CVEs published December 9, 2025
667 CVEs were published on December 9, 2025: 42 critical, 217 high. 2 are now in CISA KEV.
- Published
- 667
- Critical
- 42
- High
- 217
- Medium
- 289
- Low
- 13
- Unrated
- 106
- Now in CISA KEV
- 2
- Fix available
- 232
Most affected products
- Linux
- 152
- Microsoft Windows
- 38
- MailEnable
- 14
- Phoenix Contact FL SWITCH · Phoenix Contact FL NAT
- 14
- Mozilla Firefox · Mozilla Thunderbird
- 13
- Adobe ColdFusion
- 11
- Microsoft 365 Apps for Enterprise · Microsoft Excel +1
- 6
- Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- 6
- OPEN BMCS OpenBMCS
- 5
- Siemens SIMATIC CN
- 5
Critical 42
- CVE-2025-67501WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameterLabRedesCefetRJ WeGIA
- CVE-2025-61808ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe ColdFusion
- CVE-2025-61809ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-61811ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2025-67494ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel · github.com/zitadel/zitadel +1
- CVE-2025-66039FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth HeaderFreePBX framework
- CVE-2023-53771MiniDVBLinux 5.4 Unauthenticated Root Password Change via System SetupMiniDVBLinux Change Root Password PoC
- CVE-2025-67489@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development servervitejs vite-plugin-react · @vitejs/plugin-rsc
- CVE-2023-53739Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup DisclosureTinycontrol LAN Controller v · Tinycontrol LK
- CVE-2021-47731Selea Targa IP Camera Developer Backdoor Configuration OverwriteSelea s.r.l. Selea Targa IP OCR-ANPR Camera
- CVE-2021-47728Selea Targa IP Camera Remote Code Execution via UtilsSelea Targa IP OCR-ANPR Camera
- CVE-2021-47708COMMAX Smart Home IoT Control System SQL Injection Authentication BypassCOMMAX Co. Smart Home IoT Control System
- CVE-2021-47707COMMAX CVD-Axx DVR Weak Default Credentials Stream DisclosureCOMMAX Co. COMMAX CVD-Axx DVR
- CVE-2025-66456Elysia vulnerable to prototype pollution with multiple standalone schema validationelysiajs elysia · elysia
- CVE-2025-64113Emby Server allows attackers to gain administrative server access without preconditionsEmbySupport security
- CVE-2025-34414Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCEEntrust Instant Financial Issuance
- CVE-2025-59718A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiFortinet FortiSwitchManager · Fortinet FortiOS +1
- CVE-2025-59719An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 tFortinet FortiWeb
- CVE-2025-10573Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptIvanti Endpoint Manager
- CVE-2025-12504SQLi in Talent Software's UNISTalent Software UNIS
- CVE-2025-14330JIT miscompilation in the JavaScript Engine: JIT componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14326Use-after-free in the Audio/Video: GMP componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14324JIT miscompilation in the JavaScript Engine: JIT componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14321Use-after-free in the WebRTC: Signaling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-11022CSRF in PaniluxPersonal Project Panilux
- CVE-2025-14310Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb.This issue affects rethinkdb: before 2.4.4rethinkdb
- CVE-2025-14308Integer Overflow in Robocode's Buffer Write MethodRobocode Project Robocode
- CVE-2025-14307Insecure Temporary File Creation in Robocode's AutoExtract ComponentRobocode Project Robocode · net.sf.robocode:robocode.battle
- CVE-2025-14306Directory Traversal in Robocode's CacheCleaner ComponentRobocode Project Robocode · net.sf.robocode:robocode.core
- CVE-2025-40343nvmet-fc: avoid scheduling association deletion twiceLinux
- CVE-2025-67504WBCE CMS has Weak Random Number Generator in Password Generation FunctionWBCE_CMS
- CVE-2025-42928Deserialization Vulnerability in SAP jConnect - SDK for ASESAP_SE SAP jConnect - SDK for ASE
- CVE-2025-42880Code Injection vulnerability in SAP Solution ManagerSAP_SE SAP Solution Manager
- CVE-2025-66568ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationSAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-66567ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)SAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-66565Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Valuesgofiber utils · github.com/gofiber/utils/v2 +1
- CVE-2022-50666RDMA/siw: Fix QP destroy to wait for all references dropped.Linux
- CVE-2025-66481DeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentThinkInAIXYZ deepchat
- CVE-2023-53794cifs: fix session state check in reconnect to avoid use-after-free issueLinux
- CVE-2025-63742SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attac
- CVE-2025-65741Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection.
