Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,083 results · page 95 of 302
Dec 24, 2025Google AdSense for Responsive Design – GARD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67632 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSense for Responsive Design – GARD: from n/a through <= 2.23.
- Product
- Google AdSense for Responsive Design – GARD
- Affected
- up to 2.23
- What to do
- Affects up to 2.23. Update Google AdSense for Responsive Design – GARD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025Pretty Google Calendar: Unauthorized access of dataCVE-2025-12898 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings.
- Product
- Pretty Google Calendar
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Pretty Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 18, 2025An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining acCVE-2025-13427 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cMedium 6.9
An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents' knowledge and the ability to trigger their intents, by manipulating initialization parameters or crafting specific API requests. All versions after August 20th, 2025 have been updated to protect from this vulnerability. No user action is required for this.
- Product
- Dialogflow CX Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025WordPress Contact Form 7 PDF, Google Sheet & Database: Unrestricted Upload of File with Dangerous TypeCVE-2025-64231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
- Product
- WordPress Contact Form 7 PDF, Google Sheet & Database
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update WordPress Contact Form 7 PDF, Google Sheet & Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025miniOrange's Google Authenticator: Missing AuthorizationCVE-2025-54745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.
- Product
- miniOrange's Google Authenticator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update miniOrange's Google Authenticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerablCVE-2025-13880 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2025Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML CVE-2025-14766 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Dec 16, 2025Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2025-14765 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Dec 16, 2025VK Google Job Posting Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68070 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS.This issue affects VK Google Job Posting Manager: from n/a through <= 1.2.22.
- Product
- VK Google Job Posting Manager
- Affected
- up to 1.2.22
- What to do
- Affects up to 1.2.22. Update VK Google Job Posting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Google XML Sitemaps: Missing AuthorizationCVE-2025-64632 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22.
- Product
- Google XML Sitemaps
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HCVE-2025-14373 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Dec 12, 2025Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTMLCVE-2025-14372 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.1
Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Dec 12, 2025Google Chromium Out of Bounds Memory Access VulnerabilityCVE-2025-14174 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium
- On CISA’s list since
- Dec 12, 2025 (federal fix deadline Jan 2, 2026)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Dec 11, 2025LS Google Map Router: Stored Cross-Site ScriptingCVE-2025-13850 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LS Google Map Router
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update LS Google Map Router to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code.CVE-2025-36938 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.8
In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 11, 2025In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check.CVE-2025-36937 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow.CVE-2025-36936 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data.CVE-2025-36935 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition.CVE-2025-36934 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.4
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comproject-zero.issues.chromium.org
Dec 11, 2025In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation.CVE-2025-36932 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36931 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36930 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation.CVE-2025-36929 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check.CVE-2025-36928 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36927 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36925 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check.CVE-2025-36924 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8
In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow.CVE-2025-36923 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8
In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free.CVE-2025-36922 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege in the OS Kernel level with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2025-36921 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking.CVE-2025-36919 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation.CVE-2025-36918 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check.CVE-2025-36917 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.5
In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition.CVE-2025-36916 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7
In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In cellular modem, there is a possible denial of service due to a logic error in the code.CVE-2025-36912 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.5
In cellular modem, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy.CVE-2025-36889 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2025-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Widgets for Google Reviews
- Affected
- up to 13.2.1
- What to do
- Affects up to 13.2.1. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 10, 2025A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX.CVE-2025-12952 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.7
A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacker to escalate their privileges from agent-level to project-level, granting them unauthorized access to manage resources in services associated with the project, leading to unexpected costs and resource depletion for the producer project. A fix was applied on the server side to protect from this vulnerability in February 2025. No customer action is required.
- Product
- Dialogflow CX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.CVE-2025-9571 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.7
A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure. The following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+ * 6.11.1+ Users must immediately upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases .
- Product
- Cloud Data Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
- Product
- WPForms Google Sheet Connector
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Google Analytics Events: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
- Product
- WP Google Analytics Events
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025A vulnerability exists in the SecOps SOAR server.CVE-2025-13428 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.6
A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution (RCE) in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containing a malicious setup.py file, which would execute on the server during the installation process, leading to potential server compromise. No customer action is required. All customers have been automatically upgraded to the fixed version: 6.3.64 or higher.
- Product
- Google Cloud SecOps SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition.CVE-2025-48625 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check.CVE-2025-48608 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due toCVE-2025-48606 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In multiple locations, there is a possible permanent denial of service due to resource exhaustion.CVE-2025-48569 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack.CVE-2025-48639 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Dec 8, 2025In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation.CVE-2025-48638 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Dec 8, 2025In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow.CVE-2025-48637 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Dec 8, 2025In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improperCVE-2025-48632 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.