Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

38,686 results · page 246 of 774

Jun 17, 2025An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and moCVE-2025-49216 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
Product
Trend Micro Endpoint Encryption Policy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected iCVE-2025-49213 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method.
Product
Trend Micro Endpoint Encryption Policy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected iCVE-2025-49212 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
Product
Trend Micro Endpoint Encryption Policy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected inCVE-2025-49220 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected iCVE-2025-49219 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025PostaPanduri: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49452 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injection.This issue affects PostaPanduri: from n/a through <= 2.1.3.
Product
PostaPanduri
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update PostaPanduri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025FW Food Menu: Unrestricted Upload of File with Dangerous TypeCVE-2025-49447 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0.
Product
FW Food Menu
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update FW Food Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Reformer for Elementor: Unrestricted Upload of File with Dangerous TypeCVE-2025-49444 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5.
Product
Reformer for Elementor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Reformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Integration for Contact Form 7 and Zoho CRM, Bigin: Deserialization of Untrusted DataCVE-2025-49330 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.
Product
Integration for Contact Form 7 and Zoho CRM, Bigin
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Integration for Contact Form 7 and Zoho CRM, Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Flozen: Unrestricted Upload of File with Dangerous TypeCVE-2025-49071 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through < 1.5.1.
Product
Flozen
What to do
Update Flozen to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48274 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL Injection.This issue affects WP Job Portal: from n/a through <= 2.3.2.
Product
WP Job Portal
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025School Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47573 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. This issue affects School Management: from n/a through 92.0.0.
Product
School Management
Affected
up to 92.0.0
What to do
Affects up to 92.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2025-47559 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.
Product
MapSVG
What to do
Update MapSVG to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WP VR: Unrestricted Upload of File with Dangerous TypeCVE-2025-47452 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.
Product
WP VR
Affected
up to 8.5.26
What to do
Affects up to 8.5.26. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Smart Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39479 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3.
Product
Smart Notification
Affected
up to 10.3
What to do
Affects up to 10.3. Update Smart Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Ovatheme Events Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-32510 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through <= 1.8.4.
Product
Ovatheme Events Manager
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Spare: Deserialization of Untrusted DataCVE-2025-31919 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
Product
Spare
Affected
up to 1.7
What to do
Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Rapyd Payment Extension for WooCommerce: Deserialization of Untrusted DataCVE-2025-30618 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through <= 1.2.0.
Product
Rapyd Payment Extension for WooCommerce
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Rapyd Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
Product
WPCRM - CRM for Contact form CF7 & WooCommerce
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025A privilege escalation from host to domain vulnerability was found in the FreeIPA project.CVE-2025-4404 · Other software · Red Hat · reported by Red HatCritical 9.1
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 17, 2025Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCVE-2025-5777 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.3
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jul 10, 2025 (federal fix deadline Jul 11, 2025)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com citrixbleed.com
Jun 16, 2025Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and accCVE-2025-6179 · Computers, phones & browsers · Google · reported by 7f6e188d-c52a-4a19-8674-3c3fa7d1fc7fCritical 9.8
Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHang3r and ExtPrint3r tools.
Product
ChromeOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.chromium.org issuetracker.google.com
Jun 16, 2025A vulnerability was found in libxml2.CVE-2025-49796 · Other software · Red Hat · reported by Red HatCritical 9.1
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 16, 2025A use-after-free vulnerability was found in libxml2.CVE-2025-49794 · Other software · Red Hat · reported by Red HatCritical 9.1
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 16, 2025Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application.CVE-2025-47869 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to buffer overflow. Structure members buffers were updated to valid size of CONFIG_XMLRPC_STRINGSIZE+1. This issue affects Apache NuttX RTOS users that may have used or base their code on example application as presented in releases from 6.22 before 12.9.0. Users of XMLRPC in Apache NuttX RTOS are advised to review their code for this pattern and update buffer sizes as presented in the version of the example in release 12.9.0.
Product
Apache NuttX RTOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Jun 16, 2025Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part ofCVE-2025-47868 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation). This issue affects Apache NuttX: from 6.9 before 12.9.0. Users are recommended to upgrade to version 12.9.0, which fixes the issue.
Product
Apache NuttX RTOS: tools/bdf-converter.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Jun 16, 2025Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.CVE-2025-40916 · Other software · GRYPHON · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
Product
Mojolicious::Plugin::CaptchaPNG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org metacpan.org
Jun 16, 2025Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.CVE-2025-6172 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.
Product
com.afmobi.boomplayer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jun 16, 2025The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inCVE-2025-6169 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twCritical 9.3
The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
WIMP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jun 14, 2025Image Resizer On The Fly: Arbitrary file deletionCVE-2025-6065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Image Resizer On The Fly
Affected
up to 1.1
What to do
Affects up to 1.1. Update Image Resizer On The Fly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 13, 2025The MCP inspector is a developer tool for testing and debugging MCP servers.CVE-2025-49596 · Other software · modelcontextprotocol · reported by GitHubCritical 9.4
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Product
inspector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 13, 2025Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry SysCVE-2025-6030 · Other software · Autoeastern · reported by cve@asrg.ioCritical 9.4
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.
Product
Cyclone Matrix TRF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asrg.io revers3everything.com
Jun 13, 2025Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart KeylessCVE-2025-6029 · Other software · KIA · reported by cve@asrg.ioCritical 9.4
Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. Manufacture is unknown at the time of release. CVE Record will be updated once this is clarified.
Product
Aftermarket Generic Smart Keyless Entry System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asrg.io revers3everything.com
Jun 13, 2025Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.CVE-2025-28389 · Other software · Openc3 · reported by MITRECritical 9.8
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
Product
Cosmos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openc3.com visionspace.com
Jun 13, 2025OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.CVE-2025-28388 · Other software · Openc3 · reported by MITRECritical 9.8
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Product
Cosmos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 13, 2025A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading CVE-2025-28386 · Other software · Openc3 · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Product
Cosmos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openc3.com visionspace.com
Jun 13, 2025An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.CVE-2025-28384 · Other software · Openc3 · reported by MITRECritical 9.1
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Product
Cosmos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 13, 2025Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME componentCVE-2025-46060 · Other software · Totolink · reported by MITRECritical 9.8
Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component
Product
N600r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 13, 2025Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-CVE-2025-45988 · Other software · B-link · reported by MITRECritical 9.8
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.
Product
Bl-wr9000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 13, 2025Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-CVE-2025-45987 · Other software · B-link · reported by MITRECritical 9.8
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.
Product
Bl-wr9000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 13, 2025Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-CVE-2025-45986 · Other software · B-link · reported by MITRECritical 9.8
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function.
Product
Bl-x10 Ac8 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 13, 2025Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-CVE-2025-45985 · Other software · B-link · reported by MITRECritical 9.8
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.
Product
Bl-wr9000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 13, 2025Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AECVE-2025-45984 · Other software · B-link · reported by MITRECritical 9.8
Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function.
Product
Bl-wr9000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 13, 2025Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.CVE-2025-29902 · Other software · Telex · reported by psirt@bosch.comCritical 10
Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.
Product
Remote Dispatch Console Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com
Jun 13, 2025Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0.CVE-2025-46783 · Other software · Ricoh Company, Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is running by tampering with specific files used on the product.
Product
RICOH Streamline NX V3 PC Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp ricoh.com
Jun 13, 2025Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-38824 · Other software · VMware · reported by security@vmware.comCritical 9.6
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
Product
SALT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.saltproject.io docs.saltproject.io
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
Product
REST API | Custom API Generator For Cross Platform And Import Export In WP
Affected
1.0.0 to 2.0.3
What to do
Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 12, 2025A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered.CVE-2025-49467 · Other software · jevents.net / GWE Systems Ltd · reported by security@joomla.orgCritical 9.3
A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.
Product
JEvents component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jevents.net
Jun 12, 2025XWiki is a generic wiki platform.CVE-2024-56158 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, aCVE-2025-4973 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.