Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,708 results · page 188 of 355
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint.CVE-2025-43921 · Other software · GNU · reported by MITREMedium 5.3
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.launchpad.netgithub.com
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commanCVE-2025-43920 · Other software · GNU · reported by MITREMedium 5.4
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.launchpad.netgithub.com
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/maiCVE-2025-43919 · Other software · GNU · reported by MITREMedium 5.8
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.launchpad.netgithub.com
Apr 18, 2025Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges.CVE-2025-28231 · Other software · reported by MITRECritical 9.1
Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.CVE-2025-29209 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.
- Product
- X18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized CVE-2025-28228 · Other software · Electrolink · reported by MITREHigh 7.5
A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.
- Product
- Fm/dab/tv Transmitter Web Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users.CVE-2025-29722 · Other software · Yassmittal · reported by MITREMedium 6.3
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints.
- Product
- Commercify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access.CVE-2025-29662 · Other software · Landchat · reported by MITRECritical 9.8
A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access.
- Product
- Landchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025wpLike2Get: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensitive Data.This issue affects wpLike2Get: from n/a through <= 1.2.9.
- Product
- wpLike2Get
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update wpLike2Get to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
- Product
- Klarna Checkout for WooCommerce
- Fixed in
- 2.13.5
- What to do
- Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Apr 16, 2025Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fileCVE-2024-55372 · Other software · Wallosapp · reported by MITRECritical 9.8
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite, pCVE-2025-32817 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 6.1
A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite, potentially leading to denial of service or file corruption.
- Product
- Connect Tunnel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Apr 16, 2025An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing asCVE-2024-53304 · Other software · reported by MITREMedium 6.5
An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing as an infected machine.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, whicCVE-2025-20236 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
- Product
- Cisco Webex Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 16, 2025A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts.CVE-2025-20150 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow an attacker to determine which usernames are valid LDAP user accounts.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 16, 2025Essential Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.1.9
- What to do
- Affects up to 6.1.9. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Mediavine Control Panel: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Retrieve Embedded Sensitive Data.This issue affects Mediavine Control Panel: from n/a through <= 2.10.6.
- Product
- Mediavine Control Panel
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update Mediavine Control Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-31950 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain other users' charger information.CVE-2025-31945 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain other users' charger information.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-31360 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31147 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-30512 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.CVE-2025-30257 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27929 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-27927 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27719 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query an API endpoint and get device details.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-27575 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-27565 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-27561 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename "rooms" of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).CVE-2025-26857 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Macro Calculator with Admin Email Optin & Data: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26730 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
- Product
- Macro Calculator with Admin Email Optin & Data
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Macro Calculator with Admin Email Optin & Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-25276 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can hijack other users' devices and potentially control them.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).CVE-2025-24315 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.CVE-2025-31941 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can check the existence of usernames in the system by querying an API.CVE-2025-31933 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a user's plant list by knowing the username.CVE-2025-31357 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a user's plant list by knowing the username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-30514 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-30254 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-27938 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can get users' emails by knowing usernames.CVE-2025-27568 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can infer the existence of usernames in the system by querying an API.CVE-2025-24487 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system.CVE-2025-3579 · Other software · AiDex · reported by cve-coordination@incibe.esCritical 9.3
In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system. This includes executing operating system (Unix) commands, interacting with internal services such as PHP or MySQL, and even invoking native functions of the framework used, such as Laravel or Symfony. This execution is achieved by Prompt Injection attacks through the /api/<string-chat>/message endpoint, manipulating the content of the ‘content’ parameter.
- Product
- AiDex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUCVE-2025-2572 · Other software · Progress Software Corporation · reported by security@progress.comMedium 5.6
In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.progress.comprogress.com
Apr 14, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthCVE-2025-22371 · Other software · SicommNet · reported by csirt@divd.nlCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)
- Product
- BASEC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasec.sicomm.netcsirt.divd.nl
Apr 13, 2025SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbCVE-2025-3572 · Other software · INTUMIT · reported by twcert@cert.org.twHigh 7.5
SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server.
- Product
- SmartRobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 11, 2025Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-29834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared ResourcCVE-2025-32080 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 6.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.
- Product
- Mediawiki - Mobile Frontend Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orggerrit.wikimedia.org
Apr 11, 2025A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to accessCVE-2024-52280 · Other software · SUSE · reported by meissner@suse.deHigh 7.7
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b.
- Product
- rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Apr 11, 2025A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens aCVE-2025-23387 · Other software · SUSE · reported by meissner@suse.deMedium 5.3
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
- Product
- rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Apr 11, 2025A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps CatalCVE-2024-52282 · Other software · SUSE · reported by meissner@suse.deMedium 6.2
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.
- Product
- rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.