CVEs published March 27, 2025
377 CVEs were published on March 27, 2025: 14 critical, 99 high. Browse them by severity, product and exploitation status.
- Published
- 377
- Critical
- 14
- High
- 99
- Medium
- 217
- Low
- 4
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 99
Most affected products
- Linux
- 124
- LabRedesCefetRJ WeGIA
- 7
- GitLab
- 5
- gnuplot · Red Hat Enterprise Linux
- 5
- AWS tough · tough
- 4
- shinetheme Traveler
- 4
- IBM UrbanCode Deploy · IBM DevOps Deploy
- 3
- JetBrains TeamCity
- 3
- AwesomeTOGI Awesome Event Booking
- 2
- Eli EZ SQL Reports Shortcode Widget and DB Backup
- 2
Critical 14
- CVE-2025-26873WordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerabilityshinetheme Traveler
- CVE-2025-26898WordPress Traveler theme < 3.2.1 - SQL Injection vulnerabilityshinetheme Traveler
- CVE-2023-53006cifs: Fix oops due to uncleared server->smbd_conn in reconnectLinux
- CVE-2025-30367WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-30365SQL Injection in query_geracao_auto.phpLabRedesCefetRJ WeGIA
- CVE-2025-30364WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionarioLabRedesCefetRJ WeGIA
- CVE-2025-30361WeGIA Vulnerable to Broken Authentication - Old Password ValidationLabRedesCefetRJ WeGIA
- CVE-2025-26909WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerabilityJohn Darrel Hide My WP Ghost
- CVE-2025-2516Use of a weak cryptographic key in the signature verification process in WPS OfficeKingsoft WPS Office
- CVE-2025-2857Incorrect handle could lead to sandbox escapesMozilla Firefox
- CVE-2025-2332Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injectionsmackcoders Export All Posts, Products, Orders, Refunds & U…
- CVE-2025-25686semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
- CVE-2025-28138The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg…
- CVE-2025-29306An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
High 99
- CVE-2025-26733WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerabilityshinetheme Traveler
- CVE-2025-26874WordPress MemberSpace plugin <= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerabilityMemberSpace
- CVE-2025-26890WordPress HUSKY plugin <= 1.3.6.4 - Local File Inclusion vulnerabilityRealMag777 HUSKY
- CVE-2025-26956WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerabilityshinetheme Traveler
- CVE-2023-53033netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bitsLinux
- CVE-2023-53028Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"Linux
- CVE-2023-53026RDMA/core: Fix ib block iterator counter overflowLinux
- CVE-2023-53023net: nfc: Fix use-after-free in local_cleanup()Linux
- CVE-2023-53021net/sched: sch_taprio: fix possible use-after-freeLinux
- CVE-2023-53009drm/amdkfd: Add sync after creating vram boLinux
- CVE-2023-53003EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_infoLinux
- CVE-2023-52999net: fix UaF in netns ops registration error pathLinux
- CVE-2023-52991net: fix NULL pointer in skb_segment_listLinux
- CVE-2023-52988ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()Linux
- CVE-2023-52987ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()Linux
- CVE-2023-52983block, bfq: fix uaf for bfqq in bic_set_bfqq()Linux
- CVE-2023-52981drm/i915: Fix request ref counting during error capture & debugfs dumpLinux
- CVE-2023-52975scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddressLinux
- CVE-2023-52974scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddressLinux
- CVE-2023-52973vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAFLinux
- CVE-2022-49761btrfs: always report error in run_one_delayed_ref()Linux
- CVE-2022-49760mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()Linux
- CVE-2022-49755usb: gadget: f_fs: Prevent race during ffs_ep0_queue_waitLinux
- CVE-2022-49754Bluetooth: Fix a buffer overflow in mgmt_mesh_add()Linux
- CVE-2022-49753dmaengine: Fix double increment of client_count in dma_chan_get()Linux
Show all 99 entriesShow fewer entries
- CVE-2022-49743ovl: Use "buf" flexible array for memcpy() destinationLinux
- CVE-2022-49740wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds readsLinux
- CVE-2022-49739gfs2: Always check inode size of inline inodesLinux
- CVE-2022-49738f2fs: fix to do sanity check on i_extra_isize in is_alive()Linux
- CVE-2023-52935mm/khugepaged: fix ->anon_vma raceLinux
- CVE-2023-52934mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookupsLinux
- CVE-2023-52931drm/i915: Avoid potential vm use-after-freeLinux
- CVE-2023-52930drm/i915: Fix potential bit_17 double-freeLinux
- CVE-2021-4454can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivateLinux
- CVE-2024-12905An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path…tar-fs
- CVE-2025-22783WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.03 - SQL Injection vulnerabilitySEO Squirrly SEO Plugin by Squirrly SEO
- CVE-2025-22628WordPress Filled In Plugin <= 1.9.2 - CSRF to Stored XSS vulnerabilityFolioVision Filled In
