CVEs published November 6, 2025
243 CVEs were published on November 6, 2025: 31 critical, 141 high. Browse them by severity, product and exploitation status.
- Published
- 243
- Critical
- 31
- High
- 141
- Medium
- 69
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 82
Most affected products
- Google Chrome
- 16
- Advantech WebAccess/VPN
- 12
- Advantech iView
- 5
- uxper Togo
- 5
- Advantech DeviceOn/iEdge
- 4
- CodexThemes TheGem
- 3
- hogash KALLYAS
- 3
- MatiasDesuu ThinkDashboard
- 3
- Vito Peleg Atarim
- 3
- CodexThemes TheGem Theme Elements
- 2
Critical 31
- CVE-2025-12487oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerabilityoobabooga text-generation-webui
- CVE-2025-12488oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerabilityoobabooga text-generation-webui
- CVE-2022-50589SuiteCRM < 7.12.6 SQL Injection via 'export' FunctionalitySuiteCRM
- CVE-2022-50596D-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command InjectionD-Link DIR-1260
- CVE-2022-50595Advantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCEAdvantech iView
- CVE-2022-50593Advantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCEAdvantech iView
- CVE-2022-50592Advantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCEAdvantech iView
- CVE-2025-6327WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2025-6325WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2025-62065WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerabilityRometheme RTMKit
- CVE-2025-62064WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerabilityElated-Themes Search & Go
- CVE-2025-62047WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerabilityCase-Themes Case Addons
- CVE-2025-62016WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerabilityhogash KALLYAS
- CVE-2025-60245WordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerabilityWP User Manager
- CVE-2025-60243WordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerabilityHolest Engineering Selling Commander for WooCommerce
- CVE-2025-60235WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerabilityPlugify Support Ticket System for WooCommerce
- CVE-2025-60207WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload VulnerabilityAddify Custom User Registration Fields for WooCommerce
- CVE-2025-60195WordPress Atarim plugin <= 4.2.1 - Privilege Escalation vulnerabilityVito Peleg Atarim
- CVE-2025-58998WordPress s2Member Plugin <= 250701 - PHP Object Injection VulnerabilityCristián Lávaque s2Member
- CVE-2025-58996WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload VulnerabilityHelmut Wandl Advanced Settings
- CVE-2025-58636WordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data VulnerabilityCRM Perks WP Gravity Forms Keap/Infusionsoft
- CVE-2025-58627WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerabilitykamleshyadav Miraculous Core Plugin
- CVE-2025-53283WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerabilityborisolhor Drop Uploader for CF7 - Drag&Drop File Uploader…
- CVE-2025-53242WordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data VulnerabilityVictorThemes Seil
- CVE-2025-52773WordPress HieCOR Payment Gateway plugin plugin <= 1.5.11 - SQL Injection vulnerabilityHieCOR Payment Gateway Plugin
Show all 31 entriesShow fewer entries
- CVE-2025-49393WordPress Sign-up Sheets Plugin <= 2.3.2 - PHP Object Injection VulnerabilityFetch Designs Sign-up Sheets
- CVE-2025-49372WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerabilityVillaTheme HAPPY
- CVE-2025-48089WordPress Education WordPress Theme | HiStudy theme < 3.1.0 - SQL Injection vulnerabilityRainbow-Themes Education WordPress Theme | HiStudy
- CVE-2025-47588WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerabilityacowebs Dynamic Pricing With Discount Rules for WooCommerce
- CVE-2025-32222WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) VulnerabilityWidgetlogic.org Widget Logic
- CVE-2025-27918An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for…
High 141
- CVE-2025-58423Advantech DeviceOn/iEdge Path TraversalAdvantech DeviceOn/iEdge
- CVE-2025-59171Advantech DeviceOn/iEdge Path TraversalAdvantech DeviceOn/iEdge
- CVE-2025-62630Advantech DeviceOn/iEdge Path TraversalAdvantech DeviceOn/iEdge
- CVE-2025-11460Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video…Google Chrome
- CVE-2025-11458Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via…Google Chrome
- CVE-2025-11756Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2025-12036Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory…Google Chrome
- CVE-2025-11211Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory…Google Chrome
- CVE-2025-11209Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents…Google Chrome
- CVE-2025-11206Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape…Google Chrome
- CVE-2025-11205Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2024-121253scale-porta: readonly fields not validated server-side3scale porta · Red Hat 3scale API Management Platform
- CVE-2025-64178Jellysweep uses uncontrolled data in image cache API endpointjon4hz jellysweep · github.com/jon4hz/jellysweep
- CVE-2025-12790Rubygem-mqtt: rubygem-mqtt hostname validationNicholas J Humfrey ruby-mqtt · Red Hat Satellite +1
- CVE-2025-64173Apollo Router Core: Access Control Bypass on Polymorphic Typesapollographql router · apollo-router
- CVE-2025-52881runc: LSM labels can be bypassed with malicious config using dummy procfs filesopencontainers runc · github.com/opencontainers/runc +1
- CVE-2025-12486Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution VulnerabilityHeimdall Data Database Proxy
- CVE-2025-12489evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerabilityevernote-mcp-server
- CVE-2025-12490Netgate pfSense CE Suricata Path Traversal Remote Code Execution VulnerabilityNetgate pfSense
- CVE-2025-52565container escape due to /dev/console mount and related racesopencontainers runc · github.com/opencontainers/runc
- CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalitySuiteCRM
- CVE-2022-50591Advantech iView < v5.7.04 Build 6425 ztp_config_id Parameter SQL Injection Information DisclosureAdvantech iView
- CVE-2022-50594Advantech iView < v5.7.04 Build 6425 data Parameter SQL Injection Information DisclosureAdvantech iView
- CVE-2025-34242Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()Advantech WebAccess/VPN
- CVE-2025-34240Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()Advantech WebAccess/VPN
Show all 141 entriesShow fewer entries
- CVE-2025-34239Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()Advantech WebAccess/VPN
- CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditionsopencontainers runc · github.com/opencontainers/runc
- CVE-2024-25621containerd affected by a local privilege escalation via wide permissions on CRI directorycontainerd · github.com/containerd/containerd +1
- CVE-2025-10885Privilege Escalation VulnerabilityAutodesk Installer
- CVE-2025-12485Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to…Devolutions Server
- CVE-2025-64287WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerabilityEdge-Themes Alloggio - Hotel Booking
- CVE-2025-64232WordPress Import from YML plugin <= 3.1.17 - Cross Site Scripting (XSS) vulnerabilityicopydoc Import from YML
- CVE-2025-64224WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Conference Theme Custom Post Type
- CVE-2025-64198WordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerabilityappscreo Easy Social Share Buttons
- CVE-2025-64196WordPress Booster for WooCommerce plugin <= 7.2.5 - Cross Site Scripting (XSS) vulnerabilityPluggabl Booster for WooCommerce
- CVE-2025-62076WordPress Simple Payment plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityIdo Kobelkowsky Simple Payment
- CVE-2025-62075WordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerabilityIdo Kobelkowsky Simple Payment
- CVE-2025-62074WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerabilityAmauri WPMobile.App
- CVE-2025-62067WordPress Savory theme <= 2.5 - Local File Inclusion vulnerabilityElated-Themes Savory
- CVE-2025-62066WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerabilityfuelthemes Revolution
- CVE-2025-62059WordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force SureRank
- CVE-2025-62057WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality
- CVE-2025-62055WordPress Academist theme < 1.3 - Local File Inclusion vulnerabilityElated-Themes Academist
- CVE-2025-62053WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerabilityfavethemes Houzez
- CVE-2025-62045WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-62041WordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem
- CVE-2025-62040WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerabilityYOP Poll
- CVE-2025-62039WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerabilityAys Pro AI ChatBot with ChatGPT and Content Generator by AYS
- CVE-2025-62036WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerabilityuxper Togo
- CVE-2025-62035WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerabilityuxper Togo
- CVE-2025-62034WordPress Togo theme < 1.0.4 - Privilege Escalation vulnerabilityuxper Togo
- CVE-2025-62031WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilitytagDiv Composer
- CVE-2025-62014WordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerabilityApusTheme ITok
- CVE-2025-62010WordPress Famita theme <= 1.54 - Local File Inclusion vulnerabilityApusTheme Famita
- CVE-2025-60248WordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerabilityWPClever WPC Product Options for WooCommerce
- CVE-2025-60244WordPress TableOn plugin <= 1.0.5.1 - Content Injection vulnerabilityRealMag777 TableOn
- CVE-2025-60242WordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerabilityAnatoly Download Counter
- CVE-2025-60241WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerabilityPremmerce
- CVE-2025-60240WordPress AnyComment plugin <= 0.3.6 - Local File Inclusion vulnerabilityAlexander AnyComment
- CVE-2025-60239WordPress CoSchool LMS plugin <= 1.4.3 - SQL Injection vulnerabilityCodexpert CoSchool LMS
- CVE-2025-60204WordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerabilityJosh Kohlbach WooCommerce Store Toolkit
- CVE-2025-60203WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerabilityJosh Kohlbach Store Exporter
- CVE-2025-60202WordPress Favorites plugin <= 2.3.6 - Local File Inclusion vulnerabilityKyle Phillips Favorites
- CVE-2025-60201WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerabilityaguilatechnologies WP Customer Area
- CVE-2025-60200WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerabilityThimPress LearnPress Export Import
- CVE-2025-60199WordPress InHype - Blog & Magazine WordPress Theme theme <= 1.5.2 - Local File Inclusion vulnerabilitydedalx InHype - Blog & Magazine WordPress Theme
- CVE-2025-60198WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme <= 1.9.3 - Local File Inclusion vulnerabilitydedalx Saxon - Viral Content Blog & Magazine Marketing Word…
- CVE-2025-60197WordPress Simple Contact Forms plugin <= 1.6.4 - Local File Inclusion vulnerabilityowenr88 Simple Contact Forms
- CVE-2025-60196WordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerabilityClearblue® Ovulation Calculator
- CVE-2025-60194WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerabilityPremmerce Product Search for WooCommerce
- CVE-2025-60193WordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerabilityPremmerce User Roles
- CVE-2025-60192WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityPremmerce Wholesale Pricing for WooCommerce
- CVE-2025-60191WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityPremmerce Wishlist for WooCommerce
- CVE-2025-60190WordPress Immocaster WordPress Plugin plugin <= 1.3.6 - Local File Inclusion vulnerabilityHinnerk Altenburg Immocaster WordPress Plugin
- CVE-2025-60189WordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerabilityPoloPag – Pix Automático para Woocommerce
- CVE-2025-60188WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerabilityVito Peleg Atarim
- CVE-2025-60074WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerabilityProcessby Lazy Load Optimizer
- CVE-2025-60073WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerabilityProcessby Responsive Sidebar
- CVE-2025-59556WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerabilityskygroup GoStore
- CVE-2025-58995WordPress Leblix Theme <= 2.4 - Local File Inclusion VulnerabilityCreatives_Planet Leblix
- CVE-2025-58994WordPress Greenify theme <= 2.2 - Local File Inclusion vulnerabilitydesignervily Greenify
- CVE-2025-58972WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…
- CVE-2025-58964WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerabilityskygroup Enzy
- CVE-2025-58638WordPress Institutions Directory Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerabilitye-plugins Institutions Directory
- CVE-2025-58629WordPress Miraculous theme < 2.0.9 - Arbitrary Content Deletion vulnerabilitykamleshyadav Miraculous
- CVE-2025-58619WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerabilitysbouey Falang multilanguage
- CVE-2025-58592WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data VulnerabilityCozmoslabs TranslatePress
- CVE-2025-58207WordPress Ai Image Alt Text Generator for WP Plugin <= 1.1.5 - Broken Access Control VulnerabilityWP Messiah Ai Image Alt Text Generator for WP
- CVE-2025-54737WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
- CVE-2025-54722WordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEx-Themes WooTour
- CVE-2025-54721WordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityThimPress Resca
- CVE-2025-54719WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data VulnerabilityNooTheme Yogi - Health Beauty & Yoga
