CVEs published October 29, 2025
158 CVEs were published on October 29, 2025: 8 critical, 50 high.
- Published
- 158
- Critical
- 8
- High
- 50
- Medium
- 94
- Low
- 4
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- wazuh
- 8
- GIMP
- 7
- Arista Networks DANZ Monitoring Fabric
- 5
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 4
- Linux
- 4
- Ashlar-Vellum Cobalt
- 3
- Jenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- 3
- Razer Synapse
- 3
- ckan
- 2
- Drupal CivicTheme Design System · drupal/civictheme
- 2
Critical 8
- CVE-2025-11202win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerabilitywin-cli-mcp-server
- CVE-2018-25120D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_TestD-Link DNS-343 ShareCenter
- CVE-2025-12479Systemic Lack of Cross-Site Request Forgery (CSRF) Token ImplementationAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12478Non-Compliant TLS ConfigurationAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12477Server Version DisclosureAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12476Resource Lacking AuthNAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2024-45162A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field.
- CVE-2025-63622A vulnerability was found in code-projects Online Complaint Site 1.0.
High 50
- CVE-2025-12466Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…
- CVE-2025-12082CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112Drupal CivicTheme Design System · drupal/civictheme
- CVE-2025-9954Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105Drupal Acquia DAM · drupal/acquia_dam
- CVE-2025-54546On affected platforms, restricted users could use SSH port forwarding to access host-internal servicesArista Networks DANZ Monitoring Fabric
- CVE-2025-54545On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.Arista Networks DANZ Monitoring Fabric
- CVE-2025-58188Panic when validating certificates with DSA public keys in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2025-61723Quadratic complexity when parsing some invalid inputs in encoding/pemGo standard library encoding/pem · stdlib
- CVE-2025-58187Quadratic complexity when checking name constraints in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2025-61725Excessive CPU consumption in ParseAddress in net/mailGo standard library net/mail · stdlib
- CVE-2025-54459Vertikal Systems Hospital Manager Backend Services Exposure of Sensitive System Information to an Unauthorized Control SphereVertikal Systems Hospital Manager Backend Services
- CVE-2025-10934GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-11465Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-11464Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-11463Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-11200MLflow Weak Password Requirements Authentication Bypass VulnerabilityMLflow
- CVE-2025-11201MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution VulnerabilityMLflow
- CVE-2025-9870Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation VulnerabilityRazer Synapse
- CVE-2025-9871Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation VulnerabilityRazer Synapse
- CVE-2025-9869Razer Synapse 3 Macro Module Link Following Local Privilege Escalation VulnerabilityRazer Synapse
- CVE-2025-10925GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-10924GIMP FF File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-10923GIMP WBMP File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-10922GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-10921GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-10920GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityGIMP
- CVE-2025-64104LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStorelangchain-ai langgraph · langgraph-checkpoint-sqlite
- CVE-2025-64103Zitadel Bypass Second Authentication Factorzitadel · github.com/zitadel/zitadel +1
- CVE-2025-64102Zitadel allows brute-forcing authentication factorszitadel · github.com/zitadel/zitadel/v2 +1
- CVE-2025-64101ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injectionzitadel · github.com/zitadel/zitadel/v2 +1
- CVE-2025-11232Invalid characters cause assertISC Kea
- CVE-2025-62797CSRF in FluxCP account endpoints allows account takeover / state-changing actionsrathena FluxCP
- CVE-2024-14012Potential Privilege Escalation in Revenera InstallShield 2023 R1Revenera InstallShield
- CVE-2025-10932AS2 module allows uncontrolled file uploadsProgress MOVEit Transfer
- CVE-2023-7324scsi: ses: Fix possible addl_desc_ptr out-of-bounds accessesLinux
- CVE-2025-40084ksmbd: transport_ipc: validate payload size before reading handleLinux
- CVE-2025-64140Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with IteJenkins Project Jenkins Azure CLI Plugin · org.jenkins-ci.p…
- CVE-2025-64134Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevJenkins Project Jenkins JDepend Plugin · org.jenkins-ci.plu…
- CVE-2025-64131Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about Jenkins Project Jenkins SAML Plugin · org.jenkins-ci.plugin…
- CVE-2025-64284WordPress Majestic Support plugin <= 1.0.7 - Local File Inclusion vulnerabilityMajestic Support
- CVE-2025-64216WordPress SmartMag theme <= 10.3.0 - Local File Inclusion vulnerabilityThemeSphere SmartMag
- CVE-2025-64195WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerabilityThimPress Eduma
- CVE-2025-60075WordPress hpb seo plugin for WordPress plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) vulnerabilityAllegro Marketing hpb seo plugin for WordPress
- CVE-2025-11702Missing Authorization in GitLabGitLab
- CVE-2025-62776The installer of WTW EAGLE (for Windows) 3.0.8.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic LiWireless Tsukamoto Co. WTW EAGLE
- CVE-2025-57227An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted ex
- CVE-2025-60595SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.