- CVE-2025-30067Apache Kylin: The remote code execution via jdbc urlApache Software Foundation org.apache.kylin:kylin-datasourc…
- CVE-2025-22652WordPress Payment Forms for Paystack plugin <= 4.0.1 - SQL Injection vulnerabilitykendysond Payment Forms for Paystack
- CVE-2025-22658WordPress Listings for Appfolio plugin <= 1.2.0 - CSRF to Stored XSS vulnerabilityListings for Appfolio
- CVE-2025-21890idpf: fix checksums set in idpf_rx_rsc()Linux
- CVE-2025-21889perf/core: Add RCU read lock protection to perf_iterate_ctx()Linux
- CVE-2025-21887ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_upLinux
- CVE-2025-21885RDMA/bnxt_re: Fix the page details for the srq created by kernel consumersLinux
- CVE-2025-21884net: better track kernel sockets lifetimeLinux
- CVE-2025-21882net/mlx5: Fix vport QoS cleanup on errorLinux
- CVE-2025-21879btrfs: fix use-after-free on inode when scanning root during em shrinkingLinux
- CVE-2025-21876iommu/vt-d: Fix suspicious RCU usageLinux
- CVE-2025-21875mptcp: always handle address removal under msk socket lockLinux
- CVE-2024-58091drm/fbdev-dma: Add shadow buffering for deferred I/OLinux
- CVE-2025-30358Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacksmesop-dev mesop · mesop
- CVE-2025-25086WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityWPDeveloper Secret Meta
- CVE-2025-25100WordPress Cazamba plugin <= 1.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityvictoracano Cazamba
- CVE-2025-21870ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiersLinux
- CVE-2025-21868net: allow small head cache usage with large MAX_SKB_FRAGS valuesLinux
- CVE-2025-21867bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()Linux
- CVE-2025-0811Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-2242Incorrect Authorization in GitLabGitLab
- CVE-2025-2255Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-30921WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerabilityTribulant Software Newsletters
- CVE-2025-30919WordPress Store Locator Widget plugin <= 2025r2 - CSRF to Stored XSS vulnerabilityStore Locator Widgets Store Locator Widget
- CVE-2025-30895WordPress WpEvently Plugin <= 4.2.9 - PHP Object Injection vulnerabilitymagepeopleteam WpEvently
- CVE-2025-30891WordPress WpTravelly Plugin <= 1.8.7 - Local File Inclusion vulnerabilitymagepeopleteam WpTravelly
- CVE-2025-30890WordPress Login Widget for Ultimate Member plugin <= 1.1.2 - Local File Inclusion vulnerabilitySuitePlugins Login Widget for Ultimate Member
- CVE-2025-30879WordPress MC Woocommerce Wishlist plugin <= 1.8.9 - SQL Injection vulnerabilityMoreconvert Team MC Woocommerce Wishlist
- CVE-2025-30871WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerabilityWP Travel Engine
- CVE-2025-30868WordPress Team Manager plugin <= 2.1.23 - Local File Inclusion VulnerabilityMaidul Team Manager
- CVE-2025-30857WordPress Currency Switcher for WooCommerce plugin <= 0.0.7 - CSRF to Stored XSS vulnerabilityPressMaximum Currency Switcher for WooCommerce
- CVE-2025-30846WordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerabilityjetmonsters Restaurant Menu by MotoPress
- CVE-2025-30845WordPress The Pack Elementor addons plugin <= 2.1.1 - Local File Inclusion vulnerabilitywebangon The Pack Elementor addons
- CVE-2025-30843WordPress bizcalendar-web plugin <= 1.1.0.34 - SQL Injection vulnerabilitysetriosoft bizcalendar-web
- CVE-2025-30831WordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerabilitythemifyme Themify Event Post
- CVE-2025-30829WordPress WPCafe plugin <= 2.2.31 - Local File Inclusion vulnerabilityArraytics WPCafe
- CVE-2025-30820WordPress WishSuite plugin <= 1.4.4 - Local File Inclusion VulnerabilityHT Plugins WishSuite
- CVE-2025-30819WordPress Simple Giveaways plugin <= 2.48.1 - SQL Injection vulnerabilityIgor Benic Simple Giveaways
- CVE-2025-30814WordPress The Post Grid plugin <= 7.7.17 - Local File Inclusion vulnerabilityRadiusTheme The Post Grid
- CVE-2025-30810WordPress Lead Form Data Collection to CRM plugin <= 3.0.1 - SQL Injection vulnerabilitySmackcoders Inc., Lead Form Data Collection to CRM
- CVE-2025-30806WordPress Vimeotheque plugin <= 2.3.4.2 - SQL Injection vulnerabilityConstantin Boiangiu Vimeotheque
- CVE-2025-30791WordPress Cart tracking for WooCommerce plugin <= 1.0.16 - SQL Injection Vulnerabilitywpdever Cart tracking for WooCommerce
- CVE-2025-30788WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.25.08 - CSRF to SQL Injection vulnerabilityEli EZ SQL Reports Shortcode Widget and DB Backup
- CVE-2025-30787WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.25.08 - CSRF to Stored XSS vulnerabilityEli EZ SQL Reports Shortcode Widget and DB Backup
- CVE-2025-30785WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion VulnerabilityWP Shuffle Subscribe to Download Lite
- CVE-2025-30784WordPress WP Subscription Forms plugin <= 1.2.3 - SQL Injection VulnerabilityWP Shuffle WP Subscription Forms