- CVE-2025-65882An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function crea
High 217
- CVE-2025-61813ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe ColdFusion
- CVE-2025-61812ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-61810ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2025-67495ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Loginzitadel · github.com/zitadel/zitadel +1
- CVE-2025-66645NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Readingzauberzeug nicegui · nicegui
- CVE-2023-53773MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.shMiniDVBLinux
- CVE-2023-53772MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About PageMiniDVBLinux
- CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup EndpointMiniDVBLinux(TM) Distribution
- CVE-2021-47730Selea Targa IP Camera Cross-Site Request Forgery via Admin CreationSelea s.r.l. Selea Targa IP OCR-ANPR Camera
- CVE-2021-47727Selea Targa IP Camera Unauthenticated Stream DisclosureSelea s.r.l. Selea Targa IP OCR-ANPR Camera
- CVE-2021-47724STVS ProVision Authenticated File Disclosure via archive.rbSTVS SA STVS ProVision
- CVE-2021-47719CNC_Ctrl DllUnregisterServer f5501 Access ViolationCOMMAX Co. COMMAX WebViewer ActiveX Control
- CVE-2021-47718OpenBMCS Directory Listing Information DisclosureOPEN BMCS OpenBMCS
- CVE-2021-47710COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials DisclosureCOMMAX Co. Smart Home Ruvie CCTV Bridge DVR Service
- CVE-2021-47709COMMAX Smart Home Ruvie CCTV Bridge DVR Service Config Write / DoSCOMMAX Co. Smart Home Ruvie CCTV Bridge DVR Service
- CVE-2021-47706COMMAX Biometric Access Control System Authentication BypassCOMMAX Co. COMMAX Biometric Access Control System
- CVE-2021-47705CNC_Ctrl DllUnregisterServer Access ViolationCOMMAX Co. COMMAX UMS Client ActiveX Control
- CVE-2021-47704OpenBMCS SQL Injection via obix_test.phpOPEN BMCS OpenBMCS
- CVE-2021-47701OpenBMCS User Management Privilege EscalationOPEN BMCS OpenBMCS
- CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCEsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2025-64899Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat Reader
- CVE-2025-64785Acrobat Reader | Untrusted Search Path (CWE-426)Adobe Acrobat Reader
- CVE-2025-66626argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksargoproj argo-workflows · github.com/argoproj/argo-workf… +2
- CVE-2025-66457Elysia affected by arbitrary code injection through cookie configelysiajs elysia · elysia
- CVE-2025-66214Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)wearefrank ladybug
- CVE-2025-34413Legality WHISTLEBLOWING Missing Critical HTTP Security HeadersDigitalPA S.r.l. Legality WHISTLEBLOWING
- CVE-2025-34396MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAINFY.DLLMailEnable
- CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-54100PowerShell Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-64680Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-64679Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-64678Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-64672Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Server Subscription Edition
- CVE-2025-64671GitHub Copilot for Jetbrains Remote Code Execution VulnerabilityMicrosoft GitHub Copilot Plugin for JetBrains IDEs
- CVE-2025-64661Windows Shell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62565Windows File Explorer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62570Windows Camera Frame Server Monitor Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-62569Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62560Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62559Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-62558Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-62557Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-62556Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62555Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-62554Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-62553Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62552Microsoft Access Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Access +1
- CVE-2025-62550Azure Monitor Agent Remote Code Execution VulnerabilityMicrosoft Azure Monitor
- CVE-2025-62474Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62467Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-55233Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62464Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62462Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62461Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62455Microsoft Message Queuing (MSMQ) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-59517Windows Storage VSP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-59516Windows Storage VSP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-64673Windows Storage VSP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-64666Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2025-64658Windows File Explorer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62573DirectX Graphics Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62572Application Information Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62571Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62564Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62563Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62562Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-62561Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-62549Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-62472Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62470Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62469Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62466Windows Client-Side Caching Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62458Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62457Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62456Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-62454Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-33214NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue.NVIDIA NVTabular
- CVE-2025-33213NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issueNVIDIA Merlin Transformers4Rec
- CVE-2025-64784DNG SDK | Heap-based Buffer Overflow (CWE-122)Adobe DNG SDK
- CVE-2025-64893DNG SDK | Out-of-bounds Read (CWE-125)Adobe DNG SDK
- CVE-2025-64783DNG SDK | Integer Overflow or Wraparound (CWE-190)Adobe DNG SDK
- CVE-2025-46637Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability.Dell Encryption
- CVE-2025-53949An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiSandbox
- CVE-2025-60024Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet Fortinet FortiVoice
- CVE-2025-64447A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 throuFortinet FortiWeb
- CVE-2025-13662Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1Ivanti Endpoint Manager
- CVE-2025-13661Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outsIvanti Endpoint Manager
- CVE-2025-13659Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticIvanti Endpoint Manager
- CVE-2025-5469Dylib Hijacking in Yandex MessengerYandex Messenger
- CVE-2025-5471Dylib Hijacking in Yandex TelemostYandex Telemost
- CVE-2025-5470Dylib Hijacking in Yandex DiskYandex Disk
- CVE-2025-2296Un-verified kernel bypass Secure Boot mechanism in direct boot modeTianoCore EDK2
- CVE-2025-63076WordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerabilityDream-Theme The7 Elements
- CVE-2025-63074WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerabilityDream-Theme The7
- CVE-2025-63062WordPress UDesign Core plugin <= 4.14.0 - Local File Inclusion vulnerabilityAndonDesign UDesign Core
- CVE-2025-63036WordPress Ronneby Theme Core plugin <= 1.5.68 - Local File Inclusion vulnerabilityDFDevelopment Ronneby Theme Core
- CVE-2025-63030WordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerabilitySaad Iqbal New User Approve
- CVE-2025-63003WordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerabilityfuelthemes North - Required Plugin
- CVE-2025-62093WordPress Image&Video FullScreen Background plugin <= 1.6.7 - SQL Injection vulnerabilityLambertGroup Image&Video FullScreen Background
- CVE-2025-49351WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityValentin Agachi Create Posts & Terms
- CVE-2025-49347WordPress WP sIFR plugin <= 0.6.8.1 - Cross Site Request Forgery (CSRF) vulnerabilityJupitercow WP sIFR
- CVE-2025-49341WordPress PDF Creator Lite plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerabilityAlex Furr PDF Creator Lite
- CVE-2025-10655Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_dataFrappe HelpDesk
- CVE-2025-67534WordPress Rencontre plugin <= 3.13.7 - Cross Site Request Forgery (CSRF) vulnerabilityJacques Malgrange Rencontre
- CVE-2025-67533WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Portfolio Post
- CVE-2025-67532WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerabilitythembay Hara
- CVE-2025-67531WordPress Turitor theme < 1.5.3 - Local File Inclusion vulnerabilitytrippleS Turitor
- CVE-2025-67530WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerabilitythembay Besa
- CVE-2025-67529WordPress Fashion theme < 5.3.0 - Local File Inclusion vulnerabilityOpal_WP Fashion
- CVE-2025-67528WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerabilitythembay Urna
- CVE-2025-67527WordPress Digiqole theme < 2.2.7 - Local File Inclusion vulnerabilitytrippleS Digiqole
- CVE-2025-67526WordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerabilityThimPress Sailing
- CVE-2025-67525WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerabilityOpal_WP ekommart
- CVE-2025-67524WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerabilityNooTheme Jobmonster Elementor Addon
- CVE-2025-67523WordPress Exhibz theme <= 3.0.9 - Local File Inclusion vulnerabilitytrippleS Exhibz
- CVE-2025-67522WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerabilityNooTheme Jobmonster
- CVE-2025-67521WordPress Select Core plugin < 2.6 - Local File Inclusion vulnerabilitySelect-Themes Select Core
- CVE-2025-67520WordPress Media Library Tools plugin <= 1.6.15 - SQL Injection vulnerabilityTiny Solutions Media Library Tools
- CVE-2025-67519WordPress Ninja Tables plugin <= 5.2.3 - SQL Injection vulnerabilityShahjahan Jewel Ninja Tables
- CVE-2025-67518WordPress Accordion Slider PRO plugin <= 1.2 - SQL Injection vulnerabilityLambertGroup Accordion Slider PRO
- CVE-2025-67517WordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerabilityArtPlacer Widget
- CVE-2025-67516WordPress Store Locator WordPress plugin <= 1.6.2 - SQL Injection vulnerabilityAgile Logix Store Locator WordPress
- CVE-2025-67515WordPress Wilmër theme < 3.5 - Local File Inclusion vulnerabilityMikado-Themes Wilmër
- CVE-2025-9368432ES-IG3 Series A Denial-of-Service VulnerabilityRockwell Automation 432ES-IG3 Series A
- CVE-2025-12807FactoryTalk® DataMosaix™ Private Cloud SQL InjectionRockwell Automation FactoryTalk® DataMosaix™ Private Cloud
- CVE-2025-12705Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviewswidgetpack Reviews Widgets for Google, Yelp & TripAdvisor
- CVE-2025-14333Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-14332Memory safety bugs fixed in Firefox 146 and Thunderbird 146Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-14329Privilege escalation in the Netmonitor componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14328Privilege escalation in the Netmonitor componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14327Spoofing issue in the Downloads Panel componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14325JIT miscompilation in the JavaScript Engine: JIT componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14323Privilege escalation in the DOM: Notifications componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-14322Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-40938A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1).Siemens SIMATIC CN
- CVE-2025-40937A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1).Siemens SIMATIC CN
- CVE-2025-40820Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range.Siemens SIDOOR ATD430W · Siemens SIDOOR ATE530G COATED +138
- CVE-2025-40801A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional TranslaSiemens COMOS · Siemens JT Bi-Directional Translator for… +3
- CVE-2025-40800A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < Siemens COMOS · Siemens NX +3
- CVE-2024-56840A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-56839A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-56838A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-56837A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-56836A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-56835A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2025-59030Insufficient validation of incoming notifies over TCP can lead to a denial of service in RecursorPowerDNS Recursor
- CVE-2025-41695Reflected XSS vulnerability in dyn_conn.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41745Reflected XSS vulnerability in pxc_portCntr2.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41746Reflected XSS vulnerability in pxc_portSecCfg.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41747Reflected XSS vulnerability in pxc_vlanIntfCfg.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41748Reflected XSS vulnerability in pxc_Dot1xCfg.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41749Reflected XSS vulnerability in port_util.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41750Reflected XSS vulnerability in pxc_PortCfg.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41751Reflected XSS vulnerability in pxc_portCntr.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41752Reflected XSS vulnerability in pxc_portSfp.phpPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-14309NULL Pointer Dereference vulnerability in ravynsoft ravynos.This issue affects ravynos: through 0.5.2.ravynsoft ravynos
