CVEs published September 9, 2025
346 CVEs were published on September 9, 2025: 34 critical, 154 high. 1 is now in CISA KEV.
- Published
- 346
- Critical
- 34
- High
- 154
- Medium
- 150
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 148
Most affected products
- Microsoft Windows
- 46
- Ivanti Connect Secure · Ivanti Policy Secure +2
- 9
- Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1
- 9
- Microsoft 365 Apps for Enterprise · Microsoft Excel +1
- 8
- Adobe Experience Manager
- 7
- Netgate pfSense CE
- 7
- Calix GigaCenter ONT
- 5
- Liferay Portal · Liferay DXP +1
- 4
- SAP_SE SAP HCM
- 4
- Siemens SIMATIC PCS neo · Siemens User Management Component
- 4
Critical 34
- CVE-2025-59046interactive-git-checkout has Command Injection vulnerabilityninofiliu interactive-git-checkout · interactive-git-checko…
- CVE-2025-59039Prebid Universal Creative on npm briefly compromisedprebid-universal-creative
- CVE-2025-58448rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.rathena
- CVE-2025-58447rAthena has heap-based buffer overflow in login serverrathena
- CVE-2025-58462OPEXUS FOIAXpress PAL SQL injectionOPEXUS FOIAXpress Public Access Link
- CVE-2025-10159An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access PointsSophos AP6 Series Wireless Access Points
- CVE-2025-58768DeepChat's Mermaid rendering has XSS leading to RCEThinkInAIXYZ deepchat
- CVE-2025-58762Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentTautulli
- CVE-2025-55051CWE-1392: Use of Default CredentialsBaicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
- CVE-2025-55050CWE-1242: Inclusion of Undocumented FeaturesBaicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
- CVE-2025-55730XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macroxwikisas xwiki-pro-macros
- CVE-2025-55049Use of Default Cryptographic Key (CWE-1394)Baicells NEUTRINO430
- CVE-2025-55729XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macroxwikisas xwiki-pro-macros
- CVE-2025-55048Multiple CWE-78Baicells NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOV…
- CVE-2025-55728XWiki Remote Macros vulnerable to remote code execution using the panel macroxwikisas xwiki-pro-macros
- CVE-2025-55727XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macroxwikisas xwiki-pro-macros
- CVE-2025-55232Microsoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityMicrosoft HPC Pack
- CVE-2025-54261ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2025-58997WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) VulnerabilityFrenify Mow
- CVE-2025-32486WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation VulnerabilityHossein Material Dashboard
- CVE-2025-47569WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerabilityWPSwings WooCommerce Ultimate Gift Card
- CVE-2025-47579WordPress Photography Theme <= 7.7.2 - PHP Object Injection VulnerabilityThemeGoods Photography
- CVE-2025-10183XML External Entity Injection in TecConnect 4.1TecCom TecConnect
- CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition +1
- CVE-2025-9994Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authenticationAmped RF BT-AP
- CVE-2025-40804A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions).Siemens SIMATIC Virtualization as a Service
- CVE-2025-40795A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vSiemens SIMATIC PCS neo · Siemens User Management Component
- CVE-2025-10134Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File DeletionBearsthemes Goza - Nonprofit Charity WordPress Theme
- CVE-2025-42958Missing Authentication check in SAP NetWeaverSAP_SE SAP NetWeaver
- CVE-2025-42944Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)SAP_SE SAP Netweaver
- CVE-2025-42922Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)SAP_SE SAP NetWeaver AS Java
- CVE-2025-44594halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-
- CVE-2025-57085Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function.
