Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,661 results · page 40 of 114
May 2, 2025A vulnerability was found in handrew browserpilot up to 0.2.51.CVE-2025-4218 · Other software · handrew · reported by VulDBMedium 4.8
A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAgent of the file browserpilot/browserpilot/agents/gpt_selenium_agent.py. The manipulation of the argument instructions leads to code injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- browserpilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken CVE-2023-53142 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 ("netlink: eeprom: Defer page requests to individual parsers") After this commit, ethtool reads a block with length = 1; to read the SFF-8024 identifier value. unpatched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 00 00 00 00 00 00 $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00 $ $ ethtool -m enp65s0f0np0 Offset Values ------ ------ 0x0000: 11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScriCVE-2024-11390 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical.CVE-2025-3983 · Other software · AMTT · reported by VulDBMedium 5.1
A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hotel Broadband Operation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.CVE-2024-52887 · Other software · checkpoint · reported by cve@checkpoint.comLow 3.5
Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.
- Product
- Check Point Mobile Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.checkpoint.com
Apr 25, 2025NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.CVE-2025-32982 · Other software · Netscout · reported by MITREHigh 7.5
NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, afCVE-2025-1908 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.7
An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Apr 23, 2025Broadcom Brocade Fabric OS Code Injection VulnerabilityCVE-2025-1976 · Other software · Broadcom · reported by sirt@brocade.comExploitedHigh 8.6
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
- Product
- Brocade Fabric OS
- On CISA’s list since
- Apr 28, 2025 (federal fix deadline May 19, 2025)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comcisa.gov
Apr 23, 2025BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, aCVE-2025-28169 · Other software · reported by MITREHigh 8.1
BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.combyd.com
Apr 22, 2025xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser.CVE-2025-32965 · Other software · XRPLF · reported by GitHubCritical 9.3
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
- Product
- xrpl.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, ContrCVE-2025-28233 · Other software · reported by MITRECritical 9.1
Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.CVE-2025-28232 · Other software · Jmbroadcast · reported by MITRECritical 9.1
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
- Product
- Jmb0150 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.CVE-2025-28230 · Other software · Jmbroadcast · reported by MITRECritical 9.1
Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.
- Product
- Jmb0150 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user tCVE-2024-45651 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
- Product
- Sterling Connect:Direct Web Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Broken Links Remover: Cross-Site Request Forgery (CSRF)CVE-2025-39440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through <= 1.2.2.
- Product
- Broken Links Remover
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Broken Links Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Browser is affected by type confusion vulnerability, successful exploitation of this vulnerability may affect service availability.CVE-2025-2197 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.3
Browser is affected by type confusion vulnerability, successful exploitation of this vulnerability may affect service availability.
- Product
- com. hihonor.baidu.browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to meCVE-2025-22109 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to memory leaks in ax25_connect() and also refcount leaks in ax25_release(). Memory leak was detected with kmemleak: ================================================================ unreferenced object 0xffff8880253cd680 (size 96): backtrace: __kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43) kmemdup_noprof (mm/util.c:136) ax25_rt_autobind (net/ax25/ax25_route.c:428) ax25_connect (net/ax25/af_ax25.c:1282) __sys_connect_file (net/socket.c:2045) __sys_connect (net/socket.c:2064) __x64_sys_connect (net/socket.c:2067) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) ================================================================ When socket is bound, refcounts must be incremented the way it is done in ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of autobind, the refcounts are not incremented. This bug leads to the following issue reported by Syzkaller: ===============================================================
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 11, 2025An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy CVE-2025-0129 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comCritical 9.3
An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Rules. This enables the user to use Prisma Access Browser without any restrictions.
- Product
- Prisma Access Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Apr 11, 2025A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privilCVE-2025-0119 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.3
A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM.
- Product
- Cortex XDR Broker VM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Apr 11, 2025Private Browsing tabs may be accessed without authentication.CVE-2023-42973 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4
Private Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and iPadOS 17. The issue was addressed with improved UI.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.CVE-2025-29811 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Broadstreet Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32211 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
- Product
- Broadstreet Ads
- Affected
- up to 1.52.1
- What to do
- Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files wiCVE-2025-20951 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files with the privilege of Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 8, 2025Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID.CVE-2025-20942 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 6, 2025Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links: SQL InjectionCVE-2025-1264 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025Broadstreet Ads: Cross-Site Request Forgery (CSRF)CVE-2025-32270 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
- Product
- Broadstreet Ads
- Affected
- up to 1.52.1
- What to do
- Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025404 Image Redirection (Replace Broken Images): Cross-Site Request Forgery (CSRF)CVE-2025-32266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.
- Product
- 404 Image Redirection (Replace Broken Images)
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update 404 Image Redirection (Replace Broken Images) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Libro de Reclamaciones y Quejas: Cross-Site Request Forgery (CSRF)CVE-2025-32113 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows Cross Site Request Forgery.This issue affects Libro de Reclamaciones y Quejas: from n/a through <= 1.0.
- Product
- Libro de Reclamaciones y Quejas
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Libro de Reclamaciones y Quejas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restrictionCVE-2025-3192 · Other software · reported by report@snyk.ioHigh 7.8
Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsecurity.snyk.io
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who CVE-2025-31285 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who couCVE-2025-31284 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users whoCVE-2025-31283 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users wCVE-2025-31282 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 1, 2025A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actionsCVE-2025-28131 · Other software · Nagios · reported by MITREMedium 4.6
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): froCVE-2025-31694 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.1
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
- Product
- Two-factor Authentication (TFA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.CVE-2025-31691 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
- Product
- OAuth2 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeCVE-2025-31686 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.1
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeCVE-2025-31685 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.CVE-2025-31681 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
- Product
- Authenticator Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 CVE-2025-31678 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.2
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 befoCVE-2025-31673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.6
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
- Product
- Drupal core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.3.
- Product
- IMPress for IDX Broker
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.CVE-2025-26689 · Other software · Inaba Denki Sangyo Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.
- Product
- CHOCO TEI WATCHER mini (IB-MCT001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Browser Caching with .htaccess: Cross-Site Request Forgery (CSRF)CVE-2025-31439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Caching with .htaccess: from 1.2.1 through n/a.
- Product
- Browser Caching with .htaccess
- What to do
- Update Browser Caching with .htaccess to the newest version.
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permCVE-2024-55070 · Other software · Mealie · reported by MITRELow 3.1
A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orderCVE-2024-55073 · Other software · Mealie · reported by MITREHigh 7.6
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orderCVE-2024-55072 · Other software · Mealie · reported by MITREMedium 5.4
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connectiCVE-2022-39163 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.7
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025RabbitMQ is a messaging and streaming broker.CVE-2025-30219 · Other software · rabbitmq · reported by GitHubMedium 6.1
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025Browser Address Bar Color: Cross-Site Request Forgery (CSRF)CVE-2025-30577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.
- Product
- Browser Address Bar Color
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Browser Address Bar Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.