CVEs published April 24, 2025
171 CVEs were published on April 24, 2025: 14 critical, 66 high. 2 are now in CISA KEV.
- Published
- 171
- Critical
- 14
- High
- 66
- Medium
- 87
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 30
Most affected products
- HCL Software HCL Leap
- 10
- Franka Robotics Franka Emika Robot
- 3
- GitLab
- 3
- Planet Technology UNI-NMS-Lite
- 3
- Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- 2
- Carlo La Pera WP Customize Login Page
- 2
- libsoup · Red Hat Enterprise Linux
- 2
- Mattermost · github.com/mattermost/mattermost-plugin-pla… +4
- 2
- Planet Technology WGS-804HPT-V2 · Planet Technology WGS-421…
- 2
- v1rustyle Flynax Bridge
- 2
Critical 14
- CVE-2025-46275Planet Technology Network Products Missing Authentication for Critical FunctionPlanet Technology WGS-804HPT-V2 · Planet Technology WGS-421…
- CVE-2025-46274Planet Technology Network Products Use of Hard-coded CredentialsPlanet Technology UNI-NMS-Lite
- CVE-2025-46273Planet Technology Network Products Use of Hard-coded CredentialsPlanet Technology UNI-NMS-Lite
- CVE-2025-46272Planet Technology Network Products OS Command InjectionPlanet Technology WGS-804HPT-V2 · Planet Technology WGS-421…
- CVE-2025-46271Planet Technology Network Products OS Command InjectionPlanet Technology UNI-NMS-Lite
- CVE-2025-26382Johnson Controls Software House iSTAR Configuration Utility (ICU) ToolJohnson Controls iSTAR Configuration Utility
- CVE-2025-43859h11 accepts some malformed Chunked-Encoding bodiespython-hyper h11 · h11
- CVE-2025-43858YoutubeDLSharp allows command injection on windows system due to non sanitized argumentsBluegrams YoutubeDLSharp · YoutubeDLSharp
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2025-46264WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerabilityblubrry PowerPress Podcasting
- CVE-2025-46248WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection VulnerabilityM A Vinoth Kumar Frontend Dashboard
- CVE-2025-3603Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Updatev1rustyle Flynax Bridge
- CVE-2025-3604Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeoverv1rustyle Flynax Bridge
- CVE-2025-3065Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletionneoslab Database Toolset
High 66
- CVE-2025-2185ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session ExpirationALBEDO Telecom Net.Time - PTP/NTP clock
- CVE-2025-3606Vestel AC Charger Exposure of Sensitive System Information to an Unauthorized Control SphereVestel AC Charger EVC04
- CVE-2025-1294eForm <= 4.18.0 - Unauthenticated Stored Cross-Site ScriptingWPQuark eForm - WordPress Form Builder
- CVE-2023-37534HCL Leap is affected by a Cross-site scripting (XSS) vulnerabilityHCL Software HCL Leap
- CVE-2025-46473WordPress Social Counter plugin <= 2.0.5 - PHP Object Injection VulnerabilityPrisna Social Counter
- CVE-2025-46507WordPress Unsafe Mimetypes plugin <= 0.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityldrumm Unsafe Mimetypes
- CVE-2025-46481WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection VulnerabilityMichael Cannon Flickr Shortcode Importer
- CVE-2025-46442WordPress Loan Calculator plugin <= 1.3 - CSRF to Stored XSS vulnerabilityCasey Johnson Loan Calculator
- CVE-2025-46457WordPress Wp Custom CMS Block plugin <= 2.1 - CSRF to Stored XSS vulnerabilityAhsanullah Akanda Wp Custom CMS Block
- CVE-2025-46449WordPress WoWHead Tooltips plugin <= 2.0.1 - Cross Site Scripting (XSS) VulnerabilityNovium WoWHead Tooltips
- CVE-2025-46530WordPress Hacklog Remote Attachment plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) VulnerabilityHuangYe WuDeng Hacklog Remote Attachment
- CVE-2025-46528WordPress Availability Calendar plugin <= 0.2.4 - Cross Site Request Forgery (CSRF) VulnerabilitySteve Availability Calendar
- CVE-2025-46524WordPress WP Filter Post Category plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitystesvis WP Filter Post Category
- CVE-2025-46522WordPress Tabs plugin <= 4.0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityBilly Bryant Tabs
- CVE-2025-46520WordPress Related Posts via Taxonomies plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityalphasis Related Posts via Taxonomies
- CVE-2025-46516WordPress Twitter Card Generator plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitysilencecm Twitter Card Generator
- CVE-2025-46514WordPress Milat jQuery Automatic Popup plugin <= 1.3.1 - CSRF to Stored XSS vulnerabilityMilat jQuery Automatic Popup
- CVE-2025-46512WordPress Custom Functions Plugin plugin <= 1.1 - CSRF to Stored XSS vulnerabilityShamim Hasan Custom Functions Plugin
- CVE-2025-46510WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerabilityharrysudana Contact Form 7 Calendar
- CVE-2025-46508WordPress Advanced lazy load plugin <= 1.6.0 - CSRF to Stored XSS vulnerabilitykasonzhao Advanced lazy load
- CVE-2025-46506WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerabilityLora77 WpZon – Amazon Affiliate Plugin
- CVE-2025-46504WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerabilityOlar Marius Vasaio QR Code
- CVE-2025-46502WordPress LSD Custom taxonomy and category meta plugin <= 1.3.2 - CSRF to XSS vulnerabilityBas Matthee LSD Custom taxonomy and category meta
- CVE-2025-46499WordPress PayPal Express Checkout plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityhccoder PayPal Express Checkout
- CVE-2025-46497WordPress Navegg Analytics plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityNavegg Analytics
- CVE-2025-46492WordPress Call Now PHT Blog plugin <= 2.4.1 - CSRF to XSS vulnerabilityPham Thanh Call Now PHT Blog
- CVE-2025-46478WordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerabilitymetaloha Dropdown Content
- CVE-2025-46466WordPress Modern Polls plugin <= 1.0.10 - CSRF to Stored XSS vulnerabilityfelixtz Modern Polls
- CVE-2025-46465WordPress Print Science Designer plugin <= 1.3.155 - CSRF to Stored XSS vulnerabilityJohn Weissberg Print Science Designer
- CVE-2025-46452WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerabilityOlav Kolbu Google News
- CVE-2025-46450WordPress occupancyplan plugin <= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityx000x occupancyplan
- CVE-2025-46439WordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerabilityVladimir Prelovac Plugin Central
- CVE-2025-46435WordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerabilityYash Binani Time Based Greeting
- CVE-2025-32921WordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerabilitywpoperations Arrival
- CVE-2025-39359WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerabilitycodeworkweb CWW Portfolio
- CVE-2025-39360WordPress Grace Mag theme <= 1.1.5 - Local File Inclusion vulnerabilityeverestthemes Grace Mag
- CVE-2025-39377WordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerabilityweDevs Appsero Helper
- CVE-2025-39378WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerabilityHolest Engineering Spreadsheet Price Changer for WooCommerc…
- CVE-2025-39379WordPress Capturly plugin <= 2.0.1 - Local File Inclusion vulnerabilityCapturly
- CVE-2025-39381WordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerabilityKiotViet Sync
- CVE-2025-39382WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilitydanielpataki ACF: Google Font Selector
- CVE-2025-39383WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerabilitycodeworkweb Xews Lite
- CVE-2025-39384WordPress Product Lister for eBay plugin <= 2.0.9 - Local File Inclusion vulnerabilitycedcommerce Product Lister for eBay
- CVE-2025-39387WordPress Opstore theme <= 1.4.5 - Local File Inclusion vulnerabilitywpoperations Opstore
- CVE-2025-39391WordPress Checkout Field Visibility for WooCommerce plugin <= 1.3.0 - Local File Inclusion vulnerabilityzamartz Checkout Field Visibility for WooCommerce
- CVE-2025-39397WordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerabilitygopiplus@hotmail.com Anything Popup
- CVE-2025-39399WordPress License For Envato plugin <= 1.0.0 - Local File Inclusion vulnerabilityAshraful Sarkar Naiem License For Envato
- CVE-2025-39400WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywpeverest User Registration
- CVE-2025-39408WordPress BruteGuard – Brute Force Login Protection plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEverPress BruteGuard – Brute Force Login Protection
- CVE-2025-46230WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion VulnerabilityGhozyLab Popup Builder
- CVE-2025-46234WordPress Control Listings plugin <= 1.0.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityHabibur Rahman Razib Control Listings
- CVE-2025-43855tRPC 11 WebSocket DoS Vulnerabilitytrpc · @trpc/server
- CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypassApache Software Foundation Apache HttpComponents · org.apac…
- CVE-2021-47663Improper session handlingFranka Robotics Franka Emika Robot
- CVE-2021-47662Unauthenticated remote shutdown of the cobotFranka Robotics Franka Emika Robot
- CVE-2025-3872Privilege escalation by altering payload in contact formCentreon
- CVE-2025-3776Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Executioncajka Verification SMS with TargetSMS
- CVE-2025-3300WPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Writeludwigyou WPMasterToolKit (WPMTK) – All in one plugin
- CVE-2025-3607Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Resetarkenon Login, Registration and Lost Password Blocks
- CVE-2025-3101Configurator Theme Core <= 1.4.7 - Authenticated (Subscriber+) Privilege Escalationwp-configurator Configurator Theme Core
- CVE-2025-3058Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Updatejauharixelion Xelion Webchat
- CVE-2025-1908Business Logic Errors in GitLabGitLab
- CVE-2025-3761My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalationjoedolson My Tickets – Accessible Event Ticketing
- CVE-2025-2558The Wound <= 0.0.1 - Unauthenticated LFIthe-wound
- CVE-2025-1976Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6Brocade Fabric OS
- CVE-2025-25777Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles.
Medium, low and unrated 91
- CVE-2025-3749Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parametermgyura Breeze Display
- CVE-2025-43861ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionmiraheze ManageWiki
- CVE-2022-44759HCL Leap is affected by Cross-site scripting (XSS)HCL Software HCL Leap
- CVE-2022-44760HCL Leap is affected by an unrestricted upload of file with dangerous type vulnerabilityHCL Software HCL Leap
- CVE-2023-37516HCL Leap is affected by missing "no cache" headersHCL Software HCL Leap
- CVE-2024-30127HCL Leap is affected by missing "no cache" headersHCL Software HCL Leap
- CVE-2023-45720HCL Leap is affected by a disclosure of private personal information vulnerabilityHCL Software HCL Leap
- CVE-2024-30113HCL Leap is affected by a cross-site scripting (XSS) vulnerabilityHCL Software HCL Leap
- CVE-2024-30114HCL Leap is affected by a cross-site scripting (XSS) vulnerabilityHCL Software HCL Leap
- CVE-2024-30147HCL Leap is affected by a cross-site scripting (XSS) vulnerabilityHCL Software HCL Leap
- CVE-2024-30148HCL Leap is affected by improper access controlHCL Software HCL Leap
- CVE-2025-46498WordPress Zalo Official Live Chat plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerabilitynghialuu Zalo Official Live Chat
- CVE-2025-46523WordPress COVID-19 (Coronavirus) Update Your Customers plugin <= 1.5.1 - Cross Site Scripting (XSS) Vulnerabilitydevignstudiosltd COVID-19 (Coronavirus) Update Your Custome…
- CVE-2025-46447WordPress Fable Extra plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityWPFable Fable Extra
- CVE-2025-46531WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) VulnerabilityAnkur Vishwakarma WP AVCL Automation Helper
- CVE-2025-46519WordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control VulnerabilityM.Code Media Library Downloader
- CVE-2025-46511WordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) VulnerabilityDerek Springer BeerXML Shortcode
- CVE-2025-46503WordPress Simple Google Photos Grid plugin <= 1.5 - Server Side Request Forgery (SSRF) Vulnerabilityjosheli Simple Google Photos Grid
- CVE-2025-46489WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerabilityvinodvaswani9 Bulk Assign Linked Products For WooCommerce
- CVE-2025-46485WordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control VulnerabilityCarlo La Pera WP Customize Login Page
- CVE-2025-46477WordPress WP Customize Login Page plugin <= 1.6.5 - Cross Site Scripting (XSS) VulnerabilityCarlo La Pera WP Customize Login Page
- CVE-2025-46469WordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityBenjamin Buddle Send From
- CVE-2025-46459WordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) VulnerabilityRalf Hortt Confirm User Registration
- CVE-2025-46451WordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) VulnerabilitySyed Balkhi Floating Social Bar
- CVE-2025-46541WordPress WP-reCAPTCHA-bp plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerabilityelrata_ WP-reCAPTCHA-bp
- CVE-2025-46533WordPress Landing pages and Domain aliases for WordPress plugin <= 0.8 - Cross Site Scripting (XSS) Vulnerabilitywpdrift.no Landing pages and Domain aliases for WordPress
- CVE-2025-46529WordPress Business Contact Widget plugin <= 2.7.0 - Cross Site Scripting (XSS) VulnerabilityStressFree Sites Business Contact Widget
- CVE-2025-46525WordPress WP Cookie Consent plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilitymsmitley WP Cookie Consent
- CVE-2025-46521WordPress WS Force Login Page plugin <= 3.0.3 - Cross Site Scripting (XSS) VulnerabilitySilver Muru WS Force Login Page
- CVE-2025-46517WordPress Blog Manager WP plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerabilitywpdiscover Blog Manager WP
- CVE-2025-46513WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) VulnerabilityCodebangers All in One Time Clock Lite
- CVE-2025-46509WordPress 360 View plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityAndrey Mikhalchuk 360 View
- CVE-2025-46505WordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerabilityfarinspace Peekaboo
- CVE-2025-46501WordPress Mixcloud Embed plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerabilitybiancardi Mixcloud Embed
- CVE-2025-46496WordPress Mini twitter feed plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerabilityoniswap Mini twitter feed
- CVE-2025-46491WordPress Multi-Column Taxonomy List plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityMatthew Muro Multi-Column Taxonomy List
- CVE-2025-46483WordPress Peadig’s Google +1 Button plugin <= 0.1.2 - Cross Site Scripting (XSS) VulnerabilityAlex Moss Peadig’s Google +1 Button
- CVE-2025-46479WordPress BBCode Deluxe plugin <= 2020.08.01.2 - Cross Site Scripting (XSS) VulnerabilityDevynCJohnson BBCode Deluxe
- CVE-2025-46475WordPress Able Player plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityJoe Dolson Able Player
- CVE-2025-46471WordPress WP Custom Post Popup plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerabilitygnanavelshenll WP Custom Post Popup
- CVE-2025-46467WordPress RAphicon plugin <= 2.1.2 - Cross Site Scripting (XSS) VulnerabilityRahendra Putra K™ RAphicon
- CVE-2025-46461WordPress RRSSB plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityRelentless Apps RRSSB
- CVE-2025-46453WordPress Zoho Creator Forms <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityCreatorTeam Zoho Creator Forms
- CVE-2025-46445WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) VulnerabilitypReya External Markdown
- CVE-2025-46438WordPress GTDB Guitar Tuners plugin <= 4.2.2 - Cross Site Scripting (XSS) Vulnerabilitywarmwhisky GTDB Guitar Tuners
- CVE-2025-46542WordPress Xpert Tab plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityThemeXpert Xpert Tab
- CVE-2025-46540WordPress GNA Search Shortcode plugin <= 0.9.5 - Cross Site Scripting (XSS) VulnerabilityChris Mok GNA Search Shortcode
- CVE-2025-46538WordPress Inline Text Popup plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerabilitywebplanetsoft Inline Text Popup
- CVE-2025-46536WordPress Carousel-of-post-images plugin <= 1.07 - Cross Site Scripting (XSS) VulnerabilityRichardHarrison Carousel-of-post-images
- CVE-2025-46534WordPress Image Style Hover plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityDanielRiera Image Style Hover
- CVE-2025-46532WordPress Tooltip plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityHaris Zulfiqar Tooltip
- CVE-2025-46495WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerabilitytomontoast Drop Caps
- CVE-2025-46484WordPress Image Hover Effects For WPBakery Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerabilitynasir179125 Image Hover Effects For WPBakery Page Builder
- CVE-2025-46480WordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) VulnerabilityPadam Shankhadev Nepali Post Date
- CVE-2025-46476WordPress Awesome Wp Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilitynayon46 Awesome Wp Image Gallery
- CVE-2025-46472WordPress The Pack Elementor addons plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerabilitywebangon The Pack Elementor addons
- CVE-2025-46470WordPress Smart Hashtags [#hashtagger] plugin <= 7.2.3 - Broken Access Control VulnerabilityPeter Raschendorfer Smart Hashtags [#hashtagger]
- CVE-2025-46462WordPress WPVN plugin <= 0.7.8 - Cross Site Request Forgery (CSRF) VulnerabilityTrân Minh-Quân WPVN
- CVE-2025-46443WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) VulnerabilityAdam Pery Animate
- CVE-2025-46436WordPress SCSS-Library plugin <= 0.4.1 - Cross Site Request Forgery (CSRF) VulnerabilitySebastian Echeverry SCSS-Library
- CVE-2025-39385WordPress Sirat theme <= 1.5.1 - Broken Access Control vulnerabilityvowelweb Sirat
- CVE-2025-39390WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-39404WordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerabilityHeateor Support Sassy Social Share
- CVE-2025-46260WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilitywowDevs Sky Addons for Elementor
- CVE-2025-46261WordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-30409Denial of service due to allocation of resources without limits.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2025-30408Local privilege escalation due to insecure folder permissions.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2025-46421Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a serverlibsoup · Red Hat Enterprise Linux
- CVE-2025-46420Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.clibsoup · Red Hat Enterprise Linux
- CVE-2021-47664Enumeration of valid user namesFranka Robotics Franka Emika Robot
- CVE-2025-3793Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Updatelamarant Buddypress Force Password Change
- CVE-2025-3280ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injectionelextensions ELEX WooCommerce Bulk Edit Products, Prices &…
- CVE-2024-13307Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updatespixel_prime Reales WP - Real Estate WordPress Theme
- CVE-2025-3832FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameterjeremyshapiro FuseDesk
- CVE-2025-2579Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Uploadbplugins Lottie Player – Add Interactive Lottie Animations…
- CVE-2025-2543Advanced Accordion Gutenberg Block <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadspiderdevs Advanced Accordion Gutenberg Block – Create Beau…
- CVE-2025-1284Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosurexpertsclub Woocommerce Automatic Order Printing |
- CVE-2024-12244Missing Authorization in GitLabGitLab
- CVE-2025-0639Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-41423Unauthorized Playbooks Post Deletion in Mattermost Playbooks PluginMattermost · github.com/mattermost/mattermost-plugin-pla… +4
- CVE-2025-35965DoS in Mattermost Playbooks via Excessive Task ActionsMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2025-41395Webapp DoS via malicious retrospective post in PlaybooksMattermost · github.com/mattermost/mattermost-plugin-pla… +4
- CVE-2025-32730Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd.i-PRO Co. i-PRO Configuration Tool
- CVE-2025-1453Category Posts Widget < 4.9.20 - Admin+ Stored XSSCategory Posts Widget
- CVE-2025-3435MangBoard WP <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footerkitae-park Mang Board WP
- CVE-2025-29529ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpa
- CVE-2025-29568A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0.
- CVE-2025-44134A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php.
- CVE-2025-44135A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php.
- CVE-2025-46417The unsafe globals in Picklescan before 0.0.25 do not include ssl.Picklescan
- CVE-2025-46419Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.Westermo WeOS