- CVE-2025-57633A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS comman
High 154
- CVE-2025-10172UTT 750W formPictureUrl buffer overflowUTT
- CVE-2025-59042PyInstaller has local privilege escalation vulnerabilitypyinstaller
- CVE-2025-59038Prebid.js NPM package briefly compromisedPrebid.js
- CVE-2025-58750rAthena missing bound check in chclif_parse_moveCharSlotrathena
- CVE-2025-54258Substance3D - Modeler | Use After Free (CWE-416)Adobe Substance3D - Modeler
- CVE-2025-54259Substance3D - Modeler | Integer Overflow or Wraparound (CWE-190)Adobe Substance3D - Modeler
- CVE-2025-54260Substance3D - Modeler | Out-of-bounds Read (CWE-125)Adobe Substance3D - Modeler
- CVE-2025-10171UTT 1250GW formConfigApConfTemp sub_453DC buffer overflowUTT 1250GW
- CVE-2025-49459Zoom Workplace for Windows on ARM - Missing AuthorizationZoom Communications Zoom Workplace for Windows on ARM
- CVE-2025-54244Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Viewer
- CVE-2025-54243Substance3D - Viewer | Out-of-bounds Write (CWE-787)Adobe Substance3D - Viewer
- CVE-2025-54245Substance3D - Viewer | Out-of-bounds Write (CWE-787)Adobe Substance3D - Viewer
- CVE-2025-23344The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to run code on the platform host as a non-privileged user.NVIDIA NVDebug tool
- CVE-2025-23343The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components.NVIDIA NVDebug tool
- CVE-2025-23342The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account .NVIDIA NVDebug tool
- CVE-2025-10170UTT 1200GW formApLbConfig sub_4B48F8 buffer overflowUTT 1200GW
- CVE-2025-10169UTT 1200GW ConfigWirelessBase buffer overflowUTT 1200GW
- CVE-2025-54084Calix Gigacenter ONT - Command InjectionCalix GigaCenter ONT
- CVE-2025-43491Poly Lens Desktop Application – Privilege EscalationHP Poly Lens
- CVE-2025-59037DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malwareduckdb-node · duckdb +3
- CVE-2025-58765wabac.js has XSS vulnerability in 404 error handling logicwebrecorder wabac.js · @webrecorder/wabac +2
- CVE-2025-58763Tautulli vulnerable to Authenticated Remote Code Execution via Command InjectionTautulli
- CVE-2025-54257Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat Reader
- CVE-2025-7635Calix GigaCenter ONT - Unauthenticated TelnetCalix GigaCenter ONT
- CVE-2025-53914Calix GigaCenter ONT (Broadcom SoC) - Excessive PrivilegesCalix GigaCenter ONT
- CVE-2025-58761Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`Tautulli
- CVE-2025-58760Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpointTautulli
- CVE-2025-53913Calix GigaCenter ONT (Quantenna SoC) - Excessive PrivilegesCalix GigaCenter ONT
- CVE-2025-58430listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeoverknadh listmonk · github.com/knadh/listmonk
- CVE-2025-58180OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadOctoPrint
- CVE-2025-58063CoreDNS: DNS Cache Pinning via etcd Lease ID Confusioncoredns · github.com/coredns/coredns
- CVE-2025-55047CWE-798 Use of Hard-coded CredentialsBaicells SPECTRA LTE-U eNB
- CVE-2025-54242Premiere Pro | Use After Free (CWE-416)Adobe Premiere Pro
- CVE-2025-54256Dreamweaver Desktop | Cross-Site Request Forgery (CSRF) (CWE-352)Adobe Dreamweaver Desktop
- CVE-2025-10199A local privilege escalation vulnerability exists in LizardBytes' Sunshine for WindowsLizardByte Sunshine for Windows
- CVE-2025-10198LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerabilityLizardByte Sunshine for Windows
- CVE-2025-55234Windows SMB Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-55227Microsoft SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2025-55224Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-54912Windows BitLocker Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54911Windows BitLocker Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54910Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-54900Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54116Windows MultiPoint Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54115Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54114Windows Connected Devices Platform Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54113Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-54112Microsoft Virtual Hard Disk Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54108Capability Access Management Service (camsvc) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54105Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54103Windows Management Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54098Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54093Windows TCP/IP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54092Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54091Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53807Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53805HTTP.sys Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-53802Windows Bluetooth Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53801Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53800Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-49692Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2025-55317Microsoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityMicrosoft AutoUpdate for Mac
- CVE-2025-55316Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2025-55243Microsoft OfficePlus Spoofing VulnerabilityMicrosoft OfficePLUS
- CVE-2025-55245Xbox Gaming Services Elevation of Privilege VulnerabilityMicrosoft Xbox Gaming Services