- CVE-2025-54718WordPress Yogi - Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityNooTheme Yogi - Health Beauty & Yoga
- CVE-2025-54711WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control VulnerabilitybPlugins Info Cards
- CVE-2025-53586WordPress WeMusic Theme <= 1.9.1 - PHP Object Injection VulnerabilityNooTheme WeMusic
- CVE-2025-53585WordPress WeMusic theme <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityNooTheme WeMusic
- CVE-2025-53574WordPress Doliconnect Plugin <= 9.3.2 - Cross Site Scripting (XSS) Vulnerabilityptibogxiv Doliconnect
- CVE-2025-53573WordPress Epic Review Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerabilityjegtheme Epic Review
- CVE-2025-53349WordPress Kalium Theme <= 3.18.3 - Cross Site Scripting (XSS) VulnerabilityLaborator Kalium
- CVE-2025-53324WordPress Gutenify Plugin <= 1.5.7 - Cross Site Scripting (XSS) VulnerabilityCodeYatri Gutenify
- CVE-2025-53316WordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityShahjahan Jewel WP GDPR Cookie Consent
- CVE-2025-53286WordPress Dropify plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityJhainey Milevis Dropify
- CVE-2025-53252WordPress Zegen Theme <= 1.1.9 - Local File Inclusion Vulnerabilityzozothemes Zegen
- CVE-2025-53245WordPress WP Logo Changer Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityAfzal Multani WP Logo Changer
- CVE-2025-53239WordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerabilitybnovotny User Registration Aide
- CVE-2025-52764WordPress flexoslider plugin <= 1.0004 - Cross Site Scripting (XSS) vulnerabilitymarielav flexoslider
- CVE-2025-49909WordPress Penci Bookmark & Follow plugin < 2.4 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Bookmark & Follow
- CVE-2025-49905WordPress Range Slider Addon for Gravity Forms plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityPluginsCafe Range Slider Addon for Gravity Forms
- CVE-2025-49904WordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-49900WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerabilitybPlugins Advanced scrollbar
- CVE-2025-49394WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerabilitybPlugins Image Gallery block – Create and display photo gal…
- CVE-2025-49390WordPress Cookie Notice & Consent plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilitychristophrado Cookie Notice & Consent
- CVE-2025-49386WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection VulnerabilityScott Reilly Preserve Code Formatting
- CVE-2025-48330WordPress Real Time Validation for Gravity Forms <= 1.7.0 - Local File Inclusion VulnerabilityDaman Jeet Real Time Validation for Gravity Forms
- CVE-2025-48290WordPress Kinsley theme <= 3.4.4 - Local File Inclusion vulnerabilitybslthemes Kinsley
- CVE-2025-48090WordPress Blanka - One Page WordPress Theme Theme < 1.5 - Local File Inclusion VulnerabilityCocoBasic Blanka - One Page WordPress Theme
- CVE-2025-48085WordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityZIPANG Simple Stripe
- CVE-2025-48083WordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityandriassundskard wpNamedUsers
- CVE-2025-48078WordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityNorbert Slick Google Map
- CVE-2025-48077WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitynitinmaurya12 Block Country
- CVE-2025-39468WordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerabilitypantherius Modal Survey
- CVE-2025-39467WordPress Wanderland theme <= 1.7.1 - Local File Inclusion VulnerabilityMikado-Themes Wanderland
- CVE-2025-39466WordPress Dør theme <= 2.4 - Local File Inclusion VulnerabilityMikado-Themes Dør
- CVE-2025-39463WordPress Dessau theme < 1.9 - Local File Inclusion vulnerabilitySelect-Themes Dessau
- CVE-2025-31029WordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilitybingu replyMail
- CVE-2025-28953WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerabilityaxiomthemes smart SEO
- CVE-2025-12556IDIS ICM Viewer Argument InjectionIDIS ICM Viewer
- CVE-2025-11956XSS in Proliz's OBSProliz Software Ltd. OBS
- CVE-2025-37735Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the…Elastic Kibana
- CVE-2025-9338A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver.ASUS Armoury Crate
- CVE-2025-64171MARIN3R: Cross-Namespace Vulnerability in the Operator3scale-sre marin3r · github.com/3scale-sre/marin3r
- CVE-2025-64164DataEase is vulnerable to Oracle JNDI Injectiondataease
- CVE-2025-27916An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0.
- CVE-2025-27917An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for…
- CVE-2025-27919An issue was discovered in AnyDesk through 9.0.4.
