CVEs published November 12, 2025
212 CVEs were published on November 12, 2025: 14 critical, 85 high.
- Published
- 212
- Critical
- 14
- High
- 85
- Medium
- 50
- Low
- 8
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 90
Most affected products
- Linux
- 96
- Apache Software Foundation Apache OpenOffice
- 7
- N-able N-central
- 4
- aEnrich a+HRD
- 3
- Dell SmartFabric OS10 Software
- 3
- Schneider Electric PowerChute™ Serial Shutdown
- 3
- Apache Software Foundation Apache OFBiz
- 2
- Autodesk 3ds Max
- 2
- code-projects Responsive Hotel Site
- 2
- Enalean tuleap
- 2
Critical 14
- CVE-2021-4464FIberHome AN5506-04-FA / HG6245D Routers Remote Stack OverflowFiberHome AN5506-04-FA · FiberHome HG6245D
- CVE-2025-46608Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability.Dell Data Lakehouse
- CVE-2025-11367N-central windows software probe Remote Code ExecutionN-able N-central
- CVE-2025-11366N-central Authentication bypass via path traversalN-able N-central
- CVE-2025-40176tls: wait for pending async decryptions if tls_strp_msg_hold failsLinux
- CVE-2025-12871aEnrich｜a+HRD - Authentication AbuseaEnrich a+HRD
- CVE-2025-12870aEnrich｜eHRD - Authentication AbuseaEnrich a+HRD
- CVE-2025-56385A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint.
- CVE-2025-63289Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryp
- CVE-2025-63353A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be pre
- CVE-2025-63666Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-en
- CVE-2025-63679free5gc v4.1.0 and before is vulnerable to Buffer Overflow.
- CVE-2025-64280A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
- CVE-2025-64281An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin creden
High 85
- CVE-2025-64523FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Functionfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2022-4982DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFIDBL Technology (DBLTek) GoIP-1
- CVE-2023-7326Epson Stylus SX510W Printer Remote Power Off DoSSeiko Epson Epson Stylus SX510W
- CVE-2016-15055JVC VN-T IP-Camera Directory Traversal via check.cgiJVC (JVCKENWOOD) IP-Camera
- CVE-2021-4463Longjing Technology BEMS API <= 1.21 Remote Arbitrary File DownloadShenzhen Longjing Technology Co. BEMS API
- CVE-2023-7327Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File ReadOzeki SMS Gateway
- CVE-2023-7329Tinycontrol LAN Controller v3 (LK3) Remote DoStinycontrol Lan Controller
- CVE-2017-20211UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCEUCanCode.Net Software E-XD++ Visualization Enterprise Suite
- CVE-2025-40206netfilter: nft_objref: validate objref and objrefmap expressionsLinux
- CVE-2025-40205btrfs: avoid potential out-of-bounds in btrfs_encode_fh()Linux
- CVE-2025-40204sctp: Fix MAC comparison to be constant-timeLinux
- CVE-2025-40203listmount: don't call path_put() under namespace semaphoreLinux
- CVE-2025-40202ipmi: Rework user message limit handlingLinux
- CVE-2025-40201kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() pathsLinux
- CVE-2025-40199page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit archesLinux
- CVE-2025-40198ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()Linux
- CVE-2025-40190ext4: guard against EA inode refcount underflow in xattr updateLinux
- CVE-2025-40187net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()Linux
- CVE-2025-40186tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().Linux
- CVE-2025-40183bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Linux
- CVE-2025-40182crypto: skcipher - Fix reqsize handlingLinux
- CVE-2025-64500Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypasssymfony · symfony/http-foundation +1
- CVE-2025-64186Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclavesevervault-go · github.com/evervault/evervault-go
- CVE-2025-46427Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommaDell SmartFabric OS10 Software
- CVE-2025-46428Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommDell SmartFabric OS10 Software
- CVE-2025-12048An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allowLenovo Scanner Pro
- CVE-2025-10495A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applicationLenovo App Store · Lenovo PC Manager +2
- CVE-2025-8485An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevLenovo App Store
- CVE-2025-64099OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_infoOpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2025-61667Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsdatadog-agent
- CVE-2024-47866RGW DoS attack with empty HTTP header in S3 object copyceph
