CVEs published November 18, 2025
182 CVEs were published on November 18, 2025: 17 critical, 42 high. 1 is now in CISA KEV.
- Published
- 182
- Critical
- 17
- High
- 42
- Medium
- 112
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 50
Most affected products
- JCD Windu CMS
- 8
- GNU grub2 · Red Hat Enterprise Linux +1
- 6
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- 5
- Informatica del Este WinPlus
- 5
- METZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- 5
- Drupal core · drupal/core
- 4
- SourceCodester Train Station Ticketing System
- 4
- Checkmk
- 3
- Fortinet FortiClientWindows
- 3
- librenms · librenms/librenms
- 3
Critical 17
- CVE-2025-65015joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloadsauthlib joserfc · joserfc
- CVE-2025-12383Race Condition allows Bypass of Trust RestrictionsEclipse Foundation Jersey · org.glassfish.jersey.core:jerse…
- CVE-2025-9312Improper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsWSO2 API Manager · WSO2 API Control Plane +8
- CVE-2025-41734Unauthenticated Local File Inclusion in php moduleMETZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- CVE-2025-41733Possible malfunction credential injectionMETZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- CVE-2025-41346Stored Cross-Site Scripting (XSS) in WinPlus by Informática del EsteInformatica del Este WinPlus
- CVE-2025-40549SolarWinds Serv-U Path Restriction Bypass VulnerabilitySolarWinds Serv-U
- CVE-2025-40548SolarWinds Serv-U Broken Access Control - Remote Code Execution VulnerabilitySolarWinds Serv-U
- CVE-2025-40547SolarWinds Serv-U Logic Abuse - Remote Code Execution VulnerabilitySolarWinds Serv-U
- CVE-2025-54321In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerabi
- CVE-2025-56643Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out.
- CVE-2025-63216The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices.
- CVE-2025-63217The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices.
- CVE-2025-63225The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on crit
- CVE-2025-63228The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /
- CVE-2025-63694DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
- CVE-2025-63695DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
High 42
- CVE-2025-64325Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin DashboardEmbySupport Emby.Security
- CVE-2025-62406Piwigo is vulnerable to one-click account takeover by modifying the password-reset linkPiwigo
- CVE-2025-64324KubeVirt Vulnerable to Arbitrary Host File Read and Writekubevirt · kubevirt.io/kubevirt
- CVE-2025-37161Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in Web Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking 100 S…
- CVE-2025-37163Authenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLIHewlett Packard Enterprise (HPE) HPE Aruba Networking Manag…
- CVE-2025-37155Authenticated Privilege Escalation Allows Unauthorized Access in Network Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- CVE-2025-61662Grub2: missing unregister call for gettext command may lead to use-after-freeGNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-46373A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.Fortinet FortiClientWindows
- CVE-2025-58692An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiVoice
- CVE-2025-47761An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, Fortinet FortiClientWindows
- CVE-2025-33184NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue.NVIDIA Isaac-GR00T N1.5
- CVE-2025-33183NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue.NVIDIA Isaac-GR00T N1.5
- CVE-2025-34324GoSign Desktop < 2.4.1 Insecure Update Mechanism RCETinexta InfoCert S.p.A. GoSign Desktop
- CVE-2025-6670Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesWSO2 Open Banking AM · WSO2 Open Banking IAM +7
- CVE-2025-41348Stored Cross-Site Scripting (XSS) in WinPlus by Informática del EsteInformatica del Este WinPlus
- CVE-2025-41347Stored Cross-Site Scripting (XSS) in WinPlus by Informática del EsteInformatica del Este WinPlus
- CVE-2025-41737Improper access control via php endpointMETZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- CVE-2025-41736Possible arbitrary code executionMETZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- CVE-2025-41735Possible arbitrary file uploadMETZ CONNECT Energy-Controlling EWIO2-M · METZ CONNECT E… +1
- CVE-2025-13069Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypassideastocode Enable SVG, WebP, and ICO Upload
- CVE-2025-12955Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposurerajeshsingh520 PiWeb Live sales notification for WooCommerce
- CVE-2025-4212Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scriptingwpwham Checkout Files Upload for WooCommerce
- CVE-2025-13088Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusionikhodal Category and Product Woocommerce Tabs
