheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS6.4 Medium
- elastic kibanaKibana allocation of resources without limits or throttling leads to crash6.5 Medium
- elastic elasticsearchElasticsearch allocation of resources without limits or throttling leads to crash6.5 Medium
- elastic defendElastic Defend Improper Handling of Alternate Encoding Leads to Crash5.5 Medium
- nec corporation websam deploymentmanagerNEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset...5.3 Medium
- apache cxfApache CXF: Denial of Service vulnerability with temporary files5.9 Medium
- jackdewey link libraryLink Library <= 7.7.2 - Reflected Cross-Site Scripting6.1 Medium
- atarim, wpfeedback atarim – visual feedback, review & ai collaboration +1 moreVisual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion5.3 Medium
- infinitescript wp-bibtexWP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting6.1 Medium
dhcpopenSUSESecurity update for dhcpNo score- crocoblock jetelementsJet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- instawp string locatorString Locator <= 2.6.6 - Unauthenticated PHP Object Injection8.8 High
- go standard library net/httpSensitive headers incorrectly sent after cross-domain redirect in net/http6.1 Medium
- brave desktop browserOn most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site...6.1 Medium
- 8blocks 1003 mortgage application1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure5.3 Medium
- ibm urbancode deployIBM UrbanCode Deploy information disclosure6.2 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...5.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...5.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...5.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the...8.8 High
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...5.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...6.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via...8.2 High
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...6.5 Medium
- linksys e8450 firmwareLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The...6.3 Medium
- Show moreLoading…