CVEs published September 26, 2025
199 CVEs were published on September 26, 2025: 5 critical, 39 high.
- Published
- 199
- Critical
- 5
- High
- 39
- Medium
- 147
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- GitLab
- 9
- Open Babel · openbabel
- 7
- givanz Vvveb
- 4
- marceljm Featured Image from URL
- 4
- BehaviorTree
- 3
- OGRECave Ogre
- 3
- Unitree Go2 · Unitree G1 +2
- 3
- Benjamin Intal Stackable
- 2
- code-projects E-Commerce Website
- 2
- CodexThemes TheGem
- 2
Critical 5
- CVE-2025-59934Formbricks missing JWT signature verificationformbricks
- CVE-2025-60219WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload VulnerabilityHaruTheme WooCommerce Designer Pro
- CVE-2025-60156WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerabilitywebandprint AR For WordPress
- CVE-2025-55187In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.
- CVE-2025-58384In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library
High 39
- CVE-2025-59845Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypassapollographql embeddable-explorer · @apollo/sandbox +1
- CVE-2025-10657Docker Desktop with ECI Fails to Enforce Socket Command RestrictionsDocker Desktop
- CVE-2025-59844Argument injection vulnerability in SonarQube Scan ActionSonarSource sonarqube-scan-action
- CVE-2025-36274IBM Aspera HTTP Gateway information disclosureIBM Aspera HTTP Gateway
- CVE-2025-9267In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs fromSeagate Toolkit
- CVE-2025-10544Unrestricted uploading of dangerous file types to AvePoint productsAvePoint DocAve · AvePoint Perimeter +1
- CVE-2025-9642Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-9958Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2025-10858Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-11021Libsoup: out-of-bounds read in cookie date handling of libsoup http librarylibsoup · Red Hat Enterprise Linux
- CVE-2025-60173WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) VulnerabilityAshwani kumar GST for WooCommerce
- CVE-2025-60172WordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) VulnerabilityFlytedesk Digital
- CVE-2025-60171WordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) VulnerabilityConditional Cart Messages for WooCommerce – YourPlugins.com
- CVE-2025-60170WordPress HTACCESS IP Blocker Plugin <= 1.0 - Cross Site Request Forgery (CSRF) VulnerabilityTaraprasad Swain HTACCESS IP Blocker
- CVE-2025-60169WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerabilityW3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM
- CVE-2025-60164WordPress NewsmanApp plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityNewsmanApp
- CVE-2025-60153WordPress Subscribe To Unlock Plugin <= 1.1.5 - Local File Inclusion Vulnerabilitywpshuffle Subscribe To Unlock
- CVE-2025-60150WordPress Subscribe to Download plugin <= 2.0.9 - Local File Inclusion vulnerabilitywpshuffle Subscribe to Download
- CVE-2025-60126WordPress Testimonial Slider Plugin <= 3.5.8.6 - Local File Inclusion VulnerabilityPluginOps Testimonial Slider
- CVE-2025-60118WordPress PGS Core Plugin <= 5.9.0 - SQL Injection VulnerabilityPotenzaglobalsolutions PGS Core
- CVE-2025-60111WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerabilityjavothemes Javo Core
- CVE-2025-60110WordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection VulnerabilityLambertGroup AllInOne - Banner Rotator
- CVE-2025-60109WordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection VulnerabilityLambertGroup - AllInOne - Content Slider
- CVE-2025-60108WordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection VulnerabilityLambertGroup - AllInOne - Banner with Thumbnails
- CVE-2025-60107WordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection VulnerabilityLambertGroup - AllInOne - Banner with Playlist
- CVE-2025-4957WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss ProfileGrid
- CVE-2025-48107WordPress Uncode theme < 2.9.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityundsgn Uncode
- CVE-2025-59012WordPress Traveler theme < 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityshinetheme Traveler
- CVE-2025-59002WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion VulnerabilitySeaTheme BM Content Builder
- CVE-2025-59010WordPress Permalink Manager Lite Plugin <= 2.5.1.3 - Sensitive Data Exposure VulnerabilityMaciej Bis Permalink Manager Lite
- CVE-2025-59011WordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerabilityshinetheme Traveler
- CVE-2025-35027Unitree Multiple Robotic Products Command InjectionUnitree Go2 · Unitree G1
- CVE-2025-10747WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Uploadgamerz WP-DownloadManager
- CVE-2025-45994An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST reques
- CVE-2025-55847Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file.
- CVE-2025-55848An issue was discovered in DIR-823 firmware 20250416.
- CVE-2025-56383Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code.
