CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- brocade ascg, broadcom brocade active support connectivity gateway +1 more Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100 7.6 High
- minio MinIO SFTP authentication bypass due to improperly trusted SSH key 4.6 Medium
- pwndoc PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json 6.5 Medium
- pwndoc PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin 6.5 Medium
- No product listed PixelYourSite 10.1.1.1 - Insecure deserialization 6.3 Medium
- ibm storage virtualize IBM FlashSystem code execution 8.1 High
- ibm storage virtualize IBM FlashSystem authentication bypass 9.1 Critical
- python software foundation cpython Mishandling of comma during folding and unicode-encoding of email headers 2.3 Low
-
ntpdcrates.io ntpd NTS client denial of service via wrongly sized cookies 5.3 Medium -
github.com/cosmos/ibc-goGo,github.com/cosmos/ibc-go/v2Go,github.com/cosmos/ibc-go/v3Go +5 more +7 more IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement 9.3 Critical - mnfst manifest Manifest Uses a One-Way Hash without a Salt 4.8 Medium
- dario health application database and internet-based server infrastructure Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Sensitive Information Due to Incompatible Policies 6.9 Medium
- dario health application database and internet-based server infrastructure Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag 5.9 Medium
- dario health application database and internet-based server infrastructure Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting 7.1 High
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 more Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cleartext Transmission of Sensitive Information 7.5 High
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 more Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access Control 5.1 Medium
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 more Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs 6.9 Medium
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 more Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Private Personal Information to an Unauthorized Actor 8.7 High
- ibm mq IBM MQ information disclosure 5.5 Medium
- ibm mq IBM MQ denial of service 5.5 Medium
- openmage magento-lts Magento vulnerable to stored XSS in theme config fields 2.9 Low
- sote soteshop Cross-Site Scripting (XSS) vulnerability in Soteshop 6.1 Medium
- opencart HTML injection vulnerability in OpenCart 4.7 Medium
- opencart HTML injection vulnerability in OpenCart 4.7 Medium
- opencart HTML injection vulnerability in OpenCart 4.7 Medium
- opencart Cross-Site Scripting vulnerability in OpenCart 6.1 Medium
- ericsson codechecker Open redirect in CodeChecker web server 6.1 Medium
- elementor site mailer, elemntor site mailer – smtp replacement, email api deliverability & email log +1 more Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting 7.2 High
- cyberark endpoint privilege manager HTML injection in CyberArk Endpoint Privilege Manager 2.0 Low
- cyberark endpoint privilege manager Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager 9.3 Critical
- cyberark endpoint privilege manager Self Reflected XSS in CyberArk Endpoint Privilege Manager 2.1 Low
- cyberark endpoint privilege manager IP Spoofing in CyberArk Endpoint Privilege Manager 6.9 Medium
- cyberark endpoint privilege manager Stored XSS in CyberArk Endpoint Privilege Manager 7.3 High
- xlplugins nextmove, nextmove lite – thank you page for woocommerce +1 more NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission 4.3 Medium
- eaton foreseer reporting software (frs) Insecure storage of connection strings in FRS 6.3 Medium
- blackmagic design inc davinci resolve Dylib Hijacking in DaVinci Resolve 8.4 High
- eaton foreseer reporting software (frs) Improper Input Validation in Foreseer Reporting Software (FRS) 6.7 Medium
- sitesao dhvc form DHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation 9.8 Critical
- apprhyme url media uploader URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding 6.4 Medium
- whmpress whmcs client area, creativeon whmcs client area for wordpress by whmpress +1 more WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update 8.8 High
- evigeo modal portfolio Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting 5.5 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 more Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP 8.1 High
- wpbranch tabs for woocommerce Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs 7.2 High
- directsoftware order attachments for woocommerce Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory 5.9 Medium
- creativeon whmpress - whmcs wordpress integration plugin, whmpress whmcs +1 more WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update 9.8 Critical
- wp swings woocommerce ultimate gift card WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload 9.8 Critical
- secupress, secupress with simple ssl – simple and performant security +1 more SecuPress Free — WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode 6.4 Medium
- tarbor forex calculators Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update 4.3 Medium
- pickplugins pricing table Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 Medium
- darkosxrc wow entrance effects (wee!), wow entrance effects \(wee\!\) +1 more WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 Medium
- Show olderLoading…