- CVE-2025-30783WordPress WP Google Review Slider plugin <= 16.0 - CSRF to SQL Injection vulnerabilityjgwhite33 WP Google Review Slider
- CVE-2025-30775WordPress WPGuppy plugin <= 1.1.3 - SQL Injection vulnerabilityAmentoTech Private Limited WPGuppy
- CVE-2025-30773WordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection VulnerabilityCozmoslabs TranslatePress
- CVE-2025-30769WordPress WIP WooCarousel Lite plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityalexvtn WIP WooCarousel Lite
- CVE-2025-30772WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityWPClever WPC Smart Upsell Funnel for WooCommerce
- CVE-2025-30765WordPress FlexStock plugin <= 3.13.1 - SQL Injection VulnerabilityWPPOOL FlexStock
- CVE-2024-45356Xiaomi phone framework has unauthorized access vulnerabilityXiaomi phone framework has unauthorized access vulnerability
- CVE-2024-45352Xiaomi smarthome application Webview has code execution vulnerabilityXiaomi smarthome application
- CVE-2025-30355Synapse vulnerable to federation denial of service via malformed eventselement-hq synapse · matrix-synapse
- CVE-2024-55073A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit…
- CVE-2025-28135TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
- CVE-2025-29072An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the…github.com/NethermindEth/juno
- CVE-2025-29484An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to…
- CVE-2025-29487An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to…
- CVE-2025-30093HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to…
- CVE-2025-30232A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.Exim
Medium, low and unrated 264
- CVE-2025-31092WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityNinja Team Click to Chat – WP Support All-in-One Floating W…
- CVE-2025-2878Kentico CMS Additional Database Installation Wizard install.aspx cross site scriptingKentico CMS
- CVE-2025-31101WordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityVault Group Pty VaultRE Contact Form
- CVE-2025-2888Improper timestamp caching during snapshot rollback in toughAWS tough · tough
- CVE-2025-2887Failure to detect delegated target rollback in toughAWS tough · tough
- CVE-2025-2886Terminating targets role delegations are not respected in toughAWS tough · tough
- CVE-2025-2885Root metadata version not validated in toughAWS tough · tough
- CVE-2025-31031WordPress Job Colors for WP Job Manager plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityAstoundify Job Colors for WP Job Manager
- CVE-2025-22739WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2025-22740WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerabilityAutomattic Sensei LMS
- CVE-2023-38272IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-37405IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-53032netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.Linux
- CVE-2023-53031powerpc/imc-pmu: Fix use of mutex in IRQs disabled sectionLinux
- CVE-2023-53030octeontx2-pf: Avoid use of GFP_KERNEL in atomic contextLinux
- CVE-2023-53029octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rtLinux
- CVE-2023-53024bpf: Fix pointer-leak due to insufficient speculative store bypass mitigationLinux
- CVE-2023-53022net: enetc: avoid deadlock in enetc_tx_onestep_tstamp()Linux
- CVE-2023-53020l2tp: close all race conditions in l2tp_tunnel_register()Linux
- CVE-2023-53019net: mdio: validate parameter addr in mdiobus_get_phy()Linux
- CVE-2023-53018Bluetooth: hci_conn: Fix memory leaksLinux
- CVE-2023-53017Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()Linux
- CVE-2023-53016Bluetooth: Fix possible deadlock in rfcomm_sk_state_changeLinux
- CVE-2023-53015HID: betop: check shape of output reportsLinux
- CVE-2023-53014dmaengine: tegra: Fix memory leak in terminate_all()Linux
Show all 264 entriesShow fewer entries
- CVE-2023-53013ptdma: pt_core_execute_cmd() should use spinlockLinux
- CVE-2023-53012thermal: core: call put_device() only after device_register() failsLinux
- CVE-2023-53011net: stmmac: enable all safety features by defaultLinux
- CVE-2023-53010bnxt: Do not read past the end of test namesLinux
- CVE-2023-53008cifs: fix potential memory leaks in session setupLinux
- CVE-2023-53007tracing: Make sure trace_printk() can output as soon as it can be usedLinux
- CVE-2023-53005trace_events_hist: add check for return value of 'create_hist_field'Linux
- CVE-2023-53004ovl: fix tmpfile leakLinux
- CVE-2023-53002drm/i915: Fix a memory leak with reused mmap_offsetLinux
- CVE-2023-53000netlink: prevent potential spectre v1 gadgetsLinux
- CVE-2023-52998net: fec: Use page_pool_put_full_page when freeing rx buffersLinux
- CVE-2023-52997ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()Linux
- CVE-2023-52996ipv4: prevent potential spectre v1 gadget in fib_metrics_match()Linux
- CVE-2023-52995riscv/kprobe: Fix instruction simulation of JALRLinux
- CVE-2023-52994acpi: Fix suspend with Xen PVLinux
