Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,394 results · page 63 of 388
Oct 24, 2025PixelYourSite: Does not validate some URL parameters before using them to generate paths passed to function/sCVE-2025-10723 · WordPress plugins & themes · reported by WPScanLow 2.7
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
- Product
- PixelYourSite
- Fixed in
- 11.1.2
- What to do
- Update PixelYourSite to 11.1.2 or newer.
Oct 22, 2025In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't releaseCVE-2023-53720 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't release the label mapping when replacing existing ct entry which leads to following memleak report: unreferenced object 0xffff8881854cf280 (size 96): comm "kworker/u48:74", pid 23093, jiffies 4296664564 (age 175.944s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002722d368>] __kmalloc+0x4b/0x1c0 [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core] [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core] [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core] [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core] [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core] [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core] [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table] [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 22, 2025In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have itsCVE-2022-50568 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted. This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent): gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&- Pull the existing device up in to struct f_hidg and make use of the cdev_device_{add,del}() helpers. This changes the lifetime of the device object to match struct f_hidg, but note that it is still added and deleted at the same time.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 22, 2025In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed iCVE-2022-50565 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed in exception paths in __lf_x_usb_enable_rx(). That will trigger memory leak. To fix it, add kfree() for urbs within "error" label. Compile tested only.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 22, 2025Meta Tag Manager: Does not restrictCVE-2025-5983 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
- Product
- Meta Tag Manager
- Fixed in
- 3.3
- What to do
- Update Meta Tag Manager to 3.3 or newer.
Oct 21, 2025The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should CVE-2025-11757 · Other software · CloudEdge · reported by ics-cert@hq.dhs.govHigh 8.7
The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key information to connect to the cameras from peer to peer.
- Product
- CloudEdge App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.CVE-2025-62651 · Other software · Restaurant Brands International · reported by MITREMedium 6.5
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.
- Product
- assistant platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.todaybobdahacker.com
Oct 17, 2025The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user accountCVE-2025-62642 · Other software · Restaurant Brands International · reported by MITREMedium 5.8
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.
- Product
- assistant platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.todaybobdahacker.com
Oct 16, 2025The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations.CVE-2025-11493 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.8
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackCVE-2025-56746 · Other software · Creativeitem · reported by MITRELow 2.2
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operCVE-2025-39966 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then go on to immediately kfree() the obj. This causes a UAF once the workqueue completes the fput() and tries to decrement the users refcount. Fix this by putting the core code in charge of the file lifetime, and call __fput_sync() during abort to ensure that release() is called before kfree. __fput_sync() is a bit too tricky to open code in all the object implementations. Instead the objects tell the core code where the file pointer is and the core will take care of the life cycle. If the object is successfully allocated then the file will hold a users refcount and the iommufd_object cannot b
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 15, 2025BlindMatrix e-Commerce: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-10406 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
- Product
- BlindMatrix e-Commerce
- Fixed in
- 3.1
- What to do
- Update BlindMatrix e-Commerce to 3.1 or newer.
Oct 14, 2025Pz-LinkCard: Does not validate a parameter before making a request to itCVE-2025-8594 · WordPress plugins & themes · reported by WPScanLow 3.8
The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.
- Product
- Pz-LinkCard
- Fixed in
- 2.5.7
- What to do
- Update Pz-LinkCard to 2.5.7 or newer.
Oct 14, 2025Simple SEO: Does not sanitise and escape some parametersCVE-2025-10357 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- Simple SEO
- Fixed in
- 2.0.32
- What to do
- Update Simple SEO to 2.0.32 or newer.
Oct 13, 2025Plus Addons for Elementor: Does not sanitize SVG file contentsCVE-2025-9698 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
- Product
- Plus Addons for Elementor
- Fixed in
- 6.3.16
- What to do
- Update Plus Addons for Elementor to 6.3.16 or newer.
Oct 8, 2025Find Me On: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-10635 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
- Product
- Find Me On
- Affected
- up to 2.0.9.1
- What to do
- Affects up to 2.0.9.1. Update Find Me On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Does not validate the path of files to be downloadedCVE-2025-10162 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 15.1
- What to do
- Affects up to 15.1. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2025The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to rCVE-2025-59449 · Other software · YoSmart · reported by MITREMedium 4.9
The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices.
- Product
- YoLink MQTT broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Oct 6, 2025The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an aCVE-2025-58587 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025Responsive Lightbox & Gallery: Does not properly handle HTML tag attributes modificationsCVE-2025-9710 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.3
- What to do
- Update Responsive Lightbox & Gallery to 2.5.3 or newer.
