Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,393 results · page 16 of 68
Jan 26, 2026Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generatCVE-2026-24430 · Other software · Shenzhen Tenda Technology Co., Ltd. · reported by VulnCheckHigh 8.2
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
- Product
- W30E V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtendacn.comvulncheck.com
Jan 23, 2026Anything Order by Terms: Missing AuthorizationCVE-2026-24567 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through <= 1.4.0.
- Product
- Anything Order by Terms
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Anything Order by Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026BA Book Everything: Missing AuthorizationCVE-2026-24371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.
- Product
- BA Book Everything
- Affected
- up to 1.8.16
- What to do
- Affects up to 1.8.16. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9466 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9465 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9464 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP classes, which causes the CIP port to become unresponsive.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9283 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9282 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9281 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device reboots
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9280 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requiring a reboot.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9279 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9278 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP connectivity, causing the web application to become inaccessible.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbCVE-2025-14377 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.8
A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This component has been retired and has been optional since the 1.36 release in 2024.
- Product
- Verve Asset Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on thCVE-2025-14376 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.6
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
- Product
- Verve Asset Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metCVE-2025-14369 · Other software · mackron · reported by cret@cert.orgMedium 5.5
dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool.
- Product
- dr_flac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files.CVE-2026-23849 · Other software · filebrowser · reported by GitHubMedium 5.3
File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint. The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow. This difference in execution path creates a measurable timing discrepancy. Version 2.55.0 contains a patch for the issue.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files.CVE-2021-47840 · Other software · Moeditor · reported by VulnCheckMedium 5.1
Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can upload specially crafted markdown files with embedded JavaScript that execute when opened, potentially enabling remote code execution on the victim's system.
- Product
- Moeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimgur.commoeditor.js.org
Jan 16, 2026Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files.CVE-2021-47837 · Other software · amitmerchant1990 · reported by VulnCheckMedium 5.1
Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can upload crafted markdown files with embedded scripts that execute when the file is opened, potentially enabling remote code execution.
- Product
- Markdownify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the coCVE-2025-29943 · Other software · AMD · reported by psirt@amd.comMedium 4.6
Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.
- Product
- AMD EPYC™ 9004 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend.CVE-2026-0615 · Other software · TheLibrarian · reported by cret@cert.orgHigh 7.3
The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions.
- Product
- TheLibrarian.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmindgard.aithelibrarian.io
Jan 16, 2026In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication iCVE-2025-68675 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Jan 14, 2026A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being diCVE-2026-0421 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
- Product
- ThinkPad L13 Gen 6 BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enrolCVE-2025-13455 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.
- Product
- ThinkPlus FU100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device informCVE-2025-13454 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information.
- Product
- ThinkPlus FU100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.CVE-2025-13453 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.1
A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.
- Product
- ThinkPlus FU100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools StCVE-2025-71166 · Other software · Typesetter · reported by VulnCheckMedium 4.8
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
- Product
- Typesetter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools StCVE-2025-71165 · Other software · Typesetter · reported by VulnCheckMedium 4.8
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
- Product
- Typesetter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBeCVE-2026-22211 · Other software · TinyOS · reported by VulnCheckMedium 5.1
TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.
- Product
- TinyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Jan 14, 2026Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.CVE-2025-56226 · Other software · Libsndfile Project · reported by MITREMedium 5.3
Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.
- Product
- Libsndfile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 9, 2026The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initializatCVE-2025-69426 · Other software · RUCKUS Networks · reported by VulnCheckCritical 10
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.
- Product
- vRIoT IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.ruckuswireless.comvulncheck.com
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality.CVE-2026-22232 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality.CVE-2026-22231 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user views the Action History Log. Fixed in OPEXUS eCASE Platform 11.14.1.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 7, 2026The credentials required to access the device's web server are sent in base64 within the HTTP headers.CVE-2026-22543 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 6.9
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (CVE-2025-15474 · Other software · AuntyFey · reported by VulnCheckMedium 5.3
AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad authentication input and repeatedly force the device into lockout states, preventing legitimate users from unlocking the device.
- Product
- AuntyFey Smart Combination Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes.CVE-2025-65922 · Other software · reported by MITREMedium 4.3
PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka application on a malicious site to establish false trust (UI Redressing), potentially tricking users into entering sensitive information or credentials into overlaid fake forms. NOTE: this is disputed by the Supplier because "PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. No session can be established. No credential interception or unauthorized actions are possible. Browser Same-Origin Policy prevents the parent page from accessing iframe content. Clickjacking is not applicable on the login page. Any credential capture would require attacker-controlled input and user interaction equivalent to phishing. The security outcome depends entirely on the user's trust in the parent page. An attacker can achieve the same effect with a fully fake login page. Embedding the legitimate page adds no risk, as browsers do not show URL, certificate, or padlock indicators in c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.CVE-2026-21484 · Other software · Mintplex-Labs · reported by GitHubMedium 5.3
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.
- Product
- anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context.CVE-2025-66835 · Other software · Trueconf · reported by MITREHigh 7.1
TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context.
- Product
- Trueconf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previouCVE-2023-54252 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 26, 2025ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2025-68474 · Other software · espressif · reported by GitHubMedium 6.1
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2025-68473 · Other software · espressif · reported by GitHubNone
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.CVE-2025-66947 · Other software · Krishanmurariji · reported by MITREMedium 6.5
SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
- Product
- Student Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.CVE-2025-68944 · Other software · Gitea · reported by MITREMedium 5
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Dec 23, 2025In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksCVE-2025-68338 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains. Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 22, 2025Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector.CVE-2025-11540 · Other software · Sharp Display Solutions, Ltd. · reported by psirt-info@cyber.jp.nec.comCritical 9.1
Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector.
- Product
- NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsharp-displays.jp.sharp
Dec 19, 2025A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature.CVE-2025-66521 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the Trusted Certificates view is loaded.
- Product
- pdfonline.foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality.CVE-2025-66519 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into the “Create new Layer” field during layer import and is later rendered into the DOM without proper sanitization. As a result, the injected script executes when the Layers panel is accessed.
- Product
- pdfonline.foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature.CVE-2025-66502 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the affected PDF is loaded.
- Product
- pdfonline.foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section.CVE-2025-66501 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payload can be stored via the Identity “First Name” field, which is later rendered into the DOM without proper sanitization. As a result, the injected script may execute when predefined text is used or when viewing document properties.
- Product
- pdfonline.foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025BA Book Everything: Stored Cross-Site ScriptingCVE-2025-14449 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and including, 1.8.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BA Book Everything
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2025File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server.CVE-2023-53942 · Other software · leefish · reported by VulnCheckCritical 9.4
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
- Product
- File Thingie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.