- CVE-2023-52993x86/i8259: Mark legacy PIC interrupts with IRQ_LEVELLinux
- CVE-2023-52992bpf: Skip task with pid=1 in send_signal_common()Linux
- CVE-2023-52989firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP regionLinux
- CVE-2023-52986bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listenerLinux
- CVE-2023-52985arm64: dts: imx8mm-verdin: Do not power down eth-phyLinux
- CVE-2023-52984net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devicesLinux
- CVE-2023-52982fscache: Use wait_on_bit() to wait for the freeing of relinquished volumeLinux
- CVE-2023-52980block: ublk: extending queue_size to fix overflowLinux
- CVE-2023-52978riscv: kprobe: Fixup kernel panic when probing an illegal positionLinux
- CVE-2023-52977net: openvswitch: fix flow memory leak in ovs_flow_cmd_newLinux
- CVE-2023-52976efi: fix potential NULL deref in efi_mem_reserve_persistentLinux
- CVE-2022-49759VMCI: Use threaded irqs instead of taskletsLinux
- CVE-2022-49758reset: uniphier-glue: Fix possible null-ptr-derefLinux
- CVE-2022-49757EDAC/highbank: Fix memory leak in highbank_mc_probe()Linux
- CVE-2022-49756phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe()Linux
- CVE-2022-49752device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()Linux
- CVE-2022-49751w1: fix WARNING after calling w1_process()Linux
- CVE-2022-49750cpufreq: CPPC: Add u64 casts to avoid overflowingLinux
- CVE-2022-49749i2c: designware: use casting of u64 in clock multiplication to avoid overflowLinux
- CVE-2022-49748perf/x86/amd: fix potential integer overflow on shift of a intLinux
- CVE-2022-49747erofs/zmap.c: Fix incorrect offset calculationLinux
- CVE-2022-49746dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_initLinux
- CVE-2022-49745fpga: m10bmc-sec: Fix probe rollbackLinux
- CVE-2022-49744mm/uffd: fix pte marker when fork() without fork eventLinux
- CVE-2022-49742f2fs: initialize locks earlier in f2fs_fill_super()Linux
- CVE-2022-49741fbdev: smscufx: fix error handling code in ufx_usb_probeLinux
- CVE-2023-52942cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()Linux
- CVE-2023-52941can: isotp: split tx timer into transmission and timeoutLinux
- CVE-2023-52940mm: multi-gen LRU: fix crash during cgroup migrationLinux
- CVE-2023-52939mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()Linux
- CVE-2023-52938usb: typec: ucsi: Don't attempt to resume the ports before they existLinux
- CVE-2023-52937HV: hv_balloon: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-52936kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-52933Squashfs: fix handling and sanity checking of xattr_ids countLinux
- CVE-2023-52932mm/swapfile: add cond_resched() in get_swap_pages()Linux
- CVE-2023-52929nvmem: core: fix cleanup after dev_set_name()Linux
- CVE-2023-52928bpf: Skip invalid kfunc call in backtrack_insnLinux
- CVE-2025-30366WeGIA vulnerable to Stored XSS in personalizacao.phpLabRedesCefetRJ WeGIA
- CVE-2025-30363WeGIA vulnerable to Stored XSS in documentos_funcionario.php parameter dados_addInfoLabRedesCefetRJ WeGIA
- CVE-2025-30362WeGIA vulnerable to Stored XSS in documentos_funcionario.php parameter idLabRedesCefetRJ WeGIA
- CVE-2025-26762WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
- CVE-2025-22278WordPress Whitish Lite theme <= 2.1.13 - Stored Cross Site Scripting (XSS) vulnerabilityyudleethemes Whitish Lite
- CVE-2025-22496WordPress Notif Bell Plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityMarMar8x Notif Bell
- CVE-2025-22497WordPress Simple Google Calendar Outlook Events Block Widget plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilitybramwaas Simple Google Calendar Outlook Events Block Widget
- CVE-2025-2855elunez eladmin upload checkFile deserializationelunez eladmin
- CVE-2025-22629WordPress iNET Webkit Plugin <= 1.2.2 - Broken Access Control vulnerabilityiNET Webkit
- CVE-2025-22634WordPress Easy Booked Plugin <= 2.4.5 - Cross Site Request Forgery (CSRF) vulnerabilityMD Abu Jubayer Hossain Easy Booked – Appointment Booking an…
- CVE-2025-22637WordPress Print PDF Generator and Publisher plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityverkkovaraani Print PDF Generator and Publisher
- CVE-2025-22638WordPress Product Table For WooCommerce Plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityacowebs Product Table For WooCommerce
- CVE-2025-22640WordPress Paytm Payment Donation Plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerabilityintegrationdevpaytm Paytm Payment Donation
- CVE-2025-22644WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & Wo…
- CVE-2025-31181Gnuplot: gnuplot segmentation fault on x11_graphicsgnuplot · Red Hat Enterprise Linux
- CVE-2025-31180Gnuplot: gnuplot segmentation fault on canvas_textgnuplot · Red Hat Enterprise Linux
- CVE-2025-31179Gnuplot: gnuplot segmentation fault on xstrftimegnuplot · Red Hat Enterprise Linux