- CVE-2025-61156Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arb
- CVE-2025-61161DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search pa
- CVE-2025-61234Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentica
- CVE-2025-61429An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request.
Medium, low and unrated 100
- CVE-2025-62257Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 throLiferay Portal · Liferay DXP +1
- CVE-2025-12083CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113Drupal CivicTheme Design System · drupal/civictheme
- CVE-2025-10929Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111Drupal Reverse Proxy Header · drupal/reverse_proxy_header
- CVE-2025-10930Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110Drupal Currency · drupal/currency
- CVE-2025-10931Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109Drupal Umami Analytics · drupal/umami_analytics
- CVE-2025-10928Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108Drupal Access code · drupal/access_code
- CVE-2025-10927Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107Drupal Plausible tracking · drupal/plausible_tracking
- CVE-2025-10926JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106Drupal JSON Field · drupal/json_field
- CVE-2025-54549Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISOArista Networks DANZ Monitoring Fabric
- CVE-2025-54548On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)Arista Networks DANZ Monitoring Fabric
- CVE-2025-54547On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expiredArista Networks DANZ Monitoring Fabric
- CVE-2025-61724Excessive CPU consumption in Reader.ReadResponse in net/textprotoGo standard library net/textproto · stdlib
- CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tarGo standard library archive/tar · stdlib
- CVE-2025-58186Lack of limit when parsing cookies can cause memory exhaustion in net/httpGo standard library net/http · stdlib
- CVE-2025-58185Parsing DER payload can cause memory exhaustion in encoding/asn1Go standard library encoding/asn1 · stdlib
- CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/urlGo standard library net/url · stdlib
- CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2025-61959Vertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive InformationVertikal Systems Hospital Manager Backend Services
- CVE-2025-11466Allegra DatabaseBackupBL Directory Traversal Information Disclosure VulnerabilityAllegra
- CVE-2025-11203LiteLLM Information health API_KEY Information Disclosure VulnerabilityLiteLLM
- CVE-2025-64100CKAN Vulnerable to Session Cookie Fixationckan
- CVE-2025-1549WatchGuard Mobile VPN with SSL Local Privilege EscallationWatchGuard Mobile VPN with SSL Client
- CVE-2025-62792Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_matchwazuh
- CVE-2025-62791Wazuh vulnerable to NULL pointer dereference in DecodeCiscatwazuh
- CVE-2025-62790Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_statewazuh
- CVE-2025-62789Wazuh vulnerable to NULL pointer dereference in fim_alert line 712wazuh
- CVE-2025-62788Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_logwazuh
- CVE-2025-62787Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevtwazuh
- CVE-2025-62786Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissionswazuh
- CVE-2025-62785Wazuh fillData NULL pointer dereference causes analysisd crashwazuh
- CVE-2025-12148Unauthorized access to fields protected by Field Masking (FM) for fields of type IPfloragunn Search Guard FLX
- CVE-2025-12147Unauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an objectfloragunn Search Guard FLX
- CVE-2025-54384CKAN stored XSS vulnerability in Markdown description fieldsckan
- CVE-2024-58269Rancher exposes sensitive information through audit logsSUSE rancher · github.com/rancher/rancher
- CVE-2023-32199Rancher user retains access to clusters despite Global Role removalSUSE rancher · github.com/rancher/rancher
- CVE-2025-40085ALSA: usb-audio: Fix NULL pointer deference in try_to_register_cardLinux
- CVE-2025-40083net/sched: sch_qfq: Fix null-deref in agg_dequeueLinux
- CVE-2025-64150A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect tJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64149A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an aJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64148A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerateJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64147Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackeJenkins Project Jenkins Curseforge Publisher Plugin · org.j…
- CVE-2025-64146Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewJenkins Project Jenkins Curseforge Publisher Plugin · org.j…
- CVE-2025-64145Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for atJenkins Project Jenkins ByteGuard Build Actions Plugin · io…
- CVE-2025-64144Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can beJenkins Project Jenkins ByteGuard Build Actions Plugin · io…
- CVE-2025-64143Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controllJenkins Project Jenkins OpenShift Pipeline Plugin · com.ope…
- CVE-2025-64142A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect toJenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…
- CVE-2025-64141A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an atJenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…
- CVE-2025-64139A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connJenkins Project Jenkins Start Windocks Containers Plugin ·…
- CVE-2025-64138A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect toJenkins Project Jenkins Start Windocks Containers Plugin ·…