Oct 6, 2025Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder): Does not sanitize SVG file contentsCVE-2025-9703 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
- Product
- Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
- Fixed in
- 2.5.0
- What to do
- Update Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) to 2.5.0 or newer.
Oct 3, 2025OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owneCVE-2025-10696 · Other software · OpenSupports · reported by help@fluidattacks.comHigh 7.1
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
- Product
- OpenSupports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 3, 2025A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view.CVE-2025-27236 · Other software · Zabbix · reported by security@zabbix.comLow 2.1
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CTL Behance Importer Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2025IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to coCVE-2023-49883 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- Product
- Transformation Extender Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on thCVE-2023-49881 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
- Product
- Transformation Extender Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If create_qp does not fully succeed it is possiCVE-2023-53528 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If create_qp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch checks to see if the queues exist before attempting to drain them.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 1, 2025In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8173: Enable IRQ when pdata is ready If the device does not come straighCVE-2022-50439 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8173: Enable IRQ when pdata is ready If the device does not come straight from reset, we might receive an IRQ before we are ready to handle it. [ 2.334737] Unable to handle kernel read from unreadable memory at virtual address 00000000000001e4 [ 2.522601] Call trace: [ 2.525040] regmap_read+0x1c/0x80 [ 2.528434] mt8173_afe_irq_handler+0x40/0xf0 ... [ 2.598921] start_kernel+0x338/0x42c
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 1, 2025Schema & Structured Data for WP & AMP: Does not properly handles HTML tag attribute modificationsCVE-2025-9512 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.50
- What to do
- Update Schema & Structured Data for WP & AMP to 1.50 or newer.
Sep 29, 2025Postie: Does not sanitise and escape some of its settingsCVE-2024-5200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Postie
- Fixed in
- 1.9.71
- What to do
- Update Postie to 1.9.71 or newer.
Sep 24, 2025When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.CVE-2025-8869 · Other software · Python Packaging Authority · reported by cna@python.orgMedium 5.9
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
- Product
- pip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commail.python.org
Sep 23, 2025SureForms: Does not sanitise and escape some parametersCVE-2025-8282 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.
- Product
- SureForms
- Fixed in
- 1.9.1
- What to do
- Update SureForms to 1.9.1 or newer.
Sep 22, 2025Admin and Site Enhancements (ASE): Does not sanitise SVG filesCVE-2025-9487 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
- Product
- Admin and Site Enhancements (ASE)
- Fixed in
- 7.9.8
- What to do
- Update Admin and Site Enhancements (ASE) to 7.9.8 or newer.
Sep 22, 2025Etsy Shop: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9115 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Etsy Shop
- Fixed in
- 3.0.7
- What to do
- Update Etsy Shop to 3.0.7 or newer.
Sep 19, 2025The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connecCVE-2025-10457 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.3
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not conCVE-2023-53437 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 18, 2025In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the daCVE-2022-50394 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 18, 2025Password Reset with Code for WordPress REST API: Does not use cryptographically sound algorithms to generate OTP codesCVE-2025-5305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.
- Product
- Password Reset with Code for WordPress REST API
- Fixed in
- 0.0.17
- What to do
- Update Password Reset with Code for WordPress REST API to 0.0.17 or newer.
Sep 17, 2025CISA Thorium does not validate TLS certificates when connecting to Elasticsearch.CVE-2025-35434 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025CISA Thorium does not properly invalidate previously used tokens when resetting passwords.CVE-2025-35433 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025CISA Thorium does not rate limit requests to send account verification email messages.CVE-2025-35432 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025CISA Thorium does not escape user controlled strings used in LDAP queries.CVE-2025-35431 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'.CVE-2025-35430 · Other software · CISA · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
- Product
- Thorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messageCVE-2025-59476 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Sep 17, 2025Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers withCVE-2025-59475 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Sep 17, 2025Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking OverCVE-2025-59474 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Sep 16, 2025Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not CVE-2025-43805 · Other software · Liferay · reported by security@liferay.comMedium 6.9
Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process.CVE-2025-59270 · Other software · pspete · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process. An unauthenticated attacker in a 'Man-in-the-Middle' position could manipulate the TLS handshake and downgrade TLS to a deprecated protocol. Fixed in 7.0.209.
- Product
- psPAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846_init_controls() hi846_init_controls doesn't clean the aCVE-2023-53300 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846_init_controls() hi846_init_controls doesn't clean the allocated ctrl_hdlr in case there is a failure, which causes memleak. Add v4l2_ctrl_handler_free to free the resource properly.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.