Archive
11 February 2025
Vulnerabilities first published on this day (UTC), newest first.
15 results · Clear filters · Feed
-
Critical 9.8
WPGateway <= 3.5 - Unauthenticated Privilege Escalation
The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.
-
Critical 9.8CVE-2025-1044 EPSS 75%
Logsign Unified SecOps Platform Authentication Bypass Vulnerability
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability…
-
Critical 9.0
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
-
Critical 9.1CVE-2025-24434 EPSS 17%
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security meas…
-
Critical 9.3
Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).
A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client.
-
Critical 9.4
Concorde not removing authentication tokens after logging out
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly lo…
-
Critical 9.1
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows…
-
Critical 9.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker t…
-
Critical 9.1CVE-2024-47908 EPSS 22%
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker…
-
Critical 9.8
CVE-2024-12366
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.
-
Critical 9.8
Weak Hard-coded Credentials
The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that…
-
Critical 9.8
WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authen…
-
Critical 9.8
WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for un…
-
Critical 9.8
Quanxun School Affairs System - Exposure of Sensitive Information
School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials.
-
Critical 9.8
Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, whic…