CVEs published October 22, 2025
389 CVEs were published on October 22, 2025: 32 critical, 161 high. Browse them by severity, product and exploitation status.
- Published
- 389
- Critical
- 32
- High
- 161
- Medium
- 136
- Low
- 7
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 67
Most affected products
- Linux
- 67
- Atlassian Jira Align
- 11
- Sauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- 6
- Mercku M6a
- 5
- FantasticPlugins SUMO Memberships for WooCommerce
- 3
- Ghost Robotics Vision
- 3
- ISC BIND
- 3
- AmentoTech Doctreat
- 2
- AndonDesign UDesign Core
- 2
- Ays Pro Survey Maker
- 2
Critical 32
- CVE-2025-11957Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user…Devolutions Server
- CVE-2025-62025WordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerabilityeyecix JobSearch
- CVE-2025-62023WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerabilityCristián Lávaque s2Member
- CVE-2025-60238WordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerabilityUNIVERSAM
- CVE-2025-60232WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerabilityquantumcloud KBx Pro Ultimate
- CVE-2025-60226WordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerabilityaxiomthemes White Rabbit
- CVE-2025-60225WordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerabilityAncoraThemes BugsPatrol
- CVE-2025-60224WordPress Subscribe to Download plugin <= 2.0.9 - PHP Object Injection vulnerabilitywpshuffle Subscribe to Download
- CVE-2025-60221WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerabilitycaptivateaudio Captivate Sync
- CVE-2025-60220WordPress CouponXxL theme <= 3.0.0 - Privilege Escalation vulnerabilitypebas CouponXxL
- CVE-2025-60216WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerabilityBoldThemes Addison
- CVE-2025-60214WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerabilityBoldThemes Goldenblatt
- CVE-2025-60213WordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerabilityWhitebox-Studio Scape
- CVE-2025-60210WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerabilitywpeverest Everest Forms - Frontend Listing
- CVE-2025-60209WordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerabilityCRM Perks Connector for Gravity Forms and Google Sheets
- CVE-2025-60206WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerabilityBeplusthemes Alone
- CVE-2025-60039WordPress Noisa theme <= 2.6.0 - PHP Object Injection vulnerabilityrascals Noisa
- CVE-2025-59557WordPress Learts Addons Plugin < 1.7.5 - SQL Injection VulnerabilityThemeMove Learts Addons
- CVE-2025-59007WordPress TF Woo Product Grid Addon For Elementor Plugin <= 1.0.1 - Deserialization of untrusted data Vulnerabilitythemesflat TF Woo Product Grid Addon For Elementor
- CVE-2025-58963WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability7oroof Medcity
- CVE-2025-52758WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerabilityGesundheit Bewegt Zippy
- CVE-2025-49931WordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerabilityCrocoblock JetSearch
- CVE-2025-49915WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2025-49901WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerabilityquantumcloud Simple Link Directory
- CVE-2025-49380WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerabilitywpinstinct WooCommerce Vehicle Parts Finder
Show all 32 entriesShow fewer entries
- CVE-2025-49060WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerabilityCMSSuperHeroes Wastia
- CVE-2025-48106WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerabilityCMSSuperHeroes Clanora
- CVE-2025-57870BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.Esri ArcGIS Server
- CVE-2016-15048AMTT HiBOS Command Injection RCE via server_ping.phpAnmei Century (Beijing) Technology Co. Hotel Broadband Oper…
- CVE-2025-41108Improper Authentication vulnerability in Ghost Robotics' Vision 60Ghost Robotics Vision
- CVE-2025-41723Sauter: Directory Traversal in importFile SOAP MethodSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-56447TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.
