CVEs published November 21, 2025
163 CVEs were published on November 21, 2025: 6 critical, 30 high.
- Published
- 163
- Critical
- 6
- High
- 30
- Medium
- 115
- Low
- 10
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- elextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- 7
- wolfSSL
- 7
- LogStare Collector
- 5
- admintwentytwenty UiPress lite | Effortless custom dashboar…
- 3
- Craig Hewitt Seriously Simple Podcasting
- 3
- Linux
- 3
- vllm-project vllm · vllm
- 3
- wazuh
- 3
- beycanpress Cryptocurrency (Token), Launchpad (Presale), IC…
- 2
- magepeopleteam WpEvently
- 2
Critical 6
- CVE-2025-65108md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front mattersimonhaenisch md-to-pdf · md-to-pdf
- CVE-2025-64767hpke-js reuses AEAD noncesdajiaji hpke-js · @hpke/core
- CVE-2025-41115Incorrect privilege assignmentGrafana Enterprise · github.com/grafana/grafana
- CVE-2025-11127Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege EscalationMstoreapp Mobile App · Mstoreapp Mobile Multivendor
- CVE-2025-11456ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Uploadelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-64310EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts.EPSON WebConfig for SEIKO EPSON Projector Products · Epson…
High 30
- CVE-2025-65947thread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOSjzeuzs thread-amount · thread-amount
- CVE-2025-65946Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation BugRooCodeInc Roo-Code
- CVE-2025-65109Minder does not sandbox http.send in Rego programsmindersec minder · github.com/mindersec/minder
- CVE-2025-65106LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templateslangchain-ai langchain · langchain-core
- CVE-2025-65102PJSIP is vulnerable to buffer overflow in Opus PLCpjsip pjproject
- CVE-2025-11087Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Uploadzozothemes Zegen Core
- CVE-2025-62626Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruAMD Ryzen™ 9000HX Series Processors · AMD EPYC™ 9005 Series…
- CVE-2025-30201Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilitieswazuh
- CVE-2025-13132Dia: Increased Spoof Risk; Missing full screen toastThe Browser Company of New York Dia
- CVE-2025-13470RNP 0.18.0 Vulnerable PKESK session keysRibose RNP
- CVE-2025-12973S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Uploadoc3dots S2B AI Assistant – ChatBot, AI Agents, ChatGPT API,…
- CVE-2025-13357Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth MethodHashiCorp Tooling · github.com/hashicorp/terraform-provider…
- CVE-2025-66095WordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerabilityIqonic Design KiviCare
- CVE-2025-66073WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerabilityCozmoslabs WP Webhooks
- CVE-2025-66055WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerabilityIcegram Email Subscribers & Newsletters
- CVE-2025-40210Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"Linux
- CVE-2025-12160Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scriptingnmedia Simple User Registration
- CVE-2025-13138WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Functionwpdirectorykit WP Directory Kit
- CVE-2025-13156Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Executionappsbd Vitepos – Point of Sale (POS) for WooCommerce
- CVE-2025-11985Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatenootheme Realty Portal
- CVE-2025-13159Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Uploadflothemesplugins Flo Forms – Easy Drag & Drop Form Builder
- CVE-2025-12135WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scriptingiqonicdesign WPBookit
- CVE-2025-12138URL Image Importer <= 1.0.6 - Authenticated (Author+) Arbitrary File Uploadbww URL Image Importer
- CVE-2025-13322WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameterhusainali52 WP AUDIO GALLERY
- CVE-2025-64695Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows).Installer of LogStare Collector
- CVE-2025-13499Access of Uninitialized Pointer in WiresharkWireshark Foundation Wireshark
- CVE-2025-64762authkit-nextjs may let session cookies be cached in CDNsworkos authkit-nextjs · @workos-inc/authkit-nextjs
- CVE-2025-62372vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputsvllm-project vllm · vllm
- CVE-2025-62164VLLM deserialization vulnerability leading to DoS and potential RCEvllm-project vllm · vllm
- CVE-2025-64755@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writesanthropics claude-code · @anthropic-ai/claude-code
Medium, low and unrated 127
- CVE-2025-12889TLS 1.2 Client Can Downgrade Digest UsedwolfSSL
- CVE-2025-11932Timing Side-Channel in PSK Binder VerificationwolfSSL
- CVE-2025-11931Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 DecryptwolfSSL
- CVE-2025-12888Constant Time Issue with Xtensa-based ESP32 and X22519wolfSSL
- CVE-2025-11936Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHellowolfSSL
- CVE-2025-11933DoS Vulnerability in wolfSSL TLS 1.3 CKS ExtensionwofSSL wolfSSL
- CVE-2025-11934Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerifywolfSSL
- CVE-2025-11935Forward Secrecy Violation in WolfSSL TLS 1.3wolfSSL
- CVE-2025-65111SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Resultsauthzed spicedb · github.com/authzed/spicedb
- CVE-2025-65107Langfuse SSO Account Takeover via CSRF or phishing attacklangfuse
- CVE-2025-65092ESP32-P4 JPEG Decoder Header Parsing Vulnerabilityespressif esp-idf
- CVE-2025-0504Black Duck SCA Project Privilege EscalationBlack Duck SCA
- CVE-2025-31216The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-31266A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name.Apple Safari · Apple macOS
- CVE-2025-43374An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31248A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-13524Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call pAWS Wickr
- CVE-2025-36149IBM Concert Software clickjackingIBM Concert Software
- CVE-2025-48502Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial oAMD μProf
