CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- No product listedAn issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows...5.5 Medium
- usememos memosMemos Server-Side Request Forgery (SSRF)9.8 Critical
- g-fast gfastGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy...9.8 Critical
- nagios xiNagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by...6.1 Medium
- No product listedAn issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0...9.8 Critical
- No product listedAVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS)...5.4 Medium
- draytek vigor1000b firmware, vigor2133 firmware, vigor2135 firmware +20 more +22 moreBuffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8...9.8 Critical
- draytek vigor1000b firmware, vigor2133 firmware, vigor2135 firmware +20 more +22 moreVigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and...9.8 Critical
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreAn issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8,...8.4 High
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreAn issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior...8.8 High
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreA NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200...7.5 High
- No product listedDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860...7.5 High
- No product listedDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860...7.5 High
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860...8.8 High
- extremenetworks xiq-seIn XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible,...9.8 Critical
- extremenetworks xiq-seIn XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which...8.8 High
- extremenetworks xiq-seIn XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific...5.3 Medium
- infoblox niosInfoblox NIOS through 8.6.4 has Improper Access Control for Grids.9.1 Critical
- infoblox niosInfoblox NIOS through 8.6.4 has Improper Authentication for Grids.9.8 Critical
- infoblox niosInfoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.9.8 Critical
- infoblox niosInfoblox NIOS through 8.6.4 executes with more privileges than required.9.8 Critical
imblogPyPIPosts scraped data to IP address associated with other malware distribution attacks.No scorecolabrunPyPIExfiltrates cookies to hardcoded IP addressNo scorebrowsercmdhbt2PyPIExfiltrates user cookies to hardcoded server endpoint during normal operationsNo scoreautodzeePyPIWhen using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.No score- esri arcgis monitor[#BUG-000172669 ArcGIS Monitor has a security vulnerability]4.3 Medium
automslcPyPIWhen using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.No score- drupal oauth2 server, oauth2 server project server +1 moreOAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-0209.8 Critical
- cache utility project utility, drupal cache utility +1 moreCache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-0198.8 High
- drupal general data protection regulation, general data protection regulation project data protection regulation +1 moreGeneral Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-0188.1 High
- red hat build of apache camel 4.8 for quarkus 3.15, build of quarkus, build of quarkus 3.15.3.sp1 +4 more +6 moreIo.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout7.5 High
- beckman coulter life sciences met one 3400+MET ONE 3400+ Potential Credential Exposure5.8 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreCisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability6.0 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreCisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability4.4 Medium
- cisco nx-os softwareCisco NX-OS Software Command Injection Vulnerability5.1 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreCisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability5.1 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreCisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability4.8 Medium
- cisco nx-os softwareCisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet Denial of Service Vulnerability7.4 High
- mmaitre314 picklescanpicklescan - Security scanning bypass via non-standard file extensions5.3 Medium
- mmaitre314 picklescanpicklescan - Security scanning bypass via 'pip main'5.3 Medium
- marcus (aka @msykes) events managerWordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability5.3 Medium
- ibm cloud pak for dataIBM Cloud Pak for Data cross-site scripting6.1 Medium
- required admin menu managerWordPress Admin Menu Manager plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- acquia mautic, mautic mautic/core +1 moreRemote Code Execution & File Deletion in Asset Uploads9.1 Critical
- acquia mautic, mautic mautic/core +1 moreImproper Authorization in Reporting API7.7 High
- acquia mautic, mautic mautic/core +1 moreRelative Path Traversal in assets file upload4.3 Medium
- quizorganizer quiz organizerQuiz Organizer <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- sma www.sunnyportal.comSMA: Sunny Portal Remote Code Execution6.5 Medium
- j’s communication co., ltd. revoworks browser, revoworks scvx +1 moreIncorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.2.7 Low
- shaonsina sina extension for elementorSina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes6.4 Medium
- Show moreLoading…