- CVE-2025-22646WordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilitySyed Balkhi aThemes Addons for Elementor
- CVE-2025-22647WordPress AIO Performance Profiler plugin <= 1.2 - Broken Access Control vulnerabilitySmackcoders Inc., AIO Performance Profiler, Monitor, Optimi…
- CVE-2025-31178Gnuplot: gnuplot segmentation fault on getannotatestringgnuplot · Red Hat Enterprise Linux
- CVE-2025-22648WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityPlugin Devs Blog, Posts and Category Filter for Elementor
- CVE-2025-31176Gnuplot: gnuplot segmentation fault on plot3d_pointsgnuplot · Red Hat Enterprise Linux
- CVE-2024-48944Apache Kylin: SSRF vulnerability in the diagnosis apiApache Software Foundation org.apache.kylin:kylin-ops-serve…
- CVE-2025-22649WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerabilityweDevs WP Project Manager
- CVE-2025-22659WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerabilityOrbit Fox by ThemeIsle
- CVE-2025-21892RDMA/mlx5: Fix the recovery flow of the UMR QPLinux
- CVE-2025-21891ipvlan: ensure network headers are in skb linear partLinux
- CVE-2025-21888RDMA/mlx5: Fix a WARN during dereg_mr for DM typeLinux
- CVE-2025-21886RDMA/mlx5: Fix implicit ODP hang on parent deregistrationLinux
- CVE-2025-21883ice: Fix deinitializing VF in error pathLinux
- CVE-2025-21881uprobes: Reject the shared zeropage in uprobe_write_opcode()Linux
- CVE-2025-21880drm/xe/userptr: fix EFAULT handlingLinux
- CVE-2025-21878i2c: npcm: disable interrupt enable bit before devm_request_irqLinux
- CVE-2025-21877usbnet: gl620a: fix endpoint checking in genelink_bind()Linux
- CVE-2025-21874dm-integrity: Avoid divide by zero in table status in Inline modeLinux
- CVE-2025-21873scsi: ufs: core: bsg: Fix crash when arpmb command failsLinux
- CVE-2025-21872efi: Don't map the entire mokvar table to determine its sizeLinux
- CVE-2024-58090sched/core: Prevent rescheduling when interrupts are disabledLinux
- CVE-2025-30221Pitchfork HTTP Request/Response Splitting vulnerabilityShopify pitchfork · pitchfork
- CVE-2025-1998IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy information disclosureIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2025-1997IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injectionIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-56469IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy missing authenticationIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2025-2854code-projects Payroll Management System update_employee.php sql injectioncode-projects Payroll Management System
- CVE-2025-22660WordPress Include Mastodon Feed plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityWolfgang Include Mastodon Feed
- CVE-2025-22665WordPress RapidLoad plugin <= 2.4.4 - Broken Access Control vulnerabilityShakeeb Sadikeen RapidLoad
- CVE-2025-22667WordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access Control vulnerabilityCreative Werk Designs Export Order, Product, Customer & Cou…
- CVE-2025-22668WordPress Awesome Event Booking plugin <= 2.7.2 - Broken Access Control vulnerabilityAwesomeTOGI Awesome Event Booking
- CVE-2025-22669WordPress Awesome Event Booking plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityAwesomeTOGI Awesome Event Booking
- CVE-2025-22670WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.7.2 - CSRF to Settings Change vulnerabilitye4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2025-22671WordPress Disable Elementor Editor Translation plugin <= 1.0.2 - Broken Access Control vulnerabilityLeap13 Disable Elementor Editor Translation
- CVE-2025-22673WordPress EAN Barcode Generator <= 5.3.5 - Broken Access Control vulnerabilityWPFactory EAN for WooCommerce
- CVE-2025-22672WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.2 - Server Side Request Forgery (SSRF) vulnerabilitySuitePlugins Video & Photo Gallery for Ultimate Member
- CVE-2025-22770WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerabilityEnvoThemes Envo Multipurpose
- CVE-2025-27793Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]vega · vega-functions
- CVE-2025-22816WordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilitycodetrendy Power Mag
- CVE-2025-2867Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2025-26731WordPress ARPrice plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerabilityreputeinfosystems ARPrice
- CVE-2025-2852SourceCodester Food Ordering Management System view_menu.php sql injectionSourceCodester Food Ordering Management System
- CVE-2025-26732WordPress StoreBiz plugin <= 1.0.32 - Cross Site Scripting (XSS) vulnerabilityburgersoftware StoreBiz
- CVE-2025-26734WordPress Hester plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityperegrinethemes Hester
- CVE-2025-26736WordPress MorningTime Lite theme <= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerabilityvictortihai MorningTime Lite
- CVE-2025-26737WordPress City Store theme <= 1.4.5 - Cross Site Scripting (XSS) vulnerabilityyudleethemes City Store