- CVE-2025-58385In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded an
- CVE-2025-60017Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parUnitree Go2 · Unitree G1 +2
Medium, low and unrated 155
- CVE-2025-11048Portabilis i-Educar consulta-dispensas improper authorizationPortabilis i-Educar
- CVE-2025-11047Portabilis i-Educar aluno improper authorizationPortabilis i-Educar
- CVE-2025-11046Tencent WeKnora test testEmbeddingModel server-side request forgeryTencent WeKnora
- CVE-2025-11045WAYOS LQ_04/LQ_05/LQ_06/LQ_07/LQ_09 usb_paswd.asp command injectionWAYOS LQ_04 · WAYOS LQ_05 +3
- CVE-2025-11041itsourcecode Open Source Job Portal index.php sql injectionitsourcecode Open Source Job Portal
- CVE-2025-11040code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-11039Campcodes Computer Sales and Inventory System us_edit1.php sql injectionCampcodes Computer Sales and Inventory System
- CVE-2025-11038itsourcecode Online Clinic Management System details.php sql injectionitsourcecode Online Clinic Management System
- CVE-2025-11037code-projects E-Commerce Website admin_index_search.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11036code-projects E-Commerce Website admin_account_update.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11035Jinher OA text xml external entity referenceJinher OA
- CVE-2025-11034Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversalDibo Data Decision Making System
- CVE-2025-11033kidaze CourseSelectionSystem COUNT3s7.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-11032kidaze CourseSelectionSystem COUNT3s6.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-11031DataTables examples.php path traversalDataTables
- CVE-2025-11030Tutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorizationTutorials-Website Employee Management System
- CVE-2025-11029givanz Vvveb cross-site request forgerygivanz Vvveb
- CVE-2025-59843FlagForgeCTF Exposes User Emails via Public /api/user/[username] APIFlagForgeCTF flagForge
- CVE-2025-11028givanz Vvveb Image information disclosuregivanz Vvveb
- CVE-2025-11027givanz Vvveb SVG File cross site scriptinggivanz Vvveb
- CVE-2025-59842JupyterLab LaTeX typesetter links did not enforce `noopener` attributejupyterlab
- CVE-2025-11026givanz Vvveb Configuration File information disclosuregivanz Vvveb
- CVE-2025-11019Total.js CMS Files Menu cross site scriptingTotal.js CMS
- CVE-2025-36326IBM Controller information disclosureIBM Cognos Controller · IBM Controller
- CVE-2025-6396XSS in Webbeyaz's web siteWebbeyaz Website Design Website Software
- CVE-2025-11018Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversalFour-Faith Water Conservancy Informatization Platform
- CVE-2025-11017OGRECave Ogre OgreLogManager.cpp stream null pointer dereferenceOGRECave Ogre
- CVE-2025-11016kalcaddle kodbox index.class.php fileOut path traversalkalcaddle kodbox
- CVE-2025-11015OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routinesOGRECave Ogre
- CVE-2025-11025Information Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging PlatformVimesoft Information Technologies and Software Vimesoft Cor…
- CVE-2025-11014OGRECave Ogre Image OgreSTBICodec.cpp encode heap-based overflowOGRECave Ogre
- CVE-2025-11013BehaviorTree XML Parser xml_parsing.cpp loadDocImpl null pointer dereferenceBehaviorTree
- CVE-2025-11060Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptionssurrealdb · Red Hat OpenShift Service Mesh
- CVE-2025-11012BehaviorTree Diagnostic Message script_parser.cpp ParseScript stack-based overflowBehaviorTree
- CVE-2025-11011BehaviorTree json_export.cpp fromJson null pointer dereferenceBehaviorTree
- CVE-2025-11010vstakhov libucl ucl_util.c ucl_include_common heap-based overflowvstakhov libucl
- CVE-2025-11042Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-5069Incorrect Ownership Assignment in GitLabGitLab
- CVE-2025-10868Business Logic Errors in GitLabGitLab
- CVE-2025-7691Privilege Defined With Unsafe Actions in GitLabGitLab
- CVE-2025-10867Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-10871Missing Authorization in GitLabGitLab
- CVE-2025-60186WordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityAlex Moss Google+ Comments
- CVE-2025-60185WordPress kontur Admin Style Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerabilitykontur.us kontur Admin Style
- CVE-2025-60184WordPress SEO Search Permalink Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityTerry L. SEO Search Permalink
- CVE-2025-60181WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) VulnerabilitySilencesoft RSS Reader
- CVE-2025-60179WordPress Click & Tweet Plugin <= 0.8.9 - Cross Site Scripting (XSS) VulnerabilitySpace Studio Click & Tweet
- CVE-2025-60177WordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerabilityrozx Recaptcha – wp
- CVE-2025-60167WordPress Page Manager for Elementor Plugin <= 2.0.5 - Sensitive Data Exposure Vulnerabilityhonzat Page Manager for Elementor
- CVE-2025-60166WordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion Vulnerabilitywpshuffle WP Subscription Forms PRO
- CVE-2025-60165WordPress Frames Theme <= 1.5.7 - Broken Access Control VulnerabilityHaruTheme Frames
- CVE-2025-60163WordPress bbp topic count plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityRobin W bbp topic count
- CVE-2025-60162WordPress Job Board Manager Plugin <= 2.1.61 - Cross Site Scripting (XSS) VulnerabilityPickPlugins Job Board Manager