High 161
- CVE-2025-62617Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionalityadmidio · admidio/admidio
- CVE-2025-62614BookLore Media API Authentication Bypassbooklore-app booklore
- CVE-2025-62611aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL serveraio-libs aiomysql · aiomysql
- CVE-2025-62610Hono Improperly Authorizes JWT Audience Validationhonojs hono · hono
- CVE-2025-40780Cache poisoning due to weak PRNGISC BIND
- CVE-2025-40778Cache poisoning attacks with unsolicited RRsISC BIND
- CVE-2025-8677Resource exhaustion via malformed DNSKEY handlingISC BIND
- CVE-2025-62606my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameterMy-Little-Forum mylittleforum
- CVE-2025-62526OpenWrt ubusd vulnerable to heap buffer overflowopenwrt
- CVE-2025-62525OpenWrt vulnerable to local privilage escalationopenwrt
- CVE-2025-62054WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerabilityfavethemes Houzez Theme - Functionality
- CVE-2025-62029WordPress Grevo theme <= 2.4 - Local File Inclusion vulnerabilitythemesion Grevo
- CVE-2025-62022WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerabilityBuddyPress
- CVE-2025-62020WordPress VOD Infomaniak plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2025-62015WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.6.8 - SQL Injection vulnerabilityJosh Kohlbach Advanced Coupons for WooCommerce Coupons
- CVE-2025-62008WordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerabilityacowebs Product Table For WooCommerce
- CVE-2025-62007WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerabilitybPlugins Voice Feedback
- CVE-2025-62005WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityFantasticPlugins SUMO Memberships for WooCommerce
- CVE-2025-60246WordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityweissmike Simple Finance Calculator
- CVE-2025-60234WordPress Single Property theme <= 2.8 - PHP Object Injection vulnerabilitydesignthemes Single Property
- CVE-2025-60228WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerabilitydesignthemes Knowledge Base
- CVE-2025-60227WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerabilityThimPress WP Pipes
- CVE-2025-60222WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerabilityFantasticPlugins SUMO Memberships for WooCommerce
- CVE-2025-60217WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Deletion Vulnerabilityypromo PT Luxa Addons
- CVE-2025-60215WordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerabilitydesignthemes Kriya
Show all 161 entriesShow fewer entries
- CVE-2025-60212WordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerabilitydesignthemes VEDA
- CVE-2025-60211WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerabilityextendons WooCommerce Registration Fields Plugin - Custom S…
- CVE-2025-60208WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerabilityTusko Trush Advanced Custom Fields : CPT Options Pages
- CVE-2025-60168WordPress HotelRunner Booking Widget Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerabilityintegrationshotelrunner HotelRunner Booking Widget
- CVE-2025-60132WordPress Video Blogster Lite Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerabilityjohnh10 Video Blogster Lite
- CVE-2025-60041WordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerabilityIulia Cazan Emails Catch All
- CVE-2025-59580WordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerabilityGoodlayers Core
- CVE-2025-59579WordPress Simple Job Board plugin <= 2.13.7 - Sensitive Data Exposure vulnerabilityPressTigers Simple Job Board
- CVE-2025-59571WordPress WorkScout-Core plugin < 1.7.06 - Cross Site Scripting (XSS) vulnerabilitypurethemes WorkScout-Core
- CVE-2025-59566WordPress Workreap (theme's plugin) plugin <= 3.3.5 - Arbitrary File Deletion vulnerabilityAmentoTech Workreap
- CVE-2025-59564WordPress EduMall Theme < 4.4.5 - Local File Inclusion VulnerabilityThemeMove EduMall
- CVE-2025-59558WordPress Billey Theme < 2.1.6 - Local File Inclusion VulnerabilityThemeMove Billey
- CVE-2025-59555WordPress Medizin Theme < 1.9.7 - Local File Inclusion VulnerabilityThemeMove Medizin
- CVE-2025-59550WordPress Xcare theme < 6.5 - Local File Inclusion vulnerabilitydesignervily Xcare
- CVE-2025-59006WordPress Easy Woocommerce Customizer plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitythemebon Easy Woocommerce Customizer
- CVE-2025-59004WordPress WC Return products plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilitypco_58 WC Return products
- CVE-2025-58971WordPress Doctreat theme <= 1.6.7 - Cross Site Scripting (XSS) VulnerabilityAmentoTech Doctreat
- CVE-2025-58967WordPress Businext theme < 2.4.4 - Local File Inclusion vulnerabilityThemeMove Businext
- CVE-2025-58966WordPress NEX-Forms LITE plugin < 8.2 - Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms LITE
- CVE-2025-58961WordPress CF7 Auto Responder Addon plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilitykamleshyadav CF7 Auto Responder Addon
- CVE-2025-58959WordPress Taskbot plugin <= 6.4 - Arbitrary File Deletion vulnerabilityAmentoTech Taskbot
- CVE-2025-58958WordPress SmilePure Theme < 1.8.5 - Local File Inclusion VulnerabilityThemeMove SmilePure
- CVE-2025-58955WordPress Karzo theme < 2.6 - Local File Inclusion vulnerabilitydesignervily Karzo
- CVE-2025-58921WordPress WP Tactical Popup plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityArevico WP Tactical Popup
- CVE-2025-58916WordPress Author: Munzir plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityAuthor: Munzir
