# CVEs published 2025-03-27

377 CVEs were published on March 27, 2025: 14 critical, 99 high. Days are UTC.

- [CVE-2025-31092](https://cve.now/CVE-2025-31092.md): WordPress Click to Chat – WP Support All-in-One Floating Widget plugin \<= 2.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ninja Team Click to Chat – WP Support All-in-One Floating W…)
- [CVE-2025-2878](https://cve.now/CVE-2025-2878.md): Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting (CVSS 4.8, Kentico CMS)
- [CVE-2025-31101](https://cve.now/CVE-2025-31101.md): WordPress VaultRE Contact Form 7 plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vault Group Pty VaultRE Contact Form)
- [CVE-2025-2888](https://cve.now/CVE-2025-2888.md): Improper timestamp caching during snapshot rollback in tough (CVSS 5.7, AWS tough · tough)
- [CVE-2025-2887](https://cve.now/CVE-2025-2887.md): Failure to detect delegated target rollback in tough (CVSS 5.7, AWS tough · tough)
- [CVE-2025-2886](https://cve.now/CVE-2025-2886.md): Terminating targets role delegations are not respected in tough (CVSS 5.7, AWS tough · tough)
- [CVE-2025-2885](https://cve.now/CVE-2025-2885.md): Root metadata version not validated in tough (CVSS 5.7, AWS tough · tough)
- [CVE-2025-31031](https://cve.now/CVE-2025-31031.md): WordPress Job Colors for WP Job Manager plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Astoundify Job Colors for WP Job Manager)
- [CVE-2025-26733](https://cve.now/CVE-2025-26733.md): WordPress Traveler theme \< 3.2.1 - Broken Access Control vulnerability (CVSS 8.2, shinetheme Traveler)
- [CVE-2025-26873](https://cve.now/CVE-2025-26873.md): WordPress Traveler theme \<= 3.1.8 - PHP Object Injection vulnerability (CVSS 9.0, shinetheme Traveler)
- [CVE-2025-26874](https://cve.now/CVE-2025-26874.md): WordPress MemberSpace plugin \<= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MemberSpace)
- [CVE-2025-26890](https://cve.now/CVE-2025-26890.md): WordPress HUSKY plugin \<= 1.3.6.4 - Local File Inclusion vulnerability (CVSS 7.5, RealMag777 HUSKY)
- [CVE-2025-26898](https://cve.now/CVE-2025-26898.md): WordPress Traveler theme \< 3.2.1 - SQL Injection vulnerability (CVSS 9.3, shinetheme Traveler)
- [CVE-2025-26956](https://cve.now/CVE-2025-26956.md): WordPress Traveler theme \< 3.2.1 - Broken Access Control vulnerability (CVSS 7.6, shinetheme Traveler)
- [CVE-2025-22739](https://cve.now/CVE-2025-22739.md): WordPress LearnPress plugin \<= 4.2.7.5 - Broken Access Control vulnerability (CVSS 5.3, ThimPress LearnPress)
- [CVE-2025-22740](https://cve.now/CVE-2025-22740.md): WordPress Sensei LMS plugin \<= 4.24.4 - Broken Access Control vulnerability (CVSS 5.3, Automattic Sensei LMS)
- [CVE-2023-38272](https://cve.now/CVE-2023-38272.md): IBM Cloud Pak System information disclosure (CVSS 5.9, IBM Cloud Pak System)
- [CVE-2023-37405](https://cve.now/CVE-2023-37405.md): IBM Cloud Pak System information disclosure (CVSS 6.5, IBM Cloud Pak System)
- [CVE-2023-53033](https://cve.now/CVE-2023-53033.md): netfilter: nft\_payload: incorrect arithmetics when fetching VLAN header bits (CVSS 7.8, Linux)
- [CVE-2023-53032](https://cve.now/CVE-2023-53032.md): netfilter: ipset: Fix overflow before widen in the bitmap\_ip\_create() function. (no CVSS, Linux)
- [CVE-2023-53031](https://cve.now/CVE-2023-53031.md): powerpc/imc-pmu: Fix use of mutex in IRQs disabled section (no CVSS, Linux)
- [CVE-2023-53030](https://cve.now/CVE-2023-53030.md): octeontx2-pf: Avoid use of GFP\_KERNEL in atomic context (no CVSS, Linux)
- [CVE-2023-53029](https://cve.now/CVE-2023-53029.md): octeontx2-pf: Fix the use of GFP\_KERNEL in atomic context on rt (no CVSS, Linux)
- [CVE-2023-53028](https://cve.now/CVE-2023-53028.md): Revert "wifi: mac80211: fix memory leak in ieee80211\_if\_add()" (CVSS 7.8, Linux)
- [CVE-2023-53026](https://cve.now/CVE-2023-53026.md): RDMA/core: Fix ib block iterator counter overflow (CVSS 7.8, Linux)
- [CVE-2023-53024](https://cve.now/CVE-2023-53024.md): bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (no CVSS, Linux)
- [CVE-2023-53023](https://cve.now/CVE-2023-53023.md): net: nfc: Fix use-after-free in local\_cleanup() (CVSS 7.8, Linux)
- [CVE-2023-53022](https://cve.now/CVE-2023-53022.md): net: enetc: avoid deadlock in enetc\_tx\_onestep\_tstamp() (CVSS 5.5, Linux)
- [CVE-2023-53021](https://cve.now/CVE-2023-53021.md): net/sched: sch\_taprio: fix possible use-after-free (CVSS 7.8, Linux)
- [CVE-2023-53020](https://cve.now/CVE-2023-53020.md): l2tp: close all race conditions in l2tp\_tunnel\_register() (CVSS 4.7, Linux)
- [CVE-2023-53019](https://cve.now/CVE-2023-53019.md): net: mdio: validate parameter addr in mdiobus\_get\_phy() (no CVSS, Linux)
- [CVE-2023-53018](https://cve.now/CVE-2023-53018.md): Bluetooth: hci\_conn: Fix memory leaks (CVSS 5.5, Linux)
- [CVE-2023-53017](https://cve.now/CVE-2023-53017.md): Bluetooth: hci\_sync: fix memory leak in hci\_update\_adv\_data() (CVSS 5.5, Linux)
- [CVE-2023-53016](https://cve.now/CVE-2023-53016.md): Bluetooth: Fix possible deadlock in rfcomm\_sk\_state\_change (CVSS 5.5, Linux)
- [CVE-2023-53015](https://cve.now/CVE-2023-53015.md): HID: betop: check shape of output reports (CVSS 5.5, Linux)
- [CVE-2023-53014](https://cve.now/CVE-2023-53014.md): dmaengine: tegra: Fix memory leak in terminate\_all() (CVSS 5.5, Linux)
- [CVE-2023-53013](https://cve.now/CVE-2023-53013.md): ptdma: pt\_core\_execute\_cmd() should use spinlock (CVSS 5.5, Linux)
- [CVE-2023-53012](https://cve.now/CVE-2023-53012.md): thermal: core: call put\_device() only after device\_register() fails (no CVSS, Linux)
- [CVE-2023-53011](https://cve.now/CVE-2023-53011.md): net: stmmac: enable all safety features by default (CVSS 5.5, Linux)
- [CVE-2023-53010](https://cve.now/CVE-2023-53010.md): bnxt: Do not read past the end of test names (no CVSS, Linux)
- [CVE-2023-53009](https://cve.now/CVE-2023-53009.md): drm/amdkfd: Add sync after creating vram bo (CVSS 7.8, Linux)
- [CVE-2023-53008](https://cve.now/CVE-2023-53008.md): cifs: fix potential memory leaks in session setup (CVSS 5.5, Linux)
- [CVE-2023-53007](https://cve.now/CVE-2023-53007.md): tracing: Make sure trace\_printk() can output as soon as it can be used (no CVSS, Linux)
- [CVE-2023-53006](https://cve.now/CVE-2023-53006.md): cifs: Fix oops due to uncleared server-\>smbd\_conn in reconnect (CVSS 9.8, Linux)
- [CVE-2023-53005](https://cve.now/CVE-2023-53005.md): trace\_events\_hist: add check for return value of 'create\_hist\_field' (CVSS 5.5, Linux)
- [CVE-2023-53004](https://cve.now/CVE-2023-53004.md): ovl: fix tmpfile leak (no CVSS, Linux)
- [CVE-2023-53003](https://cve.now/CVE-2023-53003.md): EDAC/qcom: Do not pass llcc\_driv\_data as edac\_device\_ctl\_info's pvt\_info (CVSS 7.8, Linux)
- [CVE-2023-53002](https://cve.now/CVE-2023-53002.md): drm/i915: Fix a memory leak with reused mmap\_offset (CVSS 5.5, Linux)
- [CVE-2023-53000](https://cve.now/CVE-2023-53000.md): netlink: prevent potential spectre v1 gadgets (no CVSS, Linux)
- [CVE-2023-52999](https://cve.now/CVE-2023-52999.md): net: fix UaF in netns ops registration error path (CVSS 7.8, Linux)
- [CVE-2023-52998](https://cve.now/CVE-2023-52998.md): net: fec: Use page\_pool\_put\_full\_page when freeing rx buffers (no CVSS, Linux)
- [CVE-2023-52997](https://cve.now/CVE-2023-52997.md): ipv4: prevent potential spectre v1 gadget in ip\_metrics\_convert() (no CVSS, Linux)
- [CVE-2023-52996](https://cve.now/CVE-2023-52996.md): ipv4: prevent potential spectre v1 gadget in fib\_metrics\_match() (no CVSS, Linux)
- [CVE-2023-52995](https://cve.now/CVE-2023-52995.md): riscv/kprobe: Fix instruction simulation of JALR (no CVSS, Linux)
- [CVE-2023-52994](https://cve.now/CVE-2023-52994.md): acpi: Fix suspend with Xen PV (CVSS 5.5, Linux)
- [CVE-2023-52993](https://cve.now/CVE-2023-52993.md): x86/i8259: Mark legacy PIC interrupts with IRQ\_LEVEL (CVSS 5.5, Linux)
- [CVE-2023-52992](https://cve.now/CVE-2023-52992.md): bpf: Skip task with pid=1 in send\_signal\_common() (no CVSS, Linux)
- [CVE-2023-52991](https://cve.now/CVE-2023-52991.md): net: fix NULL pointer in skb\_segment\_list (CVSS 7.5, Linux)
- [CVE-2023-52989](https://cve.now/CVE-2023-52989.md): firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (CVSS 5.5, Linux)
- [CVE-2023-52988](https://cve.now/CVE-2023-52988.md): ALSA: hda/via: Avoid potential array out-of-bound in add\_secret\_dac\_path() (CVSS 7.8, Linux)
- [CVE-2023-52987](https://cve.now/CVE-2023-52987.md): ASoC: SOF: ipc4-mtrace: prevent underflow in sof\_ipc4\_priority\_mask\_dfs\_write() (CVSS 7.8, Linux)
- [CVE-2023-52986](https://cve.now/CVE-2023-52986.md): bpf, sockmap: Check for any of tcp\_bpf\_prots when cloning a listener (no CVSS, Linux)
- [CVE-2023-52985](https://cve.now/CVE-2023-52985.md): arm64: dts: imx8mm-verdin: Do not power down eth-phy (no CVSS, Linux)
- [CVE-2023-52984](https://cve.now/CVE-2023-52984.md): net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices (CVSS 5.5, Linux)
- [CVE-2023-52983](https://cve.now/CVE-2023-52983.md): block, bfq: fix uaf for bfqq in bic\_set\_bfqq() (CVSS 7.8, Linux)
- [CVE-2023-52982](https://cve.now/CVE-2023-52982.md): fscache: Use wait\_on\_bit() to wait for the freeing of relinquished volume (no CVSS, Linux)
- [CVE-2023-52981](https://cve.now/CVE-2023-52981.md): drm/i915: Fix request ref counting during error capture & debugfs dump (CVSS 7.8, Linux)
- [CVE-2023-52980](https://cve.now/CVE-2023-52980.md): block: ublk: extending queue\_size to fix overflow (no CVSS, Linux)
- [CVE-2023-52978](https://cve.now/CVE-2023-52978.md): riscv: kprobe: Fixup kernel panic when probing an illegal position (CVSS 5.5, Linux)
- [CVE-2023-52977](https://cve.now/CVE-2023-52977.md): net: openvswitch: fix flow memory leak in ovs\_flow\_cmd\_new (CVSS 5.5, Linux)
- [CVE-2023-52976](https://cve.now/CVE-2023-52976.md): efi: fix potential NULL deref in efi\_mem\_reserve\_persistent (CVSS 5.5, Linux)
- [CVE-2023-52975](https://cve.now/CVE-2023-52975.md): scsi: iscsi\_tcp: Fix UAF during logout when accessing the shost ipaddress (CVSS 7.8, Linux)
- [CVE-2023-52974](https://cve.now/CVE-2023-52974.md): scsi: iscsi\_tcp: Fix UAF during login when accessing the shost ipaddress (CVSS 7.8, Linux)
- [CVE-2023-52973](https://cve.now/CVE-2023-52973.md): vc\_screen: move load of struct vc\_data pointer in vcs\_read() to avoid UAF (CVSS 7.8, Linux)
- [CVE-2022-49761](https://cve.now/CVE-2022-49761.md): btrfs: always report error in run\_one\_delayed\_ref() (CVSS 7.8, Linux)
- [CVE-2022-49760](https://cve.now/CVE-2022-49760.md): mm/hugetlb: fix PTE marker handling in hugetlb\_change\_protection() (CVSS 7.8, Linux)
- [CVE-2022-49759](https://cve.now/CVE-2022-49759.md): VMCI: Use threaded irqs instead of tasklets (CVSS 5.5, Linux)
- [CVE-2022-49758](https://cve.now/CVE-2022-49758.md): reset: uniphier-glue: Fix possible null-ptr-deref (CVSS 5.5, Linux)
- [CVE-2022-49757](https://cve.now/CVE-2022-49757.md): EDAC/highbank: Fix memory leak in highbank\_mc\_probe() (CVSS 5.5, Linux)
- [CVE-2022-49756](https://cve.now/CVE-2022-49756.md): phy: usb: sunplus: Fix potential null-ptr-deref in sp\_usb\_phy\_probe() (CVSS 5.5, Linux)
- [CVE-2022-49755](https://cve.now/CVE-2022-49755.md): usb: gadget: f\_fs: Prevent race during ffs\_ep0\_queue\_wait (CVSS 7.8, Linux)
- [CVE-2022-49754](https://cve.now/CVE-2022-49754.md): Bluetooth: Fix a buffer overflow in mgmt\_mesh\_add() (CVSS 7.8, Linux)
- [CVE-2022-49753](https://cve.now/CVE-2022-49753.md): dmaengine: Fix double increment of client\_count in dma\_chan\_get() (CVSS 7.8, Linux)
- [CVE-2022-49752](https://cve.now/CVE-2022-49752.md): device property: fix of node refcount leak in fwnode\_graph\_get\_next\_endpoint() (CVSS 5.5, Linux)
- [CVE-2022-49751](https://cve.now/CVE-2022-49751.md): w1: fix WARNING after calling w1\_process() (CVSS 5.5, Linux)
- [CVE-2022-49750](https://cve.now/CVE-2022-49750.md): cpufreq: CPPC: Add u64 casts to avoid overflowing (CVSS 5.5, Linux)
- [CVE-2022-49749](https://cve.now/CVE-2022-49749.md): i2c: designware: use casting of u64 in clock multiplication to avoid overflow (CVSS 5.5, Linux)
- [CVE-2022-49748](https://cve.now/CVE-2022-49748.md): perf/x86/amd: fix potential integer overflow on shift of a int (CVSS 5.5, Linux)
- [CVE-2022-49747](https://cve.now/CVE-2022-49747.md): erofs/zmap.c: Fix incorrect offset calculation (no CVSS, Linux)
- [CVE-2022-49746](https://cve.now/CVE-2022-49746.md): dmaengine: imx-sdma: Fix a possible memory leak in sdma\_transfer\_init (CVSS 5.5, Linux)
- [CVE-2022-49745](https://cve.now/CVE-2022-49745.md): fpga: m10bmc-sec: Fix probe rollback (no CVSS, Linux)
- [CVE-2022-49744](https://cve.now/CVE-2022-49744.md): mm/uffd: fix pte marker when fork() without fork event (no CVSS, Linux)
- [CVE-2022-49743](https://cve.now/CVE-2022-49743.md): ovl: Use "buf" flexible array for memcpy() destination (CVSS 7.5, Linux)
- [CVE-2022-49742](https://cve.now/CVE-2022-49742.md): f2fs: initialize locks earlier in f2fs\_fill\_super() (CVSS 5.5, Linux)
- [CVE-2022-49741](https://cve.now/CVE-2022-49741.md): fbdev: smscufx: fix error handling code in ufx\_usb\_probe (CVSS 5.5, Linux)
- [CVE-2022-49740](https://cve.now/CVE-2022-49740.md): wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads (CVSS 7.1, Linux)
- [CVE-2022-49739](https://cve.now/CVE-2022-49739.md): gfs2: Always check inode size of inline inodes (CVSS 7.1, Linux)
- [CVE-2022-49738](https://cve.now/CVE-2022-49738.md): f2fs: fix to do sanity check on i\_extra\_isize in is\_alive() (CVSS 7.1, Linux)
- [CVE-2023-52942](https://cve.now/CVE-2023-52942.md): cgroup/cpuset: Fix wrong check in update\_parent\_subparts\_cpumask() (no CVSS, Linux)
- [CVE-2023-52941](https://cve.now/CVE-2023-52941.md): can: isotp: split tx timer into transmission and timeout (no CVSS, Linux)
- [CVE-2023-52940](https://cve.now/CVE-2023-52940.md): mm: multi-gen LRU: fix crash during cgroup migration (no CVSS, Linux)
- [CVE-2023-52939](https://cve.now/CVE-2023-52939.md): mm: memcg: fix NULL pointer in mem\_cgroup\_track\_foreign\_dirty\_slowpath() (CVSS 5.5, Linux)
- [CVE-2023-52938](https://cve.now/CVE-2023-52938.md): usb: typec: ucsi: Don't attempt to resume the ports before they exist (CVSS 5.5, Linux)
- [CVE-2023-52937](https://cve.now/CVE-2023-52937.md): HV: hv\_balloon: fix memory leak with using debugfs\_lookup() (CVSS 5.5, Linux)
- [CVE-2023-52936](https://cve.now/CVE-2023-52936.md): kernel/irq/irqdomain.c: fix memory leak with using debugfs\_lookup() (CVSS 5.5, Linux)
- [CVE-2023-52935](https://cve.now/CVE-2023-52935.md): mm/khugepaged: fix -\>anon\_vma race (CVSS 7.8, Linux)
- [CVE-2023-52934](https://cve.now/CVE-2023-52934.md): mm/MADV\_COLLAPSE: catch !none !huge !bad pmd lookups (CVSS 7.8, Linux)
- [CVE-2023-52933](https://cve.now/CVE-2023-52933.md): Squashfs: fix handling and sanity checking of xattr\_ids count (no CVSS, Linux)
