CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- asus rt-n10e, rt-n12e +1 moreA vulnerability was found in Asus RT-N12E 2.0.0.19. It has been classified as problematic....4.8 Medium
- kong insomniaKong Insomnia profapi.dll untrusted search path7.3 High
- elfutils project elfutils, siemens ruggedcom rst2428p +1 moreGNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption2.3 Low
- pmwebPMWeb Setting weak password6.3 Medium
- totolink x18, x18 firmware +1 moreTOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow8.7 High
- totolink x18, x18 firmware +1 moreTOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection5.3 Medium
- pimeys web-pushRust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header4.0 Medium
- nuuo cameraNUUO Camera handle_config.php print_file command injection6.9 Medium
- eastnets paymentsafeEastnets PaymentSafe BIC Search cross site scripting5.1 Medium
- cmseasyCmsEasy image_admin.php deleteimg_action path traversal5.3 Medium
- cmseasyCmsEasy file_admin.php deleteimg_action path traversal5.3 Medium
- xjd2020 fastcmsFastCMS Template Menu menu cross site scripting4.8 Medium
libvipsOSS-FuzzHeap-buffer-overflow in vips_foreign_save_heif_write_blockNo scoretryton-clientDebiantryton-client - updateNo score- eng knowageDataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30...9.1 Critical
- libarchivelibarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in...4.0 Medium
- cyberchimps responsive plus – elementor templates & starter sites, responsive addons +1 moreResponsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request5.4 Medium
- bitapps bit assist, bitpressadmin chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chat – bit assist +1 moreBit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter6.5 Medium
sophosfirewall-pythoncrates.io`sophosfirewall-python` was removed from crates.io for malicious codeNo score- enituretechnology ltl freight quotes – estes edition, ltl freight quotes +1 moreLTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection7.5 High
- wedevs wp project manager, project manager – ai powered project management, task management, kanban board & time tracker +1 moreWP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter6.5 Medium
- techlabpro team, techlabpro1 team – team members showcase plugin +1 moreTeam – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- designinvento directorypress, directorypress frontend +1 moreDirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update4.3 Medium
- wedevs wp project manager, project manager – ai powered project management, task management, kanban board & time tracker +1 moreWP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update6.5 Medium
- wpmet elementskit elementor addons, roxnor elementskit elementor addons – advanced widgets & templates addons for elementor +1 moreElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget6.4 Medium
- s2member, wp sharks s2member pro +1 mores2Member Pro <= 241216 - Unauthenticated PHP Object Injection9.8 Critical
- wpcodefactory customer email verification for woocommerceCustomer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure6.5 Medium
- maxfoundry media library foldersMedia Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change4.3 Medium
- etoilewebdesign front end usersFront End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode6.4 Medium
- joomsky js jobs, joomsky.com js jobs component for joomla +1 moreExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla4.7 Medium
- joomsky js jobs, joomsky.com js jobs component for joomla +1 moreExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla4.7 Medium
- oliverpos oliver pos – a woocommerce point of sale (pos), oliver pos +1 moreOliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation9.8 Critical
- unknown maps plugin using google maps for wordpress, wpgooglemap wp google map +1 moreWP Google Map < 1.9.4 - Admin+ Stored XSS4.3 Medium
- unknown maps plugin using google maps for wordpress, wpgooglemap wp google map +1 moreWP Google Map < 1.9.4 - Admin+ Stored XSS4.3 Medium
- fedora linux, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreKernel: secure boot does not automatically enable kernel lockdown7.7 High
jsonpath-plusnpm,@rootio/jsonpath-plusRoot +1 moreJSONPath Plus allows Remote Code Execution9.3 CriticalwavpackOSS-FuzzObject-size in unpack_dsd_samplesNo scorewavpackOSS-FuzzUse-of-uninitialized-value in get_wordNo score- broadcom fabric operating system, brocade fabric os +1 moreCommand or parameter injection via unique embedded switch SNMP commands.8.6 High
- hirsch enterphone meshThe Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through...10.0 Critical
- brocade fabric os, broadcom fabric operating system +1 moreBrocade Fabric OS may capture SNMP Passwords in clear text5.3 Medium
- broadcom brocade sannav, brocade sannav +1 moreWeak TLS Ciphers on Brocade SANnav OVA SSH port 228.2 High
- broadcom brocade sannav, brocade sannav +1 moreWeak TLS Ciphers on Brocade SANnav port 443 & 180826.9 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability4.5 Medium
- intel integrated performance primitives cryptographyGeneration of weak initialization vector in an Intel(R) IPP Cryptography software library before...7.5 High
- sick ag inspectorp8xx, lector8xx +1 moreSICK Lector8xx and InspectorP8xx vulnerable for code execution8.8 High
- xen xapi, xen +1 moreXapi: Metadata injection attack against backup/restore functionality3.8 Low
- sick ag inspectorp8xx, lector8xx +1 moreSICK Lector8xx and InspectorP8xx vulnerable for code execution8.8 High
- red hat enterprise linux 10, enterprise linux 9 +1 moreKeylime: keylime registrar dos due to incompatible database entry handling4.3 Medium
- octokit request.js@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking5.3 Medium
- Show moreLoading…