- CVE-2025-60161WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerabilitybdthemes ZoloBlocks
- CVE-2025-60160WordPress Smart Related Products plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilitysharkthemes Smart Related Products
- CVE-2025-60159WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerabilitywebmaniabr Nota Fiscal Eletrônica WooCommerce
- CVE-2025-60158WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Cross Site Scripting (XSS) vulnerabilitywebmaniabr Nota Fiscal Eletrônica WooCommerce
- CVE-2025-60157WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerabilityemarket-design WP Ticket Customer Service Software & Suppor…
- CVE-2025-60155WordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerabilityloopus WP Virtual Assistant
- CVE-2025-60154WordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityJennifer Moss MWW Disclaimer Buttons
- CVE-2025-60152WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerabilitywpshuffle Subscribe To Unlock
- CVE-2025-60149WordPress Notely plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerabilityRocket Apps Notely
- CVE-2025-60148WordPress Subscribe to Download plugin <= 2.0.9 - Broken Access Control vulnerabilitywpshuffle Subscribe to Download
- CVE-2025-60147WordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Feed
- CVE-2025-60146WordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityAmit Verma Map Categories to Pages
- CVE-2025-60145WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerabilityyonifre Lenix scss compiler
- CVE-2025-60144WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerabilityyonifre Lenix scss compiler
- CVE-2025-60143WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerabilityNetgsm
- CVE-2025-60142WordPress Simple Meta Tags Plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityDaganLev Simple Meta Tags
- CVE-2025-60141WordPress The Tribal Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerabilitythetechtribe The Tribal
- CVE-2025-60140WordPress The Tribal Plugin <= 1.3.3 - Sensitive Data Exposure Vulnerabilitythetechtribe The Tribal
- CVE-2025-60139WordPress Sendle Shipping plugin <= 6.02 - Cross Site Request Forgery (CSRF) vulnerabilityJoovii Sendle Shipping
- CVE-2025-60138WordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Blocks
- CVE-2025-60137WordPress Post Featured Video Plugin <= 1.7 - Cross Site Request Forgery (CSRF) VulnerabilityGalaxy Weblinks Post Featured Video
- CVE-2025-60136WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilitycartpauj User Notes
- CVE-2025-60133WordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityDJ-Extensions.com PE Easy Slider
- CVE-2025-60130WordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerabilitywedos.com WEDOS Global
- CVE-2025-60129WordPress Yext Plugin <= 1.1.3 - Broken Access Control VulnerabilityYext
- CVE-2025-60128WordPress Delisho Plugin <= 1.1.3 - Broken Access Control VulnerabilityWP Delicious Delisho
- CVE-2025-60127WordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerabilityArtistScope CopySafe Web Protection
- CVE-2025-60125WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerabilitythemelooks FoodBook
- CVE-2025-60124WordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) VulnerabilityRyan Hellyer Simple Colorbox
- CVE-2025-60123WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerabilityHivePress Claim Listings
- CVE-2025-60122WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerabilityHivePress Claim Listings
- CVE-2025-60121WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerabilityEx-Themes WooEvents
- CVE-2025-60119WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure VulnerabilityCoSchedule
- CVE-2025-60120WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerabilityWPDirectoryKit WP Directory Kit
- CVE-2025-60117WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) VulnerabilityTangibleWP Vehica Core
- CVE-2025-60116WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerabilityThemeGoods Grand Conference Theme Custom Post Type
- CVE-2025-60115WordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityinstapagedev Instapage Plugin
- CVE-2025-60114WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerabilityYayCommerce YayCurrency
- CVE-2025-60113WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerabilitygrooni Groovy Menu
- CVE-2025-60112WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilitySyed Balkhi aThemes Addons for Elementor
- CVE-2025-60106WordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion VulnerabilityRoxnor EmailKit
- CVE-2025-60105WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerabilitymetaphorcreations Ditty
- CVE-2025-60104WordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityJordy Meow Gallery Custom Links
- CVE-2025-60103WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerabilityCridioStudio ListingPro
- CVE-2025-60102WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) VulnerabilitySyam Mohan WPFront User Role Editor
- CVE-2025-60099WordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerabilityawsm.in Embed Any Document
- CVE-2025-60100WordPress XStore theme < 9.6 - Content Injection vulnerability8theme XStore
- CVE-2025-60101WordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerabilityduongancol Woostify
- CVE-2025-60098WordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control VulnerabilityJeff Farthing Theme My Login
- CVE-2025-60097WordPress TheGem Theme <= 5.10.5 - Broken Access Control VulnerabilityCodexThemes TheGem
