# CVEs published 2025-09-05

231 CVEs were published on September 5, 2025: 16 critical, 65 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-26383](https://cve.now/CVE-2021-26383.md): Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a com (CVSS 7.9, AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ G… +12)
- [CVE-2025-58373](https://cve.now/CVE-2025-58373.md): Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure (CVSS 5.5, RooCodeInc Roo-Code)
- [CVE-2025-58372](https://cve.now/CVE-2025-58372.md): Roo Code: Potential Remote Code Execution via .code-workspace (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-58371](https://cve.now/CVE-2025-58371.md): Roo Code is vulnerable to command injection via GitHub actions workflow (CVSS 9.9, RooCodeInc Roo-Code)
- [CVE-2025-58370](https://cve.now/CVE-2025-58370.md): Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-58369](https://cve.now/CVE-2025-58369.md): fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side (CVSS 5.3, typelevel fs2 · co.fs2:fs2-io\_2.12 +10)
- [CVE-2025-58367](https://cve.now/CVE-2025-58367.md): DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution (CVSS 10.0, seperman deepdiff · deepdiff)
- [CVE-2025-10027](https://cve.now/CVE-2025-10027.md): itsourcecode POS Point of Sale System 2512.php cross site scripting (CVSS 5.1, itsourcecode POS Point of Sale System)
- [CVE-2025-58366](https://cve.now/CVE-2025-58366.md): Onyxia private helm repository credentials are leaked through unauthenticated API (CVSS 9.4, InseeFrLab onyxia)
- [CVE-2025-57807](https://cve.now/CVE-2025-57807.md): ImageMagick BlobStream Forward-Seek Under-Allocation (CVSS 3.8, ImageMagick · Magick.NET-Q16-x64 +11)
- [CVE-2025-10061](https://cve.now/CVE-2025-10061.md): Malformed $group Query May Cause MongoDB Server to Crash (CVSS 6.5, MongoDB Server)
- [CVE-2025-10060](https://cve.now/CVE-2025-10060.md): MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation (CVSS 6.5, MongoDB Server)
- [CVE-2025-53791](https://cve.now/CVE-2025-53791.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2025-10059](https://cve.now/CVE-2025-10059.md): MongoDB Server router will crash when incorrect lsid is set on a sharded query (CVSS 6.5, MongoDB Server)
- [CVE-2025-10026](https://cve.now/CVE-2025-10026.md): itsourcecode POS Point of Sale System -complex\_header.php cross site scripting (CVSS 5.1, itsourcecode POS Point of Sale System)
- [CVE-2025-10044](https://cve.now/CVE-2025-10044.md): Keycloak: keycloak error\_description injection on error pages (CVSS 4.3, keycloak · Red Hat build of Keycloak +2)
- [CVE-2025-9566](https://cve.now/CVE-2025-9566.md): Podman: podman kube play command may overwrite host files (CVSS 8.1, podman · Red Hat Enterprise Linux +8)
- [CVE-2025-10025](https://cve.now/CVE-2025-10025.md): PHPGurukul Online Course Registration semester.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration)
- [CVE-2025-9057](https://cve.now/CVE-2025-9057.md): Biagiotti Core \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Mikado Themes Biagiotti Core)
- [CVE-2025-35452](https://cve.now/CVE-2025-35452.md): Pan-Tilt-Zoom cameras default administrative credentials for web interface (CVSS 9.8, PTZOptics PT12X-SE-xx-G3 · PTZOptics PT12X-LINK-4K-xx +23)
- [CVE-2025-30198](https://cve.now/CVE-2025-30198.md): ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK (CVSS 6.3, ECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2)
- [CVE-2025-30199](https://cve.now/CVE-2025-30199.md): ECOVACS Vacuum and Base Station accept unsigned firmware (CVSS 7.2, ECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2)
- [CVE-2025-35451](https://cve.now/CVE-2025-35451.md): Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled (CVSS 9.8, PTZOptics PT12X-SE-xx-G3 · PTZOptics PT12X-LINK-4K-xx +23)
- [CVE-2025-30200](https://cve.now/CVE-2025-30200.md): ECOVACS Vacuum and Base Station Hard-Coded AES Encryption (CVSS 6.3, ECOVACS DEEBOT X1 Series · ECOVACS DEEBOT T20 Series +2)
- [CVE-2025-10014](https://cve.now/CVE-2025-10014.md): elunez eladmin Email Address updateEmail updateUserEmail improper authorization (CVSS 2.3, elunez eladmin)
- [CVE-2025-39726](https://cve.now/CVE-2025-39726.md): s390/ism: fix concurrency management in ism\_cmd() (CVSS 9.8, Linux)
- [CVE-2025-39725](https://cve.now/CVE-2025-39725.md): mm/vmscan: fix hwpoisoned large folio handling in shrink\_folio\_list (no CVSS, Linux)
- [CVE-2025-39724](https://cve.now/CVE-2025-39724.md): serial: 8250: fix panic due to PSLVERR (no CVSS, Linux)
- [CVE-2025-39723](https://cve.now/CVE-2025-39723.md): netfs: Fix unbuffered write error handling (CVSS 7.1, Linux)
