CVEs published April 9, 2025
194 CVEs were published on April 9, 2025: 13 critical, 99 high.
- Published
- 194
- Critical
- 13
- High
- 99
- Medium
- 81
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 53
Most affected products
- Juniper Networks Junos OS
- 21
- Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- 8
- NI LabVIEW
- 4
- dnnsoftware Dnn.Platform
- 3
- Schneider Electric Trio Q Licensed Data Radio
- 3
- blubrry PowerPress Podcasting
- 2
- Bogdan Bendziukov Squeeze
- 2
- Brizy Pro
- 2
- helm · helm.sh/helm/v3
- 2
- Joe Waymark
- 2
Critical 13
- CVE-2025-3115Spotfire Data Function VulnerabilitySpotfire Statistics Services · Spotfire Analyst +6
- CVE-2025-3114Spotfire Code Execution VulnerabilitySpotfire Enterprise Runtime for R · Spotfire Statistics… +4
- CVE-2025-32695WordPress Checkout Mestres WP plugin <= 8.7.5 - Privilege Escalation VulnerabilityMestres do WP Checkout Mestres WP
- CVE-2025-31002WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerabilityBogdan Bendziukov Squeeze
- CVE-2025-31033WordPress Buddypress Humanity plugin <= 1.2 - CSRF to Privilege Escalation vulnerabilityAdam Nowak Buddypress Humanity
- CVE-2025-32496WordPress Ultra Demo Importer plugin <= 1.0.5 - CSRF to RCE vulnerabilityUncodethemes Ultra Demo Importer
- CVE-2025-32576WordPress WP shop plugin <= 2.6.1 - CSRF to Arbitrary File Upload vulnerabilityAgence web Eoxia - Montpellier WP shop
- CVE-2025-32641WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerabilityanantaddons Anant Addons for Elementor
- CVE-2025-32642WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerabilityappsbd Vite Coupon
- CVE-2025-32375Insecure Deserialization leads to RCE in BentoML's runner serverBentoML
- CVE-2025-27797OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2024-55210An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket
- CVE-2025-32461wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval.Tiki
High 99
- CVE-2025-30660Junos OS: MX Series: Decapsulation of specific GRE packets leads to PFE resetJuniper Networks Junos OS
- CVE-2025-30659Junos OS: SRX Series: A device configured for vector routing crashes when receiving malformed trafficJuniper Networks Junos OS
- CVE-2025-30658Junos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will cause memory to leak ultimately causing forwarding to stopJuniper Networks Junos OS
- CVE-2025-30656Junos OS: MX Series, SRX Series: Processing of specific SIP INVITE messages by the SIP ALG will lead to an FPC crashJuniper Networks Junos OS
- CVE-2025-30651Junos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crashJuniper Networks Junos OS
- CVE-2025-30649Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a CPU utilization DoS.Juniper Networks Junos OS
- CVE-2025-30648Junos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhcpd process to crashJuniper Networks Junos OS
- CVE-2025-30645Junos OS: SRX Series: Transmission of specific control traffic sent out of a DS-Lite tunnel results in flowd crashJuniper Networks Junos OS
- CVE-2025-30644Junos OS: EX2300, EX3400, EX4000 Series, QFX5k Series: Receipt of a specific DHCP packet causes FPC crash when DHCP Option 82 is enabledJuniper Networks Junos OS
- CVE-2025-21601Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the deviceJuniper Networks Junos OS
- CVE-2025-21594Junos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port blockJuniper Networks Junos OS
- CVE-2025-21591Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crashJuniper Networks Junos OS
- CVE-2025-2632Out of Bounds Write Vulnerability in NI LabVIEW reading CPU info from cacheNI LabVIEW
- CVE-2025-2631Out of Bounds Write Vulnerability in NI LabVIEW in InitCPUInformation()NI LabVIEW
- CVE-2025-2630DLL Hijacking Vulnerability in NI LabVIEWNI LabVIEW
- CVE-2025-2629DLL Hijacking Vulnerability in NI LabVIEW When Loading NI Error ReportingNI LabVIEW
- CVE-2025-31383WordPress FrescoChat Live Chat plugin <= 3.2.6 - CSRF to Stored XSS vulnerabilitysodena FrescoChat Live Chat
- CVE-2025-31385WordPress Site Table of Contents plugin <= 0.3 - CSRF to Stored XSS vulnerabilityintelcaprep Site Table of Contents
- CVE-2025-31023WordPress Seo Meta Tags plugin <= 1.4 - CSRF to Privilege Escalation vulnerabilityPurab Seo Meta Tags
- CVE-2025-31026WordPress Comment Validation Reloaded plugin <= 0.5 - CSRF to Stored XSS vulnerabilityAustin Comment Validation Reloaded
- CVE-2025-31032WordPress Pagopar – WooCommerce Gateway plugin <= 2.7.1 - CSRF to Stored XSS vulnerabilityPagopar - Grupo M S.A. Pagopar – WooCommerce Gateway
- CVE-2025-31036WordPress WPSolr plugin <= 24.0 - CSRF to Privilege Escalation vulnerabilityWPSolr
- CVE-2025-31038WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Privilege Escalation vulnerabilityEssential Marketer Essential Breadcrumbs
- CVE-2025-31375WordPress Scheduled plugin <= 1.0 - CSRF to Stored XSS vulnerabilitybhoogterp Scheduled
- CVE-2025-31377WordPress Woo Product Feed For Marketing Channels plugin <= 1.9.0 - Broken Access Control VulnerabilityAsaquzzaman mishu Woo Product Feed For Marketing Channels
- CVE-2025-31382WordPress Language Field plugin <= 0.9 - CSRF to Stored XSS vulnerabilitytheode Language Field
- CVE-2025-31388WordPress The World plugin <= 0.4 - CSRF to Stored XSS vulnerabilitydoa The World
- CVE-2025-31390WordPress Social Crowd plugin <= 0.9.6.1 - CSRF to Stored XSS vulnerabilitybdoga Social Crowd
- CVE-2025-31391WordPress Script Compressor plugin <= 1.7.1 - CSRF to Stored XSS vulnerabilityregen Script Compressor
- CVE-2025-31392WordPress Smart Product Gallery Slider plugin <= 1.0.4 - CSRF to Stored XSS vulnerabilityShameem Reza Smart Product Gallery Slider
- CVE-2025-31393WordPress Social Bookmarking RELOADED plugin <= 3.18 - CSRF to Stored XSS vulnerabilityvfvalent Social Bookmarking RELOADED
- CVE-2025-31394WordPress More Mime Type Filters plugin <= 0.3 - CSRF to Stored XSS vulnerabilityKailey (trepmal) More Mime Type Filters
- CVE-2025-31395WordPress Easy Custom CSS plugin <= 1.0 - CSRF to Stored XSS vulnerabilitya.ankit Easy Custom CSS
- CVE-2025-31399WordPress CG Scroll To Top plugin <= 3.5 - CSRF to Stored XSS vulnerabilityChandan Garg CG Scroll To Top
- CVE-2025-31400WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerabilityicyleaf WS Audio Player
- CVE-2025-31401WordPress MMX – Make Me Christmas plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilitymmetrodw MMX – Make Me Christmas
- CVE-2025-31402WordPress NewsBoard Post and RSS Scroller plugin <= 1.2.12 - CSRF to Stored XSS vulnerabilityNewsBoard Plugin NewsBoard Post and RSS Scroller
- CVE-2025-31404WordPress AF Tell a Friend plugin <= 1.4 - CSRF to Stored XSS vulnerabilityWladyslaw Madejczyk AF Tell a Friend
- CVE-2025-32476WordPress Advanced Tag Lists plugin <= 1.2 - CSRF to Stored XSS vulnerabilityblueinstyle Advanced Tag Lists
- CVE-2025-32477WordPress WP-Easy Menu plugin <= 0.41 - CSRF to Stored XSS vulnerabilityJordi Salord WP-Easy Menu
