# CVEs published 2025-12-10

261 CVEs were published on December 10, 2025: 31 critical, 74 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-67648](https://cve.now/CVE-2025-67648.md): Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page (CVSS 7.1, shopware · shopware/shopware +1)
- [CVE-2025-67646](https://cve.now/CVE-2025-67646.md): TableProgressTracking's missing CSRF protection allows unauthorized state changes (CVSS 3.5, Telepedia TableProgressTracking)
- [CVE-2025-67644](https://cve.now/CVE-2025-67644.md): LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method (CVSS 7.3, langchain-ai langgraph · langgraph-checkpoint-sqlite)
- [CVE-2025-67511](https://cve.now/CVE-2025-67511.md): Cybersecurity AI (CAI) vulnerable to Command Injection in run\_ssh\_command\_with\_credentials Agent tool (CVSS 9.7, aliasrobotics cai · cai-framework)
- [CVE-2025-67509](https://cve.now/CVE-2025-67509.md): MySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write (CVSS 8.2, neuron-core neuron-ai · neuron-core/neuron-ai)
- [CVE-2025-67510](https://cve.now/CVE-2025-67510.md): MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) (CVSS 9.4, neuron-core neuron-ai · neuron-core/neuron-ai)
- [CVE-2025-67513](https://cve.now/CVE-2025-67513.md): FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API (CVSS 6.9, FreePBX endpoint)
- [CVE-2025-67505](https://cve.now/CVE-2025-67505.md): Race condition in the Okta Java SDK (CVSS 8.4, okta-sdk-java · com.okta.sdk:okta-sdk-root)
- [CVE-2025-67490](https://cve.now/CVE-2025-67490.md): Auth0 Next.js SDK has Improper Request Caching Lookup (CVSS 5.4, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2025-66628](https://cve.now/CVE-2025-66628.md): ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only) (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +5)
- [CVE-2025-66474](https://cve.now/CVE-2025-66474.md): XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection (CVSS 8.7, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2025-66473](https://cve.now/CVE-2025-66473.md): XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-66033](https://cve.now/CVE-2025-66033.md): Improper Memory Cleanup in the Okta Java SDK (CVSS 5.3, okta-sdk-java · com.okta.sdk:okta-sdk-root)
- [CVE-2025-66472](https://cve.now/CVE-2025-66472.md): XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-flami… +1)
- [CVE-2024-58285](https://cve.now/CVE-2024-58285.md): Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title (CVSS 5.3, Chyrp)
- [CVE-2024-58284](https://cve.now/CVE-2024-58284.md): PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings (CVSS 8.6, PopojiCMS)
- [CVE-2024-58283](https://cve.now/CVE-2024-58283.md): WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload (CVSS 8.7, WBCE CMS)
- [CVE-2024-58282](https://cve.now/CVE-2024-58282.md): Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload (CVSS 8.6, Serendipity)
- [CVE-2024-58281](https://cve.now/CVE-2024-58281.md): Dotclear 2.29 Remote Code Execution via Authenticated File Upload (CVSS 8.7, Dotclear)
- [CVE-2024-58280](https://cve.now/CVE-2024-58280.md): CMSimple 5.15 Remote Command Execution via Extensions Configuration (CVSS 8.6, CMSimple)
- [CVE-2024-58279](https://cve.now/CVE-2024-58279.md): appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload (CVSS 8.6, appRain CMF)
- [CVE-2023-53776](https://cve.now/CVE-2023-53776.md): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (CVSS 8.7, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53775](https://cve.now/CVE-2023-53775.md): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (CVSS 7.1, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53741](https://cve.now/CVE-2023-53741.md): Screen SFT DAB 1.9.3 Authentication Bypass via IP Session Management (CVSS 5.1, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53740](https://cve.now/CVE-2023-53740.md): Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change (CVSS 8.6, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2020-36902](https://cve.now/CVE-2020-36902.md): UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges (CVSS 9.3, UBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…)
- [CVE-2020-36901](https://cve.now/CVE-2020-36901.md): UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management (CVSS 8.6, UBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…)
- [CVE-2020-36900](https://cve.now/CVE-2020-36900.md): All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management (CVSS 8.6, All-Dynamics Software Digital Signage System)
- [CVE-2020-36899](https://cve.now/CVE-2020-36899.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure (CVSS 8.7, Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…)
- [CVE-2020-36898](https://cve.now/CVE-2020-36898.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion (CVSS 8.8, Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…)
- [CVE-2020-36897](https://cve.now/CVE-2020-36897.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution (CVSS 9.3, Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…)
- [CVE-2020-36896](https://cve.now/CVE-2020-36896.md): QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure (CVSS 8.7, Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…)
- [CVE-2020-36895](https://cve.now/CVE-2020-36895.md): EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure (CVSS 8.7, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36894](https://cve.now/CVE-2020-36894.md): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation Vulnerability (CVSS 9.3, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36893](https://cve.now/CVE-2020-36893.md): Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability (CVSS 8.7, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36892](https://cve.now/CVE-2020-36892.md): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation (CVSS 9.3, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36888](https://cve.now/CVE-2020-36888.md): SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script (CVSS 6.9, SpenetiX AG Fusion Digital Signage)
- [CVE-2020-36887](https://cve.now/CVE-2020-36887.md): SpinetiX Fusion Digital Signage 3.4.8 Unauthenticated Database Backup Disclosure (CVSS 8.7, SpinetiX AG Fusion Digital Signage)
- [CVE-2020-36886](https://cve.now/CVE-2020-36886.md): SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation (CVSS 6.9, SpenetiX AG Fusion Digital Signage)
- [CVE-2020-36885](https://cve.now/CVE-2020-36885.md): Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi (CVSS 9.3, Sony Electronics IPELA Network Camera)
- [CVE-2020-36884](https://cve.now/CVE-2020-36884.md): BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF (CVSS 6.9, BrightSign Digital Signage Diagnostic Web Server)
- [CVE-2020-36883](https://cve.now/CVE-2020-36883.md): SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations (CVSS 8.8, SpenetiX AG Fusion Digital Signage)
- [CVE-2025-62181](https://cve.now/CVE-2025-62181.md): Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a… (CVSS 5.3, Pegasystems Pega Infinity)
- [CVE-2025-65950](https://cve.now/CVE-2025-65950.md): WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups\[\] Parameter (CVSS 9.4, WBCE\_CMS)
- [CVE-2025-67460](https://cve.now/CVE-2025-67460.md): Zoom Rooms for Windows - Software Downgrade Protection Mechanism Failure (CVSS 7.8, Zoom Communications Zoom Rooms)
- [CVE-2025-67461](https://cve.now/CVE-2025-67461.md): Zoom Rooms for macOS - External Control of File Name or Path (CVSS 5.0, Zoom Communications Zoom Rooms)
- [CVE-2025-64622](https://cve.now/CVE-2025-64622.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64582](https://cve.now/CVE-2025-64582.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64547](https://cve.now/CVE-2025-64547.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64833](https://cve.now/CVE-2025-64833.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64613](https://cve.now/CVE-2025-64613.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64829](https://cve.now/CVE-2025-64829.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64553](https://cve.now/CVE-2025-64553.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64545](https://cve.now/CVE-2025-64545.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64546](https://cve.now/CVE-2025-64546.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64537](https://cve.now/CVE-2025-64537.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-64574](https://cve.now/CVE-2025-64574.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64550](https://cve.now/CVE-2025-64550.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64827](https://cve.now/CVE-2025-64827.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64602](https://cve.now/CVE-2025-64602.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64593](https://cve.now/CVE-2025-64593.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64539](https://cve.now/CVE-2025-64539.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-34427](https://cve.now/CVE-2025-34427.md): MailEnable \< 10.54 Cleartext Credential Storage in AUTH.TAB (CVSS 8.4, MailEnable)
- [CVE-2025-64887](https://cve.now/CVE-2025-64887.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64548](https://cve.now/CVE-2025-64548.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64563](https://cve.now/CVE-2025-64563.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64800](https://cve.now/CVE-2025-64800.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64559](https://cve.now/CVE-2025-64559.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64817](https://cve.now/CVE-2025-64817.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64888](https://cve.now/CVE-2025-64888.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64600](https://cve.now/CVE-2025-64600.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64583](https://cve.now/CVE-2025-64583.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64826](https://cve.now/CVE-2025-64826.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64538](https://cve.now/CVE-2025-64538.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-64605](https://cve.now/CVE-2025-64605.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64875](https://cve.now/CVE-2025-64875.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64598](https://cve.now/CVE-2025-64598.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64558](https://cve.now/CVE-2025-64558.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64616](https://cve.now/CVE-2025-64616.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64820](https://cve.now/CVE-2025-64820.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64861](https://cve.now/CVE-2025-64861.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64801](https://cve.now/CVE-2025-64801.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64620](https://cve.now/CVE-2025-64620.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64601](https://cve.now/CVE-2025-64601.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34428](https://cve.now/CVE-2025-34428.md): MailEnable \< 10.54 Cleartext Credential Storage in AUTH.SAV (CVSS 8.4, MailEnable)
- [CVE-2025-64560](https://cve.now/CVE-2025-64560.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64556](https://cve.now/CVE-2025-64556.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64565](https://cve.now/CVE-2025-64565.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64606](https://cve.now/CVE-2025-64606.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64823](https://cve.now/CVE-2025-64823.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64596](https://cve.now/CVE-2025-64596.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64572](https://cve.now/CVE-2025-64572.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64541](https://cve.now/CVE-2025-64541.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64609](https://cve.now/CVE-2025-64609.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64822](https://cve.now/CVE-2025-64822.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64789](https://cve.now/CVE-2025-64789.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64881](https://cve.now/CVE-2025-64881.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64825](https://cve.now/CVE-2025-64825.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64845](https://cve.now/CVE-2025-64845.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64626](https://cve.now/CVE-2025-64626.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64544](https://cve.now/CVE-2025-64544.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64597](https://cve.now/CVE-2025-64597.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64611](https://cve.now/CVE-2025-64611.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64821](https://cve.now/CVE-2025-64821.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64580](https://cve.now/CVE-2025-64580.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64586](https://cve.now/CVE-2025-64586.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64627](https://cve.now/CVE-2025-64627.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64566](https://cve.now/CVE-2025-64566.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64604](https://cve.now/CVE-2025-64604.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64599](https://cve.now/CVE-2025-64599.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64804](https://cve.now/CVE-2025-64804.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64623](https://cve.now/CVE-2025-64623.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64858](https://cve.now/CVE-2025-64858.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64847](https://cve.now/CVE-2025-64847.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64607](https://cve.now/CVE-2025-64607.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64803](https://cve.now/CVE-2025-64803.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34429](https://cve.now/CVE-2025-34429.md): 1Panel CSRF Web Port Configuration Change (CVSS 7.0, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-64577](https://cve.now/CVE-2025-64577.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64863](https://cve.now/CVE-2025-64863.