- [CVE-2025-39722](https://cve.now/CVE-2025-39722.md): crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (no CVSS, Linux)
- [CVE-2025-39721](https://cve.now/CVE-2025-39721.md): crypto: qat - flush misc workqueue during device shutdown (no CVSS, Linux)
- [CVE-2025-39720](https://cve.now/CVE-2025-39720.md): ksmbd: fix refcount leak causing resource not released (CVSS 7.5, Linux)
- [CVE-2025-39719](https://cve.now/CVE-2025-39719.md): iio: imu: bno055: fix OOB access of hw\_xlate array (no CVSS, Linux)
- [CVE-2025-39718](https://cve.now/CVE-2025-39718.md): vsock/virtio: Validate length in packet header before skb\_put() (CVSS 8.4, Linux)
- [CVE-2025-39717](https://cve.now/CVE-2025-39717.md): open\_tree\_attr: do not allow id-mapping changes without OPEN\_TREE\_CLONE (CVSS 7.8, Linux)
- [CVE-2025-39716](https://cve.now/CVE-2025-39716.md): parisc: Revise \_\_get\_user() to probe user read access (no CVSS, Linux)
- [CVE-2025-39715](https://cve.now/CVE-2025-39715.md): parisc: Revise gateway LWS calls to probe user read access (no CVSS, Linux)
- [CVE-2025-39714](https://cve.now/CVE-2025-39714.md): media: usbtv: Lock resolution while streaming (CVSS 7.8, Linux)
- [CVE-2025-39713](https://cve.now/CVE-2025-39713.md): media: rainshadow-cec: fix TOCTOU race condition in rain\_interrupt() (no CVSS, Linux)
- [CVE-2025-39712](https://cve.now/CVE-2025-39712.md): media: mt9m114: Fix deadlock in get\_frame\_interval/set\_frame\_interval (no CVSS, Linux)
- [CVE-2025-39711](https://cve.now/CVE-2025-39711.md): media: ivsc: Fix crash at shutdown due to missing mei\_cldev\_disable() calls (CVSS 7.8, Linux)
- [CVE-2025-39710](https://cve.now/CVE-2025-39710.md): media: venus: Add a check for packet size after reading from shared memory (CVSS 7.8, Linux)
- [CVE-2025-39709](https://cve.now/CVE-2025-39709.md): media: venus: protect against spurious interrupts during probe (CVSS 5.5, Linux)
- [CVE-2025-39708](https://cve.now/CVE-2025-39708.md): media: iris: Fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2025-39707](https://cve.now/CVE-2025-39707.md): drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu\_dm\_capabilities (no CVSS, Linux)
- [CVE-2025-39706](https://cve.now/CVE-2025-39706.md): drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (no CVSS, Linux)
- [CVE-2025-39705](https://cve.now/CVE-2025-39705.md): drm/amd/display: fix a Null pointer dereference vulnerability (no CVSS, Linux)
- [CVE-2025-39704](https://cve.now/CVE-2025-39704.md): LoongArch: KVM: Fix stack protector issue in send\_ipi\_data() (CVSS 8.8, Linux)
- [CVE-2025-39703](https://cve.now/CVE-2025-39703.md): net, hsr: reject HSR frame if skb can't hold tag (CVSS 9.8, Linux)
- [CVE-2025-39702](https://cve.now/CVE-2025-39702.md): ipv6: sr: Fix MAC comparison to be constant-time (CVSS 9.8, Linux)
- [CVE-2025-39701](https://cve.now/CVE-2025-39701.md): ACPI: pfr\_update: Fix the driver update version check (no CVSS, Linux)
- [CVE-2025-39700](https://cve.now/CVE-2025-39700.md): mm/damon/ops-common: ignore migration request to invalid nodes (no CVSS, Linux)
- [CVE-2025-39699](https://cve.now/CVE-2025-39699.md): iommu/riscv: prevent NULL deref in iova\_to\_phys (no CVSS, Linux)
- [CVE-2025-39698](https://cve.now/CVE-2025-39698.md): io\_uring/futex: ensure io\_futex\_wait() cleans up properly on failure (CVSS 7.8, Linux)
- [CVE-2025-39697](https://cve.now/CVE-2025-39697.md): NFS: Fix a race when updating an existing write (CVSS 7.8, Linux)
- [CVE-2025-39696](https://cve.now/CVE-2025-39696.md): ALSA: hda: tas2781: Fix wrong reference of tasdevice\_priv (CVSS 7.8, Linux)
- [CVE-2025-39695](https://cve.now/CVE-2025-39695.md): RDMA/rxe: Flush delayed SKBs while releasing RXE resources (no CVSS, Linux)
- [CVE-2025-39694](https://cve.now/CVE-2025-39694.md): s390/sclp: Fix SCCB present check (CVSS 7.3, Linux)
- [CVE-2025-39693](https://cve.now/CVE-2025-39693.md): drm/amd/display: Avoid a NULL pointer dereference (no CVSS, Linux)
- [CVE-2025-39692](https://cve.now/CVE-2025-39692.md): smb: server: split ksmbd\_rdma\_stop\_listening() out of ksmbd\_rdma\_destroy() (no CVSS, Linux)
- [CVE-2025-39691](https://cve.now/CVE-2025-39691.md): fs/buffer: fix use-after-free when call bh\_read() helper (CVSS 7.8, Linux)
- [CVE-2025-39690](https://cve.now/CVE-2025-39690.md): iio: accel: sca3300: fix uninitialized iio scan data (no CVSS, Linux)
- [CVE-2025-39689](https://cve.now/CVE-2025-39689.md): ftrace: Also allocate and copy hash for reading of filter files (CVSS 7.8, Linux)
- [CVE-2025-39687](https://cve.now/CVE-2025-39687.md): iio: light: as73211: Ensure buffer holes are zeroed (no CVSS, Linux)
- [CVE-2025-39686](https://cve.now/CVE-2025-39686.md): comedi: Make insn\_rw\_emulate\_bits() do insn-\>n samples (no CVSS, Linux)
- [CVE-2025-39685](https://cve.now/CVE-2025-39685.md): comedi: pcl726: Prevent invalid irq number (no CVSS, Linux)
- [CVE-2025-39684](https://cve.now/CVE-2025-39684.md): comedi: Fix use of uninitialized memory in do\_insn\_ioctl() and do\_insnlist\_ioctl() (no CVSS, Linux)
- [CVE-2025-39683](https://cve.now/CVE-2025-39683.md): tracing: Limit access to parser-\>buffer when trace\_get\_user failed (CVSS 7.8, Linux)
- [CVE-2025-39682](https://cve.now/CVE-2025-39682.md): tls: fix handling of zero-length records on the rx\_list (CVSS 9.8, KEV, Linux · :linux\_kernel:)
- [CVE-2025-39681](https://cve.now/CVE-2025-39681.md): x86/cpu/hygon: Add missing resctrl\_cpu\_detect() in bsp\_init helper (no CVSS, Linux)
- [CVE-2025-39680](https://cve.now/CVE-2025-39680.md): i2c: rtl9300: Fix out-of-bounds bug in rtl9300\_i2c\_smbus\_xfer (CVSS 7.8, Linux)
- [CVE-2025-39679](https://cve.now/CVE-2025-39679.md): drm/nouveau/nvif: Fix potential memory leak in nvif\_vmm\_ctor(). (no CVSS, Linux)
- [CVE-2025-39678](https://cve.now/CVE-2025-39678.md): platform/x86/amd/hsmp: Ensure sock-\>metric\_tbl\_addr is non-NULL (no CVSS, Linux)
- [CVE-2025-39677](https://cve.now/CVE-2025-39677.md): net/sched: Fix backlog accounting in qdisc\_dequeue\_internal (CVSS 7.8, Linux)
- [CVE-2025-39676](https://cve.now/CVE-2025-39676.md): scsi: qla4xxx: Prevent a potential error pointer dereference (no CVSS, Linux)
- [CVE-2025-39675](https://cve.now/CVE-2025-39675.md): drm/amd/display: Add null pointer check in mod\_hdcp\_hdcp1\_create\_session() (no CVSS, Linux)
- [CVE-2025-39674](https://cve.now/CVE-2025-39674.md): scsi: ufs: ufs-qcom: Fix ESI null pointer dereference (no CVSS, Linux)
- [CVE-2025-39673](https://cve.now/CVE-2025-39673.md): ppp: fix race conditions in ppp\_fill\_forward\_path (CVSS 9.8, Linux)
- [CVE-2025-38737](https://cve.now/CVE-2025-38737.md): cifs: Fix oops due to uninitialised variable (CVSS 9.8, Linux)
- [CVE-2025-38736](https://cve.now/CVE-2025-38736.md): net: usb: asix\_devices: Fix PHY address mask in MDIO bus initialization (no CVSS, Linux)
- [CVE-2025-38735](https://cve.now/CVE-2025-38735.md): gve: prevent ethtool ops after shutdown (CVSS 7.8, Linux)
- [CVE-2025-38734](https://cve.now/CVE-2025-38734.md): net/smc: fix UAF on smcsk after smc\_listen\_out() (CVSS 9.8, Linux)
- [CVE-2025-38733](https://cve.now/CVE-2025-38733.md): s390/mm: Do not map lowcore with identity mapping (CVSS 7.8, Linux)
- [CVE-2025-38732](https://cve.now/CVE-2025-38732.md): netfilter: nf\_reject: don't leak dst refcount for loopback packets (no CVSS, Linux)
- [CVE-2025-38731](https://cve.now/CVE-2025-38731.md): drm/xe: Fix vm\_bind\_ioctl double free bug (CVSS 7.8, Linux)
- [CVE-2025-9709](https://cve.now/CVE-2025-9709.md): NRF52810 Runtime EM Fault Injection APPROTECT Bypass (CVSS 8.6, Nordic Semiconductor nRF52810)
- [CVE-2025-9999](https://cve.now/CVE-2025-9999.md): Improper validation of payload elements (CVSS 7.6, arcinfo PcVue)
- [CVE-2025-9998](https://cve.now/CVE-2025-9998.md): Improper validation of packets sequencing (CVSS 6.0, arcinfo PcVue)
- [CVE-2025-27003](https://cve.now/CVE-2025-27003.md): WordPress Quick Paypal Payments Plugin \<= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, fullworks Quick Paypal Payments)
- [CVE-2025-53571](https://cve.now/CVE-2025-53571.md): WordPress HAPPY plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 6.5, VillaTheme HAPPY)
- [CVE-2025-58206](https://cve.now/CVE-2025-58206.md): WordPress MaxCoach Theme \<= 3.2.5 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove MaxCoach)
- [CVE-2025-58214](https://cve.now/CVE-2025-58214.md): WordPress Indutri Theme \< 1.3.0 - Local File Inclusion Vulnerability (CVSS 8.1, gavias Indutri)
- [CVE-2025-58628](https://cve.now/CVE-2025-58628.md): WordPress Miraculous Theme \< 2.0.9 - SQL Injection Vulnerability (CVSS 9.3, kamleshyadav Miraculous)
- [CVE-2025-48102](https://cve.now/CVE-2025-48102.md): WordPress GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin \<= 1.6.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership)
- [CVE-2025-48103](https://cve.now/CVE-2025-48103.md): WordPress Today's Date Inserter plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mulscully Today's Date Inserter)
- [CVE-2025-48104](https://cve.now/CVE-2025-48104.md): WordPress Floating Window Music Player plugin \<= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, ericzane Floating Window Music Player)
- [CVE-2025-48105](https://cve.now/CVE-2025-48105.md): WordPress Easy Flash Embed plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vincent Boiardt Easy Flash Embed)
- [CVE-2025-48317](https://cve.now/CVE-2025-48317.md): WordPress WooCommerce Payment Gateway for Saferpay Plugin \<= 0.4.9 - Path Traversal Vulnerability (CVSS 7.5, Stefan Keller WooCommerce Payment Gateway for Saferpay)