- CVE-2025-12775WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Uploadnazsabuz WP Dropzone
- CVE-2025-12528Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Uploadgenetechproducts Pie Forms — Drag & Drop Form Builder
- CVE-2025-11620Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalationjemoreto Multiple Roles per User
- CVE-2025-12411Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL InjectionPremmerce Wholesale Pricing for WooCommerce
- CVE-2025-8727A stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).SMCI X13SEDW-F
- CVE-2025-10089Malicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.SMitsubishi Electric MILCO.S Setting Application · Mitsub… +1
- CVE-2025-8076A stack buffer overflow vulnerability exists in the Supermicro BMC Web functionSMCI MBD-X13SEDW-F
- CVE-2025-48593In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free.Google Android
- CVE-2025-12974Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked UploadGravity Forms
- CVE-2025-8693A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earliZyxel DX3300-T0 firmware
- CVE-2025-55796The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup con
- CVE-2025-56527Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.
- CVE-2025-60455Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature imax · modular
- CVE-2025-63215The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.
- CVE-2025-63227The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /pat
- CVE-2025-63602A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) a
- CVE-2025-63800The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing
- CVE-2025-63955A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an at
- CVE-2025-64076Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (sourcbor2
Medium, low and unrated 123
- CVE-2025-65093LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpointlibrenms · librenms/librenms
- CVE-2025-65014LibreNMS has Weak Password Policylibrenms · librenms/librenms
- CVE-2025-65013LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`librenms · librenms/librenms
- CVE-2025-65012Kirby CMS has cross-site scripting (XSS) in the changes dialoggetkirby kirby · getkirby/cms
- CVE-2025-64515Open Forms prefill data in read-only components can be tamperedopen-formulieren open-forms
- CVE-2025-54990XWiki AdminTools application doesn't set permissions on the AdminTools spacexwikisas application-admintools · com.xwiki.admintools:appl…
- CVE-2025-12119Bulk write with options may read invalid memoryMongoDB C Driver · MongoDB PHP Driver +1
- CVE-2025-37162Authenticated Command Injection Vulnerability Leading to Arbitrary Remote Command ExecutionHewlett Packard Enterprise (HPE) HPE Aruba Networking 100 S…
- CVE-2025-52639HCL Connections is vulnerable to sensitive information disclosureHCL Software Connections
- CVE-2025-37160Authenticated Broken Access Control (BAC) in REST API Configuration ServiceHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- CVE-2025-37159Authenticated Session Hijacking Allows Unauthorized Access in Network Switching SoftwareHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- CVE-2025-37158Authenticated Command Injection allows Unauthorized Command Execution in AOS-CXHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- CVE-2025-37157Authenticated Command Injection allows Unauthorized Command Execution in AOS-CXHewlett Packard Enterprise (HPE) HPE Aruba Networkign AOS-CX
- CVE-2025-37156ArubaOS-CX Platform-Level Denial-of-Service VulnerabilityHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX
- CVE-2025-54770Grub2: use-after-free in net_set_vlanGNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-61664Grub2: missing unregister call for normal_exit command may lead to use-after-freeGNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-61663Grub2: missing unregister call for normal commands may lead to use-after-freeGNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-61661Grub2: grub2: out-of-bounds write via malicious usb deviceGNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-54771Grub2: use-after-free in grub_file_close()GNU grub2 · Red Hat Enterprise Linux +1
- CVE-2025-53843A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, Fortinet FortiOS
- CVE-2025-48839An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versioFortinet FortiADC
- CVE-2025-54821An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11Fortinet FortiOS · Fortinet FortiProxy +1
- CVE-2025-58413A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, Fortinet FortiOS · Fortinet FortiSASE
- CVE-2025-46215An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 throuFortinet FortiSandbox
- CVE-2025-59669A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0Fortinet FortiWeb
- CVE-2025-54660An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWFortinet FortiClientWindows