- CVE-2025-55236Graphics Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-55228Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-55223DirectX Graphics Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54919Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-54918Windows NTLM Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54916Windows NTFS Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-54913Windows UI XAML Maps MapControlSettings Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54908Microsoft PowerPoint Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-54907Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-54906Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2025-54905Microsoft Word Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-54904Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54903Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54902Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54899Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54898Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54897Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-54896Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54895SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54894Local Security Authority Subsystem Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54111Windows UI XAML Phone DatePickerFlyout Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54110Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54106Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-54102Windows Connected Devices Platform Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54099Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-49734PowerShell Direct Elevation of Privilege VulnerabilityMicrosoft PowerShell · Microsoft Windows
- CVE-2025-54248Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager
- CVE-2025-58991WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) VulnerabilityCristiano Zanca WooCommerce Booking Bundle Hours
- CVE-2025-58993WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection VulnerabilityThemeum Tutor LMS
- CVE-2025-53303WordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection VulnerabilityThemeMove Core
- CVE-2025-58215WordPress Ziston Theme < 1.4.5 - Local File Inclusion Vulnerabilitygavias Ziston
- CVE-2025-48101WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerabilitywebdevstudios Constant Contact for WordPress
- CVE-2025-49430WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) VulnerabilityFWDesign Ultimate Video Player
- CVE-2025-54709WordPress Sala Theme <= 1.1.6 - Local File Inclusion Vulnerabilityuxper Sala
- CVE-2025-32689WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerabilityConvers Lab WP SmartPay
- CVE-2025-47570WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerabilityvillatheme WooCommerce Photo Reviews
- CVE-2025-47571WordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerabilityhighwarden Super Store Finder
- CVE-2025-47694WordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilitysolwin Blog Designer PRO
- CVE-2025-47695WordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerabilitysolwin Blog Designer PRO
- CVE-2025-59008WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerabilityPressTigers ZIP Code Based Content Protection
- CVE-2025-55142Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55141Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55148Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55147CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55145Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure 22.7R2.9 · Ivanti Policy Secure +2
- CVE-2025-9872Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toIvanti Endpoint Manager
- CVE-2025-9712Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toIvanti Endpoint Manager
- CVE-2025-33045Legacy Serial Redirection SMRAM VulnerabilitiesAMI AptioV
- CVE-2025-9951Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000FFmpeg
- CVE-2025-9161Rockwell Automation FactoryTalk Optix Remote Code Execution VulnerabilityRockwell Automation FactoryTalk Optix
- CVE-2025-7350Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution VulnerabilityRockwell Automation Stratix IOS
- CVE-2025-9065Rockwell Automation ThinManager® Server-Side Request Forgery VulnerabilityRockwell Automation ThinManager
- CVE-2025-7970Rockwell Automation FactoryTalk Activation Manager Lack of Encryption VulnerabilityRockwell Automation FactoryTalk Activation Manager
- CVE-2025-9364Rockwell Automation FactoryTalk® Analytics™ LogixAI® Exposed Redis DBRockwell Automation FactoryTalk® Analytics™ LogixAI®
- CVE-2025-9166Rockwell Automation ControlLogix® 5580 V35.013 Denial-Of-ServiceRockwell Automation ControlLogix®
- CVE-2025-9160Rockwell Automation CompactLogix® 5480 Code Execution VulnerabilityRockwell Automation CompactLogix®
- CVE-2025-8007Rockwell Automation 1756-ENT2R, EN4TR, EN4TRXT VulnerabilityRockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT
- CVE-2025-8008Rockwell Automation 1756-ENT2R, EN4TR, EN4TRXT VulnerabilityRockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT
- CVE-2025-48208Apache HertzBeat (incubating): Jmx JNDI injection vulnerabilityApache Software Foundation Apache HertzBeat
- CVE-2025-24404Apache HertzBeat (incubating): RCE by parse http sitemap xml responseApache Software Foundation Apache HertzBeat
- CVE-2025-59018Information Disclosure in Workspaces ModuleTYPO3 CMS · typo3/cms-workspaces
- CVE-2025-41701Beckhoff: Deserialization of untrusted data by TwinCAT 3 EngineeringBeckhoff TE1000 | TwinCAT 3 Enineering
- CVE-2025-40798A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vSiemens SIMATIC PCS neo · Siemens User Management Component
- CVE-2025-40797A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vSiemens SIMATIC PCS neo · Siemens User Management Component
- CVE-2025-40796A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vSiemens SIMATIC PCS neo · Siemens User Management Component
- CVE-2025-9539AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creationrubengc AutomatorWP – Automator plugin for no-code automati…
- CVE-2025-42933Insecure Storage of Sensitive Information in SAP Business One (SLD)SAP_SE SAP Business One
- CVE-2025-42929Missing input validation vulnerability in SAP Landscape Transformation Replication ServerSAP_SE SAP Landscape Transformation Replication Server
- CVE-2025-42916Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)SAP_SE SAP S/4HANA
- CVE-2025-10120Tenda AC20 GetParentControlInfo strcpy buffer overflowTenda AC20
- CVE-2025-29089An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information
- CVE-2025-52322An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to
- CVE-2025-52915K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to termin
- CVE-2025-57057Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function.
- CVE-2025-57058Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and
- CVE-2025-57059Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function.
- CVE-2025-57060Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dns_forward_rule_store function.
- CVE-2025-57061Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac,
- CVE-2025-57062Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function.
- CVE-2025-57063Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function.
- CVE-2025-57064Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function.
- CVE-2025-57069Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function.
- CVE-2025-57070Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function.
- CVE-2025-57071Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function.
- CVE-2025-57072Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute functio
- CVE-2025-57078Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhi
- CVE-2025-57086Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function.
- CVE-2025-57087Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function.
- CVE-2025-57278The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handlin
Medium, low and unrated 158
- CVE-2025-59044Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)himmelblau-idm himmelblau
- CVE-2025-59036Infrahub allows authentication with deleted and expired API tokensopsmill infrahub · infrahub-server
- CVE-2025-58131Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon - Race ConditionZoom Communications Zoom Workplace VDI Plugin macOS Univers…
- CVE-2025-58135Zoom Workplace Clients for Windows - Improper Action EnforcementZoom Communications Zoom Workplace Clients for Windows
- CVE-2025-58134Zoom Workplace Clients for Windows - Incorrect AuthorizationZoom Communications Zoom Workplace Clients for Windows
- CVE-2025-49461Zoom Workplace Clients - Cross-site ScriptingZoom Communications Zoom Workplace Clients
- CVE-2025-49460Zoom Workplace Clients - Argument InjectionZoom Communications Zoom Workplace Clients
- CVE-2025-49458Zoom Workplace Clients - Buffer OverflowZoom Communications Zoom Workplace Clients
- CVE-2025-9997CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause comSchneider Electric Saitel DR RTU · Schneider Electric Saite…
- CVE-2025-9996CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause theSchneider Electric Saitel DR RTU · Schneider Electric Saite…
- CVE-2025-7746CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvaliSchneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altiva… +6
- CVE-2025-54241After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-54239After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-54240After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-54083Calix GigaCenter ONT firmware - Sensitive Information DisclosureCalix GigaCenter ONT
- CVE-2025-34178Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site ScriptingNetgate pfSense CE
- CVE-2025-34177Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site ScriptingNetgate pfSense CE
- CVE-2025-34176Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information DisclosureNetgate pfSense CE
- CVE-2025-54255Acrobat Reader | Violation of Secure Design Principles (CWE-657)Adobe Acrobat Reader
- CVE-2025-34175Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingNetgate pfSense CE
- CVE-2025-34174Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site ScriptingNetgate pfSense CE
- CVE-2025-34173Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information DisclosureNetgate pfSense CE
- CVE-2025-58753copyparty: Sharing a single file does not fully restrict access to other files in source folder9001 copyparty · copyparty
- CVE-2025-58759TinyEnv: Inline comments not stripped properly in .env valuesdatahihi1 tiny-env · datahihi1/tiny-env
- CVE-2025-58758TinyEnv: Missing .env file not required — may cause unexpected behaviordatahihi1 tiny-env · datahihi1/tiny-env
- CVE-2025-58442Saleor has user enumeration vulnerability due to different error messagessaleor
- CVE-2025-58435Open OnDemand didn't rotate password for VNC batch_connectOSC ondemand
- CVE-2025-34172Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site ScriptingNetgate pfSense CE
- CVE-2025-36011IBM Jazz for Service Management information disclosureIBM Jazz for Service Management
- CVE-2025-36125IBM Hardware Management Console - Power Systems cross-site scriptingIBM Hardware Management Console
- CVE-2025-47415RECWAVE Filepath TraversalCRESTRON TOUCHSCREENS x60, x70 series
- CVE-2025-55054CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Baicells EG7035E-M11
- CVE-2025-55053CWE-328: Use of Weak HashBaicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
- CVE-2025-43786Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 throuLiferay Portal · Liferay DXP +3
- CVE-2025-55052CWE-200 Exposure of Sensitive Information to an Unauthorized ActorBaicells NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOV…
- CVE-2025-43781Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.Liferay Portal · Liferay DXP +1
- CVE-2025-10164lmsys sglang update_weights_from_tensor main deserializationlmsys sglang · sglang
- CVE-2025-43775Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024Liferay Portal · Liferay DXP +1
- CVE-2025-9269Server-Side Request Forgery (SSRF) vulnerability found in embedded web serverLexmark CX, XC, CS, MS, MX, XM, et. al.
