CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- tenda a18, a18 firmware +1 moreTenda A18 HTTP POST Request SetCmdlineRun stack-based overflow7.1 High
- 1000 projects employee task management system1000 Projects Employee Task Management System Login index.php sql injection6.9 Medium
- 1000 projects employee task management system1000 Projects Employee Task Management System AdminLogin.php sql injection6.9 Medium
debian-security-supportDebiandebian-security-support - updateNo score- thecontrolgroup voyagerDevDojo Voyager Arbitrary File Write4.3 Medium
- thecontrolgroup voyagerDevDojo Voyager vulnerable to reflected Cross-site Scripting3.5 Low
- thecontrolgroup voyagerDevDojo Voyager vulnerable to path traversal5.7 Medium
files.photo.gallerynpmfiles.photo.gallery command injection6.5 Medium- needyamin library card systemneedyamin Library Card System Registration Page signup.php cross site scripting6.9 Medium
- microsoft accountMicrosoft Account Elevation of Privilege Vulnerability8.2 High
- needyamin library card systemneedyamin Library Card System Admin Panel admindashboard.php sql injection6.9 Medium
- microsoft azure ai face serviceAzure AI Face Service Elevation of Privilege Vulnerability9.9 Critical
- needyamin library card systemneedyamin Library Card System Login admin.php sql injection6.9 Medium
- aws deepjavalibraryPath traversal issue in Deep Java Library9.3 Critical
- aridius xyzAridius XYZ News loadMore deserialization6.9 Medium
- snowflake connector, snowflakedb snowflake-connector-python +1 moreThe Snowflake Connector for Python uses insecure cache files permissions4.4 Medium
- snowflake connector, snowflakedb snowflake-connector-python +1 moreThe Snowflake Connector for Python uses insecure deserialization of the OCSP response cache6.7 Medium
- snowflake connector, snowflakedb snowflake-connector-python +1 moreSnowflake Connector for Python has an SQL Injection in write_pandas7.0 High
- snowflake connector, snowflakedb snowflake-connector-net +1 moreSnowflake Connector for .NET has weak temporary files permissions5.0 Medium
- richardoc kube-audit-restkube-audit-rest's example logging configuration could disclose secret values in the audit log5.1 Medium
- gnu binutilsGNU Binutils objdump.c disassemble_bytes stack-based overflow6.3 Medium
- myscada mypro manager, mypro runtime +1 moremySCADA myPRO Manager OS Command Injection9.3 Critical
- myscada mypro manager, mypro runtime +1 moremySCADA myPRO Manager OS Command Injection9.3 Critical
- abb flxeonInformation disclosures6.9 Medium
- github enterprise serverCode Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling7.1 High
- abb flxeonAuthentication and Authorization Issues8.8 High
- snowflake jdbc, snowflakedb snowflake-jdbc +1 moreSnowflake JDBC uses insecure temporary credential cache file permissions4.4 Medium
- snowflake jdbc, snowflakedb snowflake-jdbc +1 moreSnowflake JDBC allows an untrusted search path on Windows7.8 High
- drupal google tag, google tag project tag +1 moreGoogle Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-0126.8 Medium
- drupal google tag, google tag project tag +1 moreGoogle Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0114.8 Medium
- snowflake connector, snowflakedb snowflake-connector-nodejs +1 moresnowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions4.4 Medium
- admin lte theme project lte theme, drupal admin lte theme +1 moreDrupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-0106.6 Medium
- authenticator login project login, drupal authenticator login +1 moreAuthenticator Login - Critical - Access bypass - SA-CONTRIB-2025-0099.8 Critical
- ibm aspera faspexIBM Aspera Faspex information disclosure5.9 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure5.3 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure5.9 Medium
- ibm aspera faspexIBM Aspera Faspex improper access control4.4 Medium
- snowflakedb pdo snowflakeSnowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error4.4 Medium
- twigphp twigTwig fixes a security issue where escaping was missing when using null coalesce operator (??)4.3 Medium
- flutter image picker androidUnsanitized Filenames in Flutter package image_picker_android Allow File Overwrites2.1 Low
- flutter file selector androidUnsanitized Filenames in Flutter package file_selector_android Allow File Overwrites2.1 Low
- manageengine applications manager, zohocorp manageengine applications manager +1 moreImproper Authorization8.1 High
- badhonrocks divi torque lite – divi theme, divi builder & extra themeDivi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- nebojsadabic target video easy publishTarget Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode6.4 Medium
- google chromeUse after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to...8.8 High
- trellix hx consoleAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data...5.9 Medium
- drupal matomo analytics, matomo analytics project analytics +1 moreMatomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-0086.8 Medium
- moxa eds-405a series, eds-408a series, eds-505a series +48 more +50 moreOut-of-bounds Write Vulnerability8.7 High
- wpdesk flexible wishlist for woocommerce – ecommerce wishlist & save for laterFlexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter7.2 High
- raiserweb competition formCompetition Form <= 2.0 - Reflected XSS7.1 High
- Show moreLoading…