- [CVE-2023-52932](https://cve.now/CVE-2023-52932.md): mm/swapfile: add cond\_resched() in get\_swap\_pages() (CVSS 5.5, Linux)
- [CVE-2023-52931](https://cve.now/CVE-2023-52931.md): drm/i915: Avoid potential vm use-after-free (CVSS 7.8, Linux)
- [CVE-2023-52930](https://cve.now/CVE-2023-52930.md): drm/i915: Fix potential bit\_17 double-free (CVSS 7.8, Linux)
- [CVE-2023-52929](https://cve.now/CVE-2023-52929.md): nvmem: core: fix cleanup after dev\_set\_name() (no CVSS, Linux)
- [CVE-2023-52928](https://cve.now/CVE-2023-52928.md): bpf: Skip invalid kfunc call in backtrack\_insn (no CVSS, Linux)
- [CVE-2021-4454](https://cve.now/CVE-2021-4454.md): can: j1939: fix errant WARN\_ON\_ONCE in j1939\_session\_deactivate (CVSS 7.5, Linux)
- [CVE-2025-30367](https://cve.now/CVE-2025-30367.md): WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-30366](https://cve.now/CVE-2025-30366.md): WeGIA vulnerable to Stored XSS in personalizacao.php (CVSS 6.2, LabRedesCefetRJ WeGIA)
- [CVE-2025-30365](https://cve.now/CVE-2025-30365.md): SQL Injection in query\_geracao\_auto.php (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-30364](https://cve.now/CVE-2025-30364.md): WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id\_funcionario (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-30363](https://cve.now/CVE-2025-30363.md): WeGIA vulnerable to Stored XSS in documentos\_funcionario.php parameter dados\_addInfo (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-12905](https://cve.now/CVE-2024-12905.md): An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Tra (CVSS 7.5, tar-fs)
- [CVE-2025-30362](https://cve.now/CVE-2025-30362.md): WeGIA vulnerable to Stored XSS in documentos\_funcionario.php parameter id (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-30361](https://cve.now/CVE-2025-30361.md): WeGIA Vulnerable to Broken Authentication - Old Password Validation (CVSS 9.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-22783](https://cve.now/CVE-2025-22783.md): WordPress SEO Plugin by Squirrly SEO plugin \<= 12.4.03 - SQL Injection vulnerability (CVSS 8.5, SEO Squirrly SEO Plugin by Squirrly SEO)
- [CVE-2025-26762](https://cve.now/CVE-2025-26762.md): WordPress WooCommerce plugin \<= 9.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Automattic WooCommerce)
- [CVE-2025-26909](https://cve.now/CVE-2025-26909.md): WordPress Hide My WP Ghost plugin \<= 5.4.01 - Local File Inclusion to RCE vulnerability (CVSS 9.6, John Darrel Hide My WP Ghost)
- [CVE-2025-22278](https://cve.now/CVE-2025-22278.md): WordPress Whitish Lite theme \<= 2.1.13 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, yudleethemes Whitish Lite)
- [CVE-2025-22496](https://cve.now/CVE-2025-22496.md): WordPress Notif Bell Plugin \<= 0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, MarMar8x Notif Bell)
- [CVE-2025-22497](https://cve.now/CVE-2025-22497.md): WordPress Simple Google Calendar Outlook Events Block Widget plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bramwaas Simple Google Calendar Outlook Events Block Widget)
- [CVE-2025-2855](https://cve.now/CVE-2025-2855.md): elunez eladmin upload checkFile deserialization (CVSS 5.1, elunez eladmin)
- [CVE-2025-22628](https://cve.now/CVE-2025-22628.md): WordPress Filled In Plugin \<= 1.9.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, FolioVision Filled In)
- [CVE-2025-22629](https://cve.now/CVE-2025-22629.md): WordPress iNET Webkit Plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.3, iNET Webkit)
- [CVE-2025-22634](https://cve.now/CVE-2025-22634.md): WordPress Easy Booked Plugin \<= 2.4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MD Abu Jubayer Hossain Easy Booked – Appointment Booking an…)
- [CVE-2025-22637](https://cve.now/CVE-2025-22637.md): WordPress Print PDF Generator and Publisher plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, verkkovaraani Print PDF Generator and Publisher)
- [CVE-2025-22638](https://cve.now/CVE-2025-22638.md): WordPress Product Table For WooCommerce Plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, acowebs Product Table For WooCommerce)
- [CVE-2025-22640](https://cve.now/CVE-2025-22640.md): WordPress Paytm Payment Donation Plugin \<= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, integrationdevpaytm Paytm Payment Donation)
- [CVE-2025-22644](https://cve.now/CVE-2025-22644.md): WordPress Vayu Blocks – Gutenberg Blocks plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & Wo…)
- [CVE-2025-31181](https://cve.now/CVE-2025-31181.md): Gnuplot: gnuplot segmentation fault on x11\_graphics (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-31180](https://cve.now/CVE-2025-31180.md): Gnuplot: gnuplot segmentation fault on canvas\_text (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-31179](https://cve.now/CVE-2025-31179.md): Gnuplot: gnuplot segmentation fault on xstrftime (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-22646](https://cve.now/CVE-2025-22646.md): WordPress aThemes Addons for Elementor plugin \<= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Syed Balkhi aThemes Addons for Elementor)
- [CVE-2025-22647](https://cve.now/CVE-2025-22647.md): WordPress AIO Performance Profiler plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 4.3, Smackcoders Inc., AIO Performance Profiler, Monitor, Optimi…)
- [CVE-2025-31178](https://cve.now/CVE-2025-31178.md): Gnuplot: gnuplot segmentation fault on getannotatestring (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-30067](https://cve.now/CVE-2025-30067.md): Apache Kylin: The remote code execution via jdbc url (CVSS 7.2, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2025-22648](https://cve.now/CVE-2025-22648.md): WordPress Blog, Posts and Category Filter for Elementor plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Plugin Devs Blog, Posts and Category Filter for Elementor)
- [CVE-2025-31176](https://cve.now/CVE-2025-31176.md): Gnuplot: gnuplot segmentation fault on plot3d\_points (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2024-48944](https://cve.now/CVE-2024-48944.md): Apache Kylin: SSRF vulnerability in the diagnosis api (CVSS 6.5, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2025-22649](https://cve.now/CVE-2025-22649.md): WordPress WP Project Manager plugin \<= 2.6.22 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, weDevs WP Project Manager)
- [CVE-2025-22652](https://cve.now/CVE-2025-22652.md): WordPress Payment Forms for Paystack plugin \<= 4.0.1 - SQL Injection vulnerability (CVSS 7.6, kendysond Payment Forms for Paystack)
- [CVE-2025-22658](https://cve.now/CVE-2025-22658.md): WordPress Listings for Appfolio plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Listings for Appfolio)
- [CVE-2025-22659](https://cve.now/CVE-2025-22659.md): WordPress Orbit Fox by ThemeIsle plugin \<= 2.10.44 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Orbit Fox by ThemeIsle)
- [CVE-2025-21892](https://cve.now/CVE-2025-21892.md): RDMA/mlx5: Fix the recovery flow of the UMR QP (no CVSS, Linux)
- [CVE-2025-21891](https://cve.now/CVE-2025-21891.md): ipvlan: ensure network headers are in skb linear part (CVSS 5.5, Linux)
- [CVE-2025-21890](https://cve.now/CVE-2025-21890.md): idpf: fix checksums set in idpf\_rx\_rsc() (CVSS 8.2, Linux)
- [CVE-2025-21889](https://cve.now/CVE-2025-21889.md): perf/core: Add RCU read lock protection to perf\_iterate\_ctx() (CVSS 7.8, Linux)
- [CVE-2025-21888](https://cve.now/CVE-2025-21888.md): RDMA/mlx5: Fix a WARN during dereg\_mr for DM type (no CVSS, Linux)
- [CVE-2025-21887](https://cve.now/CVE-2025-21887.md): ovl: fix UAF in ovl\_dentry\_update\_reval by moving dput() in ovl\_link\_up (CVSS 7.8, Linux)
- [CVE-2025-21886](https://cve.now/CVE-2025-21886.md): RDMA/mlx5: Fix implicit ODP hang on parent deregistration (no CVSS, Linux)
- [CVE-2025-21885](https://cve.now/CVE-2025-21885.md): RDMA/bnxt\_re: Fix the page details for the srq created by kernel consumers (CVSS 7.5, Linux)
- [CVE-2025-21884](https://cve.now/CVE-2025-21884.md): net: better track kernel sockets lifetime (CVSS 7.8, Linux)
- [CVE-2025-21883](https://cve.now/CVE-2025-21883.md): ice: Fix deinitializing VF in error path (no CVSS, Linux)
- [CVE-2025-21882](https://cve.now/CVE-2025-21882.md): net/mlx5: Fix vport QoS cleanup on error (CVSS 7.8, Linux)
- [CVE-2025-21881](https://cve.now/CVE-2025-21881.md): uprobes: Reject the shared zeropage in uprobe\_write\_opcode() (no CVSS, Linux)
- [CVE-2025-21880](https://cve.now/CVE-2025-21880.md): drm/xe/userptr: fix EFAULT handling (no CVSS, Linux)
- [CVE-2025-21879](https://cve.now/CVE-2025-21879.md): btrfs: fix use-after-free on inode when scanning root during em shrinking (CVSS 7.8, Linux)
- [CVE-2025-21878](https://cve.now/CVE-2025-21878.md): i2c: npcm: disable interrupt enable bit before devm\_request\_irq (no CVSS, Linux)
- [CVE-2025-21877](https://cve.now/CVE-2025-21877.md): usbnet: gl620a: fix endpoint checking in genelink\_bind() (no CVSS, Linux)
- [CVE-2025-21876](https://cve.now/CVE-2025-21876.md): iommu/vt-d: Fix suspicious RCU usage (CVSS 8.8, Linux)
- [CVE-2025-21875](https://cve.now/CVE-2025-21875.md): mptcp: always handle address removal under msk socket lock (CVSS 7.8, Linux)
- [CVE-2025-21874](https://cve.now/CVE-2025-21874.md): dm-integrity: Avoid divide by zero in table status in Inline mode (no CVSS, Linux)
- [CVE-2025-21873](https://cve.now/CVE-2025-21873.md): scsi: ufs: core: bsg: Fix crash when arpmb command fails (no CVSS, Linux)
- [CVE-2025-21872](https://cve.now/CVE-2025-21872.md): efi: Don't map the entire mokvar table to determine its size (no CVSS, Linux)
- [CVE-2024-58091](https://cve.now/CVE-2024-58091.md): drm/fbdev-dma: Add shadow buffering for deferred I/O (CVSS 7.8, Linux)
- [CVE-2024-58090](https://cve.now/CVE-2024-58090.md): sched/core: Prevent rescheduling when interrupts are disabled (no CVSS, Linux)
- [CVE-2025-30358](https://cve.now/CVE-2025-30358.md): Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks (CVSS 8.1, mesop-dev mesop · mesop)
- [CVE-2025-30221](https://cve.now/CVE-2025-30221.md): Pitchfork HTTP Request/Response Splitting vulnerability (CVSS 4.3, Shopify pitchfork · pitchfork)
- [CVE-2025-1998](https://cve.now/CVE-2025-1998.md): IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy information disclosure (CVSS 5.5, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2025-1997](https://cve.now/CVE-2025-1997.md): IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injection (CVSS 5.4, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-56469](https://cve.now/CVE-2024-56469.md): IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy missing authentication (CVSS 6.3, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2025-2854](https://cve.now/CVE-2025-2854.md): code-projects Payroll Management System update\_employee.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-2516](https://cve.now/CVE-2025-2516.md): Use of a weak cryptographic key in the signature verification process in WPS Office (CVSS 9.5, Kingsoft WPS Office)
- [CVE-2025-22660](https://cve.now/CVE-2025-22660.md): WordPress Include Mastodon Feed plugin \<= 1.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wolfgang Include Mastodon Feed)
- [CVE-2025-22665](https://cve.now/CVE-2025-22665.md): WordPress RapidLoad plugin \<= 2.4.4 - Broken Access Control vulnerability (CVSS 4.3, Shakeeb Sadikeen RapidLoad)
- [CVE-2025-22667](https://cve.now/CVE-2025-22667.md): WordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin \<= 1.8.2 - Broken Access Control vulnerability (CVSS 4.3, Creative Werk Designs Export Order, Product, Customer & Cou…)
- [CVE-2025-22668](https://cve.now/CVE-2025-22668.md): WordPress Awesome Event Booking plugin \<= 2.7.2 - Broken Access Control vulnerability (CVSS 6.5, AwesomeTOGI Awesome Event Booking)
- [CVE-2025-22669](https://cve.now/CVE-2025-22669.md): WordPress Awesome Event Booking plugin \<= 2.7.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AwesomeTOGI Awesome Event Booking)
- [CVE-2025-22670](https://cve.now/CVE-2025-22670.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.7.2 - CSRF to Settings Change vulnerability (CVSS 6.5, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2025-22671](https://cve.now/CVE-2025-22671.md): WordPress Disable Elementor Editor Translation plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 4.3, Leap13 Disable Elementor Editor Translation)
- [CVE-2025-22673](https://cve.now/CVE-2025-22673.md): WordPress EAN Barcode Generator \<= 5.3.5 - Broken Access Control vulnerability (CVSS 4.3, WPFactory EAN for WooCommerce)
- [CVE-2025-22672](https://cve.now/CVE-2025-22672.md): WordPress Video & Photo Gallery for Ultimate Member plugin \<= 1.1.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, SuitePlugins Video & Photo Gallery for Ultimate Member)
- [CVE-2025-22770](https://cve.now/CVE-2025-22770.md): WordPress Envo Multipurpose theme \<= 1.1.6 - Broken Access Control vulnerability (CVSS 5.4, EnvoThemes Envo Multipurpose)
- [CVE-2025-25086](https://cve.now/CVE-2025-25086.md): WordPress Secret Meta plugin \<= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPDeveloper Secret Meta)
- [CVE-2025-27793](https://cve.now/CVE-2025-27793.md): Vega vulnerable to Cross-site Scripting via RegExp.prototype\[@@replace\] (CVSS 5.3, vega · vega-functions)
- [CVE-2025-22816](https://cve.now/CVE-2025-22816.md): WordPress Power Mag theme \<= 1.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codetrendy Power Mag)
- [CVE-2025-25100](https://cve.now/CVE-2025-25100.md): WordPress Cazamba plugin \<= 1.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, victoracano Cazamba)
- [CVE-2025-2867](https://cve.now/CVE-2025-2867.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 4.4, GitLab)
- [CVE-2025-26731](https://cve.now/CVE-2025-26731.md): WordPress ARPrice plugin \<= 4.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, reputeinfosystems ARPrice)
- [CVE-2025-2852](https://cve.now/CVE-2025-2852.md): SourceCodester Food Ordering Management System view\_menu.php sql injection (CVSS 5.1, SourceCodester Food Ordering Management System)
- [CVE-2025-26732](https://cve.now/CVE-2025-26732.md): WordPress StoreBiz plugin \<= 1.0.32 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, burgersoftware StoreBiz)
- [CVE-2025-26734](https://cve.now/CVE-2025-26734.md): WordPress Hester plugin \<= 1.1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, peregrinethemes Hester)
- [CVE-2025-26736](https://cve.now/CVE-2025-26736.md): WordPress MorningTime Lite theme \<= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, victortihai MorningTime Lite)
- [CVE-2025-26737](https://cve.now/CVE-2025-26737.md): WordPress City Store theme \<= 1.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, yudleethemes City Store)
- [CVE-2025-26738](https://cve.now/CVE-2025-26738.md): WordPress Quick Interest Slider plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Graham Quick Interest Slider)
- [CVE-2025-26619](https://cve.now/CVE-2025-26619.md): Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode \`expressionInterpeter\` (CVSS 5.3, vega · vega-functions)
- [CVE-2025-21871](https://cve.now/CVE-2025-21871.md): tee: optee: Fix supplicant wait loop (no CVSS, Linux)
- [CVE-2025-21870](https://cve.now/CVE-2025-21870.md): ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers (CVSS 7.8, Linux)
- [CVE-2025-21869](https://cve.now/CVE-2025-21869.md): powerpc/code-patching: Disable KASAN report during patching via temporary mm (no CVSS, Linux)
- [CVE-2025-21868](https://cve.now/CVE-2025-21868.md): net: allow small head cache usage with large MAX\_SKB\_FRAGS values (CVSS 7.5, Linux)
- [CVE-2025-21867](https://cve.now/CVE-2025-21867.md): bpf, test\_run: Fix use-after-free issue in eth\_skb\_pkt\_type() (CVSS 7.8, Linux)
- [CVE-2025-2849](https://cve.now/CVE-2025-2849.md): UPX p\_lx\_elf.cpp un\_DT\_INIT heap-based overflow (CVSS 4.8, UPX)
- [CVE-2025-2857](https://cve.now/CVE-2025-2857.md): Incorrect handle could lead to sandbox escapes (CVSS 10.0, Mozilla Firefox)
- [CVE-2025-2847](https://cve.now/CVE-2025-2847.md): Codezips Gym Management System over\_month.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2024-9773](https://cve.now/CVE-2024-9773.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 3.7, GitLab)
- [CVE-2025-0811](https://cve.now/CVE-2025-0811.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-2846](https://cve.now/CVE-2025-2846.md): SourceCodester Online Eyewear Shop Registration Users.php registration sql injection (CVSS 6.9, SourceCodester Online Eyewear Shop)
- [CVE-2025-2242](https://cve.now/CVE-2025-2242.md): Incorrect Authorization in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-2255](https://cve.now/CVE-2025-2255.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-31141](https://cve.now/CVE-2025-31141.md): In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page (CVSS 2.7, JetBrains TeamCity)
- [CVE-2025-31140](https://cve.now/CVE-2025-31140.md): In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page (CVSS 4.6, JetBrains TeamCity)
- [CVE-2025-31139](https://cve.now/CVE-2025-31139.md): In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-30925](https://cve.now/CVE-2025-30925.md): WordPress The Pack Elementor addons plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webangon The Pack Elementor addons)
- [CVE-2025-30923](https://cve.now/CVE-2025-30923.md): WordPress Gift Message for WooCommerce plugin \<= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, powerfulwp Gift Message for WooCommerce)
- [CVE-2025-30922](https://cve.now/CVE-2025-30922.md): WordPress Simplebooklet PDF Viewer and Embedder plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Simplebooklet PDF Viewer and Embedder)
- [CVE-2025-30921](https://cve.now/CVE-2025-30921.md): WordPress Newsletters plugin \<= 4.9.9.7 - SQL Injection vulnerability (CVSS 7.6, Tribulant Software Newsletters)
- [CVE-2025-30920](https://cve.now/CVE-2025-30920.md): WordPress WP Posts Carousel plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, teastudio.pl WP Posts Carousel)
- [CVE-2025-30919](https://cve.now/CVE-2025-30919.md): WordPress Store Locator Widget plugin \<= 2025r2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Store Locator Widgets Store Locator Widget)
- [CVE-2025-30918](https://cve.now/CVE-2025-30918.md): WordPress Structured Content plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gordon Böhme Structured Content)
- [CVE-2025-30914](https://cve.now/CVE-2025-30914.md): WordPress Metform Elementor Contact Form Builder plugin \<= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Roxnor Metform)
- [CVE-2025-30912](https://cve.now/CVE-2025-30912.md): WordPress Float menu plugin \<= 6.1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Wow-Company Float menu)
- [CVE-2025-30909](https://cve.now/CVE-2025-30909.md): WordPress Conversios.io plugin \<= 7.2.3 - Broken Access Control vulnerability (CVSS 4.3, Conversios.io)
- [CVE-2025-30907](https://cve.now/CVE-2025-30907.md): WordPress SecuPress Free plugin \<= 2.2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SecuPress Free)
- [CVE-2025-30904](https://cve.now/CVE-2025-30904.md): WordPress Chartify plugin \<= 3.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro Chartify)
- [CVE-2025-30903](https://cve.now/CVE-2025-30903.md): WordPress SyntaxHighlighter Evolved plugin \<= 3.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alex Mills SyntaxHighlighter Evolved)
- [CVE-2025-30900](https://cve.now/CVE-2025-30900.md): WordPress Zoho Billing – Embed Payment Form plugin \<= 4.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zoho Subscriptions Zoho Billing – Embed Payment Form)
- [CVE-2025-30899](https://cve.now/CVE-2025-30899.md): WordPress User Registration plugin \<= 4.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpeverest User Registration)
- [CVE-2025-30898](https://cve.now/CVE-2025-30898.md): WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin \<= 4.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mahdi Yousefi \[MahdiY\] افزونه حمل و نقل ووکامرس)
- [CVE-2025-30897](https://cve.now/CVE-2025-30897.md): WordPress Analytify plugin \<= 5.5.1 - Settings Change vulnerability (CVSS 4.3, Adnan Analytify)
- [CVE-2025-30896](https://cve.now/CVE-2025-30896.md): WordPress WP ERP plugin \<= 1.13.4 - Broken Access Control vulnerability (CVSS 5.4, weDevs WP ERP)
- [CVE-2025-30895](https://cve.now/CVE-2025-30895.md): WordPress WpEvently Plugin \<= 4.2.9 - PHP Object Injection vulnerability (CVSS 7.5, magepeopleteam WpEvently)
- [CVE-2025-30894](https://cve.now/CVE-2025-30894.md): WordPress WP Fast Total Search plugin \<= 1.79.262 - Broken Access Control vulnerability (CVSS 4.3, Epsiloncool WP Fast Total Search)
- [CVE-2025-30893](https://cve.now/CVE-2025-30893.md): WordPress LeadConnector plugin \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LeadConnector)
- [CVE-2025-30891](https://cve.now/CVE-2025-30891.md): WordPress WpTravelly Plugin \<= 1.8.7 - Local File Inclusion vulnerability (CVSS 8.8, magepeopleteam WpTravelly)
- [CVE-2025-30890](https://cve.now/CVE-2025-30890.md): WordPress Login Widget for Ultimate Member plugin \<= 1.1.2 - Local File Inclusion vulnerability (CVSS 7.5, SuitePlugins Login Widget for Ultimate Member)
- [CVE-2025-30888](https://cve.now/CVE-2025-30888.md): WordPress Custom Fields Account Registration For Woocommerce Plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, silverplugins217 Custom Fields Account Registration For Woo…)
- [CVE-2025-30887](https://cve.now/CVE-2025-30887.md): WordPress WpEvently Plugin \<= 4.2.9 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam WpEvently)
- [CVE-2025-30885](https://cve.now/CVE-2025-30885.md): WordPress Bit Form plugin \<= 2.18.0 - Open Redirection vulnerability (CVSS 4.7, Bit Apps Bit Form)
- [CVE-2025-30884](https://cve.now/CVE-2025-30884.md): WordPress Bit Integrations plugin \<= 2.4.10 - Open Redirection vulnerability (CVSS 4.7, Bit Apps Bit Integrations)
- [CVE-2025-30883](https://cve.now/CVE-2025-30883.md): WordPress Trust.Reviews plugin \<= 2.3 - Broken Access Control vulnerability (CVSS 4.3, richplugins Trust.Reviews)
- [CVE-2025-30881](https://cve.now/CVE-2025-30881.md): WordPress Big Store theme \<= 2.0.8 - Broken Access Control vulnerability (CVSS 4.3, themehunk Big Store)
- [CVE-2025-30879](https://cve.now/CVE-2025-30879.md): WordPress MC Woocommerce Wishlist plugin \<= 1.8.9 - SQL Injection vulnerability (CVSS 7.6, Moreconvert Team MC Woocommerce Wishlist)
- [CVE-2025-30877](https://cve.now/CVE-2025-30877.md): WordPress Quiz Cat plugin \<= 3.0.8 - Broken Access Control vulnerability (CVSS 2.7, fatcatapps Quiz Cat)
- [CVE-2025-30874](https://cve.now/CVE-2025-30874.md): WordPress Specific Content For Mobile plugin \<= 0.5.3 - Broken Access Control vulnerability (CVSS 4.3, Jose Mortellaro Specific Content For Mobile)
- [CVE-2025-30873](https://cve.now/CVE-2025-30873.md): WordPress Greenshift plugin \<= 11.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpsoul Greenshift)
- [CVE-2025-30872](https://cve.now/CVE-2025-30872.md): WordPress Product Author for WooCommerce plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Nitin Prakash Product Author for WooCommerce)
- [CVE-2025-30871](https://cve.now/CVE-2025-30871.md): WordPress WP Travel Engine plugin \<= 6.3.5 - Local File Inclusion vulnerability (CVSS 7.5, WP Travel Engine)
- [CVE-2025-30868](https://cve.now/CVE-2025-30868.md): WordPress Team Manager plugin \<= 2.1.23 - Local File Inclusion Vulnerability (CVSS 7.5, Maidul Team Manager)
- [CVE-2025-30867](https://cve.now/CVE-2025-30867.md): WordPress SearchIQ plugin \<= 4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SearchIQ)
- [CVE-2025-30866](https://cve.now/CVE-2025-30866.md): WordPress Terms & Conditions Per Product plugin \<= 1.2.15 - Broken Access Control Vulnerability (CVSS 5.3, Giannis Kipouros Terms & Conditions Per Product)
- [CVE-2025-30865](https://cve.now/CVE-2025-30865.md): WordPress 3DPrint Lite plugin \<= 2.1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, fuzzoid 3DPrint Lite)
- [CVE-2025-30864](https://cve.now/CVE-2025-30864.md): WordPress Exchange Rates plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 4.3, falselight Exchange Rates)
- [CVE-2025-30863](https://cve.now/CVE-2025-30863.md): WordPress Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin \<= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CRM Perks Integration for Google Sheets and Contact Form 7,…)
- [CVE-2025-30862](https://cve.now/CVE-2025-30862.md): WordPress reCAPTCHA for all plugin \<= 2.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, sminozzi reCAPTCHA for all)
- [CVE-2025-30861](https://cve.now/CVE-2025-30861.md): WordPress Five Star Restaurant Reservations plugin \<= 2.6.29 - Broken Access Control vulnerability (CVSS 4.9, Rustaurius Five Star Restaurant Reservations)
- [CVE-2025-30860](https://cve.now/CVE-2025-30860.md): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin \<= 0.5.8.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jory Hogeveen Off-Canvas Sidebars & Menus)
- [CVE-2025-30859](https://cve.now/CVE-2025-30859.md): WordPress AliNext plugin \<= 3.5.1 - Open Redirection vulnerability (CVSS 4.7, guru-aliexpress AliNext)
- [CVE-2025-30857](https://cve.now/CVE-2025-30857.md): WordPress Currency Switcher for WooCommerce plugin \<= 0.0.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, PressMaximum Currency Switcher for WooCommerce)
- [CVE-2025-30856](https://cve.now/CVE-2025-30856.md): WordPress Custom Field For WP Job Manager plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, theme funda Custom Field For WP Job Manager)
- [CVE-2025-30854](https://cve.now/CVE-2025-30854.md): WordPress Serial Codes Generator and Validator with WooCommerce Support plugin \<= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Vollstart Serial Codes Generator and Validator with WooComm…)
- [CVE-2025-30851](https://cve.now/CVE-2025-30851.md): WordPress Tickera plugin \<= 3.5.5.2 - Broken Access Control vulnerability (CVSS 4.3, Tickera)
- [CVE-2025-30850](https://cve.now/CVE-2025-30850.md): WordPress Dr. Flex plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sfaerber Dr. Flex)
- [CVE-2025-30847](https://cve.now/CVE-2025-30847.md): WordPress Novelist plugin \<= 1.2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Ashley Novelist)
- [CVE-2025-30846](https://cve.now/CVE-2025-30846.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.4 - Local File Inclusion vulnerability (CVSS 8.8, jetmonsters Restaurant Menu by MotoPress)
- [CVE-2025-30845](https://cve.now/CVE-2025-30845.md): WordPress The Pack Elementor addons plugin \<= 2.1.1 - Local File Inclusion vulnerability (CVSS 7.5, webangon The Pack Elementor addons)
- [CVE-2025-30843](https://cve.now/CVE-2025-30843.md): WordPress bizcalendar-web plugin \<= 1.1.0.34 - SQL Injection vulnerability (CVSS 7.6, setriosoft bizcalendar-web)
- [CVE-2025-30842](https://cve.now/CVE-2025-30842.md): WordPress Christmas Panda plugin \<= 1.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, pixolette Christmas Panda)
- [CVE-2025-30839](https://cve.now/CVE-2025-30839.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam Taxi Booking Manager for WooCommerce)
- [CVE-2025-30838](https://cve.now/CVE-2025-30838.md): WordPress Cozy Blocks plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CozyThemes Cozy Blocks)
- [CVE-2025-30836](https://cve.now/CVE-2025-30836.md): WordPress LatePoint plugin \<= 5.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LatePoint)
- [CVE-2025-30833](https://cve.now/CVE-2025-30833.md): WordPress Verge3D Publishing and E-Commerce Plugin \<= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Soft8Soft Verge3D)
- [CVE-2025-30832](https://cve.now/CVE-2025-30832.md): WordPress Themify Event Post Plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themifyme Themify Event Post)
- [CVE-2025-30831](https://cve.now/CVE-2025-30831.md): WordPress Themify Event Post Plugin \<= 1.3.2 - Local File Inclusion vulnerability (CVSS 7.5, themifyme Themify Event Post)
- [CVE-2025-30830](https://cve.now/CVE-2025-30830.md): WordPress Cool Author Box plugin \<= 2.9.9 - Broken Access Control vulnerability (CVSS 5.3, Hossni Mubarak Cool Author Box)
- [CVE-2025-30829](https://cve.now/CVE-2025-30829.md): WordPress WPCafe plugin \<= 2.2.31 - Local File Inclusion vulnerability (CVSS 7.5, Arraytics WPCafe)
- [CVE-2025-30828](https://cve.now/CVE-2025-30828.md): WordPress Timetics plugin \<= 1.0.29 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Timetics)
- [CVE-2025-30826](https://cve.now/CVE-2025-30826.md): WordPress IP Locator plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pierre Lannoy IP Locator)
- [CVE-2025-30824](https://cve.now/CVE-2025-30824.md): WordPress Textmetrics plugin \<= 3.6.1 - Broken Access Control vulnerability (CVSS 5.4, Israpil Textmetrics)
- [CVE-2025-30823](https://cve.now/CVE-2025-30823.md): WordPress Anthologize Plugin \<= 0.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Boone Gorges Anthologize)
- [CVE-2025-30822](https://cve.now/CVE-2025-30822.md): WordPress Custom Login Logo Plugin \<= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Hakik Zaman Custom Login Logo)
- [CVE-2025-30821](https://cve.now/CVE-2025-30821.md): WordPress SNORDIAN's H5PxAPIkatchu plugin \<= 0.4.14 - Broken Access Control vulnerability (CVSS 5.3, otacke SNORDIAN's H5PxAPIkatchu)
- [CVE-2025-30820](https://cve.now/CVE-2025-30820.md): WordPress WishSuite plugin \<= 1.4.4 - Local File Inclusion Vulnerability (CVSS 7.5, HT Plugins WishSuite)
- [CVE-2025-30819](https://cve.now/CVE-2025-30819.md): WordPress Simple Giveaways plugin \<= 2.48.1 - SQL Injection vulnerability (CVSS 8.5, Igor Benic Simple Giveaways)
- [CVE-2025-30818](https://cve.now/CVE-2025-30818.md): WordPress jAlbum Bridge plugin \<= 2.0.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mlaza jAlbum Bridge)
- [CVE-2025-30817](https://cve.now/CVE-2025-30817.md): WordPress Z Companion plugin \<= 1.0.13 - Broken Access Control vulnerability (CVSS 5.4, wpzita Z Companion)
- [CVE-2025-30816](https://cve.now/CVE-2025-30816.md): WordPress publish post email notification plugin \<= 1.0.2.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Nks publish post email notification)
- [CVE-2025-30815](https://cve.now/CVE-2025-30815.md): WordPress Hesabfa Accounting plugin \<= 2.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saeed Sattar Beglou Hesabfa Accounting)
- [CVE-2025-30814](https://cve.now/CVE-2025-30814.md): WordPress The Post Grid plugin \<= 7.7.17 - Local File Inclusion vulnerability (CVSS 7.5, RadiusTheme The Post Grid)
- [CVE-2025-30813](https://cve.now/CVE-2025-30813.md): WordPress Listamester plugin \<= 2.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Listamester)
- [CVE-2025-30812](https://cve.now/CVE-2025-30812.md): WordPress SKT Addons for Elementor plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Addons for Elementor)
- [CVE-2025-30811](https://cve.now/CVE-2025-30811.md): WordPress ValidateCertify plugin \<= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Javier Revilla ValidateCertify)
- [CVE-2025-30810](https://cve.now/CVE-2025-30810.md): WordPress Lead Form Data Collection to CRM plugin \<= 3.0.1 - SQL Injection vulnerability (CVSS 8.5, Smackcoders Inc., Lead Form Data Collection to CRM)
- [CVE-2025-30809](https://cve.now/CVE-2025-30809.md): WordPress WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin \<= 4.8.4 - Settings Change vulnerability (CVSS 5.4, Shahjada Live Forms)
- [CVE-2025-30806](https://cve.now/CVE-2025-30806.md): WordPress Vimeotheque plugin \<= 2.3.4.2 - SQL Injection vulnerability (CVSS 8.5, Constantin Boiangiu Vimeotheque)
- [CVE-2025-30805](https://cve.now/CVE-2025-30805.md): WordPress Flexible Cookies plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpdesk Flexible Cookies)
- [CVE-2025-30804](https://cve.now/CVE-2025-30804.md): WordPress wpShopGermany IT-RECHT KANZLEI plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, maennchen1.de wpShopGermany IT-RECHT KANZLEI)
- [CVE-2025-30803](https://cve.now/CVE-2025-30803.md): WordPress Just Writing Statistics plugin \<= 5.3 - Broken Access Control vulnerability (CVSS 4.3, Greg Ross Just Writing Statistics)
- [CVE-2025-30801](https://cve.now/CVE-2025-30801.md): WordPress TWB Woocommerce Reviews plugin \<= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Abu Bakar TWB Woocommerce Reviews)
- [CVE-2025-30800](https://cve.now/CVE-2025-30800.md): WordPress Gum Elementor Addon plugin \<= 1.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atawai Gum Elementor Addon)
- [CVE-2025-30799](https://cve.now/CVE-2025-30799.md): WordPress WP Google Street View plugin \<= 1.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pagup WP Google Street View)
- [CVE-2025-30795](https://cve.now/CVE-2025-30795.md): WordPress Automation By Autonami plugin \<= 3.5.1 - Open Redirection vulnerability (CVSS 4.7, Aman FunnelKit Automations)
- [CVE-2025-30792](https://cve.now/CVE-2025-30792.md): WordPress Comment Approved Notifier Extended plugin \<= 5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ufukart Comment Approved Notifier Extended)
- [CVE-2025-30791](https://cve.now/CVE-2025-30791.md): WordPress Cart tracking for WooCommerce plugin \<= 1.0.16 - SQL Injection Vulnerability (CVSS 7.6, wpdever Cart tracking for WooCommerce)
- [CVE-2025-30790](https://cve.now/CVE-2025-30790.md): WordPress Chatbox Manager plugin \<= 1.2.2 - Broken Access Control Vulnerability (CVSS 5.3, alexvtn Chatbox Manager)
- [CVE-2025-30789](https://cve.now/CVE-2025-30789.md): WordPress Clearout Email Validator plugin \<= 3.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, clearoutio Clearout Email Validator)
- [CVE-2025-30788](https://cve.now/CVE-2025-30788.md): WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin \<= 5.25.08 - CSRF to SQL Injection vulnerability (CVSS 8.2, Eli EZ SQL Reports Shortcode Widget and DB Backup)
- [CVE-2025-30787](https://cve.now/CVE-2025-30787.md): WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin \<= 5.25.08 - CSRF to Stored XSS vulnerability (CVSS 7.1, Eli EZ SQL Reports Shortcode Widget and DB Backup)
- [CVE-2025-30786](https://cve.now/CVE-2025-30786.md): WordPress Quotes llama plugin \<= 3.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, oooorgle Quotes llama)
- [CVE-2025-30785](https://cve.now/CVE-2025-30785.md): WordPress Subscribe to Download Lite plugin \<= 1.2.9 - Local File Inclusion Vulnerability (CVSS 7.5, WP Shuffle Subscribe to Download Lite)
- [CVE-2025-30784](https://cve.now/CVE-2025-30784.md): WordPress WP Subscription Forms plugin \<= 1.2.3 - SQL Injection Vulnerability (CVSS 8.5, WP Shuffle WP Subscription Forms)
- [CVE-2025-30783](https://cve.now/CVE-2025-30783.md): WordPress WP Google Review Slider plugin \<= 16.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, jgwhite33 WP Google Review Slider)
- [CVE-2025-30781](https://cve.now/CVE-2025-30781.md): WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin \<= 3.7.1 - Open Redirection Vulnerability (CVSS 4.7, WPFactory Scheduled & Automatic Order Status Controller for…)
- [CVE-2025-30780](https://cve.now/CVE-2025-30780.md): WordPress Audio Album plugin \<= 1.5.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, cubecolour Audio Album)
- [CVE-2025-30779](https://cve.now/CVE-2025-30779.md): WordPress Doneren met Mollie plugin \<= 2.10.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Nick van Wobbie Doneren met Mollie)
- [CVE-2025-30777](https://cve.now/CVE-2025-30777.md): WordPress Support Genix plugin \<= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 4.3, DevItems Support Genix)
- [CVE-2025-30776](https://cve.now/CVE-2025-30776.md): WordPress Sitekit plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webvitaly Sitekit)
- [CVE-2025-30775](https://cve.now/CVE-2025-30775.md): WordPress WPGuppy plugin \<= 1.1.3 - SQL Injection vulnerability (CVSS 8.5, AmentoTech Private Limited WPGuppy)
- [CVE-2025-30773](https://cve.now/CVE-2025-30773.md): WordPress TranslatePress plugin \<= 2.9.6 - PHP Object Injection Vulnerability (CVSS 7.2, Cozmoslabs TranslatePress)
- [CVE-2025-30771](https://cve.now/CVE-2025-30771.md): WordPress WP Cassify plugin \<= 2.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Alain-Aymerick FRANCOIS WP Cassify)
- [CVE-2025-30770](https://cve.now/CVE-2025-30770.md): WordPress Charitable plugin \<= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Syed Balkhi Charitable)
- [CVE-2025-30769](https://cve.now/CVE-2025-30769.md): WordPress WIP WooCarousel Lite plugin \<= 1.1.7 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, alexvtn WIP WooCarousel Lite)
- [CVE-2025-30772](https://cve.now/CVE-2025-30772.md): WordPress WPC Smart Upsell Funnel for WooCommerce plugin \<= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, WPClever WPC Smart Upsell Funnel for WooCommerce)
- [CVE-2025-30768](https://cve.now/CVE-2025-30768.md): WordPress jAlbum Bridge plugin \<= 2.0.18 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, mlaza jAlbum Bridge)
- [CVE-2025-30767](https://cve.now/CVE-2025-30767.md): WordPress PDF for WPForms plugin \<= 5.3.0 - Arbitrary Shortcode Execution vulnerability (CVSS 5.4, add-ons.org PDF for WPForms)
- [CVE-2025-30766](https://cve.now/CVE-2025-30766.md): WordPress Happy Addons for Elementor plugin \<= 3.16.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HappyMonster Happy Addons for Elementor)
- [CVE-2025-30765](https://cve.now/CVE-2025-30765.md): WordPress FlexStock plugin \<= 3.13.1 - SQL Injection Vulnerability (CVSS 7.6, WPPOOL FlexStock)
- [CVE-2025-30764](https://cve.now/CVE-2025-30764.md): WordPress Football Pool plugin \<= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, AntoineH Football Pool)
- [CVE-2025-30763](https://cve.now/CVE-2025-30763.md): WordPress EO4WP plugin \<= 1.0.8.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Olaf Lederer EO4WP)
- [CVE-2025-29993](https://cve.now/CVE-2025-29993.md): The affected versions of PowerCMS allow HTTP header injection. (CVSS 5.3, Alfasado PowerCMS 6.x series · Alfasado PowerCMS 5.x ser… +1)
- [CVE-2024-45361](https://cve.now/CVE-2024-45361.md): Mi Connect Service APP protocol flaws lead to leaking sensitive user information (CVSS 6.5, Xiaomi Mi Connect Service)
- [CVE-2024-45356](https://cve.now/CVE-2024-45356.md): Xiaomi phone framework has unauthorized access vulnerability (CVSS 7.3, Xiaomi phone framework has unauthorized access vulnerability)
- [CVE-2024-45355](https://cve.now/CVE-2024-45355.md): Xiaomi phone framework has unauthorized access vulnerability (CVSS 5.5, Xiaomi phone framework)
- [CVE-2024-45354](https://cve.now/CVE-2024-45354.md): xiaomi shop application Webview has code execution vulnerability (CVSS 4.3, Xiaomi shop application)
- [CVE-2024-45353](https://cve.now/CVE-2024-45353.md): quick App has intent redriction vulnerability (CVSS 4.3, Xiaomi quick app framework)
- [CVE-2025-2685](https://cve.now/CVE-2025-2685.md): TablePress – Tables in WordPress made easy \<= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, tobiasbg TablePress – Tables in WordPress made easy)
- [CVE-2025-2332](https://cve.now/CVE-2025-2332.md): Export All Posts, Products, Orders, Refunds & Users \<= 2.13 - Unauthenticated PHP Object Injection (CVSS 9.8, smackcoders Export All Posts, Products, Orders, Refunds & U…)
- [CVE-2025-0273](https://cve.now/CVE-2025-0273.md): HCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability (CVSS 5.5, HCL Software HCL DevOps Deploy / HCL Launch)
- [CVE-2025-31165](https://cve.now/CVE-2025-31165.md): Cross Site Scripting in NightWolf Penetration Platform (CVSS 6.9, FPT Software NightWolf Penetration Platform)
- [CVE-2025-2835](https://cve.now/CVE-2025-2835.md): zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery (CVSS 5.3, zhangyd-c OneBlog)
- [CVE-2025-2833](https://cve.now/CVE-2025-2833.md): zhangyd-c OneBlog HTTP Header redos (CVSS 6.9, zhangyd-c OneBlog)
- [CVE-2025-2832](https://cve.now/CVE-2025-2832.md): mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgery (CVSS 5.3, mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统)
- [CVE-2025-2831](https://cve.now/CVE-2025-2831.md): mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 bookList getBookList sql injection (CVSS 5.3, mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统)
- [CVE-2024-45352](https://cve.now/CVE-2024-45352.md): Xiaomi smarthome application Webview has code execution vulnerability (CVSS 8.8, Xiaomi smarthome application)
- [CVE-2025-2481](https://cve.now/CVE-2025-2481.md): MediaView \<= 1.1.2 - Reflected Cross-Site Scripting via id Parameter (CVSS 6.1, dman25560 MediaView)
- [CVE-2025-30355](https://cve.now/CVE-2025-30355.md): Synapse vulnerable to federation denial of service via malformed events (CVSS 7.1, element-hq synapse · matrix-synapse)
- [CVE-2024-55070](https://cve.now/CVE-2024-55070.md): A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to (CVSS 3.1)
- [CVE-2024-55072](https://cve.now/CVE-2024-55072.md): A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their (CVSS 5.4)
- [CVE-2024-55073](https://cve.now/CVE-2024-55073.md): A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their (CVSS 7.6)
- [CVE-2025-25686](https://cve.now/CVE-2025-25686.md): semcms \<=5.0 is vulnerable to SQL Injection in SEMCMS\_Fuction.php. (CVSS 9.8)
- [CVE-2025-26265](https://cve.now/CVE-2025-26265.md): A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification (CVSS 6.5)
- [CVE-2025-28135](https://cve.now/CVE-2025-28135.md): TOTOLINK A810R V4.1.2cu.5182\_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi. (CVSS 7.5)
- [CVE-2025-28138](https://cve.now/CVE-2025-28138.md): The TOTOLINK A800R V4.1.2cu.5137\_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg funct (CVSS 9.8)
- [CVE-2025-29072](https://cve.now/CVE-2025-29072.md): An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes (CVSS 7.5, github.com/NethermindEth/juno)
- [CVE-2025-29306](https://cve.now/CVE-2025-29306.md): An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. (CVSS 9.8)
- [CVE-2025-29483](https://cve.now/CVE-2025-29483.md): libming v0.4.8 was discovered to contain a memory leak via the parseSWF\_ENABLEDEBUGGER2 function. (CVSS 6.5)
- [CVE-2025-29484](https://cve.now/CVE-2025-29484.md): An out-of-memory error in the parseABC\_NS\_SET\_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to all (CVSS 7.5)
- [CVE-2025-29485](https://cve.now/CVE-2025-29485.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileRETURN function. (CVSS 6.5)
- [CVE-2025-29486](https://cve.now/CVE-2025-29486.md): libming v0.4.8 was discovered to contain a memory leak via the parseSWF\_PLACEOBJECT3 function. (CVSS 6.5)
- [CVE-2025-29487](https://cve.now/CVE-2025-29487.md): An out-of-memory error in the parseABC\_STRING\_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to all (CVSS 7.5)
- [CVE-2025-29488](https://cve.now/CVE-2025-29488.md): libming v0.4.8 was discovered to contain a memory leak via the parseSWF\_INITACTION function. (CVSS 6.5)
- [CVE-2025-29489](https://cve.now/CVE-2025-29489.md): libming v0.4.8 was discovered to contain a memory leak via the parseSWF\_MORPHLINESTYLES function. (CVSS 6.5)
- [CVE-2025-29490](https://cve.now/CVE-2025-29490.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. (CVSS 6.5)
- [CVE-2025-29491](https://cve.now/CVE-2025-29491.md): An allocation-size-too-big error in the parseSWF\_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (D (CVSS 6.5)
- [CVE-2025-29492](https://cve.now/CVE-2025-29492.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function. (CVSS 6.5)
- [CVE-2025-29493](https://cve.now/CVE-2025-29493.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function. (CVSS 6.5)
- [CVE-2025-29494](https://cve.now/CVE-2025-29494.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function. (CVSS 6.5)
- [CVE-2025-29496](https://cve.now/CVE-2025-29496.md): libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function. (CVSS 6.5)
- [CVE-2025-29497](https://cve.now/CVE-2025-29497.md): libming v0.4.8 was discovered to contain a memory leak via the parseSWF\_MORPHFILLSTYLES function. (CVSS 6.5)
- [CVE-2025-30093](https://cve.now/CVE-2025-30093.md): HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to by (CVSS 8.1)
- [CVE-2025-30232](https://cve.now/CVE-2025-30232.md): A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. (CVSS 8.1, Exim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.