- CVE-2025-26738WordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerabilityGraham Quick Interest Slider
- CVE-2025-26619Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`vega · vega-functions
- CVE-2025-21871tee: optee: Fix supplicant wait loopLinux
- CVE-2025-21869powerpc/code-patching: Disable KASAN report during patching via temporary mmLinux
- CVE-2025-2849UPX p_lx_elf.cpp un_DT_INIT heap-based overflowUPX
- CVE-2025-2847Codezips Gym Management System over_month.php sql injectionCodezips Gym Management System
- CVE-2024-9773Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabGitLab
- CVE-2025-2846SourceCodester Online Eyewear Shop Registration Users.php registration sql injectionSourceCodester Online Eyewear Shop
- CVE-2025-31141In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageJetBrains TeamCity
- CVE-2025-31140In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageJetBrains TeamCity
- CVE-2025-31139In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logJetBrains TeamCity
- CVE-2025-30925WordPress The Pack Elementor addons plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilitywebangon The Pack Elementor addons
- CVE-2025-30923WordPress Gift Message for WooCommerce plugin <= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerabilitypowerfulwp Gift Message for WooCommerce
- CVE-2025-30922WordPress Simplebooklet PDF Viewer and Embedder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilitySimplebooklet PDF Viewer and Embedder
- CVE-2025-30920WordPress WP Posts Carousel plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityteastudio.pl WP Posts Carousel
- CVE-2025-30918WordPress Structured Content plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityGordon Böhme Structured Content
- CVE-2025-30914WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerabilityRoxnor Metform
- CVE-2025-30912WordPress Float menu plugin <= 6.1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityWow-Company Float menu
- CVE-2025-30909WordPress Conversios.io plugin <= 7.2.3 - Broken Access Control vulnerabilityConversios.io
- CVE-2025-30907WordPress SecuPress Free plugin <= 2.2.5.3 - Cross Site Scripting (XSS) vulnerabilitySecuPress Free
- CVE-2025-30904WordPress Chartify plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilityAys Pro Chartify
- CVE-2025-30903WordPress SyntaxHighlighter Evolved plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerabilityAlex Mills SyntaxHighlighter Evolved
- CVE-2025-30900WordPress Zoho Billing – Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) vulnerabilityZoho Subscriptions Zoho Billing – Embed Payment Form
- CVE-2025-30899WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerabilitywpeverest User Registration
- CVE-2025-30898WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityMahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس
- CVE-2025-30897WordPress Analytify plugin <= 5.5.1 - Settings Change vulnerabilityAdnan Analytify
- CVE-2025-30896WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerabilityweDevs WP ERP
- CVE-2025-30894WordPress WP Fast Total Search plugin <= 1.79.262 - Broken Access Control vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2025-30893WordPress LeadConnector plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityLeadConnector
- CVE-2025-30888WordPress Custom Fields Account Registration For Woocommerce Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilitysilverplugins217 Custom Fields Account Registration For Woo…
- CVE-2025-30887WordPress WpEvently Plugin <= 4.2.9 - Broken Access Control vulnerabilitymagepeopleteam WpEvently
- CVE-2025-30885WordPress Bit Form plugin <= 2.18.0 - Open Redirection vulnerabilityBit Apps Bit Form
- CVE-2025-30884WordPress Bit Integrations plugin <= 2.4.10 - Open Redirection vulnerabilityBit Apps Bit Integrations
- CVE-2025-30883WordPress Trust.Reviews plugin <= 2.3 - Broken Access Control vulnerabilityrichplugins Trust.Reviews
- CVE-2025-30881WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerabilitythemehunk Big Store
- CVE-2025-30877WordPress Quiz Cat plugin <= 3.0.8 - Broken Access Control vulnerabilityfatcatapps Quiz Cat
- CVE-2025-30874WordPress Specific Content For Mobile plugin <= 0.5.3 - Broken Access Control vulnerabilityJose Mortellaro Specific Content For Mobile
- CVE-2025-30873WordPress Greenshift plugin <= 11.0.2 - Cross Site Scripting (XSS) vulnerabilitywpsoul Greenshift
- CVE-2025-30872WordPress Product Author for WooCommerce plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityNitin Prakash Product Author for WooCommerce
- CVE-2025-30867WordPress SearchIQ plugin <= 4.7 - Cross Site Scripting (XSS) vulnerabilitySearchIQ
- CVE-2025-30866WordPress Terms & Conditions Per Product plugin <= 1.2.15 - Broken Access Control VulnerabilityGiannis Kipouros Terms & Conditions Per Product
- CVE-2025-30865WordPress 3DPrint Lite plugin <= 2.1.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityfuzzoid 3DPrint Lite
- CVE-2025-30864WordPress Exchange Rates plugin <= 1.2.2 - Broken Access Control vulnerabilityfalselight Exchange Rates
- CVE-2025-30863WordPress Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.0.9 - Cross Site Request Forgery…CRM Perks Integration for Google Sheets and Contact Form 7,…
- CVE-2025-30862WordPress reCAPTCHA for all plugin <= 2.22 - Cross Site Request Forgery (CSRF) vulnerabilitysminozzi reCAPTCHA for all
- CVE-2025-30861WordPress Five Star Restaurant Reservations plugin <= 2.6.29 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Reservations
- CVE-2025-30860WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.2 - Cross Site Scripting (XSS) VulnerabilityJory Hogeveen Off-Canvas Sidebars & Menus
- CVE-2025-30859WordPress AliNext plugin <= 3.5.1 - Open Redirection vulnerabilityguru-aliexpress AliNext
- CVE-2025-30856WordPress Custom Field For WP Job Manager plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitytheme funda Custom Field For WP Job Manager
- CVE-2025-30854WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityVollstart Serial Codes Generator and Validator with WooComm…
- CVE-2025-30851WordPress Tickera plugin <= 3.5.5.2 - Broken Access Control vulnerabilityTickera
- CVE-2025-30850WordPress Dr. Flex plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerabilitysfaerber Dr. Flex
- CVE-2025-30847WordPress Novelist plugin <= 1.2.3 - Cross Site Scripting (XSS) VulnerabilityAshley Novelist
- CVE-2025-30842WordPress Christmas Panda plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) vulnerabilitypixolette Christmas Panda
- CVE-2025-30839WordPress Taxi Booking Manager for WooCommerce plugin <= 1.2.1 - Broken Access Control vulnerabilitymagepeopleteam Taxi Booking Manager for WooCommerce
- CVE-2025-30838WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityCozyThemes Cozy Blocks
- CVE-2025-30836WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerabilityLatePoint
- CVE-2025-30833WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerabilitySoft8Soft Verge3D
- CVE-2025-30832WordPress Themify Event Post Plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Event Post
- CVE-2025-30830WordPress Cool Author Box plugin <= 2.9.9 - Broken Access Control vulnerabilityHossni Mubarak Cool Author Box
- CVE-2025-30828WordPress Timetics plugin <= 1.0.29 - Broken Access Control vulnerabilityArraytics Timetics
- CVE-2025-30826WordPress IP Locator plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityPierre Lannoy IP Locator
- CVE-2025-30824WordPress Textmetrics plugin <= 3.6.1 - Broken Access Control vulnerabilityIsrapil Textmetrics
- CVE-2025-30823WordPress Anthologize Plugin <= 0.8.2 - Cross Site Request Forgery (CSRF) vulnerabilityBoone Gorges Anthologize
- CVE-2025-30822WordPress Custom Login Logo Plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerabilityHakik Zaman Custom Login Logo
- CVE-2025-30821WordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerabilityotacke SNORDIAN's H5PxAPIkatchu
- CVE-2025-30818WordPress jAlbum Bridge plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerabilitymlaza jAlbum Bridge
- CVE-2025-30817WordPress Z Companion plugin <= 1.0.13 - Broken Access Control vulnerabilitywpzita Z Companion
- CVE-2025-30816WordPress publish post email notification plugin <= 1.0.2.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityNks publish post email notification
- CVE-2025-30815WordPress Hesabfa Accounting plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) vulnerabilitySaeed Sattar Beglou Hesabfa Accounting
- CVE-2025-30813WordPress Listamester plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerabilityListamester
- CVE-2025-30812WordPress SKT Addons for Elementor plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Addons for Elementor
- CVE-2025-30811WordPress ValidateCertify plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityJavier Revilla ValidateCertify
- CVE-2025-30809WordPress WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin <= 4.8.4 - Settings Change vulnerabilityShahjada Live Forms
- CVE-2025-30805WordPress Flexible Cookies plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerabilitywpdesk Flexible Cookies
- CVE-2025-30804WordPress wpShopGermany IT-RECHT KANZLEI plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerabilitymaennchen1.de wpShopGermany IT-RECHT KANZLEI
- CVE-2025-30803WordPress Just Writing Statistics plugin <= 5.3 - Broken Access Control vulnerabilityGreg Ross Just Writing Statistics
- CVE-2025-30801WordPress TWB Woocommerce Reviews plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityAbu Bakar TWB Woocommerce Reviews
- CVE-2025-30800WordPress Gum Elementor Addon plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerabilityAtawai Gum Elementor Addon
- CVE-2025-30799WordPress WP Google Street View plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityPagup WP Google Street View
- CVE-2025-30795WordPress Automation By Autonami plugin <= 3.5.1 - Open Redirection vulnerabilityAman FunnelKit Automations
- CVE-2025-30792WordPress Comment Approved Notifier Extended plugin <= 5.2 - Cross Site Scripting (XSS) vulnerabilityufukart Comment Approved Notifier Extended
- CVE-2025-30790WordPress Chatbox Manager plugin <= 1.2.2 - Broken Access Control Vulnerabilityalexvtn Chatbox Manager
- CVE-2025-30789WordPress Clearout Email Validator plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerabilityclearoutio Clearout Email Validator
- CVE-2025-30786WordPress Quotes llama plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerabilityoooorgle Quotes llama
- CVE-2025-30781WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection VulnerabilityWPFactory Scheduled & Automatic Order Status Controller for…
- CVE-2025-30780WordPress Audio Album plugin <= 1.5.0 - Cross Site Scripting (XSS) Vulnerabilitycubecolour Audio Album
- CVE-2025-30779WordPress Doneren met Mollie plugin <= 2.10.7 - Cross Site Scripting (XSS) VulnerabilityNick van Wobbie Doneren met Mollie
- CVE-2025-30777WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) VulnerabilityDevItems Support Genix
- CVE-2025-30776WordPress Sitekit plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerabilitywebvitaly Sitekit
- CVE-2025-30771WordPress WP Cassify plugin <= 2.3.5 - Cross Site Scripting (XSS) VulnerabilityAlain-Aymerick FRANCOIS WP Cassify
- CVE-2025-30770WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) VulnerabilitySyed Balkhi Charitable
- CVE-2025-30768WordPress jAlbum Bridge plugin <= 2.0.18 - Cross Site Scripting (XSS) Vulnerabilitymlaza jAlbum Bridge
- CVE-2025-30767WordPress PDF for WPForms plugin <= 5.3.0 - Arbitrary Shortcode Execution vulnerabilityadd-ons.org PDF for WPForms
- CVE-2025-30766WordPress Happy Addons for Elementor plugin <= 3.16.2 - Cross Site Scripting (XSS) VulnerabilityHappyMonster Happy Addons for Elementor
- CVE-2025-30764WordPress Football Pool plugin <= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityAntoineH Football Pool
- CVE-2025-30763WordPress EO4WP plugin <= 1.0.8.4 - Cross Site Scripting (XSS) VulnerabilityOlaf Lederer EO4WP
- CVE-2025-29993The affected versions of PowerCMS allow HTTP header injection.Alfasado PowerCMS 6.x series · Alfasado PowerCMS 5.x ser… +1
- CVE-2024-45361Mi Connect Service APP protocol flaws lead to leaking sensitive user informationXiaomi Mi Connect Service
- CVE-2024-45355Xiaomi phone framework has unauthorized access vulnerabilityXiaomi phone framework
- CVE-2024-45354xiaomi shop application Webview has code execution vulnerabilityXiaomi shop application
- CVE-2024-45353quick App has intent redriction vulnerabilityXiaomi quick app framework
- CVE-2025-2685TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scriptingtobiasbg TablePress – Tables in WordPress made easy
- CVE-2025-0273HCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerabilityHCL Software HCL DevOps Deploy / HCL Launch
- CVE-2025-31165Cross Site Scripting in NightWolf Penetration PlatformFPT Software NightWolf Penetration Platform
- CVE-2025-2835zhangyd-c OneBlog RestApiController.java autoLink server-side request forgeryzhangyd-c OneBlog
- CVE-2025-2833zhangyd-c OneBlog HTTP Header redoszhangyd-c OneBlog
- CVE-2025-2832mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgerymingyuefusu 明月复苏 tushuguanlixitong 图书管理系统
- CVE-2025-2831mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 bookList getBookList sql injectionmingyuefusu 明月复苏 tushuguanlixitong 图书管理系统
- CVE-2025-2481MediaView <= 1.1.2 - Reflected Cross-Site Scripting via id Parameterdman25560 MediaView
- CVE-2024-55070A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers…
- CVE-2024-55072A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit…
- CVE-2025-26265A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context…
- CVE-2025-29483libming v0.4.8 was discovered to contain a memory leak via the parseSWF_ENABLEDEBUGGER2 function.
- CVE-2025-29485libming v0.4.8 was discovered to contain a segmentation fault via the decompileRETURN function.
- CVE-2025-29486libming v0.4.8 was discovered to contain a memory leak via the parseSWF_PLACEOBJECT3 function.
- CVE-2025-29488libming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function.
- CVE-2025-29489libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function.
- CVE-2025-29490libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function.
- CVE-2025-29491An allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service…
- CVE-2025-29492libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function.
- CVE-2025-29493libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function.
- CVE-2025-29494libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function.
- CVE-2025-29496libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function.
- CVE-2025-29497libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function.