CVEs published September 5, 2025
231 CVEs were published on September 5, 2025: 16 critical, 65 high. 1 is now in CISA KEV.
- Published
- 231
- Critical
- 16
- High
- 65
- Medium
- 111
- Low
- 7
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 46
Most affected products
- Linux
- 59
- Google Android
- 7
- Huawei HarmonyOS
- 4
- RooCodeInc Roo-Code
- 4
- ECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2
- 3
- MongoDB Server
- 3
- Portabilis i-Educar
- 3
- arcinfo PcVue
- 2
- itsourcecode POS Point of Sale System
- 2
- kujirahand TkEasyGUI · tkeasygui
- 2
Critical 16
- CVE-2025-58371Roo Code is vulnerable to command injection via GitHub actions workflowRooCodeInc Roo-Code
- CVE-2025-58367DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionseperman deepdiff · deepdiff
- CVE-2025-58366Onyxia private helm repository credentials are leaked through unauthenticated APIInseeFrLab onyxia
- CVE-2025-35452Pan-Tilt-Zoom cameras default administrative credentials for web interfacePTZOptics PT12X-SE-xx-G3 · PTZOptics PT12X-LINK-4K-xx +23
- CVE-2025-35451Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabledPTZOptics PT12X-SE-xx-G3 · PTZOptics PT12X-LINK-4K-xx +23
- CVE-2025-39726s390/ism: fix concurrency management in ism_cmd()Linux
- CVE-2025-39703net, hsr: reject HSR frame if skb can't hold tagLinux
- CVE-2025-39702ipv6: sr: Fix MAC comparison to be constant-timeLinux
- CVE-2025-39682tls: fix handling of zero-length records on the rx_listLinux · :linux_kernel:
- CVE-2025-39673ppp: fix race conditions in ppp_fill_forward_pathLinux
- CVE-2025-38737cifs: Fix oops due to uninitialised variableLinux
- CVE-2025-38734net/smc: fix UAF on smcsk after smc_listen_out()Linux
- CVE-2025-58628WordPress Miraculous Theme < 2.0.9 - SQL Injection Vulnerabilitykamleshyadav Miraculous
- CVE-2025-49401WordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerabilityaxiomthemes smart SEO
- CVE-2025-58819WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerabilityCreedAlly Bulk Featured Image
- CVE-2025-55037Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.kujirahand TkEasyGUI · tkeasygui
High 65
- CVE-2021-26383Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a comAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ G… +12
- CVE-2025-58372Roo Code: Potential Remote Code Execution via .code-workspaceRooCodeInc Roo-Code
- CVE-2025-58370Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect ReferenceRooCodeInc Roo-Code
- CVE-2025-9566Podman: podman kube play command may overwrite host filespodman · Red Hat Enterprise Linux +8
- CVE-2025-30199ECOVACS Vacuum and Base Station accept unsigned firmwareECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2
- CVE-2025-39723netfs: Fix unbuffered write error handlingLinux
- CVE-2025-39720ksmbd: fix refcount leak causing resource not releasedLinux
- CVE-2025-39718vsock/virtio: Validate length in packet header before skb_put()Linux
- CVE-2025-39717open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONELinux
- CVE-2025-39714media: usbtv: Lock resolution while streamingLinux
- CVE-2025-39711media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() callsLinux
- CVE-2025-39710media: venus: Add a check for packet size after reading from shared memoryLinux
- CVE-2025-39704LoongArch: KVM: Fix stack protector issue in send_ipi_data()Linux
- CVE-2025-39698io_uring/futex: ensure io_futex_wait() cleans up properly on failureLinux
- CVE-2025-39697NFS: Fix a race when updating an existing writeLinux
- CVE-2025-39696ALSA: hda: tas2781: Fix wrong reference of tasdevice_privLinux
- CVE-2025-39694s390/sclp: Fix SCCB present checkLinux
- CVE-2025-39691fs/buffer: fix use-after-free when call bh_read() helperLinux
- CVE-2025-39689ftrace: Also allocate and copy hash for reading of filter filesLinux
- CVE-2025-39683tracing: Limit access to parser->buffer when trace_get_user failedLinux
- CVE-2025-39680i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xferLinux
- CVE-2025-39677net/sched: Fix backlog accounting in qdisc_dequeue_internalLinux
- CVE-2025-38735gve: prevent ethtool ops after shutdownLinux
- CVE-2025-38733s390/mm: Do not map lowcore with identity mappingLinux
- CVE-2025-38731drm/xe: Fix vm_bind_ioctl double free bugLinux