- CVE-2025-62609MLX has Wild Pointer Dereference in load_gguf()ml-explore mlx · mlx
- CVE-2025-62608MLX has heap-buffer-overflow in load()ml-explore mlx · mlx
- CVE-2025-29934A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiAMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +5
- CVE-2025-64169Wazuh NULL pointer dereference in fim_alert line 666wazuh
- CVE-2025-54866Wazuh installation fails to protected authd.pass on Windowswazuh
- CVE-2025-64483Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpointwazuh-dashboard-plugins
- CVE-2025-12747Tainacan <= 1.0.0 - Unauthenticated Information ExposureTainacan
- CVE-2025-13432Terraform Enterprise state versions can be created by users with specific permissions without sufficient write accessHashiCorp Terraform Enterprise
- CVE-2025-66115WordPress Easy Invoice plugin <= 2.1.4 - Local File Inclusion vulnerabilityMatrixAddons Easy Invoice
- CVE-2025-66114WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerabilitytheme funda Show Variations as Single Products Woocommerce
- CVE-2025-66113WordPress Better Chat Support for Messenger plugin <= 1.2.18 - Broken Access Control vulnerabilityThemeAtelier Better Chat Support for Messenger
- CVE-2025-66112WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerabilityWebToffee Accessibility Toolkit by WebYes
- CVE-2025-66111WordPress Nelio Popups plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityNelio Software Nelio Popups
- CVE-2025-66110WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerabilitybPlugins Tiktok Feed
- CVE-2025-66109WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerabilityOctolize Shipping Plugins Cart Weight for WooCommerce
- CVE-2025-66108WordPress TNC Toolbox: Web Performance plugin <= 2.0.4 - Broken Access Control vulnerabilityMerlot Digital (by TNC) TNC Toolbox: Web Performance
- CVE-2025-66107WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerabilityScott Paterson Subscriptions & Memberships for PayPal
- CVE-2025-66106WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerabilityEssential Plugin Featured Post Creative
- CVE-2025-66101WordPress CBX Bookmark & Favorite plugin <= 2.0.1 - Broken Access Control vulnerabilitySabuj Kundu CBX Bookmark & Favorite
- CVE-2025-66099WordPress Chat Help plugin <= 3.1.3 - Broken Access Control vulnerabilityThemeAtelier Chat Help
- CVE-2025-66098WordPress Travelers' Map plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityCamille V Travelers' Map
- CVE-2025-66097WordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerabilityIgor Jerosimić I Order Terms
- CVE-2025-66096WordPress Table Block by Tableberg plugin <= 0.6.9 - Broken Access Control vulnerabilityImtiaz Rayhan Table Block by Tableberg
- CVE-2025-66093WordPress Extensions for Leaflet Map plugin <= 4.8 - Cross Site Scripting (XSS) vulnerabilityhupe13 Extensions for Leaflet Map
- CVE-2025-66092WordPress Accordion Slider plugin <= 1.9.13 - Cross Site Scripting (XSS) vulnerabilitybqworks Accordion Slider
- CVE-2025-66091WordPress Stylish Cost Calculator plugin <= 8.1.5 - Cross Site Scripting (XSS) vulnerabilityDesign Stylish Cost Calculator
- CVE-2025-66090WordPress SKT Skill Bar plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Skill Bar
- CVE-2025-66089WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerabilityWebToffee Product Feed for WooCommerce
- CVE-2025-66087WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerabilityProperty Hive PropertyHive
- CVE-2025-66086WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2025-66085WordPress Arconix Shortcodes plugin <= 2.1.18 - Broken Access Control vulnerabilitytychesoftwares Arconix Shortcodes
- CVE-2025-66084WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerabilityShahjahan Jewel FluentCommunity
- CVE-2025-66083WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerabilitymagepeopleteam WpEvently
- CVE-2025-66082WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerabilitymagepeopleteam WpEvently
- CVE-2025-66081WordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerabilityJeff Starr Head Meta Data
- CVE-2025-66079WordPress Gutenverse Form plugin <= 2.2.0 - Broken Access Control vulnerabilityJegstudio Gutenverse Form
- CVE-2025-66077WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerabilitywpWax Legal Pages
- CVE-2025-66075WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerabilityWP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…
- CVE-2025-66072WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerabilityStiofan UsersWP
- CVE-2025-66071WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerabilitytychesoftwares Custom Order Numbers for WooCommerce
- CVE-2025-66069WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerabilityThemeisle PPOM for WooCommerce
- CVE-2025-66067WordPress Funnel Builder by FunnelKit plugin <= 3.13.1.2 - Cross Site Scripting (XSS) vulnerabilityAman Funnel Builder by FunnelKit
- CVE-2025-66066WordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerabilityEnvoThemes Envo Extra
- CVE-2025-66065WordPress Gutenverse plugin <= 3.2.1 - Broken Access Control vulnerabilityJegstudio Gutenverse
- CVE-2025-66064WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerabilitySyed Balkhi Giveaways and Contests by RafflePress
- CVE-2025-66063WordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerabilityjgwhite33 WP Google Review Slider
- CVE-2025-66062WordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerabilityFrank Goossens WP YouTube Lyte
- CVE-2025-66061WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-66060WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-66059WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Sensitive Data Exposure vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-66057WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
- CVE-2025-66056WordPress Uncanny Automator plugin < 6.10.0 - Sensitive Data Exposure vulnerabilityUncanny Owl Uncanny Automator
- CVE-2025-66053WordPress Enfold theme <= 7.1.2 - Cross Site Scripting (XSS) vulnerabilityKriesi Enfold
- CVE-2025-10039ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'elextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-12935FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcodetechjewel FluentCRM – Email Newsletter, Automation, Email M…
- CVE-2025-10054ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removalelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-40211ACPI: video: Fix use-after-free in acpi_video_switch_brightness()Linux
- CVE-2025-40209btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relationLinux
- CVE-2025-12750Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injectiontrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2025-12066WP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scriptingetruel WP Delete Post Copies
- CVE-2025-12964Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widgetnalam-1 Magical Shop Builder – WooCommerce Template Builder…
- CVE-2025-11808Shortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeantiochinteractive Shortcode for Google Street View
- CVE-2025-13141HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injectiondevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-13149Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status ModificationSchedule Post Changes With PublishPress Future: Unpublish,…
- CVE-2025-11826WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebdeleasa WP Company Info
- CVE-2025-11973简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Readzhengdon 简数采集器
- CVE-2025-12039BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposuredevsmip BigBuy Dropshipping Connector for WooCommerce
- CVE-2025-11803WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpfanyi WPSite Shortcode
- CVE-2025-11800Surbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingSurbma | MiniCRM Shortcode
- CVE-2025-11802Bulma Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbartboy011 Bulma Shortcodes
- CVE-2025-11773Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Updatebeycanpress Cryptocurrency (Token), Launchpad (Presale), IC…
- CVE-2025-11763Display Pages Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrustybadrobot Display Pages Shortcode
- CVE-2025-13135HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingintegrationshotelrunner HotelRunner Booking Widget
- CVE-2025-11764Shortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingfastmover Shortcodes Bootstrap
- CVE-2025-10938UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposureadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2025-11771Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Updatebeycanpress Cryptocurrency (Token), Launchpad (Presale), IC…
- CVE-2025-11003UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2025-11799Affiliate AI Lite <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrustaurius Affiliate AI Lite
- CVE-2025-12881Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Readwpswings Return Refund and Exchange For WooCommerce
- CVE-2025-11815UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updateadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2025-13134AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingpowerblogservice AuthorSure
- CVE-2025-11885EchBay Admin Security <= 1.3.0 - Reflected Cross-Site Scriptingitvn9online EchBay Admin Security
- CVE-2025-13142Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletionfarvehandleren Custom Post Type
- CVE-2025-11768Islamic Phrases <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scriptingdarto Islamic Phrases
- CVE-2025-11770BrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbillybigpotatoes BrightTALK WordPress Shortcode
- CVE-2025-11767Tips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingfpcorso Tips Shortcode
- CVE-2025-12894Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposurejcollings Import WP – Export and Import CSV and XML files t…
- CVE-2025-11801AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdavidangel AudioTube
- CVE-2025-11765Stock Tools <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdevelopdaly Stock Tools
- CVE-2025-12170Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearingbandido Checkbox
- CVE-2025-12086Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellationwpswings Return Refund and Exchange For WooCommerce
- CVE-2025-12661Pollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeqzzr Pollcaster Shortcode Plugin
- CVE-2025-12660Padlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecoffeebite Padlet Shortcode
- CVE-2025-12746Tainacan <= 1.0.0 - Reflected Cross-Site ScriptingTainacan
- CVE-2025-64299LogStare Collector improperly handles the password hash data.LogStare Collector
- CVE-2025-62687Cross-site request forgery vulnerability exists in LogStare Collector.LogStare Collector
- CVE-2025-62189LogStare Collector contains an incorrect authorization vulnerability in UserRegistration.LogStare Collector
- CVE-2025-61949LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement.LogStare Collector
- CVE-2025-58097The installation directory of LogStare Collector is configured with incorrect access permissions.LogStare Collector
- CVE-2025-9825Missing Authorization in GitLabGitLab
- CVE-2025-12169ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletionelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-12022ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restoreelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-12085ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Emptyelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-12023ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restoreelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-11368LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposurethimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-64751OpenFGA Improper Policy Enforcementopenfga · github.com/openfga/openfga
- CVE-2025-62426vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`vllm-project vllm · vllm
- CVE-2025-13485itsourcecode Online File Management System ajax.php sql injectionitsourcecode Online File Management System