- CVE-2025-61713A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPFortinet FortiPAM
- CVE-2025-46776A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiEFortinet FortiExtender
- CVE-2025-46775A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through Fortinet FortiExtender
- CVE-2025-54971An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC Fortinet FortiADC
- CVE-2025-54972An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 thrFortinet FortiMail
- CVE-2025-58034An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiWeb
- CVE-2025-12761Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116Drupal Simple multi step form · drupal/simple_multistep
- CVE-2025-12760Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115Drupal Email TFA · drupal/email_tfa
- CVE-2025-13083Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008Drupal core · drupal/core
- CVE-2025-13082Drupal core - Moderately critical - Defacement - SA-CORE-2025-007Drupal core · drupal/core
- CVE-2025-13081Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006Drupal core · drupal/core
- CVE-2025-13080Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005Drupal core · drupal/core
- CVE-2025-53360pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requestspluginsGLPI databaseinventory
- CVE-2025-9977Improper neutralization of input in Times Software E-PAYROLLTimes Software E-Payroll
- CVE-2025-55074Channel member objects leak read statusMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-58121Insufficient permission validation on multiple REST API endpointsCheckmk
- CVE-2025-58122Insufficient permission validation when configuring notification parametersCheckmk
- CVE-2025-64996Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's outputCheckmk
- CVE-2025-10158Rsync: Out of bounds array access via negative indexrsync
- CVE-2025-13349SourceCodester Student Grades Management System Add New Grade grades.php cross site scriptingSourceCodester Student Grades Management System
- CVE-2025-55179Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApFacebook WhatsApp Business for iOS · Facebook WhatsApp f… +1
- CVE-2025-12545Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposurealekv Pixel Manager for WooCommerce – Conversion Tracking,…
- CVE-2025-12376Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgerybplugins Icon List Block – Add Icon-Based Lists with Custom…
- CVE-2025-59116User enumeration in Windu CMSJCD Windu CMS
- CVE-2025-59111Broken Access Control in Windu CMSJCD Windu CMS
- CVE-2025-59117Multiple Stored XSS in Windu CMSJCD Windu CMS
- CVE-2025-59115Stored XSS in Windu CMSJCD Windu CMS
- CVE-2025-59114Cross-Site Request Forgery in Windu CMSJCD Windu CMS
- CVE-2025-59113Bruteforce Protection Bypass in Windu CMSJCD Windu CMS
- CVE-2025-59112Cross-Site Request Forgery in Windu CMSJCD Windu CMS
- CVE-2025-59110Cross-Site Request Forgery in Windu CMSJCD Windu CMS
- CVE-2025-13347SourceCodester Train Station Ticketing System ajax.php sql injectionSourceCodester Train Station Ticketing System
- CVE-2025-13346SourceCodester Train Station Ticketing System ajax.php sql injectionSourceCodester Train Station Ticketing System
- CVE-2025-8084AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgerytigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2025-13345SourceCodester Train Station Ticketing System ajax.php sql injectionSourceCodester Train Station Ticketing System
- CVE-2025-13344SourceCodester Train Station Ticketing System ajax.php sql injectionSourceCodester Train Station Ticketing System
- CVE-2025-13343SourceCodester Interview Management System editQuestion.php cross site scriptingSourceCodester Interview Management System
- CVE-2025-41350Stored Cross-Site Scripting (XSS) in WinPlus by Informática del EsteInformatica del Este WinPlus
- CVE-2025-41349Stored Cross-Site Scripting (XSS) in WinPlus by Informática del EsteInformatica del Este WinPlus
- CVE-2025-11427WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgerywpengine WP Migrate Lite – Migration Made Easy
- CVE-2025-12391Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Updateseventhqueen Restrictions for BuddyPress
- CVE-2025-12457Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadsideastocode Enable SVG, WebP, and ICO Upload
- CVE-2025-12691Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attributesayontan Photonic Gallery & Lightbox for Flickr, SmugMug &…
- CVE-2025-12639wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosuresundayfanz wModes – Catalog Mode, Product Pricing, Enquiry…
- CVE-2025-12392Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Updatetripleatechnology Cryptocurrency Payment Gateway for WooCom…
- CVE-2025-12088Meta Display Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbhargavbhandari90 Meta Display Block
- CVE-2025-12481WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosureninjateam WP Duplicate Page
