CVEs published December 2, 2025
177 CVEs were published on December 2, 2025: 17 critical, 55 high.
- Published
- 177
- Critical
- 17
- High
- 55
- Medium
- 97
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- Google Chrome
- 13
- SGE-PLC1000 SGE-PLC50 Circutor
- 12
- MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- 8
- Samsung Mobile Devices
- 8
- MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- 7
- MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- 6
- Mirion Medical EC2 Software NMIS BioDose
- 5
- TCMAN GIM
- 4
- lookyloo
- 3
- MediaTek MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, M…
- 3
Critical 17
- CVE-2025-13658Industrial Video & Control Longwatch has a Code Injection vulnerabilityIndustrial Video & Control Longwatch
- CVE-2025-13510Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiyIskra iHUB and iHUB Lite
- CVE-2025-13542DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege EscalationDesignThemes LMS
- CVE-2025-13828Mautic user without privileged access to the Marketplace can install and uninstall composer packagesMautic · mautic/core
- CVE-2025-11779Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11778Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-41742Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system componentsSprecher Automation SPRECON-E-C · Sprecher Automation SP… +1
- CVE-2025-41744Sprecher Automation: SPRECON-E series has static default key material for TLS connectionsSprecher Automation SPRECON-E-C · Sprecher Automation SP… +1
- CVE-2025-58386In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorizatio
- CVE-2025-59693The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS)
- CVE-2025-59695Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user
- CVE-2025-59703Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physi
- CVE-2025-60736code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
- CVE-2025-60854A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.
- CVE-2025-65358Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.
- CVE-2025-65656dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
- CVE-2025-65896SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.asyncmy
High 55
- CVE-2025-66476Vim for Windows Uncontrolled Search Path Element Remote Code Execution Vulnerabilityvim
- CVE-2025-62575Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceMirion Medical EC2 Software NMIS BioDose
- CVE-2025-64778Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded CredentialsMirion Medical EC2 Software NMIS BioDose
- CVE-2025-61940Mirion Medical EC2 Software NMIS BioDose Use of Client-Side AuthenticationMirion Medical EC2 Software NMIS BioDose
- CVE-2025-64298Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceMirion Medical EC2 Software NMIS BioDose
- CVE-2025-64642Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceMirion Medical EC2 Software NMIS BioDose
- CVE-2025-13633Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2025-13721Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2025-13720Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentiallyGoogle Chrome
- CVE-2025-13639Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write viaGoogle Chrome
- CVE-2025-13638Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2025-13631Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilegeGoogle Chrome
- CVE-2025-13630Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-61729Excessive resource consumption when printing error string for host certificate validation in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2025-66468Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editorsaimeos ai-cms-grapesjs · aimeos/ai-cms-grapesjs
- CVE-2025-34352JumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp DirectoryJumpCloud Remote Assist
- CVE-2025-66416DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhostmodelcontextprotocol python-sdk · mcp
- CVE-2025-66414DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhostmodelcontextprotocol typescript-sdk · @modelcontextprotocol…
- CVE-2025-66399SNMP Command Injection leads to RCE in Cacticacti
- CVE-2025-13827GrapesJsBuilder File Upload allows all file uploadsMautic · mautic/grapes-js-builder-bundle
- CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extractiondjangoproject Django · django
- CVE-2025-13295Sensitive Data Exposure in ArgusTech's BILGERArgus Technology BILGER
- CVE-2025-41013SQL injection vulnerability in TCMAN GIMTCMAN GIM
- CVE-2025-41012Unauthorized access vulnerability in TCMAN GIMTCMAN GIM
- CVE-2025-11789Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11788Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11787Command injection vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11786Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11785Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11784Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11783Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11782Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11781Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11780Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-12465Blind SQL Injection in QuickCMSOpenSolution QuickCMS
- CVE-2025-13353gokey allows secret recovery from a seed file without the master passwordCloudflare gokey · github.com/cloudflare/gokey
- CVE-2025-13516SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Uploadbrainstormforce SureMail – SMTP and Email Logs Plugin with…
- CVE-2025-13724VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parametere4jvikwp VikRentCar Car Rental Management System
- CVE-2025-10971Insecure Storage of Sensitive InformationFERMAX ELECTRÓNICA S.A.U MeetMe
- CVE-2025-13000DB Access <= 0.8.7 - Subscriber+ SQLidb-access
- CVE-2025-13387Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scriptingstellarwp Kadence WooCommerce Email Designer
- CVE-2025-20768In display, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20767In display, there is a possible out of bounds write due to an integer overflow.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20766In display, there is a possible memory corruption due to improper input validation.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20764In smi, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20763In mmdvfs, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT…
- CVE-2024-45675IBM Informix Dynamic Server Authentication BypassIBM Informix Dynamic Server
- CVE-2025-12529Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletionstylemix Cost Calculator Builder
- CVE-2025-58482Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.Samsung Mobile MotionPhoto
- CVE-2025-58481Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.Samsung Mobile MotionPhoto
- CVE-2025-59697Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59702Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59704Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an atta
- CVE-2025-65844EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint.