- CVE-2025-53428WordPress Simple User Registration plugin <= 6.8 - Privilege Escalation vulnerabilityN-Media Simple User Registration
- CVE-2025-53427WordPress SEO Pyramid plugin <= 1.9.8 - Cross Site Scripting (XSS) vulnerabilityChibueze Okechukwu SEO Pyramid
- CVE-2025-53426WordPress Likert Survey Master plugin <= 0.8.0.1 - Cross Site Scripting (XSS) vulnerabilityBob Likert Survey Master
- CVE-2025-53425WordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerabilityDokan
- CVE-2025-53423WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerabilitydesignthemes Triss
- CVE-2025-53422WordPress WhatsApp Chat for WordPress and WooCommerce plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityThemeWarriors WhatsApp Chat for WordPress and WooCommerce
- CVE-2025-53420WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerabilityVibeThemes WPLMS
- CVE-2025-53352WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerabilityG5Theme Grid Plus
- CVE-2025-53351WordPress Fidelo Snippet plugin <= 1.12 - Cross Site Scripting (XSS) vulnerabilityFidelo Software Fidelo Snippet
- CVE-2025-53350WordPress Calendar Plus plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilitywebjunk Calendar Plus
- CVE-2025-53297WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityAA-Team Woocommerce Envato Affiliates
- CVE-2025-53238WordPress Toast Mobile Menu plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityToast Plugins Toast Mobile Menu
- CVE-2025-53234WordPress UDesign Core plugin <= 4.14.0 - Cross Site Scripting (XSS) vulnerabilityAndonDesign UDesign Core
- CVE-2025-53229WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykamleshyadav RockON DJ
- CVE-2025-52770WordPress Hello Followers plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilityappscreo Hello Followers
- CVE-2025-52763WordPress Nifty Backups plugin <= 1.08 - Cross Site Scripting (XSS) vulnerabilityNickDuncan Nifty Backups
- CVE-2025-52760WordPress MultiSite Clone Duplicator plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityGlobalis MultiSite Clone Duplicator
- CVE-2025-52756WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerabilitySayan Datta WP Last Modified Info
- CVE-2025-52755WordPress Child Themes plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityChris Taylor Child Themes
- CVE-2025-52754WordPress Sello ChannelConnector plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityselloio Sello ChannelConnector
- CVE-2025-52753WordPress Contact Form by Supsystic plugin <= 1.7.36 - Cross Site Scripting (XSS) vulnerabilityContact Form by Supsystic
- CVE-2025-52751WordPress Slide Puzzle plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitycolome Slide Puzzle
- CVE-2025-52750WordPress Emu2 plugin <= 0.83b - Cross Site Scripting (XSS) vulnerabilityJuergen Schulze Emu2
- CVE-2025-52749WordPress Uji Countdown plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerabilityActivity Track Uji Countdown
- CVE-2025-52748WordPress Directory Pro plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerabilitye-plugins Directory Pro
- CVE-2025-52743WordPress oik-privacy-policy plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerabilitybobbingwide oik-privacy-policy
- CVE-2025-52742WordPress Pets Plugin <= 1.4.1 - Cross Site Scripting (XSS) VulnerabilityIgor Benic Pets
- CVE-2025-52741WordPress Post Connector Plugin <= 1.0.11 - Cross Site Scripting (XSS) VulnerabilityBarry Kooij Post Connector
- CVE-2025-52740WordPress Boldermail Plugin <= 2.4.0 - PHP Object Injection VulnerabilityHernan Villanueva Boldermail
- CVE-2025-52737WordPress WP Store Locator plugin <= 2.2.260 - PHP Object Injection vulnerabilityTijmen Smit WP Store Locator
- CVE-2025-52736WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) VulnerabilityDaman Jeet Finale Lite
- CVE-2025-52735WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerabilityXLPlugins NextMove Lite
- CVE-2025-52734WordPress CropRefine Plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityERA404 CropRefine
- CVE-2025-49992WordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerabilityThimPress LearnPress Export Import
- CVE-2025-49963WordPress Simple Stripe Checkout plugin <= 1.1.28 - Cross Site Scripting (XSS) vulnerabilitygrowniche Simple Stripe Checkout
- CVE-2025-49962WordPress bbPress Notify plugin <= 2.19.5 - Cross Site Scripting (XSS) vulnerabilityuseStrict bbPress Notify
- CVE-2025-49959WordPress bbPress Move Topics plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityPascal Casier bbPress Move Topics
- CVE-2025-49958WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerabilityRobokassa payment gateway for Woocommerce
- CVE-2025-49957WordPress Email Attachment by Order Status & Products Plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityWeboccult Technologies Pvt Email Attachment by Order Status…
- CVE-2025-49956WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilityAnandaraj Balu Fade Slider
- CVE-2025-49955WordPress WP Smart Flexslider Plugin <= 2.5 - Cross Site Scripting (XSS) VulnerabilityRajan Vijayan WP Smart Flexslider
- CVE-2025-49954WordPress WP-Click-Tracker Plugin <= 0.7.3 - Cross Site Scripting (XSS) Vulnerabilitymithra62 WP-Click-Tracker
- CVE-2025-49953WordPress ShareBang, Ultimate Social Share Buttons for WordPress Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerabilitythemeinity ShareBang, Ultimate Social Share Buttons for Wor…