- CVE-2025-9709NRF52810 Runtime EM Fault Injection APPROTECT BypassNordic Semiconductor nRF52810
- CVE-2025-9999Improper validation of payload elementsarcinfo PcVue
- CVE-2025-58206WordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion VulnerabilityThemeMove MaxCoach
- CVE-2025-58214WordPress Indutri Theme < 1.3.0 - Local File Inclusion Vulnerabilitygavias Indutri
- CVE-2025-48104WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityericzane Floating Window Music Player
- CVE-2025-48317WordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal VulnerabilityStefan Keller WooCommerce Payment Gateway for Saferpay
- CVE-2025-53307WordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityBeaver Builder WordPress Assistant
- CVE-2025-57889WordPress InPost Gallery Plugin <= 2.1.4.5 - Local File Inclusion VulnerabilityRealMag777 InPost Gallery
- CVE-2025-32320In System UI, there is a possible way to view other users' images due to a confused deputy.Google Android
- CVE-2025-32318In Skia, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2025-58881WordPress New Simple Gallery Plugin <= 8.0 - SQL Injection Vulnerabilitygopiplus New Simple Gallery
- CVE-2025-58861WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) VulnerabilityWP Corner Quick Event Calendar
- CVE-2025-58860WordPress Enable Latex Plugin <= 1.2.16 - Cross Site Request Forgery (CSRF) VulnerabilityKaizenCoders Enable Latex
- CVE-2025-58859WordPress Add to Feedly Plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Merinas Add to Feedly
- CVE-2025-58857WordPress Table of content Plugin <= 1.5.3.1 - Cross Site Request Forgery (CSRF) VulnerabilityKaizenCoders Table of content
- CVE-2025-58855WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) VulnerabilityDenis V (Artprima) AP HoneyPot WordPress Plugin
- CVE-2025-58854WordPress Ultimate AJAX Login Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) VulnerabilitySamer Bechara Ultimate AJAX Login
- CVE-2025-58853WordPress Popping Sidebars and Widgets Light Plugin <= 1.27 - Cross Site Request Forgery (CSRF) VulnerabilityOTWthemes Popping Sidebars and Widgets Light
- CVE-2025-58852WordPress MSTW League Manager Plugin <= 2.10 - Cross Site Request Forgery (CSRF) VulnerabilityMark O'Donnell MSTW League Manager
- CVE-2025-58849WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) VulnerabilityDeepak S Hide Real Download Path
- CVE-2025-58848WordPress WP likes Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerabilityaakash1911 WP likes
- CVE-2025-58847WordPress WN Flipbox Pro Plugin <= 2.1 - Cross Site Request Forgery (CSRF) VulnerabilityYaidier WN Flipbox Pro
- CVE-2025-58846WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin <= 2020.1.0 - Cross Site Request Forgery (CSRF) VulnerabilityDejan Markovic WordPress Buffer – HYPESocial. Social Media…
- CVE-2025-58845WordPress Bulk Watermark Plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) VulnerabilityChrisHurst Bulk Watermark
- CVE-2025-58844WordPress Database to Excel Plugin <= 1.0 - Cross Site Request Forgery (CSRF) VulnerabilitySubhash Kumar Database to Excel
- CVE-2025-58843WordPress Auto Last Youtube Video Plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) VulnerabilityDavid Merinas Auto Last Youtube Video
- CVE-2025-58839WordPress eDS Responsive Menu Plugin <= 1.2 - PHP Object Injection VulnerabilityaThemeArt Translations eDS Responsive Menu
- CVE-2025-58833WordPress Invelity MyGLS connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) VulnerabilityInvelity MyGLS connect
- CVE-2025-58815WordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data VulnerabilityRubel Miah Aitasi Coming Soon
- CVE-2025-58809WordPress To Lead For Salesforce Plugin <= 2.7.3.9 - Cross Site Request Forgery (CSRF) VulnerabilityNick Ciske To Lead For Salesforce
- CVE-2025-58807WordPress Purge Varnish Cache Plugin <= 2.6 - Cross Site Request Forgery (CSRF) VulnerabilityDsingh Purge Varnish Cache
- CVE-2025-58806WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) VulnerabilityTom Longridge WordPress Error Monitoring by Bugsnag
- CVE-2025-58789WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection VulnerabilityThemeisle WP Full Stripe Free
- CVE-2025-58788WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection VulnerabilitySaad Iqbal License Manager for WooCommerce
