Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-05-01 | CVE-2025-2168 | Cross-Site Request Forgery (CSRF) vulnerability in Bdthemes Ultimate Store KIT The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. | 4.3 |
| 2025-05-01 | CVE-2025-4148 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. | 9.8 |
| 2025-05-01 | CVE-2025-4149 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability was found in Netgear EX6200 1.0.3.94. | 9.8 |
| 2025-05-01 | CVE-2025-2816 | Missing Authorization vulnerability in A3Rev Page View Count The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. | 8.1 |
| 2025-05-01 | CVE-2025-4146 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. | 9.8 |
| 2025-05-01 | CVE-2025-4147 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. | 9.8 |
| 2025-05-01 | CVE-2025-4143 | Open Redirect vulnerability in Cloudflare Workers-Oauth-Provider 0.0.5 The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-provider/pull/26 Impact: Under certain circumstances (see below), if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a malicious web site, then attacker could potentially steal the victim's credentials to the same OAuth server and subsequently impersonate them. In order for the attack to be possible, the OAuth server's authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth client that the victim has authorized previously. | 6.1 |
| 2025-05-01 | CVE-2025-4144 | Unspecified vulnerability in Cloudflare Workers-Oauth-Provider 0.0.5 PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . | 9.8 |
| 2025-05-01 | CVE-2025-4145 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. | 9.8 |
| 2025-04-30 | CVE-2025-4142 | Classic Buffer Overflow vulnerability in Netgear Ex6200 Firmware 1.0.3.94 A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. | 9.8 |