- CVE-2025-54917MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-54915Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54901Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-54109Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54107MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-54104Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54094Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53810Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53809Windows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-53808Windows Defender Firewall Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-53806Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-53804Windows Kernel-Mode Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-53803Windows Kernel Memory Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-53799Windows Imaging Component Information Disclosure VulnerabilityMicrosoft Office for Android · Microsoft Windows
- CVE-2025-53796Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-47997Microsoft SQL Server Information Disclosure VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2025-55226Graphics Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-55225Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-54101Windows SMB Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-54097Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-54096Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-54095Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-53798Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-53797Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-54250Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager
- CVE-2025-54247Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager
- CVE-2025-54246Adobe Experience Manager | Incorrect Authorization (CWE-863)Adobe Experience Manager
- CVE-2025-54251Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)Adobe Experience Manager
- CVE-2025-54252Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-54249Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Experience Manager
- CVE-2025-58975WordPress Advanced Settings Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) VulnerabilityHelmut Wandl Advanced Settings
- CVE-2025-58976WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control VulnerabilityAccessibility Checker by Equalize Digital
- CVE-2025-58977WordPress WP eBay Product Feeds Plugin <= 3.4.8 - Server Side Request Forgery (SSRF) VulnerabilityRhys Wynne WP eBay Product Feeds
- CVE-2025-58978WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control VulnerabilityWP Swings PDF Generator for WordPress
- CVE-2025-58979WordPress BerqWP Plugin <= 2.2.53 - Broken Access Control VulnerabilityBerqWP
- CVE-2025-58980WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerabilityrecorp Export WP Page to Static HTML/CSS
- CVE-2025-58981WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control VulnerabilityAccessibility Checker by Equalize Digital
- CVE-2025-58982WordPress Pixeline's Email Protector Plugin <= 1.3.8 - Cross Site Scripting (XSS) VulnerabilityPixeline's Email Protector
- CVE-2025-58983WordPress Include Me Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityStefano Lissa Include Me
- CVE-2025-58984WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerabilityinfo@welcart Welcart e-Commerce
- CVE-2025-58985WordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityWPFactory Additional Custom Product Tabs for WooCommerce
- CVE-2025-58987WordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) VulnerabilityAntoineH Football Pool
- CVE-2025-58988WordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) VulnerabilityJoe Dolson My Tickets
- CVE-2025-58989WordPress Dynamic Text Field For Contact Form 7 Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilitysilverplugins217 Dynamic Text Field For Contact Form
- CVE-2025-58990WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) VulnerabilityDevItems ShopLentor
- CVE-2025-5500ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application componentsZhenShi Mibro Fit App
- CVE-2025-5005Shanghai Lingdang Information Technology Lingdang CRM index_event.php server-side request forgeryShanghai Lingdang Information Technology Lingdang CRM
- CVE-2025-30875WordPress WP Weixin plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerabilityAlexandre Froger WP Weixin
- CVE-2025-53291WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerabilityspoddev2021 Spreadconnect
- CVE-2025-53340WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerabilityawesomesupport Awesome Support
- CVE-2025-53348WordPress Kalium Theme <= 3.18.3 - Broken Access Control VulnerabilityLaborator Kalium
- CVE-2025-32688WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerabilityNebojsa Target Video Easy Publish
- CVE-2025-39523WordPress GoodBarber plugin <= 1.0.26 - Open Redirection VulnerabilityGoodBarber
- CVE-2025-39541WordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerabilityRoland Murg WP Simple Booking Calendar
- CVE-2025-39553WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerabilityandy_moyle Church Admin
- CVE-2025-47437WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2025-49860WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerabilityMajestic Support
- CVE-2025-59005WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerabilityfrenify Categorify