- CVE-2025-58296Race condition vulnerability in the audio module.Huawei HarmonyOS
- CVE-2025-58281Out-of-bounds read vulnerability in the runtime interpreter module.Huawei HarmonyOS
- CVE-2025-58280Vulnerability of exposing object heap addresses in the Ark eTS module.Huawei HarmonyOS
- CVE-2025-55671Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22.kujirahand TkEasyGUI · tkeasygui
- CVE-2025-9990WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusionsmackcoders WordPress Helpdesk Integration
- CVE-2025-58780index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.ScienceLogic SL1
Medium, low and unrated 150
- CVE-2025-58373Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosureRooCodeInc Roo-Code
- CVE-2025-58369fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite sidetypelevel fs2 · co.fs2:fs2-io_2.12 +10
- CVE-2025-10027itsourcecode POS Point of Sale System 2512.php cross site scriptingitsourcecode POS Point of Sale System
- CVE-2025-57807ImageMagick BlobStream Forward-Seek Under-AllocationImageMagick · Magick.NET-Q16-x64 +11
- CVE-2025-10061Malformed $group Query May Cause MongoDB Server to CrashMongoDB Server
- CVE-2025-10060MongoDB may be susceptible to Invariant Failure in Transactions due Upsert OperationMongoDB Server
- CVE-2025-53791Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2025-10059MongoDB Server router will crash when incorrect lsid is set on a sharded queryMongoDB Server
- CVE-2025-10026itsourcecode POS Point of Sale System -complex_header.php cross site scriptingitsourcecode POS Point of Sale System
- CVE-2025-10044Keycloak: keycloak error_description injection on error pageskeycloak · Red Hat build of Keycloak +2
- CVE-2025-10025PHPGurukul Online Course Registration semester.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-9057Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeMikado Themes Biagiotti Core
- CVE-2025-30198ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSKECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2
- CVE-2025-30200ECOVACS Vacuum and Base Station Hard-Coded AES EncryptionECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2
- CVE-2025-10014elunez eladmin Email Address updateEmail updateUserEmail improper authorizationelunez eladmin
- CVE-2025-39725mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_listLinux
- CVE-2025-39724serial: 8250: fix panic due to PSLVERRLinux
- CVE-2025-39722crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULPLinux
- CVE-2025-39721crypto: qat - flush misc workqueue during device shutdownLinux
- CVE-2025-39719iio: imu: bno055: fix OOB access of hw_xlate arrayLinux
- CVE-2025-39716parisc: Revise __get_user() to probe user read accessLinux
- CVE-2025-39715parisc: Revise gateway LWS calls to probe user read accessLinux
- CVE-2025-39713media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()Linux
- CVE-2025-39712media: mt9m114: Fix deadlock in get_frame_interval/set_frame_intervalLinux
- CVE-2025-39709media: venus: protect against spurious interrupts during probeLinux
- CVE-2025-39708media: iris: Fix NULL pointer dereferenceLinux
- CVE-2025-39707drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilitiesLinux
- CVE-2025-39706drm/amdkfd: Destroy KFD debugfs after destroy KFD wqLinux
- CVE-2025-39705drm/amd/display: fix a Null pointer dereference vulnerabilityLinux
- CVE-2025-39701ACPI: pfr_update: Fix the driver update version checkLinux
- CVE-2025-39700mm/damon/ops-common: ignore migration request to invalid nodesLinux
- CVE-2025-39699iommu/riscv: prevent NULL deref in iova_to_physLinux
- CVE-2025-39695RDMA/rxe: Flush delayed SKBs while releasing RXE resourcesLinux
- CVE-2025-39693drm/amd/display: Avoid a NULL pointer dereferenceLinux
- CVE-2025-39692smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()Linux
- CVE-2025-39690iio: accel: sca3300: fix uninitialized iio scan dataLinux
- CVE-2025-39687iio: light: as73211: Ensure buffer holes are zeroedLinux
- CVE-2025-39686comedi: Make insn_rw_emulate_bits() do insn->n samplesLinux
- CVE-2025-39685comedi: pcl726: Prevent invalid irq numberLinux
- CVE-2025-39684comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()Linux
