CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- apple macos, safari +1 moreA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia...7.5 High
- apple ipados, macos, tvos +4 more +6 moreA type confusion issue was addressed with improved checks. This issue is fixed in visionOS 2.3,...7.5 High
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.7...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...3.3 Low
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed through improved state management. This issue is fixed in macOS Ventura...5.5 Medium
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3....5.5 Medium
- apple ipados, macos, safari +4 more +6 moreThe issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3,...4.3 Medium
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...5.5 Medium
- apple macosThe issue was addressed with improved validation of environment variables. This issue is fixed in...5.5 Medium
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS Sonoma...5.5 Medium
- axiomatic bento4Axiomatic Bento4 mp42aac ReadPartial heap-based overflow6.9 Medium
- axiomatic bento4Axiomatic Bento4 mp42aac ReadBits heap-based overflow6.9 Medium
- abb flxeonRemote Code Execution (RCE) Vulnerabilities10.0 Critical
- ruoyiy_project RuoYi Whitelist getBeanName deserialization5.1 Medium
- No product listedPostman profapi.dll untrusted search path2.0 Low
- No product listedDiscord profapi.dll untrusted search path2.0 Low
- dani-garcia vaultwardenvaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait8.1 High
- dani-garcia vaultwardenvaultwarden allows RCE in the admin panel7.2 High
- vllmvLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator7.5 High
- fastd project fastdUDP traffic amplification via fastd's fast reconnect feature6.9 Medium
- imgproxyimgproxy is vulnerable to SSRF against 0.0.0.05.3 Medium
- matrix-org matrix-hookshotmatrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support6.5 Medium
- ni data record ad, flexrio, frc game tools +4 more +6 moreDependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software7.0 High
- cactiCacti has a SQL Injection vulnerability when using tree rules through Automation API6.9 Medium
- cactiCacti allows Arbitrary File Creation leading to RCE8.7 High
- cactiCacti has Authenticated RCE via multi-line SNMP responses9.1 Critical
- cactiCacti has a SQL Injection vulnerability when request automation devices6.3 Medium
- cactiCacti has a SQL Injection vulnerability when view host template7.6 High
- tp-link tl-sg108e, tl-sg108e firmware +1 moreTP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings6.3 Medium
- tp-link tl-sg108eTP-Link TL-SG108E clickjacking6.9 Medium
- ibm mq operator, supplied mq advanced container images +1 moreIBM MQ Operator information disclosure5.9 Medium
- ibm sterling file gatewayIBM Sterling File Gateway cross-site scripting6.4 Medium
- ibm sterling file gatewayIBM Sterling File Gateway information disclosure4.3 Medium
- ibm sterling file gatewayIBM Sterling File Gateway improper access control4.3 Medium
- ibm openpages with watsonIBM OpenPages with Watson cross-site scripting5.4 Medium
- cactiCacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path6.0 Medium
- ibm storage protect backup-archive client, storage protect for virtual environments: data protection for vmware, storage protect +1 more +3 moreIBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure5.9 Medium
- ibm storage defender, storage defender - resiliency service +1 moreIBM Storage Defender information disclosure5.9 Medium
- apache cocoonApache Cocoon: continuations may not be private7.5 High
- wpwax post grid, slider & carousel ultimate, post grid\, slider \& carousel ultimate +1 moreWordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability6.5 Medium
- favethemes houzezWordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability5.3 Medium
- notfound bridge coreWordPress Bridge Core plugin <= 3.3 - Broken Access Control vulnerability4.3 Medium
- rometheme rtmkitWordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability4.3 Medium
- gopi krishnan fare calculatorWordPress Fare Calculator plugin <= 1.1 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- codecabin wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWordPress WP Google Maps plugin <= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- kb support support, logon kb support +1 moreWordPress KB Support plugin <= 1.6.7 - Open Redirection vulnerability4.7 Medium
- thimpress learnpressWordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability4.7 Medium
- codesolz better find and replaceWordPress Better Find and Replace plugin <= 1.6.7 - Privilege Escalation vulnerability8.8 High
- crm perks wp dynamics crm for contact form 7, wpforms, elementor, formidable and ninja formsWordPress WP Dynamics CRM plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- carazo import and export users and customersWordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerability5.9 Medium
- Show moreLoading…