CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreGrub2: reader/jpeg: heap oob write during jpeg parsing6.7 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-core: stored xss in keycloak when creating a items in admin console3.8 Low
- duendesoftware fossDuende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens6.3 Medium
- palantir com.palantir.artifacts:artifactsFoundry artifacts denial of service6.5 Medium
- joomla! project cms[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component6.7 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - bios +1 more +3 morenetem: Update sch->q.qlen before qdisc_tree_reduce_backlog()7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morepfifo_tail_enqueue: Drop new packet when sch->limit == 07.8 High
- undsgn uncode coreUncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias6.3 Medium
- havelsan liman mysOpen Redirect in HAVELSAN's Open Source Project Liman MYS4.8 Medium
- mozilla firefoxMemory safety bugs fixed in Firefox 135.0.16.5 Medium
- komtera technolgies klog serverPath Traversal in Komtera Technolgies' KLog Server5.7 Medium
- formcraftFormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php4.3 Medium
- undsgn uncodeUncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia6.5 Medium
- undsgn uncodeUncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description5.4 Medium
- formcraftFormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload7.2 High
- undsgn uncodeUncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed7.5 High
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePost SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- presslayouts pressmart, pressmart - modern elementor woocommerce wordpress theme +1 morePressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- churchcrmSQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php9.3 Critical
- churchcrmSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field8.4 High
- goodlayers tour master - tour booking, travel, hotel, tour master +1 moreTour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter6.5 Medium
- kerryoco threepressThreepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- akashmalik scratch & win – giveaways and contests. boost subscribers, traffic, repeat visits, referrals, sales and more, scratch \& win +1 moreScratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation5.3 Medium
- carspot project carspot, scriptsbundle carspot – dealership wordpress classified theme +1 moreCarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover9.8 Critical
- wpdesk flexible wishlist for woocommerce – ecommerce wishlist & save for later, flexible wishlist for woocommerce +1 moreFlexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification4.3 Medium
- cordaware bestinformed infoclientLocal Privilege Escalation via Config Manipulation8.5 High
- cordaware bestinformed webMultiple Authenticated Stored Cross-Site Scripting5.1 Medium
- cordaware bestinformed webMultiple Unauthenticated Stored Cross-Site Scripting5.3 Medium
- cordaware bestinformed webAuthenticated Remote Code Execution via ScriptVar8.6 High
- magazine3 web stories enhancer – level up your web stories, web stories enhancer +1 moreWeb Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pluginus active products tables for woocommerce, realmag777 active products tables for woocommerce. use constructor to create tables +1 moreActive Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting6.1 Medium
- ecwid by lightspeed ecommerce shopping cart, lightspeedhq ecwid ecommerce shopping cart +1 moreEcwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message4.3 Medium
- tusharimran ablocks, kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder +1 moreaBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- vcita online payments – get paid with paypal, square & stripe, online payments - get paid with paypal\, square \& stripe +1 moreOnline Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themepoints super testimonials, super testimonial – testimonial & customer review slider plugin for wordpress +1 moreSuper Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- clavaque s2member, s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions +1 mores2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting6.1 Medium
- shenyanzhi memorialdayMemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- hitachi hvac energy saving programInsecure Loading of Dynamic Link Libraries in HVAC Energy Saving Program7.3 High
- hitachi usb-convertercable driverInsecure Loading of Dynamic Link Libraries in USB-CONVERTERCABLE DRIVER7.3 High
- wecantrack affiliate links, affiliate links – link cloaking and management +1 moreAffiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection8.1 High
- shopwarden, shopwarden – automated woocommerce monitoring & testing +1 moreShopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update8.8 High
- speedsize image & video ai-optimizer, image \& video ai-optimizer +1 moreSpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache4.3 Medium
- fujifilm business innovation corp. docuprint cm225fw, docuprint cm228fw, docuprint cp225w +1 more +3 moreOut-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint...6.5 Medium
- labibahmed42 simple pricing tables for wpbakery page builder(formerly visual composer), webdevocean pricing tables +1 moreSimple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- 1clickmigration 1 click migration & backup: free wordpress migration plugin with zero downtime & easy clone, 1 click migration +1 more1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php5.9 Medium
- mashi simple map no apiSimple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter6.4 Medium
- photonicgnostic library bookshelvesLibrary Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- istmoplugins getbookingswp – appointments booking calendar plugin for wordpress, get bookings wp +1 moreGetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5 High
- 1clickmigration 1 click migration & backup: free wordpress migration plugin with zero downtime & easy clone, 1 click migration +1 more1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation5.3 Medium
- Show moreLoading…