- CVE-2025-39681x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helperLinux
- CVE-2025-39679drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().Linux
- CVE-2025-39678platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULLLinux
- CVE-2025-39676scsi: qla4xxx: Prevent a potential error pointer dereferenceLinux
- CVE-2025-39675drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()Linux
- CVE-2025-39674scsi: ufs: ufs-qcom: Fix ESI null pointer dereferenceLinux
- CVE-2025-38736net: usb: asix_devices: Fix PHY address mask in MDIO bus initializationLinux
- CVE-2025-38732netfilter: nf_reject: don't leak dst refcount for loopback packetsLinux
- CVE-2025-9998Improper validation of packets sequencingarcinfo PcVue
- CVE-2025-27003WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerabilityfullworks Quick Paypal Payments
- CVE-2025-53571WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerabilityVillaTheme HAPPY
- CVE-2025-48102WordPress GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilityGoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
- CVE-2025-48103WordPress Today's Date Inserter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilitymulscully Today's Date Inserter
- CVE-2025-48105WordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityVincent Boiardt Easy Flash Embed
- CVE-2025-54744WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerabilityStylemix MasterStudy LMS
- CVE-2025-32317In App Widget, there is a possible Information Disclosure due to a confused deputy.Google Android
- CVE-2025-32316In gralloc4, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-26461In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to closGoogle Android
- CVE-2025-26434In libxml2, there is a possible out of bounds read due to a buffer overflow.Google Android
- CVE-2024-0028In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check.Google Android
- CVE-2025-10013Portabilis i-Educar exportacao-para-o-seb access controlPortabilis i-Educar
- CVE-2025-10012Portabilis i-Educar educar_historico_escolar_lst.php sql injectionPortabilis i-Educar
- CVE-2025-10011Portabilis i-Educar edit sql injectionPortabilis i-Educar
- CVE-2025-58887WordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityCourse Finder | andré martin - it solutions & research UG C…
- CVE-2025-58886WordPress Instant Locations Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityTan Nguyen Instant Locations
- CVE-2025-58884WordPress vipdrv Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityIvan Drago vipdrv
- CVE-2025-58883WordPress Search Cloud One Plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityThomas Harris Search Cloud One
- CVE-2025-58882WordPress Simple Text Slider Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerabilityw1zzard Simple Text Slider
- CVE-2025-58880WordPress Translate This gTranslate Shortcode Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilityreubenthiessen Translate This gTranslate Shortcode
- CVE-2025-58878WordPress Woocommerce Gifts Product Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerabilityusamafarooq Woocommerce Gifts Product
- CVE-2025-58876WordPress Aparat Video Shortcode Plugin <= 0.2.4 - Cross Site Scripting (XSS) VulnerabilityAli Aghdam Aparat Video Shortcode
- CVE-2025-58875WordPress WP Github Gist Plugin <= 0.5 - Cross Site Scripting (XSS) VulnerabilitySudar Muthu WP Github Gist
- CVE-2025-58874WordPress StoryMap Plugin <= 2.1 - Cross Site Scripting (XSS) Vulnerabilityjosepsitjar StoryMap
- CVE-2025-58873WordPress Pushe Web Push Notification Plugin <= 0.5.0 - Cross Site Scripting (XSS) Vulnerabilitypusheco Pushe Web Push Notification
- CVE-2025-58872WordPress Simple Price Calculator Plugin <= 1.3 - Broken Access Control Vulnerabilitypremiumbizthemes Simple Price Calculator
- CVE-2025-58871WordPress Master Paper Collapse Toggle Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityLuis Rock Master Paper Collapse Toggle
- CVE-2025-58870WordPress WP-GraphViz Plugin <= 1.5.1 - Cross Site Scripting (XSS) VulnerabilityDeBAAT WP-GraphViz
- CVE-2025-58869WordPress SimaCookie Plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) VulnerabilitySimasicher SimaCookie
- CVE-2025-58868WordPress SimaCookie Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilitySimasicher SimaCookie
- CVE-2025-58867WordPress Easy Download Media Counter Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityRemi Corson Easy Download Media Counter
- CVE-2025-58866WordPress Site Info Plugin <= 1.1 - Sensitive Data Exposure VulnerabilityRami Yushuvaev Site Info
- CVE-2025-58865WordPress Compact Admin plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityreimund Compact Admin
- CVE-2025-58864WordPress 金数据 Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilityiamroody 金数据
- CVE-2025-58863WordPress Zoomify embed for WP Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilitySdeWijs Zoomify embed for WP
- CVE-2025-58862WordPress WordPress Events Calendar Plugin – connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) VulnerabilityGeorge Sexton WordPress Events Calendar Plugin – connectDai…
- CVE-2025-58858WordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityWPBean WPB Image Widget
- CVE-2025-58856WordPress Woocommerce Notify Updated Product Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerabilityablancodev Woocommerce Notify Updated Product
- CVE-2025-58851WordPress Boxed Content Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityDigitalCourt Boxed Content
- CVE-2025-58850WordPress Showpass WordPress Extension Plugin <= 4.0.3 - Cross Site Scripting (XSS) Vulnerabilitymarcshowpass Showpass WordPress Extension
- CVE-2025-58842WordPress Donation Forms WP by Givecloud Plugin <= 1.0.9 - Cross Site Scripting (XSS) VulnerabilityDonation Forms WP by Givecloud
- CVE-2025-58841WordPress Media Author Plugin <= 1.0.4 - Broken Access Control VulnerabilityJohn Luetke Media Author
- CVE-2025-58840WordPress Custom Team Manager Plugin <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityIbnul H. Custom Team Manager
- CVE-2025-58838WordPress Smooth Accordion Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityZakir Smooth Accordion
- CVE-2025-58837WordPress SS Font Awesome Icon Plugin <= 4.1.3 - Cross Site Scripting (XSS) VulnerabilityShiful H SS Font Awesome Icon
- CVE-2025-58836WordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) VulnerabilityFranz Wieser FW Anker
- CVE-2025-58835WordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerabilitycalliko Bonus for Woo
- CVE-2025-58834WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerabilitygugu short.io
- CVE-2025-58832WordPress Search by Google Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerabilitywebvitaly Search by Google
- CVE-2025-58831WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerabilitysnagysandor Parallax Scrolling Enllax.js
- CVE-2025-58830WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Scripting (XSS) Vulnerabilitysnagysandor Parallax Scrolling Enllax.js
- CVE-2025-58829WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side Request Forgery (SSRF) vulnerabilityaitool Ai Auto Tool Content Writing Assistant (Gemini Write…
- CVE-2025-58828WordPress 코드엠샵 소셜톡 plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilitycodemstory 코드엠샵 소셜톡
- CVE-2025-58827WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection VulnerabilityPickPlugins Job Board Manager
- CVE-2025-58826WordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) VulnerabilityEric Mann WP Publication Archive
- CVE-2025-58825WordPress Comment Form WP – Customize Default Comment Form plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityHabibur Rahman Comment Form WP – Customize Default Comment…
- CVE-2025-58824WordPress Shk Corporate Theme <= 2.4.1.1 - Broken Access Control Vulnerabilitypriyanshumittal Shk Corporate
- CVE-2025-58823WordPress Get Cash plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityThe African Boss Get Cash
- CVE-2025-58822WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerabilitymndpsingh287 WP Mail
- CVE-2025-58821WordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilitywpdever WP Notification Bell
- CVE-2025-58820WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityThemepoints Carousel Ultimate
- CVE-2025-58818WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) VulnerabilitySwiftNinjaPro Developer Tools Blocker
- CVE-2025-58817WordPress SoftMe Theme <= 1.1.27 - Broken Access Control Vulnerabilitydesertthemes SoftMe
- CVE-2025-58816WordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control VulnerabilityPlugin Devs Product Carousel Slider for Elementor
- CVE-2025-58814WordPress Stagtools Plugin <= 2.3.8 - Cross Site Scripting (XSS) VulnerabilityRam Ratan Maurya Stagtools
- CVE-2025-58813WordPress Consultstreet Theme <= 3.0.0 - Broken Access Control Vulnerabilitythemearile Consultstreet
- CVE-2025-58812WordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityBest Restaurant Menu by PriceListo
- CVE-2025-58811WordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) VulnerabilityWP CodeUs Ultimate Client Dash
- CVE-2025-58810WordPress Simple Link List Widget Plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerabilityjimmywb Simple Link List Widget
- CVE-2025-58808WordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityBabar prettyPhoto
- CVE-2025-58805WordPress Widgetize Pages Light Plugin <= 3.0 - Cross Site Scripting (XSS) VulnerabilityOTWthemes Widgetize Pages Light
- CVE-2025-58804WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerabilitybrijrajs WooCommerce Single Page Checkout
- CVE-2025-58802WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerabilitymichalzagdan TrustMate.io – WooCommerce integration
- CVE-2025-58801WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) VulnerabilityKCS Responder
- CVE-2025-58800WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerabilitySteve Truman WP Email Template
- CVE-2025-58799WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerabilitythemelocation Custom WooCommerce Checkout Fields Editor
- CVE-2025-58798WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityBjorn Manintveld BCM Duplicate Menu
- CVE-2025-58797WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerabilityMahmudul Hasan Arif Ninja Charts
- CVE-2025-58796WordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerabilitydudaster Elementor Element Condition
- CVE-2025-58795WordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing VulnerabilityPayoneer Checkout
- CVE-2025-58794WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerabilityrainafarai Notification for Telegram
- CVE-2025-58793WordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityWPBean WPB Elementor Addons
- CVE-2025-58792WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerabilityWPKube Authors List
- CVE-2025-58791WordPress SEO Auto Linker Plugin <= 1.5.3 - Cross Site Scripting (XSS) VulnerabilityArjan Olsder SEO Auto Linker
- CVE-2025-58790WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) VulnerabilityWPKube Kiwi
- CVE-2025-58787WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Popup
- CVE-2025-58786WordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerabilityVW THEMES Ibtana – Ecommerce Product Addons
- CVE-2025-58785WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerabilityJiro Sasamoto Ray Enterprise Translation
- CVE-2025-58784WordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerabilityarisoft ARI Fancy Lightbox
- CVE-2025-58783WordPress Gutentor plugin <= 3.5.5 - Broken Access Control vulnerabilityGutentor
- CVE-2025-8695Reflected XSS in Netcad Software's NetGIS ServerNetcad NetGIS Server
- CVE-2024-21977Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potAMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +18
- CVE-2025-58313Race condition vulnerability in the device standby module.Huawei HarmonyOS
- CVE-2025-58276Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilitHuawei HarmonyOS · Huawei EMUI
- CVE-2025-48395An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limitedEaton NMC G2
- CVE-2025-8944OceanWP < 4.1.2 - Subscriber+ Limited Option UpdateOceanWP
- CVE-2025-58400RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc.RATOC Systems RATOC RAID Monitoring Manager for Windows
- CVE-2025-41408Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remoteLY "Yahoo! Shopping" App for Android
- CVE-2025-58401Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form.Pierre-Adrien Vasseur Obsidian GitHub Copilot Plugin
- CVE-2025-8684Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeux-themes Flatsome
- CVE-2025-7445Kubernetes secrets-store-sync-controller discloses service account tokens in logsKubernetes secrets-store-sync-controller · sigs.k8s.io/secr…