- CVE-2025-13042Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2025-2843Observability-operator: observability operator privilege escalationrhobs observability-operator · Red Hat Cluster Observabi… +1
- CVE-2025-59088Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvlatchset kdcproxy · Red Hat Enterprise Linux
- CVE-2025-11797DWG File Parsing Use-After-Free VulnerabilityAutodesk 3ds Max
- CVE-2025-11795JPG File Parsing Out-of-Bounds Write VulnerabilityAutodesk 3ds Max
- CVE-2025-64293WordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerabilityGolemiq 0 Day Analytics
- CVE-2025-11700N-central Multiple XXE Injection VulnerabilitiesN-able N-central
- CVE-2025-11567CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nSchneider Electric PowerChute™ Serial Shutdown
- CVE-2025-11565CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated systemSchneider Electric PowerChute™ Serial Shutdown
- CVE-2025-12998Broken Authentication in extension “Modules” (modules)TYPO3 Extension "Modules" · codingms/modules
- CVE-2025-11994Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scriptingyudiz Easy Email Subscription
- CVE-2025-40174x86/mm: Fix SMP ordering in switch_mm_irqs_off()Linux
- CVE-2025-40173net/ip6_tunnel: Prevent perpetual tunnel growthLinux
- CVE-2025-40172accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()Linux
- CVE-2025-40171nvmet-fc: move lsop put work to nvmet_fc_ls_req_opLinux
- CVE-2025-40170net: use dst_dev_rcu() in sk_setup_caps()Linux
- CVE-2025-40169bpf: Reject negative offsets for ALU opsLinux
- CVE-2025-40168smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().Linux
- CVE-2025-40167ext4: detect invalid INLINE_DATA + EXTENTS flag combinationLinux
- CVE-2025-40166drm/xe/guc: Check GuC running state before deregistering exec queueLinux
- CVE-2025-40165media: nxp: imx8-isi: m2m: Fix streaming cleanup on releaseLinux
- CVE-2025-40159xsk: Harden userspace-supplied xdp_desc validationLinux
- CVE-2025-40158ipv6: use RCU in ip6_output()Linux
- CVE-2025-40155iommu/vt-d: debugfs: Fix legacy mode page table dump logicLinux
- CVE-2025-40151LoongArch: BPF: No support of struct argument in trampoline programsLinux
- CVE-2025-40149tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().Linux
- CVE-2025-40141Bluetooth: ISO: Fix possible UAF on iso_conn_freeLinux
- CVE-2025-40140net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicastLinux
- CVE-2025-40139smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().Linux
- CVE-2025-40135ipv6: use RCU in ip6_xmit()Linux
- CVE-2025-40133mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().Linux
- CVE-2025-40129sunrpc: fix null pointer dereference on zero-length checksumLinux
- CVE-2025-40124sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC IIILinux
- CVE-2025-40123bpf: Enforce expected_attach_type for tailcall compatibilityLinux
- CVE-2025-40118scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmodLinux
- CVE-2025-40117misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()Linux
- CVE-2025-40112sparc: fix accurate exception reporting in copy_{from_to}_user for NiagaraLinux
- CVE-2025-12382Path Traversal Allows Remote Code Execution in AlgoSec Firewall AnalyzerAlgoSec Firewall Analyzer
- CVE-2025-59118Apache OFBiz: Critical Remote Command Execution via Unrestricted File UploadApache Software Foundation Apache OFBiz
- CVE-2025-11962Stored XSS in DivvyDrive Information Technologies' Digital Corporate WarehouseDivvyDrive Information Technologies Digital Corporate Wareh…
- CVE-2025-64405Apache OpenOffice: Remote documents loaded without prompt via DDE functionApache Software Foundation Apache OpenOffice
- CVE-2025-64404Apache OpenOffice: Remote documents loaded without prompt via background and bullet imagesApache Software Foundation Apache OpenOffice
- CVE-2025-64403Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in CalcApache Software Foundation Apache OpenOffice
- CVE-2025-64401Apache OpenOffice: Remote documents loaded without prompt via IFrameApache Software Foundation Apache OpenOffice
- CVE-2025-12903Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraudpaymentplugins Payment Plugins Braintree For WooCommerce
- CVE-2025-12633Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connectionstellarwp Bookit — Booking & Appointment Calendar
- CVE-2025-11560Team Members Showcase < 3.5.0 - Reflected XSSTeam Members Showcase
- CVE-2025-40111drm/vmwgfx: Fix Use-after-free in validationLinux
- CVE-2025-57310A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allo
- CVE-2025-63667Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensiti
- CVE-2025-63811An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Wegithub.com/dvsekhvalnov/jose2go
- CVE-2025-63929A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08).
- CVE-2025-65001Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.Fujitsu fbiosdrv.sys
- CVE-2025-65002Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.Fujitsu / Fsas Technologies iRMC
Medium, low and unrated 113
- CVE-2025-13076code-projects Responsive Hotel Site usersetting.php sql injectioncode-projects Responsive Hotel Site
- CVE-2025-13075code-projects Responsive Hotel Site usersettingdel.php sql injectioncode-projects Responsive Hotel Site
- CVE-2025-64707Frappe LMS revoking access did not show immediate effect as roles were cachedfrappe lms
- CVE-2025-64705Frappe user was able to access the submission of other studentsfrappe lms
- CVE-2011-10034IRAI AUTOMGEN <= 8.0.0.7 Use-After-Free Remote DoSIRAI AUTOMGEN
- CVE-2025-64517sudo-rs doesn't record authenticating user properly in timestamptrifectatechfoundation sudo-rs · sudo-rs
- CVE-2022-4983TEC-IT TBarCode SDK 11.15 Remote File CreateTEC-IT Datenverarbeitung GmbH, Austria TEC-IT TBarCode
- CVE-2025-64503[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftorasterOpenPrinting cups-filters
- CVE-2025-40208media: iris: fix module removal if firmware download failedLinux
- CVE-2025-40207media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()Linux
- CVE-2025-40200Squashfs: reject negative file sizes in squashfs_read_inode()Linux
- CVE-2025-40197media: mc: Clear minor number before put deviceLinux
- CVE-2025-40196fs: quota: create dedicated workqueue for quota_release_workLinux
- CVE-2025-40195mount: handle NULL values in mnt_ns_release()Linux
- CVE-2025-40194cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()Linux
- CVE-2025-40193xtensa: simdisk: add input size check in proc_write_simdiskLinux
- CVE-2025-40192Revert "ipmi: fix msg stack when IPMI is disconnected"Linux
- CVE-2025-40191drm/amdkfd: Fix kfd process ref leaking when userptr unmappingLinux
- CVE-2025-40189net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eepromLinux
- CVE-2025-40188pwm: berlin: Fix wrong register in suspend/resumeLinux
- CVE-2025-40185ice: ice_adapter: release xa entry on adapter allocation failureLinux
- CVE-2025-40184KVM: arm64: Fix debug checking for np-guests using huge mappingsLinux
- CVE-2025-40181x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNPLinux
- CVE-2025-40180mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loopLinux
- CVE-2025-40179ext4: verify orphan file size is not too bigLinux
- CVE-2025-40178pid: Add a judgment for ns null in pid_nr_nsLinux
- CVE-2025-64482Tuleap missing CSRF protections in the File Release SystemEnalean tuleap
- CVE-2025-64429DuckDB Encryption Crypto implementation is vulnerableduckdb
- CVE-2025-64345Wasmtime provides unsound API access to a WebAssembly shared linear memorybytecodealliance wasmtime · wasmtime
- CVE-2025-33119IBM QRadar SIEM Information DisclosureIBM QRadar Security Information and Event Management
- CVE-2025-36223IBM OpenPages Host Header InjectionIBM OpenPages
- CVE-2025-13063DinukaNavaratna Dee Store authorizationDinukaNavaratna Dee Store
- CVE-2025-13061itsourcecode Online Voting System index.php unrestricted uploaditsourcecode Online Voting System
- CVE-2025-64170sudo-rs: Partial password reveal is possible after timeouttrifectatechfoundation sudo-rs · sudo-rs
- CVE-2025-13060SourceCodester Survey Application System view_survey.php sql injectionSourceCodester Survey Application System
- CVE-2025-13059SourceCodester Alumni Management System manage_career.php sql injectionSourceCodester Alumni Management System
- CVE-2024-48829Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerabiliDell SmartFabric OS10 Software
- CVE-2025-13058soerennb eXtplorer Filename cross site scriptingsoerennb eXtplorer
- CVE-2025-12047A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances,Lenovo Scanner Pro
- CVE-2025-8421An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could aLenovo Dock Manager
- CVE-2025-64117Tuleap missing CSRF protection in the management of SVN commit rules and immutable tagsEnalean tuleap
- CVE-2025-27368IBM OpenPages Information DisclosureIBM OpenPages
- CVE-2025-57812[BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`OpenPrinting libcupsfilters
- CVE-2025-13057Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2024-45301ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerabilitymintty
- CVE-2025-25236Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.Omnissa Workspace ONE UEM
- CVE-2025-20379Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20378Open Redirect on Web Login endpoint in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-59089Python-kdcproxy: remote dos via unbounded tcp upstream bufferinglatchset kdcproxy · Red Hat Enterprise Linux
- CVE-2025-9316N-central unauthenticated sessionID generationN-able N-central
- CVE-2025-11566CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network toSchneider Electric PowerChute™ Serial Shutdown
- CVE-2025-62876A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affeopenSUSE
- CVE-2025-11454Specific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injectiongiuse Specific Content For Mobile – Customize the mobile
- CVE-2025-40177accel/qaic: Fix bootlog initialization orderingLinux
- CVE-2025-40175idpf: cleanup remaining SKBs in PTP flowsLinux
- CVE-2025-40164usbnet: Fix using smp_processor_id() in preemptible code warningsLinux
- CVE-2025-40163sched/deadline: Stop dl_server before CPU goes offlineLinux
- CVE-2025-40162ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() failsLinux
- CVE-2025-40161mailbox: zynqmp-ipi: Fix SGI cleanup on unbindLinux
- CVE-2025-40160xen/events: Return -EEXIST for bound VIRQsLinux
- CVE-2025-40157EDAC/i10nm: Skip DIMM enumeration on a disabled memory controllerLinux
- CVE-2025-40156PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()Linux
- CVE-2025-40154ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mappingLinux
- CVE-2025-40153mm: hugetlb: avoid soft lockup when mprotect to large memory areaLinux
- CVE-2025-40152drm/msm: Fix bootup splat with separate_gpu_drm modparamLinux
- CVE-2025-40150f2fs: fix to avoid migrating empty sectionLinux
- CVE-2025-40148drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functionsLinux
- CVE-2025-40147blk-throttle: fix access race during throttle policy activationLinux
- CVE-2025-40146blk-mq: fix potential deadlock while nr_requests grownLinux
- CVE-2025-40145PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failureLinux
- CVE-2025-40143bpf: dont report verifier bug for missing bpf_scc_visit on speculative pathLinux
- CVE-2025-40142ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RTLinux
- CVE-2025-40138f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()Linux
- CVE-2025-40137f2fs: fix to truncate first page in error path of f2fs_truncate()Linux
- CVE-2025-40136crypto: hisilicon/qm - request reserved interrupt for virtual functionLinux
- CVE-2025-40134dm: fix NULL pointer dereference in __dm_suspend()Linux
- CVE-2025-40132ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callbackLinux
- CVE-2025-40131wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()Linux
- CVE-2025-40130scsi: ufs: core: Fix data race in CPU latency PM QoS request handlingLinux
- CVE-2025-40127hwrng: ks-sa - fix division by zero in ks_sa_rng_initLinux
- CVE-2025-40126sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARCLinux
- CVE-2025-40125blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctxLinux
- CVE-2025-40122perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access errorLinux
- CVE-2025-40121ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mappingLinux
- CVE-2025-40120net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlockLinux
- CVE-2025-40119ext4: fix potential null deref in ext4_mb_init()Linux
- CVE-2025-40116usb: host: max3421-hcd: Fix error pointer dereference in probe cleanupLinux
- CVE-2025-40115scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()Linux
- CVE-2025-40113remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1ELinux
- CVE-2025-37734Kibana Origin Validation ErrorElastic Kibana
- CVE-2025-61623Apache OFBiz: Reflected Cross-site ScriptingApache Software Foundation Apache OFBiz
- CVE-2025-64407Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variablesApache Software Foundation Apache OpenOffice
- CVE-2025-64406Apache OpenOffice: Possible memory corruption during CSV importApache Software Foundation Apache OpenOffice
- CVE-2025-64402Apache OpenOffice: Remote documents loaded without prompt via OLE objectsApache Software Foundation Apache OpenOffice
- CVE-2025-12732WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposuresmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-12872aEnrich｜eHRD - Stored Cross-Site ScriptingaEnrich a+HRD · aEnrich a+HCM
- CVE-2025-12869aEnrich｜eHRD - Stored Cross-Site ScriptingaEnrich a+HRD
- CVE-2025-12018MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scriptingsourcefound MembershipWorks – Membership, Events & Directory
- CVE-2025-12113Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletionwebtoffee Alt Text Generator AI – Auto Generate & Bulk Upda…
- CVE-2025-12901Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings UpdateAsgaros Forum
- CVE-2025-12833GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachmentpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2025-12087Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletionacowebs Wishlist and Save for later for Woocommerce
- CVE-2025-54983Health check port on ZCC allows tunnel bypassZscaler Client Connector
- CVE-2025-40110drm/vmwgfx: Fix a null-ptr access in the cursor snooperLinux
- CVE-2025-43205An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-52331Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user infor
- CVE-2025-59491Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.
- CVE-2025-60645A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET r
- CVE-2025-60646A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or H
- CVE-2025-63396An issue was discovered in PyTorch v2.5 and v2.7.1.torch
- CVE-2025-63419Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48.
- CVE-2025-63645A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system.
- CVE-2025-63927A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08).