- CVE-2025-64137A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attackeJenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…
- CVE-2025-64136A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specJenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…
- CVE-2025-64135Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` Jenkins Project Jenkins Eggplant Runner Plugin · io.jenkins…
- CVE-2025-64133A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackeJenkins Project Jenkins Extensible Choice Parameter Plugin…
- CVE-2025-64132Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trJenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…
- CVE-2025-11587Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Updatejgrietveld Call Now Button – The #1 Click to Call Button fo…
- CVE-2025-11632Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functionsjgrietveld Call Now Button – The #1 Click to Call Button fo…
- CVE-2025-12142BSS(Block Started by Symbol) Memory Corruption VulnerabilityABB Terra AC wallbox
- CVE-2025-12461Unprotected access to parts of the application in Epsilon RH by Grupo CastillaGrupo Castilla Epsilon RH
- CVE-2015-10147Easy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injectionnik00726 Easy Testimonial Slider and Form
- CVE-2025-12450LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scriptinglitespeedtech LiteSpeed Cache
- CVE-2015-10146Thumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injectionnik00726 Thumbnail Slider With Lightbox
- CVE-2025-12058Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRFKeras
- CVE-2025-64291WordPress Premmerce User Roles plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityPremmerce User Roles
- CVE-2025-64290WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerabilityPremmerce Product Search for WooCommerce
- CVE-2025-64289WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityPremmerce Product Search for WooCommerce
- CVE-2025-64288WordPress Premmerce plugin <= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerabilityPremmerce
- CVE-2025-64286WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityWpEstate WP Rentals
- CVE-2025-64285WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerabilityPremmerce Wholesale Pricing for WooCommerce
- CVE-2025-64283WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerabilityRometheme RTMKit
- CVE-2025-64234WordPress Evergreen Content Poster plugin <= 1.4.5 - Broken Access Control vulnerabilityEvergreen Content Poster
- CVE-2025-64229WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2025-64228WordPress SUMO Affiliates Pro plugin <= 11.0.0 - Sensitive Data Exposure vulnerabilityFantasticPlugins SUMO Affiliates Pro
- CVE-2025-64226WordPress Stockie Extra plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) vulnerabilitycolabrio Stockie Extra
- CVE-2025-64220WordPress Rey Core plugin <= 3.1.8 - Cross Site Scripting (XSS) vulnerabilityReyCommerce Rey Core
- CVE-2025-64219WordPress Business Directory plugin <= 6.4.18 - Broken Access Control vulnerabilityStrategy11 Team Business Directory
- CVE-2025-64212WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerabilityStylemixThemes MasterStudy LMS Pro
- CVE-2025-64211WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerabilityStylemixThemes Masterstudy Elementor Widgets
- CVE-2025-64210WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerabilityStylemixThemes Masterstudy Elementor Widgets
- CVE-2025-64208WordPress Jannah - Extensions plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityTieLabs Jannah - Extensions
- CVE-2025-64204WordPress SmartMag theme <= 10.3.1 - Cross Site Scripting (XSS) vulnerabilityThemeSphere SmartMag
- CVE-2025-64202WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerabilityTieLabs Sahifa
- CVE-2025-64201WordPress PowerPress Podcasting plugin <= 11.13.12 - Cross Site Request Forgery (CSRF) vulnerabilityblubrry PowerPress Podcasting
- CVE-2025-64200WordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerabilityVillaTheme Email Template Customizer for WooCommerce
- CVE-2025-64199WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerabilityWpEstate wpresidence
- CVE-2025-64197WordPress Rehub theme < 19.9.9.1 - Cross Site Scripting (XSS) vulnerabilitysizam Rehub
- CVE-2025-64194WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerabilityThimPress Eduma
- CVE-2025-58939WordPress Super Store Finder plugin <= 7.5 - Cross Site Request Forgery (CSRF) vulnerabilityhighwarden Super Store Finder
- CVE-2025-58711WordPress Blog Designer PRO plugin <= 3.4.8 - Broken Access Control vulnerabilitysolwin Blog Designer PRO
- CVE-2023-7320WooCommerce <= 7.8.2 - Sensitive Information Exposureautomattic WooCommerce
- CVE-2025-9544Doppler Forms <= 2.5.1 - Subscriber+ Limited Plugin InstallationDoppler Forms
- CVE-2025-49042WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
- CVE-2025-11705Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Readscheeeli Anti-Malware Security and Brute-Force Firewall
- CVE-2025-64296WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerabilityFacebook for WooCommerce
- CVE-2025-57931WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerabilityAys Pro Popup box
- CVE-2024-45161A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507.
- CVE-2025-56558The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_Dyson MQTT server
- CVE-2025-60320memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101).
- CVE-2025-60542SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call utypeorm
- CVE-2025-60898An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attac
- CVE-2025-61876Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with