- CVE-2025-32478WordPress WP SexyLightBox plugin <= 0.5.3 - CSRF to Stored XSS vulnerabilityMario Aguiar WP SexyLightBox
- CVE-2025-32479WordPress Flags Widget plugin <= 1.0.7 - CSRF to Stored XSS vulnerabilityab-tools Flags Widget
- CVE-2025-32480WordPress Windows Live Writer plugin <= 0.1 - CSRF to Stored XSS vulnerabilitydalziel Windows Live Writer
- CVE-2025-32481WordPress Nino Social Connect plugin <= 2.0 - CSRF to Stored XSS vulnerabilityninotheme Nino Social Connect
- CVE-2025-32482WordPress Custom Smilies plugin <= 1.2 - CSRF to Stored XSS vulnerabilityquanganhdo Custom Smilies
- CVE-2025-32484WordPress WP-Planification – WP-Planning plugin <= 2.3.1 - CSRF to Stored XSS vulnerabilityMathieu Chartier WP-Planification
- CVE-2025-32497WordPress Spoiler Block plugin <= 1.7 - CSRF to Stored XSS vulnerabilitysquiter Spoiler Block
- CVE-2025-32498WordPress VKontakte Cross-Post plugin <= 0.3.2 - CSRF to Stored XSS vulnerabilityoleglark VKontakte Cross-Post
- CVE-2025-32500WordPress Codescar Radio Widget plugin <= 0.4.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilitySudavar Codescar Radio Widget
- CVE-2025-32501WordPress RentSyst plugin <= 2.0.92 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitydimafreund Rentsyst
- CVE-2025-32502WordPress ePaper Lister for Yumpu plugin <= 1.4.0 - CSRF to Stored XSS vulnerabilitylemmentwickler ePaper Lister for Yumpu
- CVE-2025-32503WordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityJose Conti Link Shield
- CVE-2025-32505WordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerabilitySCAND MultiMailer
- CVE-2025-32518WordPress ALD Login Page plugin <= 1.1 - CSRF to Stored XSS vulnerabilityhossainawlad ALD Login Page
- CVE-2025-32543WordPress Canonical Attachments Plugin <= 1.8 - Stored Cross Site Scripting (XSS) vulnerabilityhivedigital Canonical Attachments
- CVE-2025-32547WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to SQL Injection vulnerabilitygtlwpdev All push notification for WP
- CVE-2025-32550WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerabilityClickandPledge Click & Pledge Connect Plugin
- CVE-2025-32555WordPress SEO, Nutrition and Print for Recipes by Edamam plugin <= 3.3 - CSRF to Cross-Site Scripting vulnerabilitySEO, Nutrition and Print for Recipes by Edamam
- CVE-2025-32556WordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerabilitySandor Kovacs Simple Post Meta Manager
- CVE-2025-32559WordPress REVE Chat plugin <= 6.4.4 - Cross Site Request Forgery (CSRF) vulnerabilityREVE Chat
- CVE-2025-32563WordPress WP Calais Auto Tagger plugin <= 2.0 - CSRF to Stored XSS vulnerabilitydangrossman WP Calais Auto Tagger
- CVE-2025-32570WordPress ChillPay WooCommerce Plugin <= 2.5.3 - CSRF to Stored XSS vulnerabilityChillPay WooCommerce
- CVE-2025-32575WordPress WP w3all phpBB Plugin <= 2.9.9 - CSRF to Stored XSS vulnerabilityaxew3 WP w3all phpBB
- CVE-2025-32580WordPress DeBounce Email Validator plugin <= 5.7.1 - CSRF to Stored XSS vulnerabilityDeBounce Email Validator
- CVE-2025-32581WordPress WordPress Spam Blocker Plugin <= 2.0.5 - CSRF to Stored XSS vulnerabilityAnkit Singla WordPress Spam Blocker
- CVE-2025-32584WordPress Chat2 plugin <= 4.0 - CSRF to Stored XSS vulnerabilityChat2
- CVE-2025-32591WordPress WP Abstracts Plugin <= 2.7.5 - CSRF to Stored XSS vulnerabilityKevon Adonis WP Abstracts