- CVE-2025-65877Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in c
Medium, low and unrated 105
- CVE-2025-65955ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing familyImageMagick
- CVE-2025-55181Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blFacebook proxygen
- CVE-2025-13640Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physGoogle Chrome
- CVE-2025-13637Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2025-13636Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2025-13635Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafGoogle Chrome
- CVE-2025-13634Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the Google Chrome
- CVE-2025-13632Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2025-57850Codeready-ws: privilege escalation via excessive /etc/passwd permissionsRed Hat OpenShift Dev Spaces
- CVE-2025-66460Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatableslookyloo
- CVE-2025-66459Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTMLlookyloo
- CVE-2025-66458Lookyloo has multiple XSS due to unsafe use of f-strings in Markuplookyloo
- CVE-2025-66454Arcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsArcadeAI arcade-mcp · arcade-mcp-server
- CVE-2025-66409ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handlingespressif esp-idf
- CVE-2025-52622HCL BigFix SaaS Remediate is affected by a security vulnerabilityHCL Software BigFix SaaS Remediate
- CVE-2025-65105Apptainer ineffective application of selinux and apparmor --security optionsapptainer · github.com/apptainer/apptainer
- CVE-2025-64750Singluarity ineffectively applies of selinux / apparmor LSM process labelssylabs singularity · github.com/sylabs/singularity +1
- CVE-2025-13877nocobase JWT Service jwt-service.ts hard-coded keynocobase · @nocobase/auth
- CVE-2025-12630Upload.am File Hosting VPN < 1.0.1 - Contributor+ Arbitrary Option DisclosureUpload.am
- CVE-2025-58113An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co.PDF-XChange Co. PDF-XChange Editor
- CVE-2025-13372Potential SQL injection in FilteredRelation column aliases on PostgreSQLdjangoproject Django · django
- CVE-2025-13876Rareprob HD Video Player All Formats App com.rocks.music.videoplayer path traversalRareprob HD Video Player All Formats App
- CVE-2025-13875Yohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversalYohann0617 oci-helper
- CVE-2025-13505Stored XSS in Datateam's DatactiveDatateam Information Technologies Datactive
- CVE-2025-41066Disclosure of sensitive information in Horde GroupwareHorde Groupware
- CVE-2025-13731Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeposimyththemes Nexter Extension – Security, Performance, Co…
- CVE-2025-41086Authorization bypass in GAMS from GAMS Development Corp.AMS Development GAMS
- CVE-2025-41015User Enumeration vulnerability in TCMAN GIMTCMAN GIM
- CVE-2025-41014User Enumeration vulnerability in TCMAN GIMTCMAN GIM
- CVE-2025-40700Reflected Cross-Site Scripting (XSS) in Governalia by IDI EikonIDI Eikon Governalia
- CVE-2025-13879Directory traversal vulnerability in EfficientIP's SOLIDserver IPAMSOLIDserver IPAM
- CVE-2025-13090WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injectionwpdirectorykit WP Directory Kit
- CVE-2025-41743Sprecher Automation: SPRECON-E series prone to weak encryption of update filesSprecher Automation SPRECON-E-C · Sprecher Automation SP… +1
- CVE-2025-13873The feature to import a survey is prone to stored Cross-Site Script attacksObjectPlanet Opinio
- CVE-2025-13872Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet OpinioObjectPlanet Opinio
- CVE-2025-13871The feature to manage resources is prone to Cross-Site Request Forgery attacksObjectPlanet Opinio
- CVE-2025-13870Unauthorized access and subscription vulnerability in BoardsMattermost · github.com/mattermost/mattermost +4
- CVE-2025-13534ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Actionelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-10543In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly Eclipse Foundation paho.mqtt.golang · github.com/eclipse/pa…
- CVE-2025-11726Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modificationbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2025-13696Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpointsoftdiscover Zigaform – Price Calculator & Cost Estimation…
- CVE-2025-12483Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injectionthemeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2025-13140SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletiondevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2025-13685Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actionsays-pro Photo Gallery by Ays – Responsive Image Gallery
- CVE-2025-13007WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Importadreastrian WP Social Ninja – Embed Social Feeds, User Revi…
- CVE-2025-13001Donation <= 1.0 - Admin+ SQLidonation
- CVE-2025-13606Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposuresmackcoders Export All Posts, Products, Orders, Refunds & U…
- CVE-2025-20789In GPU pdma, there is a possible information disclosure due to a missing bounds check.MediaTek MT6781, MT6833, MT6853, MT6877, MT6893, MT8196
- CVE-2025-20788In GPU pdma, there is a possible memory corruption due to a missing permission check.MediaTek MT6991, MT8196