- CVE-2025-49951WordPress gAppointments Plugin <= 1.14.1 - Cross Site Scripting (XSS) Vulnerabilitywpcrunch gAppointments
- CVE-2025-49950WordPress Official Integration for Billingo plugin <= 4.3.0 - Privilege Escalation vulnerabilityOfficial Integration for Billingo
- CVE-2025-49948WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) VulnerabilityAhmad Awais WP Super Edit
- CVE-2025-49947WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityextendons WooCommerce Registration Fields Plugin - Custom S…
- CVE-2025-49946WordPress Auto Login After Registration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityCynob IT Consultancy Auto Login After Registration
- CVE-2025-49945WordPress Shortcode Generator plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilitykylegetson Shortcode Generator
- CVE-2025-49944WordPress WPCode Content Ratio plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityJonatan Jumbert WPCode Content Ratio
- CVE-2025-49935WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerabilityxtemos WoodMart
- CVE-2025-49930WordPress JetSearch plugin <= 3.5.10 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSearch
- CVE-2025-49926WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerabilityLaborator Kalium
- CVE-2025-49925WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerabilityVibeThemes WPLMS
- CVE-2025-49924WordPress Wholesale Suite plugin <= 2.2.4.2 - Privilege Escalation vulnerabilityJosh Kohlbach Wholesale Suite
- CVE-2025-49921WordPress JetReviews plugin <= 3.0.0 - Local File Inclusion vulnerabilityCrocoblock JetReviews
- CVE-2025-49916WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerabilityMultiVendorX
- CVE-2025-49911WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerabilitywpinstinct WooCommerce Vehicle Parts Finder
- CVE-2025-49910WordPress WPGuppy plugin <= 1.1.4 - Broken Access Control vulnerabilityAmentoTech Private Limited WPGuppy
- CVE-2025-49378WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerabilityThemefic Hydra Booking
- CVE-2025-48338WordPress WP Abstracts plugin <= 2.7.4 - Local File Inclusion vulnerabilityKevon Adonis WP Abstracts
- CVE-2025-48098WordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityAys Pro Survey Maker
- CVE-2025-48097WordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityShiva WSAnalytics
- CVE-2025-48093WordPress Password only login plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCalvaweb Password only login
- CVE-2025-48092WordPress Fix Multiple Redirects plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityjurajpuchky Fix Multiple Redirects
- CVE-2025-48091WordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerabilityAlexander AnyComment
- CVE-2025-48082WordPress Progress Planner plugin <= 1.8.0 - Privilege Escalation vulnerabilityProgress Planner
- CVE-2025-39534WordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySomonator Terms Dictionary
- CVE-2025-32657WordPress Testimonial Slider and Showcase Pro plugin <= 2.1.7 - Local File Inclusion vulnerabilityRadiusTheme Testimonial Slider And Showcase Pro
- CVE-2025-32283WordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerabilitydesignthemes Solar Energy
- CVE-2025-31634WordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerabilitydesignthemes Insurance
- CVE-2025-30944WordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control VulnerabilityEssekia Tablesome Table Premium
- CVE-2023-53729soc: qcom: qmi_encdec: Restrict string length in decodeLinux
- CVE-2023-53726arm64: csum: Fix OoB access in IP checksum code for negative lengthsLinux
- CVE-2023-53718ring-buffer: Do not swap cpu_buffer during resize processLinux
- CVE-2023-53713arm64: sme: Use STR P to clear FFR context field in streaming SVE modeLinux
- CVE-2023-53711NFS: Fix a potential data corruptionLinux
- CVE-2023-53707drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1Linux
- CVE-2023-53705ipv6: Fix out-of-bounds access in ipv6_find_tlv()Linux
- CVE-2023-53698xsk: fix refcount underflow in error pathLinux
- CVE-2023-53695udf: Detect system inodes linked into directory hierarchyLinux
- CVE-2023-53692ext4: fix use-after-free read in ext4_find_extent for bigalloc + inlineLinux
- CVE-2022-50581hfs: fix OOB Read in __hfs_brec_findLinux
- CVE-2022-50570platform/chrome: fix memory corruption in ioctlLinux
- CVE-2022-50569xfrm: Update ipcomp_scratches with NULL when freedLinux
- CVE-2022-50567fs: jfs: fix shift-out-of-bounds in dbAllocAGLinux
- CVE-2025-11086Academy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addonacademylms Academy LMS Pro
- CVE-2025-41110Improper Authentication vulnerability in Ghost Robotics' Vision 60Ghost Robotics Vision
- CVE-2025-41109Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60Ghost Robotics Vision
- CVE-2025-41724Sauter: Crash via Incomplete SOAP RequestSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-41722Sauter: Hard-coded Authentication CredentialsSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-41719Sauter: Improper Validation of user-controlled dataSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-22167This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0…Atlassian Jira Software Data Center · Atlassian Jira Softwa…
- CVE-2023-53691Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files…Hikvision CSMP iSecure Center
- CVE-2024-58274Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in…Hikvision CSMP iSecure Center
- CVE-2025-60331D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint.
- CVE-2025-60332A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of…
- CVE-2025-60333TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig…
- CVE-2025-60334TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function.
- CVE-2025-60335A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service…
- CVE-2025-60336A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of…
- CVE-2025-60337Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed_dir parameter in the SetSpeedWan function.
- CVE-2025-60338Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function.
- CVE-2025-60339Multiple buffer overflow vulnerabilities in the openSchedWifi function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of…
- CVE-2025-60340Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS)…
- CVE-2025-60341Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast_setting_wifi_set function.
- CVE-2025-60342Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function.
- CVE-2025-60343Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS)…
- CVE-2025-61035The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik…
- CVE-2025-62771Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.Mercku M6a
- CVE-2025-62775Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.Mercku M6a
Medium, low and unrated 196
- CVE-2025-62710Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImplsakaiproject sakai · org.sakaiproject.kernel:sakai-kernel-i…
- CVE-2025-62708pypdf manipulated LZWDecode streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2025-62707pypdf affected by possible infinite loop when reading DCT inline images without EOF markerpy-pdf pypdf · pypdf
- CVE-2025-62706Authlib : JWE zip=DEF decompression bomb enables DoSauthlib
- CVE-2025-62705OpenBao and Vault Leak []byte Fields in Audit Logsopenbao · github.com/openbao/openbao
- CVE-2025-62613VDO.Ninja Reflected XSS Vulnerability in control.htmlsteveseguin vdo.ninja
- CVE-2025-62612FastGPT File Reading Node SSRF Vulnerabilitylabring FastGPT
- CVE-2025-62247Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through…Liferay Portal · Liferay DXP +1
- CVE-2025-62513OpenBao leaks HTTPRawBody in Audit Logsopenbao · github.com/openbao/openbao
- CVE-2025-62248A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through…Liferay Portal · Liferay DXP +1
- CVE-2025-58712Amq: privilege escalation via excessive /etc/passwd permissionsapache activemq-artemis · Red Hat RHEL-9 based Middlewar… +1
- CVE-2025-24934SO_REUSEPORT_LB breaks connect(2) for UDP socketsFreeBSD
- CVE-2025-11958An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an…Devolutions Server
- CVE-2025-22178Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22169Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22173Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22170Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22174Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22172Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22176Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22171Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22168Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22177Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-22175Jira Align is vulnerable to an authorization issue.Atlassian Jira Align
- CVE-2025-62607Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URLnautobot-app-ssot · nautobot-ssot
Show all 196 entriesShow fewer entries
- CVE-2025-62659The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectorsThe Wikimedia Foundation MediaWiki CookieConsent extension
- CVE-2025-23299NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege…NVIDIA BlueField GA · NVIDIA BlueField LTS22 +7
- CVE-2025-62604MeterSphere logic flaw allows retrieval of arbitrary user informationmetersphere
- CVE-2025-11965In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails…Eclipse Foundation Vert.x · io.vertx:vertx-web
- CVE-2025-11966In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted…Eclipse Foundation Vert.x · io.vertx:vertx-web
- CVE-2025-62073WordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerabilitySovlix MeetingHub
- CVE-2025-62072WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerabilityRustaurius Front End Users
- CVE-2025-62071WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerabilitySocial proof testimonials and reviews by Repuso
- CVE-2025-62070WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerabilityWPXPO WowRevenue
- CVE-2025-62069WordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerabilityRealMag777 MDTF
- CVE-2025-62068WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerabilitye2pdf
- CVE-2025-62063WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityWP Travel Gutenberg Blocks
- CVE-2025-62062WordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerabilityThemeRuby Easy Post Submission
- CVE-2025-62061WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerabilityimpleCode Product Catalog Simple
- CVE-2025-62060WordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityThemepoints Tab Ultimate
- CVE-2025-62058WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality
- CVE-2025-62052WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerabilityHorea Radu One Page Express Companion
- CVE-2025-62048WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform SmartCrawl
- CVE-2025-62042WordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerabilityBastien Ho Event post
- CVE-2025-62027WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerabilityStellarWP Event Tickets
- CVE-2025-62026WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerabilityBlockspare
- CVE-2025-62024WordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityJonathan Jernigan Pie Calendar
- CVE-2025-62021WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerabilityMade Neat Acknowledgify
- CVE-2025-62019WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerabilityWPZOOM Recipe Card Blocks for Gutenberg & Elementor
- CVE-2025-62013WordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerabilityPOSIMYTH UiChemy
- CVE-2025-62009WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityDmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…
- CVE-2025-62006WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerabilityVeronaLabs WP SMS
- CVE-2025-60176WordPress WP Tesseract Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerabilitytattersoftware WP Tesseract
- CVE-2025-60151WordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection VulnerabilityCRM Perks WP Gravity Forms HubSpot
- CVE-2025-60135WordPress WeShare Buttons Plugin <= 13.0.0 - Cross Site Scripting (XSS) VulnerabilityNIKITAS GEORGOPOULOS WeShare Buttons
- CVE-2025-60134WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) VulnerabilityJohn James Jacoby WP Media Categories
- CVE-2025-60131WordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityZoefff Werk aan de Muur
- CVE-2025-59593WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) VulnerabilityExtend Themes Colibri Page Builder
- CVE-2025-59578WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerabilitywpdesk ShopMagic
- CVE-2025-59575WordPress MasterStudy LMS plugin <= 3.6.20 - Sensitive Data Exposure vulnerabilityStylemix MasterStudy LMS
- CVE-2025-58970WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerabilityAmentoTech Doctreat
- CVE-2025-53424WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerabilityvanquish WooCommerce Orders & Customers Exporter
- CVE-2025-53421WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerabilityPickPlugins Accordion
- CVE-2025-53236WordPress UDesign Core plugin <= 4.14.0 - Broken Access Control vulnerabilityAndonDesign UDesign Core
- CVE-2025-53232WordPress WP Gmail SMTP plugin <= 1.0.7 - Sensitive Data Exposure vulnerabilityinkthemes WP Gmail SMTP
- CVE-2025-53218WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerabilitySaad Iqbal AppExperts
- CVE-2025-52757WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerabilityFantasticPlugins SUMO Memberships for WooCommerce
- CVE-2025-52752WordPress IDonatePro plugin <= 2.1.9 - Sensitive Data Exposure vulnerabilityThemeAtelier IDonatePro
- CVE-2025-52738WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerabilityWikimedia Foundation Wikipedia Preview
- CVE-2025-49961WordPress Breeze Checkout plugin <= 1.4.0 - Broken Access Control vulnerabilityBreeze Team Breeze Checkout
- CVE-2025-49960WordPress LeadBI Plugin for WordPress plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityLeadBI Plugin for WordPress
- CVE-2025-49952WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerabilityfavethemes Houzez
- CVE-2025-49949WordPress Templazee plugin <= 1.0.2 - Broken Access Control VulnerabilityTemplazee
- CVE-2025-49940WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
- CVE-2025-49939WordPress JetElements For Elementor plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2025-49938WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2025-49937WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerabilitySyed Balkhi Smash Balloon Social Post Feed
- CVE-2025-49936WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerabilityxtemos WoodMart
- CVE-2025-49934WordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2025-49933WordPress JetBlog plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetBlog
- CVE-2025-49932WordPress JetBlog plugin <= 2.4.4.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetBlog
- CVE-2025-49929WordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks
- CVE-2025-49928WordPress JetWooBuilder plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetWooBuilder
- CVE-2025-49927WordPress JetWooBuilder plugin <= 2.1.20.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetWooBuilder
- CVE-2025-49923WordPress Seriously Simple Podcasting plugin <= 3.11.1 - Cross Site Scripting (XSS) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-49922WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerabilityetruel WPeMatico RSS Feed Fetcher
- CVE-2025-49920WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerabilityWeb Accessibility By accessiBe
- CVE-2025-49917WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerabilityIcegram Express Pro
- CVE-2025-49913WordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerabilityCoSchedule
- CVE-2025-49912WordPress Email Subscription Popup plugin <= 1.2.26 - Cross Site Scripting (XSS) vulnerabilityNks Email Subscription Popup
- CVE-2025-49908WordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityWPClever WPC Countdown Timer for WooCommerce
- CVE-2025-49907WordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerabilityRealMag777 MDTF
- CVE-2025-49906WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerabilityStellarWP WPComplete
- CVE-2025-49903WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerabilitybdthemes ZoloBlocks
- CVE-2025-49899WordPress Whydonate plugin <= 4.0.15 - Broken Access Control vulnerabilityjjlemstra Whydonate
- CVE-2025-49377WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerabilityThemefic Hydra Booking
- CVE-2025-49376WordPress DELUCKS SEO plugin <= 2.5.9 - Broken Access Control vulnerabilityDELUCKS SEO
- CVE-2025-49374WordPress Captcha.eu plugin <= 1.0.61 - Server Side Request Forgery (SSRF) vulnerabilityCaptcha.eu
- CVE-2025-49373WordPress Evergreen Content Poster plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerabilityEvergreen Content Poster
- CVE-2025-48099WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerabilityCode Amp Search & Filter
- CVE-2025-48096WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerabilityFRESHFACE Custom CSS
- CVE-2025-48095WordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityAys Pro Survey Maker
- CVE-2025-8848HTML Injection in Accept-Language Header in danny-avila/librechatdanny-avila/librechat
- CVE-2023-53732fs/ntfs3: Fix NULL dereference in ni_write_inodeLinux
- CVE-2023-53731netlink: fix potential deadlock in netlink_set_err()Linux
- CVE-2023-53730blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_costLinux
- CVE-2023-53728posix-timers: Ensure timer ID search-loop limit is validLinux
- CVE-2023-53727net/sched: fq_pie: avoid stalls in fq_pie_timer()Linux
- CVE-2023-53725clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probeLinux
- CVE-2023-53724mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()Linux
- CVE-2023-53723drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspendLinux
- CVE-2023-53722md: raid1: fix potential OOB in raid1_remove_disk()Linux
- CVE-2023-53721wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()Linux
- CVE-2023-53720net/mlx5e: Release the label when replacing existing ct entryLinux
- CVE-2023-53719serial: arc_uart: fix of_iomap leak in `arc_serial_probe`Linux
- CVE-2023-53717wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()Linux
- CVE-2023-53716net: fix skb leak in __skb_tstamp_tx()Linux
- CVE-2023-53715wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hexLinux
- CVE-2023-53714drm/stm: ltdc: fix late dereference checkLinux
- CVE-2023-53712ARM: 9317/1: kexec: Make smp stop calls asynchronousLinux
- CVE-2023-53710wifi: mt76: mt7921: fix error code of return in mt7921_acpi_readLinux
- CVE-2023-53709ring-buffer: Handle race between rb_move_tail and rb_check_pagesLinux
- CVE-2023-53708ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objectsLinux
- CVE-2023-53706mm/vmemmap/devdax: fix kernel crash when probing devdax devicesLinux
- CVE-2023-53704clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()Linux
- CVE-2023-53703HID: amd_sfh: Fix for shift-out-of-boundsLinux
- CVE-2023-53702s390/crypto: use vector instructions only if available for ChaCha20Linux
- CVE-2023-53700media: max9286: Fix memleak in max9286_v4l2_register()Linux
- CVE-2023-53699riscv: move memblock_allow_resize() after linear mapping is readyLinux
- CVE-2023-53697nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()Linux
- CVE-2023-53696scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()Linux
- CVE-2023-53694riscv: ftrace: Fixup panic by disabling preemptionLinux
- CVE-2023-53693USB: gadget: Fix the memory leak in raw_gadget driverLinux
- CVE-2022-50582regulator: core: Prevent integer underflowLinux
- CVE-2022-50580blk-throttle: prevent overflow while calculating wait timeLinux
- CVE-2022-50579arm64: ftrace: fix module PLTs with mcountLinux
- CVE-2022-50578class: fix possible memory leak in __class_register()Linux
- CVE-2022-50577ima: Fix memory leak in __ima_inode_hash()Linux
- CVE-2022-50576serial: pch: Fix PCI device refcount leak in pch_request_dma()Linux
- CVE-2022-50575xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()Linux
- CVE-2022-50574drm/omap: dss: Fix refcount leak bugsLinux
- CVE-2022-50573wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaksLinux
- CVE-2022-50572ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()Linux
- CVE-2022-50571btrfs: call __btrfs_remove_free_space_cache_locked on cache load failureLinux
- CVE-2022-50568usb: gadget: f_hid: fix f_hidg lifetime vs cdevLinux
- CVE-2022-50566mtd: Fix device name leak when register device failed in add_mtd_device()Linux
- CVE-2022-50565wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()Linux
- CVE-2022-50564s390/netiucv: Fix return type of netiucv_tx()Linux
- CVE-2022-50563dm thin: Fix UAF in run_timer_softirq()Linux
- CVE-2022-50562tpm: acpi: Call acpi_put_table() to fix memory leakLinux
- CVE-2022-50561iio: fix memory leak in iio_device_register_eventset()Linux
- CVE-2022-50560drm/meson: explicitly remove aggregate driver at module unload timeLinux
- CVE-2022-50559clk: imx: scu: fix memleak on platform_device_add() failsLinux
- CVE-2022-50558regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnodeLinux
- CVE-2022-50557pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()Linux
- CVE-2022-50556drm: Fix potential null-ptr-deref due to drmm_mode_config_init()Linux
- CVE-2025-11844XPath Injection in Hugging Face Smolagents search_item_ctrl_f Functionhuggingface/smolagents · smolagents
- CVE-2025-11750User Enumeration via Distinct Error Messages in langgenius/dify-weblanggenius/dify
- CVE-2025-11411Possible domain hijacking via promiscuous records in the authority sectionNLnet Labs Unbound
- CVE-2025-6833All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated…codebangers All in One Time Clock Lite – Tracking Employee…
- CVE-2025-11915HTTP Desynchronisation in Vertex AI for certain third-party modelsGoogle Cloud Vertex AI: Partner Models for MaaS · Google… +1
- CVE-2025-11825Playerzbr <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Fieldpedrolaxe Playerzbr
- CVE-2025-10047Email Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injectionpmbaldha Email Tracker
- CVE-2025-11883Responsive Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingrene-puchinger Responsive Progress Bar
- CVE-2025-11817Simple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegaryhukkeri Simple Tableau Viz
- CVE-2025-11870Simple Business Data <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdmbarber Simple Business Data
- CVE-2025-11867Bg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scriptingvbog Bg Book Publisher
- CVE-2025-11819WP-Thumbnail <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderobocasters WP-Thumbnail
- CVE-2025-11824Cinza Grid <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Fieldmadebycinza Cinza Grid
- CVE-2025-11866Photographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingaurelienpierre Photographers galleries
- CVE-2025-11830WP Restaurant Listings <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdrift WP Restaurant Listings
- CVE-2025-11880SM CountDown Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsierramike SM CountDown Widget
- CVE-2025-11811Simple Youtube Shortcode <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodematthewmarichiba Simple Youtube Shortcode
- CVE-2025-11813Responsive iframe GoogleMap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepressmaninc Responsive iframe GoogleMap
- CVE-2025-11810Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodechrishurst Name: Print Button Shortcode
- CVE-2025-11818WP Responsive Meet The Team <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodevobi WP Responsive Meet The Team
- CVE-2025-11807Mixlr Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemrgeorgegray Mixlr Shortcode
- CVE-2025-10138This-or-That by André Boekhorst <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingandrex84 This-or-That
- CVE-2025-11827Oboxmedia Ads <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingoboxgroup Oboxmedia Ads
- CVE-2025-11878ST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbeautifultemplates ST Categories Widget
- CVE-2025-11809WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodenazakatali32 WP-Force Images Download
- CVE-2025-11872Material Design Iconic Font Integration <= 2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmcostales84 Material Design Iconic Font Integration
- CVE-2025-11804JB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingjobair JB News Ticker
- CVE-2025-11834WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwiellyam WP AD Gallery
- CVE-2025-11952Stored Cross-Site Scripting (XSS) in Oct8ne ChatbotOct8ne Chatbot
- CVE-2025-41721Sauter: Command InjectionSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-41720Sauter: Arbitrary File UploadSauter modulo 6 devices modu680-AS · Sauter modulo 6 dev… +4
- CVE-2025-10570Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refundwpdesk Flexible Refund and Return Order for WooCommerce
- CVE-2025-12033Simple Banner <= 3.0.10 - Authenticated (Admin+) Stored Cross-Site Scriptingrpetersen29 Simple Banner – Easily add multiple Banners/Bar…
- CVE-2025-10588PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options ModificationPixelYourSite – Your smart PIXEL (TAG) & API Manager
- CVE-2025-5983Meta Tag Manager < 3.3 - Contributor+ Open RedirectMeta Tag Manager
- CVE-2025-10638NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Subscribers ExportNS Maintenance Mode for WP
- CVE-2025-10651Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mailuscnanbu Welcart e-Commerce
- CVE-2025-62772On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.Mercku M6a
- CVE-2025-62773Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.Mercku M6a
- CVE-2025-62774On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.Mercku M6a