- CVE-2025-55144Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55143Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforeIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55139SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55146An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-8711CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-8712Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22Ivanti Connect Secure before · Ivanti Policy Secure +2
- CVE-2025-10107TRENDnet TEW-831DR formSysCmd command injectionTRENDnet TEW-831DR
- CVE-2025-43776A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202Liferay Portal · Liferay DXP +3
- CVE-2025-47416ConsoleFindCommandMatchListCRESTRON TOUCHSCREEN x70 · CRESTRON Touchscreen x60s
- CVE-2024-45325An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoSFortinet FortiDDoS-F
- CVE-2025-53609A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7Fortinet FortiWeb
- CVE-2025-8277Libssh: memory exhaustion via repeated key exchange in libsshlibssh · Red Hat Enterprise Linux +1
- CVE-2025-10095SQL injection in SMPP component of SMSEagle firmwareProximus sp. z o.o. SMSEagle
- CVE-2025-59019Information Disclosure via CSV DownloadTYPO3 CMS · typo3/cms-backend +1
- CVE-2025-59017Broken Access Control in Backend AJAX RoutesTYPO3 CMS · typo3/cms-workspaces +4
- CVE-2025-59016Information Disclosure via File Abstraction LayerTYPO3 CMS · typo3/cms-core
- CVE-2025-59015Insufficient Entropy in Password GenerationTYPO3 CMS · typo3/cms-core
- CVE-2025-59014Denial of Service in TYPO3 Bookmark ToolbarTYPO3 CMS · typo3/cms-backend
- CVE-2025-59013Open Redirect in TYPO3 CMSTYPO3 CMS · typo3/cms-core
- CVE-2025-40803A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions).Siemens RUGGEDCOM RST2428P
- CVE-2025-40802A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions).Siemens RUGGEDCOM RST2428P
- CVE-2025-40757A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC SSiemens APOGEE PXC Series · Siemens TALON TC Series
- CVE-2025-40594A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS Siemens SINAMICS G220 · Siemens SINAMICS S200 +1
- CVE-2025-9542AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functionsrubengc AutomatorWP – Automator plugin for no-code automati…
- CVE-2025-9111WPBOT < 7.1.0 - Admin+ Stored XSSAI ChatBot for WordPress
- CVE-2025-8889Compress Then Upload < 1.0.5 - Admin+ Arbitrary File UploadCompress & Upload
- CVE-2025-9058Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeMikado Themes Mikado Core
- CVE-2025-9061Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeMikado Themes Wilmer Core
- CVE-2025-9489WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Namescbutlerjr WP-Members Membership Plugin
- CVE-2025-43777Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.QLiferay Portal · Liferay DXP +1
- CVE-2025-10123D-Link DIR-823X set_static_leases sub_415028 command injectionD-Link DIR-823X
- CVE-2025-10122Maccms10 Database.php rep sql injectionMaccms10
- CVE-2025-42938Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP PlatformSAP_SE SAP NetWeaver ABAP Platform
- CVE-2025-42930Denial of Service (DoS) vulnerability in SAP Business Planning and ConsolidationSAP_SE SAP Business Planning and Consolidation
- CVE-2025-42927Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)SAP_SE SAP NetWeaver AS Java
- CVE-2025-42926Missing Authentication check in SAP NetWeaver Application Server JavaSAP_SE SAP NetWeaver Application Server Java
- CVE-2025-42925Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)SAP_SE SAP NetWeaver AS Java
- CVE-2025-42923Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)SAP_SE SAP Fiori App
- CVE-2025-42920Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship ManagementSAP_SE SAP Supplier Relationship Management
- CVE-2025-42918Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)SAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2025-42917Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)SAP_SE SAP HCM
- CVE-2025-42915Missing Authorization Check in Fiori app (Manage Payment Blocks)SAP_SE Fiori app
- CVE-2025-42914Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)SAP_SE SAP HCM
- CVE-2025-42913Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)SAP_SE SAP HCM
- CVE-2025-42912Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)SAP_SE SAP HCM
- CVE-2025-42911Missing Authorization check in SAP NetWeaver (Service Data Download)SAP_SE SAP NetWeaver
- CVE-2025-10121uverif kami_list addbatch sql injectionuverif
- CVE-2025-10118itsourcecode E-Logbook with Health Monitoring System for COVID-19 login.php sql injectionitsourcecode E-Logbook with Health Monitoring System for CO…
- CVE-2025-43778A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 20Liferay Portal · Liferay DXP +1
- CVE-2025-10117SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scriptingSourceCodester Simple To-Do List System
- CVE-2025-10116SiempreCMS file_upload.php unrestricted uploadSiempreCMS
- CVE-2025-10115SiempreCMS user_search_ajax.php sql injectionSiempreCMS
- CVE-2025-10114PHPGurukul Small CRM profile.php sql injectionPHPGurukul Small CRM
- CVE-2025-10113itsourcecode Student Information Management System index.php sql injectionitsourcecode Student Information Management System
- CVE-2025-44593Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files.
- CVE-2025-44595Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
- CVE-2025-52277Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta coyeswiki/yeswiki
- CVE-2025-57538A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Envir
- CVE-2025-57539A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PV
- CVE-2025-57540A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox
- CVE-2025-57665Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abelement-plus