CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- apache dorisApache Doris: allows admin users to read arbitrary files through the REST API5.4 Medium
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) hpe aruba networking clearpass policy manager +1 moreAuthenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface4.7 Medium
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) hpe aruba networking clearpass policy manager +1 moreSensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM)6.6 Medium
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) hpe aruba networking clearpass policy manager +1 moreSensitive Information Disclosure in HPE Aruba Networking ClearPass Policy Manager6.8 Medium
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) hpe aruba networking clearpass policy manager +1 moreAuthenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface8.8 High
- bigantsoft bigant serverBigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE9.8 Critical
- ibm security verify access appliance, security verify access, security verify access container +1 more +3 moreIBM Security Verify Access information disclosure5.3 Medium
- vitest-dev vitestRemote Code Execution when accessing a malicious website while Vitest API server is listening9.7 Critical
- vitest-dev vitestBrowser mode serves arbitrary files in vitest5.9 Medium
linux-lowlatencyUbuntulinux-lowlatency vulnerabilitiesNo score- four-faith f3x36, f3x36 firmware +1 moreFour-Faith F3x36 bapply.cgi Auth Bypass9.8 Critical
- four-faith f3x36, f3x36 firmware +1 moreFour-Faith F3x36 Hidden Debug Credentials9.8 Critical
- netgear fvs336gv2, fvs336gv3 +1 moreEOL Netgear FVS336Gv2 and FVS336Gv3 Telnet Configuration Backup Command Injection7.2 High
- ianhaycox world cup predictorWordPress World Cup Predictor Plugin <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ksherWordPress Ksher plugin <= 1.1.2 - Broken Access Control vulnerability6.5 Medium
- bplugins alert box block – display notice/alerts in the front endWordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- get bowtied product blocks for woocommerceWordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
etcdopenSUSESecurity update for etcdNo score- ays pro survey makerWordPress Survey Maker Plugin <= 5.1.3.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- sendpulse email marketing newsletterWordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tuyennv music press proWordPress Music Press Pro plugin <=1.4.6 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- famethemes onepressWordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerability4.3 Medium
- rto gmbh dynamic conditionsWordPress Dynamic Conditions plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- prem tiwari fm notification barWordPress FM Notification Bar plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpspin post/page copying toolWordPress Post/Page Copying Tool to Export and Import post/page for Cross site Migration Plugin <= 2.0.3 - Remote Code Execution (RCE) vulnerability9.9 Critical
- bowo admin and site enhancements (ase)WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2.1 - Privilege Escalation vulnerability7.5 High
- wp24 domain checkWordPress WP24 Domain Check plugin <= 1.10.14 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- brandtoss wp mailsterWordPress WP Mailster plugin <= 1.8.17.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- optimize worldwide find content idsWordPress Find Content IDs plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound traveler codeWordPress Traveler Code plugin < 3.1.3 - Subscriber+ Arbitrary SQL Execution vulnerability8.5 High
- notfound traveler codeWordPress Traveler Code plugin < 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerability9.0 Critical
- cyberchimps responsive blocksWordPress Responsive Blocks plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- embedpress document block – upload & embed docsWordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerability5.4 Medium
- joomsky js jobs, joomsky.com js jobs component for joomla +1 moreExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla4.7 Medium
- yhirose cpp-httplibCRLF injection in Cpp-httplib6.9 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 135 and Thunderbird 1359.8 Critical
- mozilla thunderbirdUnsanitized address book fields5.4 Medium
- mozilla thunderbirdAddress of e-mail sender can be spoofed by malicious email6.5 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification not properly displayed4.3 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification is not displayed when fullscreen is re-requested5.3 Medium
- goauthentik authentikStored XSS in authentik4.8 Medium
- qodeinteractive qi addons for elementorQi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- apache cassandraApache Cassandra: unrestricted deserialization of JMX authentication credentials5.3 Medium
- apache cassandraApache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions5.4 Medium
- zyxel vmg4325-b10a firmware, sbg3300-n000 firmware, sbg3300-nb00 firmware +11 more +13 more**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy...9.8 Critical
- zyxel vmg4325-b10a firmware, dsl cpe devices, sbg3300-n000 firmware +12 more +14 more**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the...8.8 High
- zyxel vmg4325-b10a firmware, dsl cpe devices, sbg3300-n000 firmware +12 more +14 more**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI...8.8 High
- apache cassandraApache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions8.8 High
- iqonicdesign socialv - social network and community buddypress themeSocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download6.5 Medium
- Show moreLoading…