- [CVE-2025-49401](https://cve.now/CVE-2025-49401.md): WordPress smart SEO Plugin \<= 4.0 - Privilege Escalation Vulnerability (CVSS 9.8, axiomthemes smart SEO)
- [CVE-2025-53307](https://cve.now/CVE-2025-53307.md): WordPress Assistant Plugin \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Beaver Builder WordPress Assistant)
- [CVE-2025-54744](https://cve.now/CVE-2025-54744.md): WordPress MasterStudy LMS plugin \<= 3.6.15 - Broken Access Control vulnerability (CVSS 6.5, Stylemix MasterStudy LMS)
- [CVE-2025-57889](https://cve.now/CVE-2025-57889.md): WordPress InPost Gallery Plugin \<= 2.1.4.5 - Local File Inclusion Vulnerability (CVSS 7.5, RealMag777 InPost Gallery)
- [CVE-2025-32320](https://cve.now/CVE-2025-32320.md): In System UI, there is a possible way to view other users' images due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32318](https://cve.now/CVE-2025-32318.md): In Skia, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 8.8, Google Android)
- [CVE-2025-32317](https://cve.now/CVE-2025-32317.md): In App Widget, there is a possible Information Disclosure due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2025-32316](https://cve.now/CVE-2025-32316.md): In gralloc4, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2025-26461](https://cve.now/CVE-2025-26461.md): In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to clos (CVSS 3.3, Google Android)
- [CVE-2025-26434](https://cve.now/CVE-2025-26434.md): In libxml2, there is a possible out of bounds read due to a buffer overflow. (CVSS 5.5, Google Android)
- [CVE-2024-0028](https://cve.now/CVE-2024-0028.md): In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2025-10013](https://cve.now/CVE-2025-10013.md): Portabilis i-Educar exportacao-para-o-seb access control (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10012](https://cve.now/CVE-2025-10012.md): Portabilis i-Educar educar\_historico\_escolar\_lst.php sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10011](https://cve.now/CVE-2025-10011.md): Portabilis i-Educar edit sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-58887](https://cve.now/CVE-2025-58887.md): WordPress Course Booking Platform Plugin \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Course Finder | andré martin - it solutions & research UG C…)
- [CVE-2025-58886](https://cve.now/CVE-2025-58886.md): WordPress Instant Locations Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Tan Nguyen Instant Locations)
- [CVE-2025-58884](https://cve.now/CVE-2025-58884.md): WordPress vipdrv Plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Ivan Drago vipdrv)
- [CVE-2025-58883](https://cve.now/CVE-2025-58883.md): WordPress Search Cloud One Plugin \<= 2.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Thomas Harris Search Cloud One)
- [CVE-2025-58882](https://cve.now/CVE-2025-58882.md): WordPress Simple Text Slider Plugin \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, w1zzard Simple Text Slider)
- [CVE-2025-58881](https://cve.now/CVE-2025-58881.md): WordPress New Simple Gallery Plugin \<= 8.0 - SQL Injection Vulnerability (CVSS 8.5, gopiplus New Simple Gallery)
- [CVE-2025-58880](https://cve.now/CVE-2025-58880.md): WordPress Translate This gTranslate Shortcode Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, reubenthiessen Translate This gTranslate Shortcode)
- [CVE-2025-58878](https://cve.now/CVE-2025-58878.md): WordPress Woocommerce Gifts Product Plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, usamafarooq Woocommerce Gifts Product)
- [CVE-2025-58876](https://cve.now/CVE-2025-58876.md): WordPress Aparat Video Shortcode Plugin \<= 0.2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ali Aghdam Aparat Video Shortcode)
- [CVE-2025-58875](https://cve.now/CVE-2025-58875.md): WordPress WP Github Gist Plugin \<= 0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Sudar Muthu WP Github Gist)
- [CVE-2025-58874](https://cve.now/CVE-2025-58874.md): WordPress StoryMap Plugin \<= 2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, josepsitjar StoryMap)
- [CVE-2025-58873](https://cve.now/CVE-2025-58873.md): WordPress Pushe Web Push Notification Plugin \<= 0.5.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, pusheco Pushe Web Push Notification)
- [CVE-2025-58872](https://cve.now/CVE-2025-58872.md): WordPress Simple Price Calculator Plugin \<= 1.3 - Broken Access Control Vulnerability (CVSS 6.5, premiumbizthemes Simple Price Calculator)
- [CVE-2025-58871](https://cve.now/CVE-2025-58871.md): WordPress Master Paper Collapse Toggle Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Luis Rock Master Paper Collapse Toggle)
