Explore CVE records

UnscoredPublished 12 Mar 2025, 16:42 WIB

CVE-2025-21848

nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:04 WIB

Official record

UnscoredPublished 12 Mar 2025, 16:42 WIB

CVE-2025-21847

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

UnscoredPublished 12 Mar 2025, 16:42 WIB

CVE-2025-21846

acct: perform last write from workqueue

In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:04 WIB

Official record

UnscoredPublished 12 Mar 2025, 16:42 WIB

CVE-2025-21845

mtd: spi-nor: sst: Fix SST write failure

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea ("mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`")' introduced a bug where only one byte of data is written, regardless of the number of bytes passed to sst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated01 Jun 2026, 23:05 WIB

Official record

HighPublished 12 Mar 2025, 16:42 WIB

CVE-2025-21844

smb: client: Add check for next_buffer in receive_encrypted_standard()

In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:04 WIB

Official record

HighPublished 12 Mar 2025, 16:41 WIB

CVE-2024-58089

btrfs: fix double accounting race when btrfs_run_delalloc_range() failed

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When running btrfs with block size (4K) smaller than page size (64K, aarch64), there is a very high chance to crash the kernel at generic/750, with the following messages:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:47 WIB

Official record

UnscoredPublished 12 Mar 2025, 16:41 WIB

CVE-2024-58088

bpf: Fix deadlock when freeing cgroup storage

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for fentry/fexit programs attaching on bpf_task_storage helper…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:03 WIB

Official record

CritPublished 12 Mar 2025, 16:22 WIB

CVE-2024-13446

Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover

The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the plugin not properly validating a user's identity prior to (1) performing a social auto-login or (2) updating their profile details (e.g. password). This makes it p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

MedPublished 12 Mar 2025, 15:21 WIB

CVE-2024-13430

Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possible for authenticate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

CritPublished 12 Mar 2025, 14:28 WIB

CVE-2024-58087

ksmbd: fix racy issue from session lookup and expire

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:47 WIB

Official record

MedPublished 12 Mar 2025, 14:00 WIB

CVE-2024-12589

Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdown timer in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:15 WIB

Official record

MedPublished 12 Mar 2025, 14:00 WIB

CVE-2024-13838

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'call_webhook' method of the Automator_Send_Webhook class This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record

MedPublished 12 Mar 2025, 12:22 WIB

CVE-2024-13498

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unaut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

LowPublished 12 Mar 2025, 11:43 WIB

CVE-2025-24912

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Excerpt language: en.

CVSS3.7v3.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 20:21 WIB

Official record

MedPublished 12 Mar 2025, 10:21 WIB

CVE-2025-2077

Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting

The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

MedPublished 12 Mar 2025, 10:21 WIB

CVE-2025-2078

BlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

MedPublished 12 Mar 2025, 10:21 WIB

CVE-2025-1508

WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download all of a site's post c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:00 WIB

Official record

MedPublished 12 Mar 2025, 10:21 WIB

CVE-2025-2076

binlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 12 Mar 2025, 10:21 WIB

CVE-2025-2205

GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

MedPublished 12 Mar 2025, 08:00 WIB

CVE-2025-2220

Odyssey CMS reCAPTCHA odyssey_contact_form.php key management

A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_contact_form/odyssey_contact_form.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key management error. Local a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 21:56 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage