CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
github.com/argoproj/gitops-engineGoArgo CD GitOps Engine does not scrub secret values from patch errors6.8 Mediumorg.openmrs.module:addresshierarchyMaven,org.openmrs.module:attachmentsMaven,org.openmrs.module:idgenMaven +3 more +5 moreGeneral OpenMRS Security Advisory, January 2025: Penetration Testing Results and PatchesNo score- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability9.3 Critical
- revenera installshieldPrivilege escalation in InstallShield8.5 High
- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability7.3 High
- rockwell automation factorytalk® assetcentre, rockwellautomation factorytalk assetcentre +1 moreRockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability7.0 High
- flexera flexnet publisherLocal privilege escalation in FlexNet Publisher8.5 High
- splunk supporting add-on for active directoryRegular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)6.5 Medium
- angeljudesuarez tailoring management systemitsourcecode Tailoring Management System customeredit.php sql injection5.3 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS...5.1 Medium
- angeljudesuarez tailoring management systemitsourcecode Tailoring Management System addpayment.php sql injection5.3 Medium
- ethereum go-ethereumgo-ethereum has a DoS via malicious p2p message8.7 High
- kubewarden kubewarden-controllerThe kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources6.5 Medium
- kubewarden kubewarden-controllerkubewarden-controller has an Information leak via AdmissionPolicyGroup Resource4.3 Medium
- vmware aria operations, cloud foundation +1 moreVMware Aria Operations information disclosure vulnerability (CVE-2025-22222)7.7 High
- vmware aria operations for logs, cloud foundation +1 moreVMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22221)5.2 Medium
- argoproj argo cd, argo-cd +1 moreArgo CD does not scrub secret values from patch errors6.8 Medium
- vmware aria operations for logs, cloud foundation +1 moreVMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)4.3 Medium
- vmware aria operations for logs, cloud foundation +1 moreVMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219)6.8 Medium
- No product listedMaybecms Add Article index.php cross site scripting5.3 Medium
- redhat wildfly, red hat build of keycloak, data grid 8 +14 more +16 moreOrg.wildfly.core:wildfly-server: wildfly improper rbac permission6.5 Medium
- vmware aria operations for logs, cloud foundation +1 moreVMware Aria Operations for Logs information disclosure vulnerability8.5 High
- stockdio historical chartStockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- gubbigubbi kona gallery blockKona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- seventhqueen typer coreTyper Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- wpbean wp post list tableWP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- notfound storelyStorely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- makewebbetter hubspot for woocommerce, mwb hubspot for woocommerce – crm, abandoned cart, email marketing, marketing automation & analytics +1 moreMWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update8.8 High
- deluxethemes media manager for userpro, userproplugin media manager +1 moreMedia Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update9.8 Critical
- royal-flush royal coreRoyal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- pantherius wordpress survey & poll – quiz, survey and poll plugin for wordpress, modalsurvey wordpress survey and poll +1 moreWordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injection6.5 Medium
- proxymis html5 chatHTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bowo system dashboardSystem Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter6.1 Medium
- elementor website builder, https://elementor.com/ elementor website builder pro +1 moreElementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode4.3 Medium
- ikjweb zstore manager basiczStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing4.3 Medium
- wp messiah ai image alt text generator for wpAi Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting6.1 Medium
- efreja music sheet viewerMusic Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- villatheme w2s, w2s – migrate woocommerce to shopify +1 moreW2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- aakashbhagat23 single-user-chat, aakashbhagat single user chat +1 moreSingle-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update8.1 High
- deluxethemes media manager for userpro, userproplugin media manager +1 moreMedia Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- areoi all bootstrap blocksAll Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- markodonnell team rostersTeam Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'6.1 Medium
- icontrolwpiControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection9.8 Critical
- wordpresteem we – testimonial slider, we - testimonial slide +1 moreWE – Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- filipmedia wp image uploaderWP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion8.8 High
- visualmodo borderless, borderless – addons and templates for elementor +1 moreBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution7.2 High
- efreja music sheet viewerMusic Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read7.5 High
- ecpay ecommerce for woocommerce, ecpaytechsupport ecpay ecommerce for woocommerce +1 moreECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion4.3 Medium
- wp messiah safe ai malware protection for wpSafe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export7.5 High
- filipmedia wp image uploaderWP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- Show moreLoading…