- [CVE-2025-58870](https://cve.now/CVE-2025-58870.md): WordPress WP-GraphViz Plugin \<= 1.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DeBAAT WP-GraphViz)
- [CVE-2025-58869](https://cve.now/CVE-2025-58869.md): WordPress SimaCookie Plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Simasicher SimaCookie)
- [CVE-2025-58868](https://cve.now/CVE-2025-58868.md): WordPress SimaCookie Plugin \<= 1.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Simasicher SimaCookie)
- [CVE-2025-58867](https://cve.now/CVE-2025-58867.md): WordPress Easy Download Media Counter Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Remi Corson Easy Download Media Counter)
- [CVE-2025-58866](https://cve.now/CVE-2025-58866.md): WordPress Site Info Plugin \<= 1.1 - Sensitive Data Exposure Vulnerability (CVSS 2.7, Rami Yushuvaev Site Info)
- [CVE-2025-58865](https://cve.now/CVE-2025-58865.md): WordPress Compact Admin plugin \<= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, reimund Compact Admin)
- [CVE-2025-58864](https://cve.now/CVE-2025-58864.md): WordPress 金数据 Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, iamroody 金数据)
- [CVE-2025-58863](https://cve.now/CVE-2025-58863.md): WordPress Zoomify embed for WP Plugin \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, SdeWijs Zoomify embed for WP)
- [CVE-2025-58862](https://cve.now/CVE-2025-58862.md): WordPress WordPress Events Calendar Plugin – connectDaily Plugin \<= 1.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, George Sexton WordPress Events Calendar Plugin – connectDai…)
- [CVE-2025-58861](https://cve.now/CVE-2025-58861.md): WordPress Quick Event Calendar Plugin \<= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, WP Corner Quick Event Calendar)
- [CVE-2025-58860](https://cve.now/CVE-2025-58860.md): WordPress Enable Latex Plugin \<= 1.2.16 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, KaizenCoders Enable Latex)
- [CVE-2025-58859](https://cve.now/CVE-2025-58859.md): WordPress Add to Feedly Plugin \<= 1.2.11 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, David Merinas Add to Feedly)
- [CVE-2025-58858](https://cve.now/CVE-2025-58858.md): WordPress WPB Image Widget Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPBean WPB Image Widget)
- [CVE-2025-58857](https://cve.now/CVE-2025-58857.md): WordPress Table of content Plugin \<= 1.5.3.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, KaizenCoders Table of content)
- [CVE-2025-58856](https://cve.now/CVE-2025-58856.md): WordPress Woocommerce Notify Updated Product Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, ablancodev Woocommerce Notify Updated Product)
- [CVE-2025-58855](https://cve.now/CVE-2025-58855.md): WordPress AP HoneyPot WordPress Plugin Plugin \<= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Denis V (Artprima) AP HoneyPot WordPress Plugin)
- [CVE-2025-58854](https://cve.now/CVE-2025-58854.md): WordPress Ultimate AJAX Login Plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Samer Bechara Ultimate AJAX Login)
- [CVE-2025-58853](https://cve.now/CVE-2025-58853.md): WordPress Popping Sidebars and Widgets Light Plugin \<= 1.27 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, OTWthemes Popping Sidebars and Widgets Light)
- [CVE-2025-58852](https://cve.now/CVE-2025-58852.md): WordPress MSTW League Manager Plugin \<= 2.10 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Mark O'Donnell MSTW League Manager)
- [CVE-2025-58851](https://cve.now/CVE-2025-58851.md): WordPress Boxed Content Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, DigitalCourt Boxed Content)
- [CVE-2025-58850](https://cve.now/CVE-2025-58850.md): WordPress Showpass WordPress Extension Plugin \<= 4.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, marcshowpass Showpass WordPress Extension)
- [CVE-2025-58849](https://cve.now/CVE-2025-58849.md): WordPress Hide Real Download Path Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Deepak S Hide Real Download Path)
- [CVE-2025-58848](https://cve.now/CVE-2025-58848.md): WordPress WP likes Plugin \<= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, aakash1911 WP likes)
- [CVE-2025-58847](https://cve.now/CVE-2025-58847.md): WordPress WN Flipbox Pro Plugin \<= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Yaidier WN Flipbox Pro)
- [CVE-2025-58846](https://cve.now/CVE-2025-58846.md): WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin \<= 2020.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Dejan Markovic WordPress Buffer – HYPESocial. Social Media…)
- [CVE-2025-58845](https://cve.now/CVE-2025-58845.md): WordPress Bulk Watermark Plugin \<= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, ChrisHurst Bulk Watermark)
