CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- yeswikiYesWiki Vulnerable to Authenticated Stored XSS7.6 High
- payara platform micro, server +1 moreHTTP Server incorrectly accepting disallowed characters within header values2.4 Low
- yeswikiYesWiki Vulnerable to Unauthenticated DOM Based XSS7.6 High
- umbraco umbraco-cms, cms +1 moreUmbraco Backoffice Components Have XSS/HTML Injection Vulnerability4.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes5.3 Medium
- hashicorp go-slug, shared library +1 moreHashiCorp go-slug Vulnerable to Zip Slip Attack7.5 High
- ericsson codecheckerCross-Site Request Forgery in CodeChecker API8.2 High
- nvidia gpu display driver, vgpu softwareNVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak...5.5 Medium
- nvidia gpu display driver, vgpu softwareNVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker...3.3 Low
- ngô thắng it ppo call to actions, ppo việt nam (ppo.vn) call to actions +1 moreWordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability7.1 High
- rara theme ultralight, rarathemes the ultralight +1 moreWordPress UltraLight theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dev@tamara.co tamara checkout, tamara solution checkout +1 moreWordPress Tamara Checkout plugin < 1.9.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp desk flexible pdf couponsWordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- wphocus my auctions allegroWordPress My auctions allegro Plugin <= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- admiral ad blocking detectorWordPress Ad Blocking Detector plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pluginops mailchimp subscribe formsWordPress MailChimp Subscribe Form plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner and Inventory manager plugin <= 1.6.7 - Arbitrary File Upload vulnerability9.1 Critical
- e4j s.r.l. vikappointments services booking calendarWordPress VikAppointments Services Booking Calendar plugin <= 1.2.16 - CSRF to Stored XSS vulnerability7.1 High
- roninwp fat event liteWordPress FAT Event Lite plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- joe dolson my ticketsWordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerability7.5 High
- taskbuilderWordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerability8.5 High
- thomas maier image source controlWordPress Image Source Control Lite Plugin <= 2.29.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- storeapps smart managerWordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability7.6 High
- soft8soft llc verge3dWordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- iova.mihai social pug: author boxWordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound bonjour barWordPress Bonjour Bar plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- inspirythemes easy real estateWordPress Easy Real Estate plugin <= 2.2.6 - Privilege Escalation vulnerability9.8 Critical
- brizy, brizy pro, notfound brizy pro +2 moreWordPress Brizy Pro Plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- steve burge wordpress tag cloud plugin – tag groupsWordPress Tag Cloud Plugin - Tag Groups plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dhananjaysingh multiple carouselWordPress Multiple Carousel Plugin <= 2.0 - SQL Injection vulnerability9.3 Critical
- deluxethemes private messages for userproWordPress Private Messages for UserPro plugin <= 4.10.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- eniture technology standard box sizes – for woocommerceWordPress Standard Box Sizes plugin <= 1.6.13 - Broken Access Control vulnerability7.5 High
- deluxethemes private messages for userproWordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability7.5 High
- ays pro poll makerWordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerability5.3 Medium
- radykal fancy product designerWordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability9.0 Critical
- fave themes homey login registerWordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability9.8 Critical
- radykal fancy product designerWordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability9.3 Critical
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability8.8 High
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerability9.8 Critical
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - SQL Injection vulnerability8.5 High
- repute infosystems arpriceWordPress ARPrice plugin <= 4.1.3 - Unauthenticated SQL Injection vulnerability9.3 Critical
- heroplugins hero mega menu - responsive wordpress menu pluginWordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerability8.5 High
- heroplugins hero mega menu - responsive wordpress menu pluginWordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerability8.5 High
- heroplugins hero mega menu - responsive wordpress menu pluginWordPress Hero Menu plugin <= 1.16.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- linux, linux kernel +1 morevirtio-blk: don't keep queue frozen during system suspend5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moredm thin: make get_first_thin use rcu-safe list first function7.8 High
- linux, linux kernel +1 morenet: stmmac: dwmac-tegra: Read iommu stream id from device tree10.0 Critical
- linux, linux kernel +1 morenet/mlx5: Fix variable not being completed when function returns5.5 Medium
- linux, linux kernel +1 moregpio: virtuser: fix missing lookup table cleanups7.8 High
- Show moreLoading…