CVEs published October 30, 2025
202 CVEs were published on October 30, 2025: 24 critical, 78 high. Browse them by severity, product and exploitation status.
- Published
- 202
- Critical
- 24
- High
- 78
- Medium
- 88
- Low
- 3
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 142
Most affected products
- Nagios XI
- 73
- Linux
- 20
- Nagios Log Server
- 13
- Dell Unity
- 6
- Nagios Fusion
- 5
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 3
- Nagios Network Analyzer
- 3
- SUSE neuvector · github.com/neuvector/neuvector
- 3
- X.Org Xwayland · Red Hat Enterprise Linux
- 3
- Zohocorp ManageEngine Exchange Reporter Plus
- 3
Critical 24
- CVE-2025-48983A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup…Veeam Backup and Replication
- CVE-2025-52665A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access…Ubiquiti UniFi Access Application
- CVE-2023-7317Nagios XI < 2024R1 Web SSH Terminal Missing Access ControlNagios XI
- CVE-2024-13996Nagios XI < 2024R1.1.3 Session Not Invalidated After Password ChangeNagios XI
- CVE-2024-14008Nagios XI < 2024R1.3.2 RCE via WinRM Configuration WizardNagios XI
- CVE-2025-34286Nagios XI < 2026R1 RCE via Run Check Command in CCMNagios XI
- CVE-2024-14003Nagios XI < 2024R1.2 RCE via NRDP Server PluginsNagios XI
- CVE-2025-34134Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)Nagios XI
- CVE-2024-14009Nagios XI < 2024R1.0.1 Privilege Escalation via System ProfileNagios XI
- CVE-2024-14005Nagios XI < 2024R1.2 Command Injection via Docker WizardNagios XI
- CVE-2020-36856Nagios XI < 5.6.14 Authenticated RCE command_test.php via addressNagios XI
- CVE-2025-34284Nagios XI < 2024R2 Authenticated Command Injection via WinRM PluginNagios XI
- CVE-2025-34277Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDNagios Log Server
- CVE-2025-34274Nagios Log Server < 2024R2.0.3 Logstash Process Root PrivilegesNagios Log Server
- CVE-2023-7325Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRFAnheng Information (Hangzhou DBAPP Security Information Tec…
- CVE-2021-4461Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication BypassSeeyon Zhiyuan OA Web Application System
- CVE-2025-62712JumpServer Connection Token Leak Vulnerabilityjumpserver
- CVE-2025-12516Lack of Graceful Error Handling - HTTP 5xx ErrorAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12515Systemic Internal Server Errors - HTTP 500 ResponseAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-43027A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain…Genetec Security Center
- CVE-2025-53883spacewalk-java has various XSS issues on search pageContainer suse manager · SUSE Manager Server LTS
- CVE-2025-40099cifs: parse_dfs_referrals: prevent oob on malformed inputLinux
- CVE-2025-54469NeuVector Enforcer is vulnerable to Command Injection and Buffer overflowSUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-50739iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
High 78
- CVE-2025-48982This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into…Veeam Agent for Microsoft Windows
- CVE-2025-48984A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.Veeam Backup and Replication
- CVE-2025-52663A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled.Ubiquiti UniFi Talk Touch · Ubiquiti UniFi Talk G3 Phones
- CVE-2025-52664SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by…Revive Adserver
- CVE-2020-36863Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import DirectoryNagios XI
- CVE-2020-36869Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit PageNagios XI
- CVE-2016-15050Nagios XI < 5.2.4 SQL Injection in Notification SearchNagios XI
- CVE-2011-10035Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPENagios XI
- CVE-2024-14004Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)Nagios XI
- CVE-2018-25123Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing ComponentNagios XI
- CVE-2020-36868Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh ScriptNagios XI
- CVE-2025-34287Nagios XI < 2024R2 Privilege Escalation via process_perfdata.plNagios XI
- CVE-2021-47700Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary DirectoryNagios XI
- CVE-2024-14006Nagios XI < 2024R1.2.2 Host Header InjectionNagios XI
- CVE-2018-25122Nagios XI < 5.4.13 Component Download Page RCENagios XI
- CVE-2020-36867Nagios XI < 5.7.3 Command Injection in Report PDF DownloadNagios XI
- CVE-2020-36859Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit PagesNagios XI
- CVE-2021-47693Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search TextNagios XI
- CVE-2013-10073Nagios XI < 2012R1.6 Auto-Discovery Shell Command InjectionNagios XI
- CVE-2013-10072Nagios XI < 2012R1.6 Auto-Discovery Missing AuthorizationNagios XI
- CVE-2020-36857Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface PageNagios XI
- CVE-2012-10063Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCMNagios XI
- CVE-2024-14002Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVisNagios XI
- CVE-2024-13995Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information DisclosureNagios XI
- CVE-2025-34283Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune ThemesNagios XI
Show all 78 entriesShow fewer entries
- CVE-2024-13994Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing AuthorizationNagios XI
- CVE-2024-13999Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information DisclosureNagios XI
- CVE-2025-34280Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal FunctionNagios Network Analyzer
- CVE-2025-34298Nagios Log Server < 2024R1.3.2 Set Email Privilege EscalationNagios Log Server
- CVE-2025-34273Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard DeletionNagios Log Server
- CVE-2024-58273Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to RootNagios Log Server
- CVE-2023-7322Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API AccessNagios Log Server
- CVE-2025-34271Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over PlaintextNagios Log Server
- CVE-2025-3356IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operationsIBM Tivoli Monitoring
- CVE-2025-3355IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operationsIBM Tivoli Monitoring
- CVE-2025-36137IBM Sterling Connect:Direct for UNIX command executionIBM Sterling Connect:Direct for Unix
- CVE-2025-64112Statmatic vulnerable to Stored Cross-Site Scriptingstatamic cms · statamic/cms
- CVE-2025-12060Keras keras.utils.get_file Utility Path Traversal VulnerabilityKeras
- CVE-2025-64096CryptoLib vulnerable to Stack Buffer Overflow in Crypto_Key_Update due to missing TLV length checknasa CryptoLib
- CVE-2025-62795JumpServer Unauthorized LDAP Configuration Access via WebSocketjumpserver
- CVE-2025-62726n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hookn8n-io n8n · n8n
- CVE-2025-43942Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-46422Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-46423Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-43939Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-43940Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-43941Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command…Dell Unity
- CVE-2025-39663Cross Site Scripting through compromised remote siteCheckmk
- CVE-2025-53880susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversalContainer suse/manager/4.3/proxy-httpd:latest · Containe… +2
- CVE-2025-40105vfs: Don't leak disconnected dentries on umountLinux
- CVE-2025-40104ixgbevf: fix mailbox API compatibility by negotiating supported featuresLinux
- CVE-2025-40096drm/sched: Fix potential double free in drm_sched_job_add_resv_dependenciesLinux
- CVE-2025-40095usb: gadget: f_rndis: Refactor bind path to use __free()Linux
- CVE-2025-40094usb: gadget: f_acm: Refactor bind path to use __free()Linux
- CVE-2025-40093usb: gadget: f_ecm: Refactor bind path to use __free()Linux
- CVE-2025-40092usb: gadget: f_ncm: Refactor bind path to use __free()Linux
- CVE-2025-40090ksmbd: fix recursive locking in RPC handle list accessLinux
- CVE-2025-40088hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()Linux
- CVE-2025-40087NFSD: Define a proc_layoutcommit for the FlexFiles layout typeLinux
- CVE-2025-54470NeuVector telemetry sender is vulnerable to MITM and DoSSUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-62229Xorg: xmayland: use-after-free in xpresentnotify structure creationX.Org Xwayland · Red Hat Enterprise Linux
- CVE-2025-62230Xorg: xwayland: use-after-free in xkb client resource removalX.Org Xwayland · Red Hat Enterprise Linux
- CVE-2025-62231Xorg: xmayland: value overflow in xkbsetcompatmap()X.Org Xwayland · Red Hat Enterprise Linux
- CVE-2025-61113TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints.
- CVE-2025-611142nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper…
- CVE-2025-61115ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors…
- CVE-2025-61116AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an…
- CVE-2025-61117Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control…
- CVE-2025-61118mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control…
- CVE-2025-61119Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities.
- CVE-2025-61120AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper…
- CVE-2025-61121Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a…
- CVE-2025-61141sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR…github.com/sqls-server/sqls
- CVE-2025-61196An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.
- CVE-2025-61498A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying…
- CVE-2025-63298A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php…
- CVE-2025-63422Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211…
- CVE-2025-63423Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password.
Medium, low and unrated 100
- CVE-2025-8849Denial of Service in danny-avila/librechatdanny-avila/librechat
- CVE-2025-27208A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2.Revive Adserver
- CVE-2025-48980In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu…Brave Desktop Browser
- CVE-2011-10037Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting PermalinksNagios XI
- CVE-2021-47697Nagios XI < 5.8.0 XSS via Views URL HandlingNagios XI
- CVE-2018-25121Nagios XI < 5.4.13 XSS via Views PageNagios XI
- CVE-2013-10074Nagios XI < 2012R2.6 XSS via Tools MenuNagios XI
- CVE-2011-10040Nagios XI < 2011R1.9 XSS via Status/Report Page Link FunctionsNagios XI
- CVE-2016-15051Nagios XI < 5.2.4 XSS via Report startdate/enddate FieldsNagios XI
- CVE-2011-10038Nagios XI < 2011R1.9 XSS via Recurring Downtime ScriptNagios XI
- CVE-2021-47695Nagios XI < 5.8.0 XSS via My Tools PageNagios XI
- CVE-2016-15053Nagios XI < 5.2.4 XSS via “My Reports” ListingNagios XI
- CVE-2016-15052Nagios XI < 5.2.4 XSS via Menu SystemNagios XI
- CVE-2020-36866Nagios XI < 5.7.3 XSS via Manage Users in Admin InterfaceNagios XI
- CVE-2023-7316Nagios XI < 2024R1 XSS via Graph ExplorerNagios XI
- CVE-2023-7315Nagios XI < 5.11.3 XSS via Graph ExplorerNagios XI
- CVE-2024-14001Nagios XI < 2024R1.1.3 XSS via Executive Summary ReportNagios XI
- CVE-2020-36864Nagios XI < 5.7.2 XSS via Dashboard Background Color SettingNagios XI
- CVE-2023-7318Nagios XI < 2024R1.0.2 XSS via Core Command ExpansionNagios XI
- CVE-2024-14000Nagios XI < 2024R1.1.3 XSS via Capacity Planning ReportNagios XI
- CVE-2023-7313Nagios XI < 5.11.3 XSS via Bulk ModificationsNagios XI
- CVE-2020-36865Nagios XI < 5.7.2 XSS via BPI Config ManagementNagios XI
- CVE-2021-47696Nagios XI < 5.8.0 XSS via BPI Config ID HandlingNagios XI
- CVE-2023-7314Nagios XI < 5.11.3 XSS via Bandwidth ReportNagios XI
- CVE-2011-10036Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link HandlerNagios XI
Show all 100 entriesShow fewer entries
- CVE-2011-10039Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” ListingNagios XI
- CVE-2021-47699Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS FormNagios XI
- CVE-2023-53688Nagios XI < 5.11.3 XSS & CSRF via Hypermap ReplayNagios XI
- CVE-2020-36862Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via HighchartsNagios XI
- CVE-2022-50587Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error TextNagios XI
- CVE-2022-50586Nagios XI < 5.8.9 Stored XSS via BPI Info URLNagios XI
- CVE-2022-50588Nagios XI < 5.8.9 Stored XSS in Update CheckingNagios XI
- CVE-2024-13993Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older BrowsersNagios XI
- CVE-2013-10071Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load FunctionalityNagios XI
- CVE-2025-34135Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit FilesNagios XI
- CVE-2021-47689Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates PagesNagios XI
- CVE-2021-47691Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services PageNagios XI
- CVE-2022-50584Nagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion FlowsNagios XI
- CVE-2020-36861Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period PagesNagios XI
- CVE-2021-47690Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay ModalsNagios XI
- CVE-2020-36860Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit PagesNagios XI
- CVE-2022-50585Nagios XI < 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search InputNagios XI
- CVE-2021-47694Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandNagios XI
- CVE-2023-7319Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator MenuNagios Network Analyzer
- CVE-2025-34278Nagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSSNagios Network Analyzer
- CVE-2023-7321Nagios Log Server < 2.1.14 XSS via Snapshots PageNagios Log Server
- CVE-2023-7323Nagios Log Server < 2024R1 XSS via Create User FunctionNagios Log Server
- CVE-2020-36858Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists PagesNagios Log Server
- CVE-2025-34272Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard FallbackNagios Log Server
- CVE-2016-15049Nagios Log Server < 1.4.2 Dashboards Logs Table XSSNagios Log Server
- CVE-2025-34270Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not ObfuscatedNagios Log Server
- CVE-2017-20209Nagios Fusion < 4.0.1 XSS via Users/Servers PageNagios Fusion
- CVE-2018-25119Nagios Fusion < 4.1.5 XSS via fusionwindow ParameterNagios Fusion
- CVE-2023-53689Nagios Fusion < 4.2.0 License Information Reflected XSSNagios Fusion
- CVE-2023-53690Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSSNagios Fusion
- CVE-2023-7312Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmailNagios Fusion
- CVE-2025-8850Insecure API Design in danny-avila/librechatdanny-avila/librechat
- CVE-2025-62265Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions…Liferay Portal · Liferay DXP +1
- CVE-2025-64118node-tar vulnerable to race condition leading to uninitialized memory exposureisaacs node-tar · tar
- CVE-2025-64115Movary unvalidated Referer header allows open redirect and phishingleepeuker movary
- CVE-2025-62266By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0…Liferay Portal · Liferay DXP +1
- CVE-2025-64116Movary vulnerable to an open redirectleepeuker movary
- CVE-2025-11998HP Card Readers (B Models) – Potential Information DisclosureHP Card Readers B Model
- CVE-2025-12517Credits Page not Matching Versions in Use in the FirmwareAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-36592Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20.Dell Secure Connect Gateway SCG Policy Manager
- CVE-2025-46363Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal…Dell Secure Connect Gateway SCG 5.0 Application and Applian…
- CVE-2025-5347Stored XSSZohocorp ManageEngine Exchange Reporter Plus
- CVE-2025-5343Stored XSSZohocorp ManageEngine Exchange Reporter Plus
- CVE-2025-5342Denial of Service (DoS)Zohocorp ManageEngine Exchange Reporter Plus
- CVE-2025-10348Stored Cross-Site Scripting in URVE Smart OfficeEveo URVE Smart Office
- CVE-2025-10317Multiple Cross-Site Request Forgery in Quick.CartOpenSolution Quick.Cart
- CVE-2025-40103smb: client: Fix refcount leak for cifs_sb_tlinkLinux
- CVE-2025-40102KVM: arm64: Prevent access to vCPU events before initLinux
- CVE-2025-40101btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RSTLinux
- CVE-2025-40100btrfs: do not assert we found block group item when creating free space treeLinux
- CVE-2025-40098ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()Linux
- CVE-2025-40097ALSA: hda: Fix missing pointer check in hda_component_manager_init functionLinux
- CVE-2025-40091ixgbe: fix too early devlink_free() in ixgbe_remove()Linux
- CVE-2025-40089cxl/features: Add check for no entries in cxl_feature_infoLinux
- CVE-2025-40086drm/xe: Don't allow evicting of BOs in same VM in array of VM bindsLinux
- CVE-2025-54471NeuVector is shipping cryptographic material into its binarySUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-54941Apache Airflow: Command injection in "example_dag_decorator"Apache Software Foundation apache-airflow-core · airflow +1
- CVE-2025-62402Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in APIApache Software Foundation apache-airflow-core · airflow +1
- CVE-2025-62503Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)Apache Software Foundation apache-airflow> 3.0.0, < · apach…
- CVE-2025-11906Privilege escalation via writable configuration files in Progress FlowmonProgress Software Flowmon
- CVE-2025-11881AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposurescottopolis AppPresser – Mobile App Framework
- CVE-2025-10636NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSSNS Maintenance Mode for WP
- CVE-2025-10008Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletionremyb92 Translate WordPress with Weglot – Multilingual AI T…
- CVE-2025-11627Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoningsminozzi Site Checkup Debug AI Troubleshooting with Wizard…
- CVE-2025-12475Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy Companion
- CVE-2025-50574Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote…
- CVE-2025-50736An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to…pdf2zh
- CVE-2025-52179Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject…
- CVE-2025-52180Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject…
- CVE-2025-56313A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive).
- CVE-2025-57109Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors.
- CVE-2025-60319PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API…
- CVE-2025-60950An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary…
- CVE-2025-63608A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality.
- CVE-2025-63885A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via…