Latest Cybersecurity Vulnerabilities - Real-Time Updates

Latest 30 CVEs - Real-Time Cyber Threats

Cyber threats are constantly evolving, making real-time vulnerability tracking essential. Below are the 30 most recently disclosed Common Vulnerabilities and Exposures (CVEs), providing key details such as affected vendors, impact levels, and risk scores.

Each CVE entry includes a brief summary and a direct link to its full details, enabling cybersecurity professionals, system administrators, and developers to quickly assess and mitigate potential security risks.

CVE-2023-52971 Security Flaw Alert
MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.
Score: 4.9_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 23:15 UTC (only 2 hours ago)
CVE-2023-52970 Risk & Patch Advisory
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
Score: 4.9_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 23:15 UTC (only 2 hours ago)
CVE-2023-52969 Risk & Patch Advisory
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty backtrace log. This may be related to make_aggr_tables_info and optimize_stage2.
Score: 4.9_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 23:15 UTC (only 2 hours ago)
CVE-2023-52968 Risk & Patch Advisory
MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.
Score: 4.9_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 23:15 UTC (only 2 hours ago)
CVE-2025-2112 High-Risk Security Alert
A vulnerability was found in user-xiangpeng yaoqishan up to a47fec4a31cbd13698c592dfdc938c8824dd25e4. It has been declared as critical. Affected by this vulnerability is the function getMediaLisByFilter of the file cn/javaex/yaoqishan/service/media_info/MediaInfoService.java. The manipulation of the argument typeId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not avai...
Score: 6.3_/10 🔥 High Risk
Published on 08 Mar 2025, 22:15 UTC (only 3 hours ago)
CVE-2025-27840 Critical Risk Assessment
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
Score: 6.8_/10 🔥 High Risk
Published on 08 Mar 2025, 20:15 UTC (only 5 hours ago)
CVE-2024-13924 Significant Vulnerability Warning
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Score: 5.3_/10 🚨 Significant Risk
Published on 08 Mar 2025, 13:15 UTC (only 12 hours ago)
CVE-2024-10326 Cybersecurity Threat Advisory
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or reset plugin widgets to their default state (all enabled). NOTE: This vulnerability was partially fixed in version 1.5.3.
Score: 4.3_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 13:15 UTC (only 12 hours ago)
CVE-2025-1664 High-Risk Security Alert
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 12:15 UTC (only 13 hours ago)
CVE-2024-13675 Active Exploit Warning
The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 12:15 UTC (only 13 hours ago)
CVE-2024-13649 Active Exploit Warning
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 12:15 UTC (only 13 hours ago)
CVE-2024-11640 Severe Vulnerability Alert
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remo...
Score: 8.8_/10 ☠️ Severe Risk
Published on 08 Mar 2025, 12:15 UTC (only 13 hours ago)
CVE-2025-1783 Active Exploit Warning
The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2025-1325 Active Exploit Warning
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rcl_preview_post' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Score: 6.3_/10 🔥 High Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2025-1324 Critical Risk Assessment
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortcode in all versions up to, and including, 16.26.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2025-1323 Critical Security Advisory
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Score: 7.5_/10 🔥 Very High Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2025-1322 Cybersecurity Threat Advisory
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to.
Score: 4.3_/10 ⚠️ Medium Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2024-13359 Immediate Threat Report
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.1. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make...
Score: 8.1_/10 ☠️ Severe Risk
Published on 08 Mar 2025, 10:15 UTC (only 15 hours ago)
CVE-2025-1287 Critical Risk Assessment
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Score: 6.4_/10 🔥 High Risk
Published on 08 Mar 2025, 09:15 UTC (only 16 hours ago)
CVE-2025-0177 Critical Vulnerability Alert
The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Score: 9.8_/10 ☠️ Critical Risk
Published on 08 Mar 2025, 09:15 UTC (only 16 hours ago)