- CVE-2025-60096WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control VulnerabilityCodexThemes TheGem
- CVE-2025-60095WordPress Stackable Plugin <= 3.18.1 - Sensitive Data Exposure VulnerabilityBenjamin Intal Stackable
- CVE-2025-60094WordPress Stackable Plugin <= 3.18.1 - Broken Access Control VulnerabilityBenjamin Intal Stackable
- CVE-2025-60093WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) VulnerabilityShahjada Download Manager
- CVE-2025-60092WordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure VulnerabilityShahjada Download Manager
- CVE-2025-60040WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerabilityfkrauthan wp-mpdf
- CVE-2025-27006WordPress Authorsy Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerabilitythemeplugs Authorsy
- CVE-2025-48326WordPress Acclectic Media Organizer Plugin <= 1.4 - Broken Access Control VulnerabilityAcclectic Media Organizer
- CVE-2025-58914WordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerabilityDi Themes Demo Site Importer
- CVE-2025-58917WordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityNick Verwymeren Quantities and Units for WooCommerce
- CVE-2025-58919WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerabilityguihom Wide Banner
- CVE-2025-1862Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code ExecutionWSO2 Enterprise Integrator · WSO2 Identity Server +1
- CVE-2025-1396Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledWSO2 Identity Server · WSO2 Open Banking IAM +1
- CVE-2025-54831Apache Airflow: Connection sensitive details exposed to users with READ permissionsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2025-10490Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scriptingdylanjkotze Zephyr Project Manager
- CVE-2025-10136TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdouglaskarr TweetThis Shortcode
- CVE-2025-10180Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingjhoppe Markdown Shortcode
- CVE-2025-10137Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgeryinc2734 Snow Monkey
- CVE-2025-10307Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletionsoftaculous Backuply – Backup, Restore, Migrate and Clone
- CVE-2025-9490Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameterdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2025-10036Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injectionmarceljm Featured Image from URL
- CVE-2025-9985Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log Filemarceljm Featured Image from URL
- CVE-2025-9984Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosuremarceljm Featured Image from URL
- CVE-2025-10037Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injectionmarceljm Featured Image from URL
- CVE-2025-11000Open Babel PQSformat.cpp ReadMolecule null pointer dereferenceOpen Babel · openbabel
- CVE-2025-10377System Dashboard <= 2.8.20 - Cross-Site Request Forgeryqriouslad System Dashboard
- CVE-2025-9044Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingMapster WP Maps
- CVE-2025-10745Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypassspecialk Banhammer – Monitor Site Traffic, Block Bad Users…
- CVE-2025-10173ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Updateroxnor ShopEngine Elementor WooCommerce Builder Addon – All…
- CVE-2025-10999Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereferenceOpen Babel · openbabel
- CVE-2025-10998Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereferenceOpen Babel · openbabel
- CVE-2025-10997Open Babel chemkinformat.cpp CheckSpecies heap-based overflowOpen Babel · openbabel
- CVE-2025-10996Open Babel smilesformat.cpp ParseSmiles heap-based overflowOpen Babel · openbabel
- CVE-2025-10995Open Babel zipstreamimpl.h underflow memory corruptionOpen Babel · openbabel
- CVE-2025-10994Open Babel gamessformat.cpp ReadMolecule use after freeOpen Babel · openbabel
- CVE-2025-10752OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgerycyberlord92 OAuth Single Sign On – SSO
- CVE-2025-8200Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widgetkraftplugins Mega Elements – Addons for Elementor
- CVE-2025-10178CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativemindssolutions CM Business Directory – Optimise and…
- CVE-2025-8906Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingtrustindex Widgets for Tiktok Feed
- CVE-2025-10993MuYuCMS Template Management admin.php code injectionMuYuCMS
- CVE-2025-10992roncoo roncoo-pay lookupList improper authorizationroncoo-pay
- CVE-2025-10989yangzongzhuan RuoYi selectAll improper authorizationyangzongzhuan RuoYi
- CVE-2025-10988YunaiV ruoyi-vue-pro transfer improper authorizationYunaiV ruoyi-vue-pro
- CVE-2025-10987YunaiV yudao-cloud HTTP Request transfer improper authorizationYunaiV yudao-cloud
- CVE-2025-10981JeecgBoot exportXls improper authorizationJeecgBoot
- CVE-2025-26258Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'
- CVE-2025-56463Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.
- CVE-2025-57292Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality.
- CVE-2025-57692PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution ofPiranha
- CVE-2025-59362Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs.
- CVE-2025-60250Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 284Unitree Go2 · Unitree G1 +2
- CVE-2025-60251Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring.Unitree Go2 · Unitree G1 +2