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64853](https://cve.now/CVE-2025-64853.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64814](https://cve.now/CVE-2025-64814.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64612](https://cve.now/CVE-2025-64612.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64857](https://cve.now/CVE-2025-64857.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64794](https://cve.now/CVE-2025-64794.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64591](https://cve.now/CVE-2025-64591.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64555](https://cve.now/CVE-2025-64555.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64549](https://cve.now/CVE-2025-64549.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64808](https://cve.now/CVE-2025-64808.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64840](https://cve.now/CVE-2025-64840.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64564](https://cve.now/CVE-2025-64564.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64551](https://cve.now/CVE-2025-64551.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64569](https://cve.now/CVE-2025-64569.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64850](https://cve.now/CVE-2025-64850.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64592](https://cve.now/CVE-2025-64592.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64543](https://cve.now/CVE-2025-64543.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64578](https://cve.now/CVE-2025-64578.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64839](https://cve.now/CVE-2025-64839.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34430](https://cve.now/CVE-2025-34430.md): 1Panel CSRF Panel Name Modification (CVSS 5.1, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-64554](https://cve.now/CVE-2025-64554.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64791](https://cve.now/CVE-2025-64791.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64841](https://cve.now/CVE-2025-64841.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64619](https://cve.now/CVE-2025-64619.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64799](https://cve.now/CVE-2025-64799.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64581](https://cve.now/CVE-2025-64581.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64852](https://cve.now/CVE-2025-64852.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64576](https://cve.now/CVE-2025-64576.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64615](https://cve.now/CVE-2025-64615.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64873](https://cve.now/CVE-2025-64873.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64590](https://cve.now/CVE-2025-64590.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64557](https://cve.now/CVE-2025-64557.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64790](https://cve.now/CVE-2025-64790.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64585](https://cve.now/CVE-2025-64585.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64797](https://cve.now/CVE-2025-64797.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64579](https://cve.now/CVE-2025-64579.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64869](https://cve.now/CVE-2025-64869.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64796](https://cve.now/CVE-2025-64796.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64603](https://cve.now/CVE-2025-64603.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64792](https://cve.now/CVE-2025-64792.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64575](https://cve.now/CVE-2025-64575.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64802](https://cve.now/CVE-2025-64802.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64793](https://cve.now/CVE-2025-64793.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64594](https://cve.now/CVE-2025-64594.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64614](https://cve.now/CVE-2025-64614.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64872](https://cve.now/CVE-2025-64872.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Experience Manager)
- [CVE-2025-64562](https://cve.now/CVE-2025-64562.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-65199](https://cve.now/CVE-2025-65199.md): Windscribe for Linux 'changeMTU' local privilege escalation (CVSS 7.8, Windscribe for Linux Desktop App)
- [CVE-2025-5467](https://cve.now/CVE-2025-5467.md): Ubuntu Apport Insecure File Permissions Vulnerability (CVSS 1.9, Canonical apport)
- [CVE-2025-13607](https://cve.now/CVE-2025-13607.md): D-Link CCTV camera model DCS-F5614-L1 Missing Authentication for Critical Function (CVSS 9.3, D-Link DCS-F5614-L1)
- [CVE-2025-67643](https://cve.now/CVE-2025-67643.md): Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b\_9517b\_6b\_202 and earlier does not correctly perform path validation of the… (CVSS 4.3, Jenkins Project Jenkins Redpen - Pipeline Reporter for Jira…)
- [CVE-2025-67642](https://cve.now/CVE-2025-67642.md): Jenkins HashiCorp Vault Plugin 371.v884a\_4dd60fb\_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing… (CVSS 4.3, Jenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2025-67641](https://cve.now/CVE-2025-67641.md): Jenkins Coverage Plugin 2.3054.ve1ff7b\_a\_a\_123b\_ and earlier does not validate the configured coverage results ID when creating coverage… (CVSS 8.0, Jenkins Project Jenkins Coverage Plugin · io.jenkins.plugin…)
- [CVE-2025-67640](https://cve.now/CVE-2025-67640.md): Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a… (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-67639](https://cve.now/CVE-2025-67639.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users… (CVSS 3.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67638](https://cve.now/CVE-2025-67638.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form… (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67637](https://cve.now/CVE-2025-67637.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins… (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67636](https://cve.now/CVE-2025-67636.md): A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view… (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67635](https://cve.now/CVE-2025-67635.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes… (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-co… +1)
- [CVE-2025-34421](https://cve.now/CVE-2025-34421.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISP.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34417](https://cve.now/CVE-2025-34417.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISO.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34419](https://cve.now/CVE-2025-34419.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISM.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34416](https://cve.now/CVE-2025-34416.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIPO.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34422](https://cve.now/CVE-2025-34422.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIPC.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34418](https://cve.now/CVE-2025-34418.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIMF.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34424](https://cve.now/CVE-2025-34424.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIDP.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34423](https://cve.now/CVE-2025-34423.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34420](https://cve.now/CVE-2025-34420.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIAM.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34410](https://cve.now/CVE-2025-34410.md): 1Panel CSRF in Change Username Functionality Allows Account Lockout (CVSS 7.0, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-34395](https://cve.now/CVE-2025-34395.md): Barracuda RMM \< 2025.1.1 Service Center .NET Remoting Path Traversal RCE (CVSS 8.7, Barracuda Networks RMM)
- [CVE-2025-34394](https://cve.now/CVE-2025-34394.md): Barracuda RMM \< 2025.1.1 Service Center .NET Remoting Deserialization RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-34393](https://cve.now/CVE-2025-34393.md): Barracuda RMM \< 2025.1.1 Service Center Insecure Reflection RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-34392](https://cve.now/CVE-2025-34392.md): Barracuda RMM \< 2025.1.1 Service Center Absolute Path Traversal RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-13125](https://cve.now/CVE-2025-13125.md): IDOR in Im Park's DijiDemi (CVSS 4.3, Im Park Information Technology, Electronics, Press, Publish…)
- [CVE-2025-13155](https://cve.now/CVE-2025-13155.md): An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code… (CVSS 8.5, Lenovo Baiying Client)
- [CVE-2025-13152](https://cve.now/CVE-2025-13152.md): A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local… (CVSS 8.5, Lenovo One Client)
- [CVE-2025-12046](https://cve.now/CVE-2025-12046.md): A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated… (CVSS 8.5, Lenovo App Store · Lenovo Browser)
- [CVE-2025-13127](https://cve.now/CVE-2025-13127.md): XSS in TACAS Consulting's GoldenHorn (CVSS 3.5, TAC Information Services Internal and External Trade Golden…)
- [CVE-2025-8110](https://cve.now/CVE-2025-8110.md): File overwrite in file update API in Gogs (CVSS 8.7, KEV, Gogs · gogs.io/gogs)
