Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 38 of 83
Apr 7, 2025Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-58116 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-58115 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availaCVE-2024-58112 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availaCVE-2024-58111 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Vite is a frontend tooling framework for javascript.CVE-2025-31486 · Other software · vitejs · reported by GitHubMedium 5.3
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-30218 · Other software · vercel · reported by GitHubLow 1.7
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron.CVE-2025-27608 · Other software · arduino · reported by GitHubLow 1
Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences -> Settings section of the Arduino IDE interface. In the vulnerable versions, any values entered in this field are directly displayed to the user through a notification tooltip object, without a proper output encoding routine, due to the underlying ElectronJS engine interpretation. This vulnerability exposes the input parameter to Self-XSS attacks, which may lead to security risks depending on where the malicious payload is injected. This vulnerability is fixed in 2.3.5.
- Product
- arduino-ide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Jooby is a web framework for Java and Kotlin.CVE-2025-31129 · Other software · jooby-project · reported by GitHubHigh 8.8
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).
- Product
- jooby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.CVE-2025-31116 · Other software · MobSF · reported by GitHubMedium 4.4
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Beego is an open-source web framework for the Go programming language.CVE-2025-30223 · Other software · beego · reported by GitHubCritical 9.3
Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.
- Product
- beego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025Mesop is a Python-based UI framework that allows users to build web applications.CVE-2025-30358 · Other software · mesop-dev · reported by GitHubHigh 8.1
Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service (DoS) attack against the server. Additionally, it could also result in other severe consequences given the application's implementation, such as identity confusion, where an attacker could impersonate an assistant or system role within conversations. This impersonation could potentially enable jailbreak attacks when interacting with large language models (LLMs). Just like the Javascript's prototype pollution, this vulnerability could leave a way for attackers to manipulate the intended data-flow or control-flow of the application at runtime and lead to severe consequences like remote code execution when gadgets are available. Users should upgrade to version 0.14.1 to obtain a fix for the issue.
- Product
- mesop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A unauthorized access vulnerability exists in the Xiaomi phone framework.CVE-2024-45356 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.3
A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
- Product
- Xiaomi phone framework has unauthorized access vulnerability
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A unauthorized access vulnerability exists in the Xiaomi phone framework.CVE-2024-45355 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 5.5
A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
- Product
- Xiaomi phone framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025An intent redriction vulnerability exists in the Xiaomi quick App framework application product.CVE-2024-45353 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.
- Product
- quick app framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Frappe is a full-stack web application framework.CVE-2025-30217 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2025-30164 · Other software · Icinga · reported by GitHubMedium 4.1
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2025-27609 · Other software · Icinga · reported by GitHubLow 1.1
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2.CVE-2025-27406 · Other software · Icinga · reported by GitHubHigh 7.6
Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
- Product
- icingaweb2-module-reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2025-27405 · Other software · Icinga · reported by GitHubHigh 7.6
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2025-27404 · Other software · Icinga · reported by GitHubHigh 7.6
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30214 · Other software · frappe · reported by GitHubHigh 8
Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30213 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30212 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail messCVE-2025-30349 · Other software · Horde · reported by MITREHigh 7.2
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
- Product
- IMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025Next.js is a React framework for building full-stack web applications.CVE-2025-29927 · Other software · vercel · reported by GitHubCritical 9.1
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inaCVE-2024-7776 · Other software · onnx · reported by security@huntr.devCritical 9.1
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.
- Product
- onnx/onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025Nuxt is an open-source web development framework for Vue.js.CVE-2025-27415 · Other software · nuxt · reported by GitHubHigh 7.5
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical.CVE-2025-2376 · Other software · viames · reported by VulDBMedium 6.9
A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pair Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 15, 2025Fresh Framework: Missing AuthorizationCVE-2025-26961 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through <= 1.70.0.
- Product
- Fresh Framework
- Affected
- up to 1.70.0
- What to do
- Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025AppPresser – Mobile App Framework: Stored Cross-Site ScriptingCVE-2025-1561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page.
- Product
- AppPresser – Mobile App Framework
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 12, 2025Flarum is open-source forum software.CVE-2025-27794 · Other software · flarum · reported by GitHubMedium 6.8
Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write.CVE-2025-23360 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang.CVE-2025-27616 · Other software · go-vela · reported by GitHubHigh 8.5
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Fresh Framework: Improper Control of Generation of Code ('Code Injection')CVE-2025-26936 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.
- Product
- Fresh Framework
- Affected
- up to 1.70.0
- What to do
- Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2025The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in tCVE-2024-13919 · Other software · Laravel Holdings Inc. · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 8
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
- Product
- Laravel Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters inCVE-2024-13918 · Other software · Laravel Holdings Inc. · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 8
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
- Product
- Laravel Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry.CVE-2025-27519 · Other software · truefoundry · reported by GitHubCritical 9.3
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243.
- Product
- cognita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry.CVE-2025-27518 · Other software · truefoundry · reported by GitHubMedium 6.9
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15.
- Product
- cognita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025CS Framework: Arbitrary File ReadCVE-2024-12036 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- CS Framework
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update CS Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 7, 2025CS Framework: Arbitrary file deletionCVE-2024-12035 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cs_widget_file_delete() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- CS Framework
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update CS Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 5, 2025Laravel is a web application framework.CVE-2025-27515 · Other software · laravel · reported by GitHubMedium 6.9
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025OpenTelemetry dotnet is a dotnet telemetry framework.CVE-2025-27513 · Other software · open-telemetry · reported by GitHubHigh 7.5
OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
- Product
- opentelemetry-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could leCVE-2025-0360 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.8
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicatioCVE-2025-0359 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.5
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025FACTION is a PenTesting Report Generation and Collaboration Framework.CVE-2025-27422 · Other software · factionsecurity · reported by GitHubHigh 7.5
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
- Product
- faction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Flask-AppBuilder is an application development framework.CVE-2025-24023 · Other software · dpgaspar · reported by GitHubLow 3.7
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2025Exertio Framework: Privilege escalationCVE-2024-13373 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due to the plugin not properly validating a user's identity prior to updating their password through the fl_forgot_pass_new() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Exertio Framework
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Exertio Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 24, 2025XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.CVE-2024-54820 · Other software · reported by MITRECritical 9.8
XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST CVE-2025-27098 · Other software · ardatan · reported by GitHubMedium 5.8
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`. Users have two options to fix vulnerability; 1. Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18` 2. Remove `staticFiles` option from the configuration, and use other solutions to serve static files.
- Product
- graphql-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST CVE-2025-27097 · Other software · ardatan · reported by GitHubMedium 5.1
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.
- Product
- graphql-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.