Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,708 results · page 182 of 355
Jun 10, 2025Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47168 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47167 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-47165 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47164 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-47160 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.CVE-2025-33071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.CVE-2025-33070 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper verification of cryptographic signature in App Control for Business (WDAC) allows an unauthorized attacker to bypass a security feature locally.CVE-2025-33069 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.1
Improper verification of cryptographic signature in App Control for Business (WDAC) allows an unauthorized attacker to bypass a security feature locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.CVE-2025-33068 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2012 R2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally.CVE-2025-33067 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.CVE-2025-33066 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.CVE-2025-33056 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2025-33050 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2025-32725 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.CVE-2025-32724 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2025-32715 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2025-32710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network.CVE-2025-29828 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortCVE-2025-25250 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comcert-portal.siemens.com
Jun 10, 2025In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.CVE-2024-57186 · Other software · Erxes · reported by MITREMedium 5.4
In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.
- Product
- Erxes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jun 10, 2025An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledCVE-2024-32119 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.8
An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.
- Product
- FortiClientEMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Jun 10, 2025Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resCVE-2023-20599 · Other software · AMD · reported by psirt@amd.comHigh 7.9
Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality.
- Product
- AMD EPYC™ 7002 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-daCVE-2025-48879 · Other software · OctoPrint · reported by GitHubMedium 6.5
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.
- Product
- OctoPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users.CVE-2025-37100 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.7
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated CVE-2025-41657 · Other software · Auma · reported by info@cert.vde.comMedium 4.3
Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker.
- Product
- AC1.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands.CVE-2024-13089 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.5
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Jun 10, 2025inprosysmedia-likes-dislikes-post: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4840 · WordPress plugins & themes · reported by WPScanHigh 7.5
The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- inprosysmedia-likes-dislikes-post
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update inprosysmedia-likes-dislikes-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request.CVE-2025-1041 · Other software · Avaya · reported by securityalerts@avaya.comCritical 9.9
An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
- Product
- Avaya Call Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal netCVE-2025-42988 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.
- Product
- SAP Business Objects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a CVE-2025-31325 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.8
Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the attacker limited access to restricted information. The vulnerability does not affect data integrity or availability and operates entirely within the context of the client's browser.
- Product
- SAP NetWeaver (ABAP Keyword Documentation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace.CVE-2025-23192 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.
- Product
- SAP BusinessObjects Business Intelligence (BI Workspace)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.CVE-2025-30507 · Other software · CyberData · reported by ics-cert@hq.dhs.govMedium 6.9
CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.CVE-2025-26468 · Other software · CyberData · reported by ics-cert@hq.dhs.govHigh 8.7
CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.CVE-2025-30184 · Other software · CyberData · reported by ics-cert@hq.dhs.govCritical 9.3
CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025elfsight Contact Form widget: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
- Product
- elfsight Contact Form widget
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update elfsight Contact Form widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to accCVE-2025-5893 · Other software · Honding Technology · reported by twcert@cert.org.twCritical 9.3
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
- Product
- Smart Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 8, 2025The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default.CVE-2025-3461 · Other software · ON Semiconductor · reported by cve@takeonme.orgCritical 9.1
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
- Product
- Quantenna Wi-Fi chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.onsemi.comtakeonme.org
Jun 7, 2025Profiler – What Slowing Down Your WP: Unauthorized modification of dataCVE-2025-5814 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_plugin_control() function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate previously deactivated plugins after accessing the "Profiler" page.
- Product
- Profiler – What Slowing Down Your WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Profiler – What Slowing Down Your WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2025An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion.CVE-2025-41646 · Other software · Kunbus · reported by info@cert.vde.comCritical 9.8
An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
- Product
- Revolution Pi webstatus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.kunbus.comkunbus.com
Jun 6, 2025Foxit eSign for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49419 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Foxit eSign for WordPress: from n/a through <= 2.0.3.
- Product
- Foxit eSign for
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Foxit eSign for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Hive Support: Unauthorized access and modification of dataCVE-2025-5018 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and overwrite the site’s OpenAI API key and inspection data or modify AI-chat prompts and behavior. This vulnerability is potentially a duplicate of CVE-2025-32208 or/and CVE-2025-32242.
- Product
- Hive Support
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-48904 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Art: Unauthorized accessCVE-2025-1778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option.
- Product
- Art
- Affected
- up to 3.12.2.3
- What to do
- Affects up to 3.12.2.3. Update Art to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BM Content Builder
- Affected
- up to 3.16.2.1
- What to do
- Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseatheme.networdfence.com
Jun 5, 2025Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.CVE-2025-47966 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025HyperComments: Unauthorized modification of data that can lead to privilege escalationCVE-2025-5701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- HyperComments
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update HyperComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 5, 2025Improper neutralization of input provided by an unauthorized user into changes__reference_id parameter in URL allows for boolean-based Blind SQL Injection attacCVE-2025-4568 · Other software · Trol InterMedia · reported by cvd@cert.plCritical 9.3
Improper neutralization of input provided by an unauthorized user into changes__reference_id parameter in URL allows for boolean-based Blind SQL Injection attacks.
- Product
- 2ClickPortal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record2clickportal.plcert.pl
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.