- [CVE-2024-2105](https://cve.now/CVE-2024-2105.md): JBL: Improper validation of ICM field in connection requests (CVSS 6.5, JBL Flip · JBL Pulse +2)
- [CVE-2024-2104](https://cve.now/CVE-2024-2104.md): JBL: Improper BLE security configurations and lack of authentication on the device's GATT server (CVSS 8.8, JBL LIVE PRO 2 TWS · JBL TUNE FLEX)
- [CVE-2025-13184](https://cve.now/CVE-2025-13184.md): Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password (CVSS 9.8, Toto Link X5000R's)
- [CVE-2025-13953](https://cve.now/CVE-2025-13953.md): Bypass in the authentication method of the GTT Sistema de Información Tributario application (CVSS 9.3, GTT Sistema de Información Tributario)
- [CVE-2025-41358](https://cve.now/CVE-2025-41358.md): Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A (CVSS 8.3, CronosWeb i2A CronosWeb)
- [CVE-2025-41732](https://cve.now/CVE-2025-41732.md): Stack-based buffer overflow via unsafe sscanf in check\_cookie() (CVSS 9.8, WAGO Indsutrial-Managed-Switches)
- [CVE-2025-41730](https://cve.now/CVE-2025-41730.md): Stack-based buffer overflow via unsafe sscanf in check\_account() (CVSS 9.8, WAGO Indsutrial-Managed-Switches)
- [CVE-2025-7073](https://cve.now/CVE-2025-7073.md): Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security (CVSS 8.8, Bitdefender Total Security · Bitdefender Internet Securi… +1)
- [CVE-2025-66675](https://cve.now/CVE-2025-66675.md): Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed (CVSS 8.2, Apache Software Foundation org.apache.struts:struts2-core ·…)
- [CVE-2025-14390](https://cve.now/CVE-2025-14390.md): Video Merchant \<= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, videomerchant Video Merchant)
- [CVE-2025-66004](https://cve.now/CVE-2025-66004.md): Local privilege escalation in usbmuxd from arbitrary local user to usbmux (CVSS 5.1, libimobiledevice usbmuxd)
- [CVE-2025-14082](https://cve.now/CVE-2025-14082.md): Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure (CVSS 2.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2025-1161](https://cve.now/CVE-2025-1161.md): Improper Authorization in Nomysoft Informatics' Nomysem (CVSS 7.1, NomySoft Information Technology Training and Consulting Nom…)
- [CVE-2025-14087](https://cve.now/CVE-2025-14087.md): Glib: glib: buffer underflow in gvariant parser leads to heap corruption (CVSS 5.6, GNOME glib · Red Hat Enterprise Linux +8)
- [CVE-2025-9315](https://cve.now/CVE-2025-9315.md): Unauthenticated Device Registration Vulnerability in MXsecurity Series (CVSS 6.3, Moxa MXsecurity Series)
- [CVE-2025-13955](https://cve.now/CVE-2025-13955.md): Predictable Default Wi-Fi Password in EZCast Pro II Dongle (CVSS 9.3, EZCast Pro II)
- [CVE-2025-13954](https://cve.now/CVE-2025-13954.md): Hard-coded cryptographic keys in EZCast Pro II Dongle (CVSS 9.3, EZCast Pro II)
- [CVE-2025-12952](https://cve.now/CVE-2025-12952.md): Privilege Escalation in Dialogflow CX via Webhook Admin Role (CVSS 8.7, Google Cloud Dialogflow CX)
- [CVE-2025-9571](https://cve.now/CVE-2025-9571.md): Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload (CVSS 8.7, Google Cloud Cloud Data Fusion)
- [CVE-2025-13073](https://cve.now/CVE-2025-13073.md): HandL UTM Grabber / Tracker \< 2.8.1 - Reflected XSS via handl\_landing\_page (CVSS 7.1, HandL UTM Grabber / Tracker)
- [CVE-2025-13072](https://cve.now/CVE-2025-13072.md): HandL UTM Grabber / Tracker \< 2.8.1 - Reflected XSS via utm\_source (CVSS 7.1, HandL UTM Grabber / Tracker)
- [CVE-2025-13339](https://cve.now/CVE-2025-13339.md): Hippoo Mobile App for WooCommerce \<= 1.7.1 - Unauthenticated Arbitrary File Read (CVSS 7.5, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2025-9056](https://cve.now/CVE-2025-9056.md): Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. (CVSS 5.3, TECNO com.transsion.audiosmartconnect)
- [CVE-2025-13677](https://cve.now/CVE-2025-13677.md): Simple Download Counter \<= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal (CVSS 4.9, specialk Simple Download Counter)
- [CVE-2025-13613](https://cve.now/CVE-2025-13613.md): Elated Membership \<= 1.2 - Authentication Bypass via Social Login (CVSS 9.8, Elated Themes Elated Membership)
- [CVE-2025-67507](https://cve.now/CVE-2025-67507.md): Filament's multi-factor authentication (app) recovery codes can be used multiple times (CVSS 8.1, filamentphp filament · filament/filament)
- [CVE-2025-67506](https://cve.now/CVE-2025-67506.md): PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload (CVSS 9.8, pipeshub-ai)
- [CVE-2025-67485](https://cve.now/CVE-2025-67485.md): HTTP/HTTPS Traffic Interception Bypass in mad-proxy (CVSS 5.3, machphy mad-proxy · mad-proxy)
- [CVE-2025-24857](https://cve.now/CVE-2025-24857.md): Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips… (CVSS 7.6)
- [CVE-2025-52493](https://cve.now/CVE-2025-52493.md): PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. (CVSS 6.5)
- [CVE-2025-56429](https://cve.now/CVE-2025-56429.md): Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information… (CVSS 6.1)
- [CVE-2025-56430](https://cve.now/CVE-2025-56430.md): Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via… (CVSS 7.5)
- [CVE-2025-56431](https://cve.now/CVE-2025-56431.md): Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via… (CVSS 7.5)
- [CVE-2025-63094](https://cve.now/CVE-2025-63094.md): XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing… (CVSS 7.5)
- [CVE-2025-63895](https://cve.now/CVE-2025-63895.md): An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service… (CVSS 7.5)
- [CVE-2025-65290](https://cve.now/CVE-2025-65290.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 fail to validate server certificates during… (CVSS 7.4)
- [CVE-2025-65291](https://cve.now/CVE-2025-65291.md): Aqara Hub devices including Hub M2 4.3.6\_0027, Hub M3 4.3.6\_0025, Camera Hub G3 4.1.9\_0027 fail to validate server certificates in TLS… (CVSS 7.4)
- [CVE-2025-65292](https://cve.now/CVE-2025-65292.md): Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 allows… (CVSS 7.3)
- [CVE-2025-65293](https://cve.now/CVE-2025-65293.md): Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9\_0027 allow attackers to execute arbitrary commands with root privileges… (CVSS 6.6)
- [CVE-2025-65294](https://cve.now/CVE-2025-65294.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 contain an undocumented remote access… (CVSS 9.8)
- [CVE-2025-65295](https://cve.now/CVE-2025-65295.md): Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025… (CVSS 8.1)
- [CVE-2025-65296](https://cve.now/CVE-2025-65296.md): NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6\_0027, Hub M3 4.3.6\_0025, and Camera Hub G3 4.1.9\_0027 in the JSON… (CVSS 6.5)
- [CVE-2025-65297](https://cve.now/CVE-2025-65297.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 automatically collect and upload… (CVSS 7.5)
- [CVE-2025-65512](https://cve.now/CVE-2025-65512.md): A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2… (CVSS 7.5)
- [CVE-2025-65602](https://cve.now/CVE-2025-65602.md): A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a… (CVSS 9.8)
- [CVE-2025-65754](https://cve.now/CVE-2025-65754.md): Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a… (CVSS 6.1, github.com/xyproto/algernon)
- [CVE-2025-65792](https://cve.now/CVE-2025-65792.md): DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. (CVSS 9.1)
- [CVE-2025-65803](https://cve.now/CVE-2025-65803.md): An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service… (CVSS 6.5)
- [CVE-2025-65807](https://cve.now/CVE-2025-65807.md): An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. (CVSS 8.4, sd)
- [CVE-2025-65814](https://cve.now/CVE-2025-65814.md): A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a… (CVSS 6.5)
- [CVE-2025-65815](https://cve.now/CVE-2025-65815.md): A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a… (CVSS 6.5)
- [CVE-2025-65820](https://cve.now/CVE-2025-65820.md): An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. (CVSS 9.8)
- [CVE-2025-65821](https://cve.now/CVE-2025-65821.md): As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and… (CVSS 7.5)
- [CVE-2025-65822](https://cve.now/CVE-2025-65822.md): The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. (CVSS 6.8)
- [CVE-2025-65823](https://cve.now/CVE-2025-65823.md): The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. (CVSS 9.8)
- [CVE-2025-65824](https://cve.now/CVE-2025-65824.md): An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using… (CVSS 8.8)
- [CVE-2025-65825](https://cve.now/CVE-2025-65825.md): The firmware on the basestation of the Meatmeet is not encrypted. (CVSS 4.6)
- [CVE-2025-65826](https://cve.now/CVE-2025-65826.md): The mobile application was found to contain stored credentials for the network it was developed on. (CVSS 9.8)
- [CVE-2025-65827](https://cve.now/CVE-2025-65827.md): The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. (CVSS 9.1)
- [CVE-2025-65828](https://cve.now/CVE-2025-65828.md): An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these… (CVSS 6.5)
- [CVE-2025-65829](https://cve.now/CVE-2025-65829.md): The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. (CVSS 6.8)
- [CVE-2025-65830](https://cve.now/CVE-2025-65830.md): Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. (CVSS 9.1)
- [CVE-2025-65831](https://cve.now/CVE-2025-65831.md): The application uses an insecure hashing algorithm (MD5) to hash passwords. (CVSS 7.5)
- [CVE-2025-65832](https://cve.now/CVE-2025-65832.md): The mobile application insecurely handles information stored within memory. (CVSS 4.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.