- CVE-2025-60541A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan…
- CVE-2025-63307alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2025-63551A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content…
- CVE-2025-63560An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of…
- CVE-2025-63588An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and…
- CVE-2025-63589A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or…
Medium, low and unrated 71
- CVE-2025-12789Rhsso: open redirectRed Hat Single Sign-On
- CVE-2025-64302Advantech DeviceOn/iEdge Cross-site ScriptingAdvantech DeviceOn/iEdge
- CVE-2025-12636Ubia UboxUbia Ubox Android · Ubia Ubox IOS
- CVE-2025-11219Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access…Google Chrome
- CVE-2025-11216Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain…Google Chrome
- CVE-2025-11215Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a…Google Chrome
- CVE-2025-11213Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user…Google Chrome
- CVE-2025-11212Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to…Google Chrome
- CVE-2025-11210Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage…Google Chrome
- CVE-2025-11208Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in…Google Chrome
- CVE-2025-11207Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary…Google Chrome
- CVE-2025-64179lakeFS: Unauthenticated access to API usage metricstreeverse lakeFS · github.com/treeverse/lakefs
- CVE-2025-64177ThinkDashboard: Stored XSS in Dashboard via Malicious BookmarkMatiasDesuu ThinkDashboard
- CVE-2025-64176ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import FeatureMatiasDesuu ThinkDashboard
- CVE-2025-64327ThinkDashboard: Blind Server-Side Request Forgery (SSRF) vulnerability in /api/ping EndpointMatiasDesuu ThinkDashboard
- CVE-2025-64326Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit logWeblateOrg weblate · weblate +1
- CVE-2025-64174OpenMage is vulnerable to XSS in Admin NotificationsOpenMage magento-lts · openmage/magento-lts
- CVE-2025-33110IBM OpenPages Vulnerable to HTML InjectionIBM OpenPages
- CVE-2025-34247Advantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()Advantech WebAccess/VPN
- CVE-2025-34246Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()Advantech WebAccess/VPN
- CVE-2025-34245Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()Advantech WebAccess/VPN
- CVE-2025-34244Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction()Advantech WebAccess/VPN
- CVE-2025-34243Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()Advantech WebAccess/VPN
- CVE-2025-34241Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()Advantech WebAccess/VPN
- CVE-2025-34238Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()Advantech WebAccess/VPN
Show all 71 entriesShow fewer entries
- CVE-2025-34237Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()Advantech WebAccess/VPN
- CVE-2025-34236Advantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()Advantech WebAccess/VPN
- CVE-2025-22397Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and…Integrated Dell Remote Access Controller 9 14G Versions… +1
- CVE-2025-12815An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version…AWS Research and Engineering Studio
- CVE-2025-12808Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists…Devolutions Server
- CVE-2025-62950WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2025-62914WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerabilityanibalwainstein Effect Maker
- CVE-2025-62051WordPress UDesign Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerabilityAndonDesign UDesign Core
- CVE-2025-62049WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerabilityStylemix Cost Calculator Builder
- CVE-2025-62046WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerabilityCodexThemes TheGem Demo Import
- CVE-2025-62044WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-62038WordPress MeetingHub plugin <= 1.23.9 - Sensitive Data Exposure vulnerabilitySovlix MeetingHub
- CVE-2025-62037WordPress Togo theme < 1.0.4 - Broken Access Control vulnerabilityuxper Togo
- CVE-2025-62033WordPress Togo theme < 1.0.4 - Broken Access Control vulnerabilityuxper Togo
- CVE-2025-62032WordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerabilitytagDiv Cloud Library
- CVE-2025-62030WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilitytagDiv Composer
- CVE-2025-62028WordPress Salient theme < 17.4.0 - Broken Access Control vulnerabilityThemeNectar Salient
- CVE-2025-62018WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerabilityhogash KALLYAS
- CVE-2025-62017WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerabilityhogash KALLYAS
- CVE-2025-62012WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem
- CVE-2025-62011WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem
- CVE-2025-60247WordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerabilityBux Woocommerce
- CVE-2025-60187WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityVito Peleg Atarim
- CVE-2025-58986WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerabilityganddser Jock On Air Now
- CVE-2025-58595WordPress All In One Login plugin <= 2.0.8 - Bypass Vulnerability vulnerabilitySaad Iqbal All In One Login
- CVE-2025-58243WordPress imEvent Theme <= 3.4.0 - Broken Access Control VulnerabilityJthemes imEvent
- CVE-2025-5803WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerabilitye4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2025-53246WordPress Backup and Move Plugin <= 0.1 - Broken Access Control VulnerabilityGaurav Aggarwal Backup and Move
- CVE-2025-53214WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control VulnerabilitySertifier Certificate & Badge Maker
- CVE-2025-49398WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerabilityEasy Appointments
- CVE-2025-48086WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerabilitywpdreams Ajax Search Lite
- CVE-2025-39465WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerabilityflippercode Advanced Google Maps
- CVE-2025-22288WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Smush Image C…
- CVE-2025-10955HTML Injection in Netcad Software's NetigmaNetcad Software Netigma
- CVE-2025-36054Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -IBM Business Automation Workflow containers · IBM Business…
- CVE-2025-11268Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Executionwpchill Strong Testimonials
- CVE-2025-12360Better Find and Replace <= 1.7.7 - Missing Authorizationcodesolz Better Find and Replace – AI-Powered Suggestions
- CVE-2025-10259Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +81
- CVE-2025-12471Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scriptingnerdpressteam Hubbub Lite – Fast, free social sharing and f…
- CVE-2025-12560Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_urlpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2025-11271Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulationsmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2025-12563Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Uploadpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2025-61994Cross-site scripting vulnerability exists in GROWI prior to v7.2.10.GROWI
- CVE-2025-10691Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletionyudiz Easy Email Subscription
- CVE-2025-10683Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uidyudiz Easy Email Subscription
- CVE-2025-59392On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive…