CVEs published July 4, 2025
186 CVEs were published on July 4, 2025: 18 critical, 75 high.
- Published
- 186
- Critical
- 18
- High
- 75
- Medium
- 61
- Low
- 1
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- Linux
- 59
- mbedtls
- 4
- HDF5
- 3
- Wikimedia Foundation Mediawiki - SecurePoll extension
- 3
- asaquzzaman WP Human Resource Management
- 2
- libssh · Red Hat Enterprise Linux +1
- 2
- modelcontextprotocol python-sdk · mcp
- 2
- NAVER Whale browser
- 2
- optinlyhq GoZen Forms
- 2
- thanhtungtnt Video List Manager
- 2
Critical 18
- CVE-2025-48952NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHPjokob-sk NetAlertX
- CVE-2025-53484SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputWikimedia Foundation Mediawiki - SecurePoll extension
- CVE-2025-38211RDMA/iwcm: Fix use-after-free of work objects after cm_id destructionLinux
- CVE-2025-38209nvme-tcp: remove tag set when second admin queue config failsLinux
- CVE-2025-23970WordPress Service Finder Booking plugin <= 6.1 - Privilege Escalation Vulnerabilityaonetheme Service Finder Booking
- CVE-2025-28983WordPress Click & Pledge Connect plugin <= 25.04010101-WP6.8 - Privilege Escalation via SQL Injection vulnerabilityClickandPledge Click & Pledge Connect
- CVE-2025-30933WordPress LogisticsHub theme <= 1.1.6 - Arbitrary File Upload VulnerabilityLiquidThemes LogisticsHub
- CVE-2025-49302WordPress Easy Stripe plugin <= 1.1 - Remote Code Execution (RCE) VulnerabilityScott Paterson Easy Stripe
- CVE-2025-49867WordPress RealHomes theme <= 4.4.0 - Privilege Escalation vulnerabilityInspiryThemes RealHomes
- CVE-2025-52830WordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection VulnerabilitybSecure – Your Universal Checkout
- CVE-2025-52831WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerabilitythanhtungtnt Video List Manager
- CVE-2025-52832WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerabilitywpo-HR NGG Smart Image Search
- CVE-2025-52833WordPress LMS theme <= 9.2 - SQL Injection Vulnerabilitydesignthemes LMS
- CVE-2025-49414WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload VulnerabilityFastw3b FW Gallery
- CVE-2025-49417WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data VulnerabilityBestWpDeveloper WooCommerce Product Multi-Action
- CVE-2025-28951WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerabilityCreedAlly Bulk Featured Image
- CVE-2025-53599Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.NAVER Whale browser
- CVE-2025-26850The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation Quest KACE Systems Management Appliance
High 75
- CVE-2025-53366MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Servicemodelcontextprotocol python-sdk · mcp
- CVE-2025-53365MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Servicemodelcontextprotocol python-sdk · mcp
- CVE-2025-53485SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesWikimedia Foundation Mediawiki - SecurePoll extension
- CVE-2025-53483SecurePoll: Multiple admin actions vulnerable to Cross-Site Request ForgeryWikimedia Foundation Mediawiki - SecurePoll extension
- CVE-2025-53481Denial of service vector on ipinfo/v0/norevisionWikimedia Foundation Mediawiki - IPInfo Extension
- CVE-2025-38234sched/rt: Fix race in push_rt_taskLinux
- CVE-2025-38233powerpc64/ftrace: fix clobbered r15 during livepatchingLinux
- CVE-2025-38232NFSD: fix race between nfsd registration and exports_procLinux
- CVE-2025-38230jfs: validate AG parameters in dbMount() to prevent crashesLinux
- CVE-2025-38227media: vidtv: Terminating the subsequent process of initialization failureLinux
- CVE-2025-38226media: vivid: Change the siize of the composingLinux
- CVE-2025-38224can: kvaser_pciefd: refine error prone echo_skb_max handling logicLinux
- CVE-2025-38218f2fs: fix to do sanity check on sit_bitmap_sizeLinux
- CVE-2025-38216iommu/vt-d: Restore context entry setup order for aliased devicesLinux
- CVE-2025-38212ipc: fix to protect IPCS lookups using RCULinux
- CVE-2025-38206exfat: fix double free in delayed_freeLinux
- CVE-2025-38204jfs: fix array-index-out-of-bounds read in add_missing_indicesLinux
- CVE-2025-38197platform/x86: dell_rbu: Fix list usageLinux
- CVE-2025-38193net_sched: sch_sfq: reject invalid perturb periodLinux
- CVE-2025-38192net: clear the dst when changing skb protocolLinux
- CVE-2025-38191ksmbd: fix null pointer dereference in destroy_previous_sessionLinux
- CVE-2025-38189drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`Linux
- CVE-2025-38187drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()Linux
- CVE-2025-38184tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearerLinux
- CVE-2025-38181calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().Linux
- CVE-2025-38180net: atm: fix /proc/net/atm/lec handlingLinux
- CVE-2025-38179smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()Linux
- CVE-2025-46733REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosureOP-TEE optee_os
- CVE-2025-38177sch_hfsc: make hfsc_qlen_notify() idempotentLinux
- CVE-2025-24771WordPress Content Manager Light plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityOTWthemes Content Manager Light
- CVE-2025-24780WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityPrintcart Web to Print Product Designer for WooCommerce
- CVE-2025-28968WordPress WP Wall plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityVladimir Prelovac WP Wall
- CVE-2025-28978WordPress SB Breadcrumbs plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityHung Trang Si SB Breadcrumbs
- CVE-2025-28980WordPress Aviation Weather from NOAA plugin <= 0.7.2 - Arbitrary File Deletion Vulnerabilitymachouinard Aviation Weather from NOAA
- CVE-2025-31037WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityfavethemes Homey
- CVE-2025-32297WordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection Vulnerabilityquantumcloud Simple Link Directory
- CVE-2025-32311WordPress Pressroom theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityQuanticaLabs Pressroom
- CVE-2025-39487WordPress Rankie plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityValvePress Rankie
- CVE-2025-47627WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerabilityLCweb PrivateContent - Mail Actions
- CVE-2025-49245WordPress Testimonials Showcase plugin <= 1.9.16 - Reflected Cross Site Scripting (XSS) vulnerabilitycmoreira Testimonials Showcase
- CVE-2025-49247WordPress Team Showcase plugin < 25.05.13 - Reflected Cross Site Scripting (XSS) vulnerabilitycmoreira Team Showcase
- CVE-2025-49274WordPress Neom Blog theme <= 0.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityawordpresslife Neom Blog
- CVE-2025-49866WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) VulnerabilityNikel Beautiful Cookie Consent Banner
- CVE-2025-49870WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection VulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2025-52718WordPress Alone theme <= 7.8.2 - Arbitrary Code Execution VulnerabilityBeplusthemes Alone
- CVE-2025-52776WordPress Video List Manager plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerabilitythanhtungtnt Video List Manager
- CVE-2025-52796WordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) Vulnerabilitytggfref WP-Recall
- CVE-2025-52798WordPress JobSearch plugin < 3.0.6 - Reflected Cross Site Scripting (XSS) Vulnerabilityeyecix JobSearch
- CVE-2025-52805WordPress Leyka plugin <= 3.32.1 - Local File Inclusion vulnerabilityVaultDweller Leyka
- CVE-2025-52807WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion VulnerabilityApusWP Kossy - Minimalist eCommerce WordPress Theme
- CVE-2025-52813WordPress MobiLoud <= 4.6.5 - Broken Access Control Vulnerabilitypietro MobiLoud
- CVE-2025-52828WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerabilitydesignthemes Red Art
- CVE-2025-4414WordPress CMSMasters Content Composer plugin < 2.5.7 - Local File Inclusion vulnerabilityCMSMasters Content Composer
- CVE-2025-49070WordPress Elessi < 6.4.1 - Local File Inclusion VulnerabilityNasaTheme Elessi
- CVE-2025-49418WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) VulnerabilityTeconceTheme Allmart
- CVE-2025-38176binder: fix use-after-free in binderfs_evict_inode()Linux
- CVE-2025-38175binder: fix yet another UAF in binder_devicesLinux
- CVE-2025-38174thunderbolt: Do not double dequeue a configuration requestLinux
- CVE-2025-5920Sharable Password Protected Posts < 1.1.1 - Unauthenticated Password Protect Post AccessSharable Password Protected Posts
- CVE-2025-30979WordPress Pixelating image slideshow gallery plugin <= 8.0 - SQL Injection Vulnerabilitygopiplus Pixelating image slideshow gallery
- CVE-2025-30969WordPress iFrame Images Gallery plugin <= 9.0 - SQL Injection Vulnerabilitygopiplus iFrame Images Gallery
- CVE-2025-30947WordPress Cool fade popup plugin <= 10.1 - SQL Injection Vulnerabilitygopiplus Cool fade popup
- CVE-2025-28969WordPress Gallery Widget plugin <= 1.2.1 - SQL Injection Vulnerabilitycybio Gallery Widget
- CVE-2025-28967WordPress Contact Us page - Contact people LITE plugin <= 3.7.4 - SQL Injection VulnerabilitySteve Truman Contact Us page - Contact people LITE
- CVE-2025-24735WordPress Chatra Live Chat + ChatBot + Cart Saver plugin <= 1.0.11 - Cross Site Scripting (XSS) VulnerabilityChatra Live Chat + ChatBot + Cart Saver
- CVE-2025-53600Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.NAVER Whale browser
- CVE-2025-6782GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()optinlyhq GoZen Forms
- CVE-2025-6783GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()optinlyhq GoZen Forms
- CVE-2025-6814Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Functiondunskii Booking X – Appointment and Reservation Availabilit…
- CVE-2025-5953WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Actionasaquzzaman WP Human Resource Management
- CVE-2025-6586Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Uploadmetagauss Download Plugin
- CVE-2025-6238AI Engine 2.8.4 - Insecure OAuth Implementationtigroumeow AI Engine
- CVE-2025-43711Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by Tunnelblick Project Tunnelblick
- CVE-2025-49809mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable.mtr
- CVE-2025-52496Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur.mbedtls
Medium, low and unrated 93
- CVE-2025-7070IROAD Dashcam Q9 MFA Pairing Request allocation of resourcesIROAD Dashcam Q9
- CVE-2025-7069HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflowHDF5
- CVE-2025-7068HDF5 H5FL.c H5FL__malloc memory leakHDF5
- CVE-2025-7067HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflowHDF5
- CVE-2025-53482IPInfo: Message key XSS through several IPInfo messages in infobox and popupWikimedia Foundation Mediawiki - IPInfo Extension
- CVE-2025-38231nfsd: Initialize ssc before laundromat_work to prevent NULL dereferenceLinux
- CVE-2025-38229media: cxusb: no longer judge rbuf when the write failsLinux
- CVE-2025-38228media: imagination: fix a potential memory leak in e5010_probe()Linux
- CVE-2025-38225media: imx-jpeg: Cleanup after an allocation errorLinux
- CVE-2025-38223ceph: avoid kernel BUG for encrypted inode with unaligned file sizeLinux
- CVE-2025-38222ext4: inline: fix len overflow in ext4_prepare_inline_dataLinux
- CVE-2025-38221ext4: fix out of bounds punch offsetLinux
- CVE-2025-38220ext4: only dirty folios when data journaling regular filesLinux
- CVE-2025-38219f2fs: prevent kernel warning due to negative i_nlink from corrupted imageLinux
- CVE-2025-38217hwmon: (ftsteutates) Fix TOCTOU race in fts_read()Linux
- CVE-2025-38215fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_varLinux
- CVE-2025-38214fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_varLinux
- CVE-2025-38210configfs-tsm-report: Fix NULL dereference of tsm_opsLinux
- CVE-2025-38208smb: client: add NULL check in automount_fullpathLinux
- CVE-2025-38207mm: fix uprobe pte be overwritten when expanding vmaLinux
- CVE-2025-38205drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1Linux
- CVE-2025-38203jfs: Fix null-ptr-deref in jfs_ioc_trimLinux
- CVE-2025-38202bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()Linux
- CVE-2025-38201netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAXLinux
- CVE-2025-38200i40e: fix MMIO write access to an invalid page in i40e_clear_hwLinux
- CVE-2025-38199wifi: ath12k: Fix memory leak due to multiple rx_stats allocationLinux
- CVE-2025-38198fbcon: Make sure modelist not set on unregistered consoleLinux
- CVE-2025-38196io_uring/rsrc: validate buffer count with offset for cloningLinux
- CVE-2025-38195LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()Linux
- CVE-2025-38194jffs2: check that raw node were preallocated before writing summaryLinux
- CVE-2025-38190atm: Revert atm_account_tx() if copy_from_iter_full() fails.Linux
- CVE-2025-38188drm/msm/a7xx: Call CP_RESET_CONTEXT_STATELinux
- CVE-2025-38186bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()Linux
- CVE-2025-38185atm: atmtcp: Free invalid length skb in atmtcp_c_send().Linux
- CVE-2025-38183net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()Linux
- CVE-2025-38182ublk: santizize the arguments from userspace when adding a deviceLinux
- CVE-2025-7061Intelbras InControl operador csv injectionIntelbras InControl
- CVE-2025-7066Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauJirafeau project Jirafeau
- CVE-2025-6056Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackeErgon Informatik AG Airlock IAM
- CVE-2025-6740Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameterarshidkv12 Database Addon for Contact Form 7 – CFDB7
- CVE-2025-28976WordPress Email Address Security by WebEmailProtector plugin <= 3.3.6 - Cross Site Scripting (XSS) Vulnerabilitydsrodzin Email Address Security by WebEmailProtector
- CVE-2025-47479WordPress WP Compress plugin <= 6.30.30 - Broken Authentication VulnerabilityAresIT WP Compress
- CVE-2025-47565WordPress EventON plugin <= 4.9.9 - Broken Access Control vulnerabilityashanjay EventON
- CVE-2025-47634WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change VulnerabilityKeylor Mendoza WC Pickup Store
- CVE-2025-48231WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerabilitycodepeople Booking Calendar Contact Form
- CVE-2025-49303WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download VulnerabilityShabti Kaplan Frontend Admin by DynamiApps
- CVE-2025-50032WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerabilityPaytiko - Payment Orchestration Platform Paytiko for WooCom…
- CVE-2025-50039WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerabilityvgwort VG WORT METIS
- CVE-2025-49431WordPress MF Plus WPML plugin <= 1.1 - Settings Change VulnerabilityGnuget MF Plus WPML
- CVE-2025-7060Monitorr Installer mkdbajax.php input validationMonitorr
- CVE-2025-30983WordPress Card flip image slideshow plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerabilitygopiplus Card flip image slideshow
- CVE-2025-30943WordPress Posts Slider Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityAakif Kadiwala Posts Slider Shortcode
- CVE-2025-30929WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerabilityamazewp fluXtore
- CVE-2025-29012WordPress CF7 7 Mailchimp Add-on plugin < 2.4 - Broken Access Control Vulnerabilitykamleshyadav CF7 7 Mailchimp Add-on
- CVE-2025-29007WordPress LMSACE Connect plugin <= 3.4 - Broken Access Control VulnerabilityLMSACE Connect
- CVE-2025-29001WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control VulnerabilityZoomIt WooCommerce Shop Page Builder
- CVE-2025-28971WordPress Easy Elements Hider plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityCWD Web Designer Easy Elements Hider
- CVE-2025-28963WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) VulnerabilityMd Yeasin Ul Haider URL Shortener
- CVE-2025-28957WordPress OwnerRez API plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityOwnerRez API
- CVE-2025-27358WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerabilityN-Media Frontend File Manager
- CVE-2025-27326WordPress Video Gallery Block plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilitybPlugins Video Gallery Block
- CVE-2025-26591WordPress WP fancybox plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityNoor Alam WP fancybox
- CVE-2025-24764WordPress (Simply) Guest Author Name plugin <= 4.36 - Cross Site Scripting (XSS) VulnerabilityA. Jones (Simply) Guest Author Name
- CVE-2025-24757WordPress uDesign theme <= 4.11.2 - Broken Access Control vulnerabilityAndonDesign uDesign
- CVE-2025-24748WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerabilityThemeFusion Avada
- CVE-2025-23972WordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) VulnerabilityBrian S. Reed Contact Form 7 reCAPTCHA
- CVE-2025-53569WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) VulnerabilityTrust Payments Gateway for WooCommerce
- CVE-2025-53568WordPress Radio Station plugin <= 2.5.12 - Cross Site Request Forgery (CSRF) VulnerabilityTony Zeoli Radio Station
- CVE-2025-53566WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 7.8 - Cross Site Scripting (XSS) Vulnerabilityosama.esh WP Visitor Statistics
- CVE-2024-9453Jenkins-image: sensitive data disclosure when using openshift jenkins imageJenkins openshift-sync-plugin · Red Hat OpenShift Developer…
- CVE-2025-5351Libssh: double free vulnerability in libssh key export functionslibssh · Red Hat Enterprise Linux +1
- CVE-2025-32918Livestatus injection in autocomplete endpointCheckmk
- CVE-2025-6673Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcodenikelschubert Easy restaurant menu manager
- CVE-2024-11937Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2025-5372Libssh: incorrect return code handling in ssh_kdf() in libsshlibssh · Red Hat Enterprise Linux +1
- CVE-2025-6944Uncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesundsgn Uncode Core
- CVE-2025-5567Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attributegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2025-7053Cockpit save cross site scriptingCockpit · cockpit-hq/cockpit
- CVE-2025-6039ProcessingJS for WordPress <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingcageehv ProcessingJS for WordPress
- CVE-2025-5924WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notificationskywaveinfo WP Firebase Push Notification
- CVE-2025-6787Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingibachal Smart Docs
- CVE-2025-6729PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgeryqazomardok PayMaster for WooCommerce
- CVE-2025-5956WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Functionasaquzzaman WP Human Resource Management
- CVE-2025-6041yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptingyonisink yContributors
- CVE-2025-6739WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injectionbauc WPQuiz
- CVE-2025-7046Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSdotrex PowerFolio – Portfolio & Image Gallery for Elementor
- CVE-2025-5933RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Updatericharddev7 RD Contacto
- CVE-2025-6786DocCheck Login <= 1.1.5 - Unauthorized Post Accessantwerpes DocCheck Login
- CVE-2025-48172CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow.CHMLib
- CVE-2025-49600In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, mbedtls
- CVE-2025-49601In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bimbedtls
- CVE-2025-52497Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions,mbedtls
- CVE-2025-53602Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.Open Zipkin Zipkin · io.zipkin:zipkin-server