- CVE-2025-32597WordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting vulnerabilityGeorge Sexton WordPress Events Calendar Plugin – connectDai…
- CVE-2025-32610WordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerabilityFolioVision Foliopress WYSIWYG
- CVE-2025-32612WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerabilityrafasashi User Session Synchronizer
- CVE-2025-32616WordPress Nimbata Call Tracking plugin <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerabilityNimbata Call Tracking
- CVE-2025-32617WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerabilityYdesignservices Multiple Location Google Map
- CVE-2025-32619WordPress KeyCAPTCHA plugin <= 2.5.1 - CSRF to Stored XSS vulnerabilityKeyCAPTCHA
- CVE-2025-32621WordPress WP Map Route Planner plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityVsourz Digital WP Map Route Planner
- CVE-2025-32623WordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerabilityplainware PlainInventory
- CVE-2025-32624WordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityCzater.pl – live chat i telefon
- CVE-2025-32644WordPress IP2Location World Clock Plugin <= 1.1.9 - CSRF to Stored XSS vulnerabilityIP2Location World Clock
- CVE-2025-32645WordPress Custom Posts Order Plugin <= 4.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityHiren Patel Custom Posts Order
- CVE-2025-32659WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.8 - CSRF to Stored XSS vulnerabilityfraudlabspro FraudLabs Pro for WooCommerce
- CVE-2025-32661WordPress Interactive US Map plugin <= 2.7 - CSRF to Stored XSS vulnerabilityWP Map Plugins Interactive US Map
- CVE-2025-32664WordPress Nepali Date Utilities plugin <= 1.0.15 - CSRF to Stored XSS vulnerabilityashokbasnet Nepali Date Utilities
- CVE-2025-32667WordPress Doppler Forms plugin <= 2.5.1 - CSRF to Stored XSS vulnerabilityfromdoppler Doppler Forms
- CVE-2025-32669WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityMergado Pack
- CVE-2025-32673WordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerabilityEpeken All Kurir
- CVE-2025-32676WordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerabilityPicture-Planet Verowa Connect
- CVE-2025-32677WordPress WP Social Stream Designer plugin <= 1.3 - SQL Injection vulnerabilitysolwininfotech WP Social Stream Designer
- CVE-2025-32685WordPress WP Inquiries plugin <= 0.2.1 - SQL Injection VulnerabilityAristo Rinjuang WP Inquiries
- CVE-2025-32692WordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion VulnerabilityWP Shuffle WP Subscription Forms
- CVE-2025-32380Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processingapollographql router · apollo-router
- CVE-2025-1968Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allProgress Software Sitefinity
- CVE-2025-2223CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineeringSchneider Electric ConneXium Network Manager
- CVE-2025-2222CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential priviSchneider Electric ConneXium Network Manager
- CVE-2025-29870Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-27934Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-25053OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-29189Flowise <= 2.2.3 is vulnerable to SQL Injection.flowise-components
- CVE-2025-29390jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.
- CVE-2025-29391horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php.
- CVE-2025-29394An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type.
Medium, low and unrated 82
- CVE-2025-32386Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Terminationhelm · helm.sh/helm/v3
- CVE-2025-32387Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflowhelm · helm.sh/helm/v3
- CVE-2025-24375MySQL K8s charm could leak credentials for root-level user `serverconfig`canonical mysql-k8s-operator
- CVE-2025-30657Junos OS: Processing of a specific BGP update causes the SRRD process to crashJuniper Networks Junos OS
- CVE-2025-30655Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabledJuniper Networks Junos OS
- CVE-2025-30654Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive informationJuniper Networks Junos OS
- CVE-2025-30653Junos OS and Junos OS Evolved: LSP flap in a specific MPLS scenario leads to rpd crashJuniper Networks Junos OS
- CVE-2025-30652Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crashJuniper Networks Junos OS
- CVE-2025-30647Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leakJuniper Networks Junos OS
- CVE-2025-30646Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crashJuniper Networks Junos OS
- CVE-2025-21597Junos OS and Junos OS Evolved: When BGP rib-sharding and update-threading are configured and a peer flaps, an rpd core is observedJuniper Networks Junos OS
- CVE-2025-21595Junos OS and Junos OS Evolved: In an EVPN-VXLAN scenario specific ARP or NDP packets cause FPC to crashJuniper Networks Junos OS
- CVE-2025-26888WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.8 - Broken Access Control vulnerabilityAmir Helzer WooCommerce Multilingual & Multicurrency
- CVE-2025-26902WordPress Brizy Pro plugin <= 2.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityBrizy Pro
- CVE-2025-26901WordPress Brizy Pro plugin <= 2.6.1 - Broken Access Control vulnerabilityBrizy Pro
- CVE-2025-3474Panels - Critical - Access bypass - SA-CONTRIB-2025-033Drupal Panels · drupal/panels
- CVE-2025-3131ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031Drupal ECA: Event - Condition - Action · drupal/eca
- CVE-2025-3475WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030Drupal WEB-T · drupal/webt
- CVE-2025-31003WordPress Squeeze plugin <= 1.6 - Full Path Disclosure (FPD) vulnerabilityBogdan Bendziukov Squeeze
- CVE-2025-31004WordPress Rich Table of Contents plugin <= 1.4.0 - Broken Access Control vulnerabilityCroover.inc Rich Table of Contents
- CVE-2025-31005WordPress Easyfonts plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityUzair Easyfonts
- CVE-2025-31008WordPress YouTube Embed plugin <= 5.3.1 - Cross Site Scripting (XSS) VulnerabilityEmbeds For YouTube Plugin Support YouTube Embed
- CVE-2025-31009WordPress IndieBlocks plugin <= 0.13.1 - Server Side Request Forgery (SSRF) VulnerabilityJan Boddez IndieBlocks
- CVE-2025-31012WordPress Age Gate plugin <= 3.5.4 - Broken Access Control VulnerabilityPhil Age Gate
- CVE-2025-31017WordPress Nav Menu Manager plugin <= 3.2.5 - Cross Site Scripting (XSS) VulnerabilityRobert Noakes Nav Menu Manager
- CVE-2025-31020WordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityWebliberty Simple Spoiler
- CVE-2025-31034WordPress Customize Login Page plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityAboZain Albanna Customize Login Page
- CVE-2025-31035WordPress WP Editor.md – The Perfect Markdown Editor plugin <= 10.2.1 - Cross Site Scripting (XSS) VulnerabilityBenjamin Chris WP Editor.md – The Perfect WordPress Markdow…
- CVE-2025-31042WordPress Sandwich Adsense plugin <= 4.0.2 - Broken Access Control Vulnerabilityrtakao Sandwich Adsense
- CVE-2025-32483WordPress Request Call Back plugin <= 1.4.1 - Cross Site Scripting (XSS) VulnerabilityScott Salisbury Request Call Back
- CVE-2025-32485WordPress WP Performance Pack plugin <= 2.5.4 - Cross Site Request Forgery (CSRF) VulnerabilityBjoern WP Performance Pack
- CVE-2025-32487WordPress Waymark plugin <= 1.5.2 - Server Side Request Forgery (SSRF) VulnerabilityJoe Waymark
- CVE-2025-32488WordPress Aria Font plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerabilityآریا وردپرس Aria Font
- CVE-2025-32489WordPress Wetterwarner plugin <= 2.7.3 - Cross Site Scripting (XSS) VulnerabilityTim Wetterwarner
- CVE-2025-32492WordPress Admin Menu Post List plugin <= 2.0.7 - Cross Site Scripting (XSS) VulnerabilityEliot Akira Admin Menu Post List
- CVE-2025-32493WordPress BP Social Connect plugin <= 1.6.2 - Cross Site Scripting (XSS) VulnerabilityVibeThemes BP Social Connect
- CVE-2025-32494WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Cross Site Request Forgery (CSRF) Vulnerabilitybozdoz reCAPTCHA Jetpack
- CVE-2025-32495WordPress Waymark plugin <= 1.5.3 - Cross Site Scripting (XSS) VulnerabilityJoe Waymark
- CVE-2025-32499WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerabilitywpWax Logo Showcase Ultimate
- CVE-2025-32640WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerabilityElementor Ally
- CVE-2025-32675WordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerabilityQuantumCloud SEO Help
- CVE-2025-32678WordPress WP Show Stats plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerabilityAshish Ajani WP Show Stats
- CVE-2025-32679WordPress User Registration Using Contact Form 7 plugin <= 2.4 - Cross Site Request Forgery (CSRF) vulnerabilityZealousWeb User Registration Using Contact Form
- CVE-2025-32680WordPress Review Stream plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityGrade Us Review Stream
- CVE-2025-32683WordPress MapSVG Lite plugin <= 8.6.6 - Cross Site Scripting (XSS) VulnerabilityRomanCode MapSVG
- CVE-2025-32684WordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control VulnerabilityRomanCode MapSVG
- CVE-2025-32690WordPress PowerPress Podcasting plugin <= 11.12.5 - Cross Site Scripting (XSS) Vulnerabilityblubrry PowerPress Podcasting
- CVE-2025-32691WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerabilityblubrry PowerPress Podcasting
- CVE-2025-32693WordPress WebinarPress plugin <= 1.33.28 - Open Redirection VulnerabilityWPWebinarSystem WebinarPress
- CVE-2025-32694WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerabilityRustaurius Ultimate WP Mail
- CVE-2025-32381Denial of Service by abusing xgrammar unbounded cache in memorymlc-ai xgrammar · xgrammar
- CVE-2025-32379XSS at ctx.redirect() function in Koajskoajs koa · koa
- CVE-2025-32016Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service LogsAzureAD microsoft-identity-web · Microsoft.Identity.Web +1
- CVE-2025-32378Shopware's default newsletter opt-in settings allow for mass sign-up abuseshopware · shopware/core +1
- CVE-2025-32374Possible Denial of Service (DoS) in DNN.PLATFORM registrationdnnsoftware Dnn.Platform
- CVE-2025-32373DNN allows a registered user to enumerate and access files they should not have access todnnsoftware Dnn.Platform
- CVE-2025-32372Server-Side Request Forgery (SSRF) in DotNetNuke.Corednnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2025-32371Unexpected external content may be displayed in DNN ImageHandlerdnnsoftware Dnn.Platform
- CVE-2025-27391Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logApache Software Foundation Apache ActiveMQ Artemis · org.ap…
- CVE-2025-25023IBM Security Guardium information disclosureIBM Security Guardium
- CVE-2023-33844IBM Security Verify Governance cross-site scriptingIBM Security Verify Governance
- CVE-2025-31672Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesApache Software Foundation Apache POI · org.apache.poi:poi-…
- CVE-2025-30677Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka ConnectorsApache Software Foundation Apache Pulsar IO Kafka Connec… +2
- CVE-2017-20197propanetank Roommate-Bill-Tracking login.php sql injectionpropanetank Roommate-Bill-Tracking
- CVE-2025-2442CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access whicSchneider Electric Trio Q Licensed Data Radio
- CVE-2025-2441CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicSchneider Electric Trio Q Licensed Data Radio
- CVE-2025-2440CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential dSchneider Electric Trio Q Licensed Data Radio
- CVE-2025-27722Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-25213Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-25056Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-23407Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.Inaba Denki Sangyo Co. AC-WPS-11ac · Inaba Denki Sangyo… +4
- CVE-2025-20952Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilegSamsung Mobile Devices
- CVE-2025-3442Information Disclosure Vulnerability in TP-Link Tapo IoT Smart HubTP-Link Tapo H200 V1 IoT Smart Hub
- CVE-2024-8243Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRFWordPress/Plugin Upgrade Time Out Plugin
- CVE-2024-6860WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRFWP MultiTasking
- CVE-2024-6857WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRFWP MultiTasking
- CVE-2025-3100WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploadwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2025-29988Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability.Dell Client Platform BIOS
- CVE-2025-29018A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking Syst
- CVE-2025-29389PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.
- CVE-2025-32460GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.GraphicsMagick
- CVE-2025-32464HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling ofHAProxy