- [CVE-2025-58844](https://cve.now/CVE-2025-58844.md): WordPress Database to Excel Plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Subhash Kumar Database to Excel)
- [CVE-2025-58843](https://cve.now/CVE-2025-58843.md): WordPress Auto Last Youtube Video Plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, David Merinas Auto Last Youtube Video)
- [CVE-2025-58842](https://cve.now/CVE-2025-58842.md): WordPress Donation Forms WP by Givecloud Plugin \<= 1.0.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Donation Forms WP by Givecloud)
- [CVE-2025-58841](https://cve.now/CVE-2025-58841.md): WordPress Media Author Plugin \<= 1.0.4 - Broken Access Control Vulnerability (CVSS 5.5, John Luetke Media Author)
- [CVE-2025-58840](https://cve.now/CVE-2025-58840.md): WordPress Custom Team Manager Plugin \<= 2.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ibnul H. Custom Team Manager)
- [CVE-2025-58839](https://cve.now/CVE-2025-58839.md): WordPress eDS Responsive Menu Plugin \<= 1.2 - PHP Object Injection Vulnerability (CVSS 7.2, aThemeArt Translations eDS Responsive Menu)
- [CVE-2025-58838](https://cve.now/CVE-2025-58838.md): WordPress Smooth Accordion Plugin \<= 2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Zakir Smooth Accordion)
- [CVE-2025-58837](https://cve.now/CVE-2025-58837.md): WordPress SS Font Awesome Icon Plugin \<= 4.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Shiful H SS Font Awesome Icon)
- [CVE-2025-58836](https://cve.now/CVE-2025-58836.md): WordPress FW Anker Plugin \<= 1.2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Franz Wieser FW Anker)
- [CVE-2025-58835](https://cve.now/CVE-2025-58835.md): WordPress Bonus for Woo plugin \<= 7.6.6 - Other vulnerability Type vulnerability (CVSS 5.3, calliko Bonus for Woo)
- [CVE-2025-58834](https://cve.now/CVE-2025-58834.md): WordPress short.io Plugin \<= 2.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, gugu short.io)
- [CVE-2025-58833](https://cve.now/CVE-2025-58833.md): WordPress Invelity MyGLS connect Plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, Invelity MyGLS connect)
- [CVE-2025-58832](https://cve.now/CVE-2025-58832.md): WordPress Search by Google Plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, webvitaly Search by Google)
- [CVE-2025-58831](https://cve.now/CVE-2025-58831.md): WordPress Parallax Scrolling Enllax.js Plugin \<= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, snagysandor Parallax Scrolling Enllax.js)
- [CVE-2025-58830](https://cve.now/CVE-2025-58830.md): WordPress Parallax Scrolling Enllax.js Plugin \<= 0.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, snagysandor Parallax Scrolling Enllax.js)
- [CVE-2025-58829](https://cve.now/CVE-2025-58829.md): WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin \<= 2.3.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, aitool Ai Auto Tool Content Writing Assistant (Gemini Write…)
- [CVE-2025-58828](https://cve.now/CVE-2025-58828.md): WordPress 코드엠샵 소셜톡 plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codemstory 코드엠샵 소셜톡)
- [CVE-2025-58827](https://cve.now/CVE-2025-58827.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Content Injection Vulnerability (CVSS 3.8, PickPlugins Job Board Manager)
- [CVE-2025-58826](https://cve.now/CVE-2025-58826.md): WordPress WP Publication Archive Plugin \<= 3.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Eric Mann WP Publication Archive)
- [CVE-2025-58825](https://cve.now/CVE-2025-58825.md): WordPress Comment Form WP – Customize Default Comment Form plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Habibur Rahman Comment Form WP – Customize Default Comment…)
- [CVE-2025-58824](https://cve.now/CVE-2025-58824.md): WordPress Shk Corporate Theme \<= 2.4.1.1 - Broken Access Control Vulnerability (CVSS 4.3, priyanshumittal Shk Corporate)
- [CVE-2025-58823](https://cve.now/CVE-2025-58823.md): WordPress Get Cash plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, The African Boss Get Cash)
- [CVE-2025-58822](https://cve.now/CVE-2025-58822.md): WordPress WP Mail Plugin \<= 1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, mndpsingh287 WP Mail)
- [CVE-2025-58821](https://cve.now/CVE-2025-58821.md): WordPress WP Notification Bell plugin \<= 1.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpdever WP Notification Bell)
- [CVE-2025-58820](https://cve.now/CVE-2025-58820.md): WordPress Carousel Ultimate Plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Themepoints Carousel Ultimate)
- [CVE-2025-58819](https://cve.now/CVE-2025-58819.md): WordPress Bulk Featured Image plugin \<= 1.2.4 - Arbitrary File Upload vulnerability (CVSS 9.1, CreedAlly Bulk Featured Image)
- [CVE-2025-58818](https://cve.now/CVE-2025-58818.md): WordPress Developer Tools Blocker Plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, SwiftNinjaPro Developer Tools Blocker)
- [CVE-2025-58817](https://cve.now/CVE-2025-58817.md): WordPress SoftMe Theme \<= 1.1.27 - Broken Access Control Vulnerability (CVSS 4.3, desertthemes SoftMe)
- [CVE-2025-58816](https://cve.now/CVE-2025-58816.md): WordPress Product Carousel Slider for Elementor Plugin \<= 2.1.3 - Broken Access Control Vulnerability (CVSS 3.5, Plugin Devs Product Carousel Slider for Elementor)
- [CVE-2025-58815](https://cve.now/CVE-2025-58815.md): WordPress Aitasi Coming Soon Plugin \<= 2.0.2 - Deserialization of untrusted data Vulnerability (CVSS 7.2, Rubel Miah Aitasi Coming Soon)
- [CVE-2025-58814](https://cve.now/CVE-2025-58814.md): WordPress Stagtools Plugin \<= 2.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ram Ratan Maurya Stagtools)
- [CVE-2025-58813](https://cve.now/CVE-2025-58813.md): WordPress Consultstreet Theme \<= 3.0.0 - Broken Access Control Vulnerability (CVSS 4.3, themearile Consultstreet)
- [CVE-2025-58812](https://cve.now/CVE-2025-58812.md): WordPress Best Restaurant Menu by PriceListo Plugin \<= 1.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Best Restaurant Menu by PriceListo)
- [CVE-2025-58811](https://cve.now/CVE-2025-58811.md): WordPress Ultimate Client Dash Plugin \<= 4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, WP CodeUs Ultimate Client Dash)
- [CVE-2025-58810](https://cve.now/CVE-2025-58810.md): WordPress Simple Link List Widget Plugin \<= 0.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, jimmywb Simple Link List Widget)
- [CVE-2025-58809](https://cve.now/CVE-2025-58809.md): WordPress To Lead For Salesforce Plugin \<= 2.7.3.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Nick Ciske To Lead For Salesforce)
- [CVE-2025-58808](https://cve.now/CVE-2025-58808.md): WordPress prettyPhoto Plugin \<= 1.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Babar prettyPhoto)
- [CVE-2025-58807](https://cve.now/CVE-2025-58807.md): WordPress Purge Varnish Cache Plugin \<= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Dsingh Purge Varnish Cache)
- [CVE-2025-58806](https://cve.now/CVE-2025-58806.md): WordPress WordPress Error Monitoring by Bugsnag Plugin \<= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Tom Longridge WordPress Error Monitoring by Bugsnag)
- [CVE-2025-58805](https://cve.now/CVE-2025-58805.md): WordPress Widgetize Pages Light Plugin \<= 3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, OTWthemes Widgetize Pages Light)
- [CVE-2025-58804](https://cve.now/CVE-2025-58804.md): WordPress WooCommerce Single Page Checkout Plugin \<= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, brijrajs WooCommerce Single Page Checkout)
- [CVE-2025-58802](https://cve.now/CVE-2025-58802.md): WordPress TrustMate.io – WooCommerce integration plugin \<= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, michalzagdan TrustMate.io – WooCommerce integration)
- [CVE-2025-58801](https://cve.now/CVE-2025-58801.md): WordPress Responder Plugin \<= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, KCS Responder)
- [CVE-2025-58800](https://cve.now/CVE-2025-58800.md): WordPress WP Email Template plugin \<= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Steve Truman WP Email Template)
- [CVE-2025-58799](https://cve.now/CVE-2025-58799.md): WordPress Custom WooCommerce Checkout Fields Editor Plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, themelocation Custom WooCommerce Checkout Fields Editor)
- [CVE-2025-58798](https://cve.now/CVE-2025-58798.md): WordPress BCM Duplicate Menu plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Bjorn Manintveld BCM Duplicate Menu)
- [CVE-2025-58797](https://cve.now/CVE-2025-58797.md): WordPress Ninja Charts plugin \<= 3.3.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, Mahmudul Hasan Arif Ninja Charts)
- [CVE-2025-58796](https://cve.now/CVE-2025-58796.md): WordPress Elementor Element Condition Plugin \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, dudaster Elementor Element Condition)
- [CVE-2025-58795](https://cve.now/CVE-2025-58795.md): WordPress Payoneer Checkout Plugin \<= 3.4.0 - Content Spoofing Vulnerability (CVSS 4.3, Payoneer Checkout)
- [CVE-2025-58794](https://cve.now/CVE-2025-58794.md): WordPress Notification for Telegram plugin \<= 3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, rainafarai Notification for Telegram)
- [CVE-2025-58793](https://cve.now/CVE-2025-58793.md): WordPress WPB Elementor Addons plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBean WPB Elementor Addons)
- [CVE-2025-58792](https://cve.now/CVE-2025-58792.md): WordPress Authors List plugin \<= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPKube Authors List)
- [CVE-2025-58791](https://cve.now/CVE-2025-58791.md): WordPress SEO Auto Linker Plugin \<= 1.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Arjan Olsder SEO Auto Linker)
- [CVE-2025-58790](https://cve.now/CVE-2025-58790.md): WordPress Kiwi Plugin \<= 2.1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPKube Kiwi)
- [CVE-2025-58789](https://cve.now/CVE-2025-58789.md): WordPress WP Full Stripe Free Plugin \<= 8.2.5 - SQL Injection Vulnerability (CVSS 7.6, Themeisle WP Full Stripe Free)
- [CVE-2025-58788](https://cve.now/CVE-2025-58788.md): WordPress License Manager for WooCommerce Plugin \<= 3.0.12 - SQL Injection Vulnerability (CVSS 7.6, Saad Iqbal License Manager for WooCommerce)
- [CVE-2025-58787](https://cve.now/CVE-2025-58787.md): WordPress Themify Popup Plugin \<= 1.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, themifyme Themify Popup)
- [CVE-2025-58786](https://cve.now/CVE-2025-58786.md): WordPress Ibtana – Ecommerce Product Addons plugin \<= 0.4.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VW THEMES Ibtana – Ecommerce Product Addons)
- [CVE-2025-58785](https://cve.now/CVE-2025-58785.md): WordPress Ray Enterprise Translation plugin \<= 1.7.2 - Broken Access Control vulnerability (CVSS 5.4, Jiro Sasamoto Ray Enterprise Translation)
- [CVE-2025-58784](https://cve.now/CVE-2025-58784.md): WordPress ARI Fancy Lightbox Plugin \<= 1.4.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, arisoft ARI Fancy Lightbox)
- [CVE-2025-58783](https://cve.now/CVE-2025-58783.md): WordPress Gutentor plugin \<= 3.5.5 - Broken Access Control vulnerability (CVSS 4.3, Gutentor)
- [CVE-2025-8695](https://cve.now/CVE-2025-8695.md): Reflected XSS in Netcad Software's NetGIS Server (CVSS 5.4, Netcad NetGIS Server)
- [CVE-2024-21977](https://cve.now/CVE-2024-21977.md): Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, pot (CVSS 3.2, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +18)
- [CVE-2025-58313](https://cve.now/CVE-2025-58313.md): Race condition vulnerability in the device standby module. (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2025-58296](https://cve.now/CVE-2025-58296.md): Race condition vulnerability in the audio module. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2025-58281](https://cve.now/CVE-2025-58281.md): Out-of-bounds read vulnerability in the runtime interpreter module. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2025-58280](https://cve.now/CVE-2025-58280.md): Vulnerability of exposing object heap addresses in the Ark eTS module. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2025-58276](https://cve.now/CVE-2025-58276.md): Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilit (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-48395](https://cve.now/CVE-2025-48395.md): An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited (CVSS 4.7, Eaton NMC G2)
- [CVE-2025-8944](https://cve.now/CVE-2025-8944.md): OceanWP \< 4.1.2 - Subscriber+ Limited Option Update (CVSS 4.3, OceanWP)
- [CVE-2025-58400](https://cve.now/CVE-2025-58400.md): RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. (CVSS 6.7, RATOC Systems RATOC RAID Monitoring Manager for Windows)
- [CVE-2025-41408](https://cve.now/CVE-2025-41408.md): Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote (CVSS 4.3, LY "Yahoo! Shopping" App for Android)
- [CVE-2025-55671](https://cve.now/CVE-2025-55671.md): Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. (CVSS 7.8, kujirahand TkEasyGUI · tkeasygui)
- [CVE-2025-55037](https://cve.now/CVE-2025-55037.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0. (CVSS 9.8, kujirahand TkEasyGUI · tkeasygui)
- [CVE-2025-58401](https://cve.now/CVE-2025-58401.md): Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. (CVSS 6.8, Pierre-Adrien Vasseur Obsidian GitHub Copilot Plugin)
- [CVE-2025-8684](https://cve.now/CVE-2025-8684.md): Flatsome \<= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ux-themes Flatsome)
- [CVE-2025-7445](https://cve.now/CVE-2025-7445.md): Kubernetes secrets-store-sync-controller discloses service account tokens in logs (CVSS 6.5, Kubernetes secrets-store-sync-controller · sigs.k8s.io/secr…)
- [CVE-2025-9990](https://cve.now/CVE-2025-9990.md): WordPress Helpdesk Integration \<= 5.8.10 - Unauthenticated Local File Inclusion (CVSS 8.1, smackcoders WordPress Helpdesk Integration)
- [CVE-2025-58780](https://cve.now/CVE-2025-58780.md): index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. (CVSS 7.2, ScienceLogic SL1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.