- CVE-2025-12079WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessagef1logic WP Twitter Auto Publish
- CVE-2025-13133Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injectionvaniivan Simple User Import Export
- CVE-2025-13196Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2025-11734Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post TrashingBroken Link Checker by AIOSEO – Easily Fix/Monitor Internal…
- CVE-2025-40545SolarWinds Observability Self-Hosted Open Redirection VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2025-26391SolarWinds Observability Self-Hosted XSS VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2025-11868everviz <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingeverviz – Charts, Maps and Tables – Interactive and respons…
- CVE-2025-12078ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessageArtiBot Free Chat Bot for WebSites
- CVE-2025-12406Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingawensley Project Honey Pot Spam Trap
- CVE-2025-12961Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modificationarkadiykilesso Download Panel
- CVE-2025-12372The Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings Update_luigi The Permalinks Cascade
- CVE-2025-8609RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attributerometheme RTMKit
- CVE-2025-12173WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creationwinkm89 WP Admin Microblog
- CVE-2025-12937ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Updatevalentinpellegrin ACF Flexible Layouts Manager
- CVE-2025-8605Gutenify - Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up blockcodeyatri Gutenify – Visual Site Builder Blocks & Site Temp…
- CVE-2025-12827Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Updatedenishua Top Friends
- CVE-2025-12962Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcodewillbontrager Local Syndication
- CVE-2025-12404Like-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingnikolayyordanov Like-it
- CVE-2025-12823CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsscovil CSV to SortTable
- CVE-2025-9625Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgeryinterledger Coil Web Monetization
- CVE-2025-8404Stack buffer overflow vulnerability exists in the Supermicro BMC Shared librarySMCI MBD-X13SEDW-F
- CVE-2025-11265VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingkurudrive VK All in One Expansion Unit
- CVE-2025-11267VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingkurudrive VK All in One Expansion Unit
- CVE-2025-7623Supermicro BMC SMASH services has a Stack-based buffer overflow vulnerabilitySMCI MBD-X13SEDW-F
- CVE-2025-12524Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Changejohnjamesjacoby Post Type Switcher
- CVE-2025-64734Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to peGallagher T21 Reader
- CVE-2025-52578Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker wGallagher High Sec End of Line Module
- CVE-2025-52457Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific Gallagher HBUS Devices
- CVE-2025-6599An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could Zyxel DX3301-T0 firmware
- CVE-2025-12792The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime.Canva
- CVE-2025-13325itsourcecode Student Information System enrollment_edit1.php sql injectionitsourcecode Student Information System
- CVE-2025-13323code-projects Simple Pizza Ordering System listorder.php sql injectioncode-projects Simple Pizza Ordering System
- CVE-2025-54320In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerabilit
- CVE-2025-56499Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated p
- CVE-2025-56526Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.
- CVE-2025-63226The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper ses
- CVE-2025-63229The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability
- CVE-2025-63258A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways
- CVE-2025-63408Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to
- CVE-2025-63512kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic.
- CVE-2025-63513kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functi
- CVE-2025-63514kishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch.php via the email parameter.
- CVE-2025-63603A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_ev
- CVE-2025-63604A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insuffici
- CVE-2025-63693The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable
- CVE-2025-63749pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter.
- CVE-2025-63828Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leadinbackdrop/backdrop
- CVE-2025-63829eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.
- CVE-2025-63883A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce).
- CVE-2025-63892A vulnerability was determined in SourceCodester Student Grades Management System 1.0.