- CVE-2025-20777In display, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20776In display, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20775In display, there is a possible memory corruption due to use after free.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20774In display, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20773In display, there is a possible memory corruption due to use after free.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20772In display, there is a possible memory corruption due to use after free.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2025-20771In display, there is a possible escalation of privilege due to improper input validation.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20770In display, there is a possible memory corruption due to use after free.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20769In display, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20765In aee daemon, there is a possible system crash due to a race condition.MediaTek MT2718, MT2737, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2025-20750In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20751In Modem, there is a possible system crash due to a missing bounds check.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20791In Modem, there is a possible system crash due to incorrect error handling.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20752In Modem, there is a possible system crash due to a missing bounds check.MediaTek MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, M…
- CVE-2025-20756In Modem, there is a possible system crash due to a logic error.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20757In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20758In Modem, there is a possible system crash due to an uncaught exception.MediaTek MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, M…
- CVE-2025-20759In Modem, there is a possible out of bounds read due to a missing bounds check.MediaTek MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T,…
- CVE-2025-20790In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20755In Modem, there is a possible application crash due to improper input validation.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-20754In Modem, there is a possible system crash due to an incorrect bounds check.MediaTek MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, M…
- CVE-2025-20753In Modem, there is a possible system crash due to an uncaught exception.MediaTek MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T,…
- CVE-2025-20792In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…
- CVE-2025-13697BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attributewpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder…
- CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatioRevive Adserver
- CVE-2025-58488Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensSamsung Mobile SmartTouchCall
- CVE-2025-58487Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung AccountSamsung Mobile Samsung Account
- CVE-2025-58486Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script.Samsung Mobile Samsung Account
- CVE-2025-58485Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script.Samsung Mobile Samsung Internet
- CVE-2025-58484Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox.Samsung Mobile Samsung Cloud Assistant
- CVE-2025-58483Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to instaSamsung Mobile Galaxy Store for Galaxy Watch
- CVE-2025-58480Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-58479Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-58478Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-58477Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-boSamsung Mobile Devices
- CVE-2025-58476Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-58475Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-21080Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access filSamsung Mobile Devices
- CVE-2025-21072Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write Samsung Mobile Devices
- CVE-2025-59694The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS)
- CVE-2025-59696Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59698Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a
- CVE-2025-59699Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59700Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59701Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi
- CVE-2025-59705Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physi
- CVE-2025-63872DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.
- CVE-2025-64070Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.
- CVE-2025-65186Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).getgrav/grav
- CVE-2025-65187A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field.
- CVE-2025-65215Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier
- CVE-2025-65379PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint.
- CVE-2025-65380PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint.
- CVE-2025-65657FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management.feehi/cms
- CVE-2025-65858A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'calibreweb
- CVE-2025-65881Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php.