- CVE-2025-13428RCE in SecOps SOAR server via user-provided Python packagesGoogle Cloud SecOps SOAR
- CVE-2025-13071Custom Admin Menu <= 1.0.0 - Reflected XSSCustom Admin Menu
- CVE-2025-13604Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URLLogin Security, FireWall, Malware removal by CleanTalk
- CVE-2025-40344ASoC: Intel: avs: Disable periods-elapsed work when closing PCMLinux
- CVE-2025-40342nvme-fc: use lock accessing port_state and rport stateLinux
- CVE-2025-40337net: stmmac: Correctly handle Rx checksum offload errorsLinux
- CVE-2025-40336drm/gpusvm: fix hmm_pfn_to_map_order() usageLinux
- CVE-2025-40334drm/amdgpu: validate userq buffer virtual address and sizeLinux
- CVE-2025-40331sctp: Prevent TOCTOU out-of-bounds writeLinux
- CVE-2025-40328smb: client: fix potential UAF in smb2_close_cached_fid()Linux
- CVE-2025-66631CSLA .NET is vulnerable to Remote Code Execution via WcfProxyMarimerLLC csla · Csla
- CVE-2025-66627Wasmi's Linear Memory has a Critical Use After Free Vulnerabilitywasmi-labs wasmi · wasmi
- CVE-2025-42878Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)SAP_SE SAP Web Dispatcher and Internet Communication Manager
- CVE-2025-42877Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content ServerSAP_SE SAP Web Dispatcher, Internet Communication Manager a…
- CVE-2025-42876Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)SAP_SE SAP S/4 HANA Private Cloud
- CVE-2025-42874Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)SAP_SE SAP NetWeaver
- CVE-2023-53866ASoC: soc-compress: Reposition and add pcm_mutexLinux
- CVE-2023-53862hfs: fix missing hfs_bnode_get() in __hfs_bnode_createLinux
- CVE-2023-53860dm: don't attempt to queue IO under RCU protectionLinux
- CVE-2023-53851drm/msm/dp: Drop aux devices together with DP controllerLinux
- CVE-2023-53846f2fs: fix to do sanity check on direct node in truncate_dnode()Linux
- CVE-2023-53844drm/ttm: Don't leak a resource on swapout move errorLinux
- CVE-2023-53838f2fs: synchronize atomic write abortsLinux
- CVE-2023-53836bpf, sockmap: Fix skb refcnt race after locking changesLinux
- CVE-2023-53829f2fs: flush inode if atomic file is abortedLinux
- CVE-2023-53828Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()Linux
- CVE-2023-53827Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}Linux
- CVE-2023-53824netlink: annotate lockless accesses to nlk->max_recvmsg_lenLinux
- CVE-2023-53823block/rq_qos: protect rq_qos apis with a new lockLinux
- CVE-2023-53822wifi: ath11k: Ignore frags from uninitialized peer in dp.Linux
- CVE-2022-50677ipmi: fix use after free in _ipmi_destroy_user()Linux
- CVE-2022-50676net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()Linux
- CVE-2022-50673ext4: fix use-after-free in ext4_orphan_cleanupLinux
- CVE-2022-50671RDMA/rxe: Fix "kernel NULL pointer dereference" errorLinux
- CVE-2022-50668ext4: fix deadlock due to mbcache entry corruptionLinux
- CVE-2022-50665wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnectedLinux
- CVE-2025-665071Panel – CAPTCHA Bypass via Client-Controlled Flag1Panel-dev 1Panel · github.com/1Panel-dev/1Panel +1
- CVE-2013-10031Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacksMIYAGAWA Plack::Middleware::Session
- CVE-2023-53819amdgpu: validate offset_in_bo of drm_amdgpu_gem_vaLinux
- CVE-2023-53817crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()Linux
- CVE-2023-53816drm/amdkfd: fix potential kgd_mem UAFsLinux
- CVE-2023-53810blk-mq: release crypto keyslot before reporting I/O completeLinux
- CVE-2023-53806drm/amd/display: populate subvp cmd info only for the top pipeLinux
- CVE-2023-53804nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()Linux
- CVE-2023-53803scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()Linux
- CVE-2023-53800ubi: Fix use-after-free when volume resizing failedLinux
- CVE-2023-53797HID: wacom: Use ktime_t rather than int when dealing with timestampsLinux
- CVE-2023-53795iommufd: IOMMUFD_DESTROY should not increase the refcountLinux
- CVE-2023-53790bpf: Zeroing allocated object from slab in bpf memory allocatorLinux
- CVE-2023-53785mt76: mt7921: don't assume adequate headroom for SDIO headersLinux
- CVE-2023-53781smc: Fix use-after-free in tcp_write_timer_handler().Linux
- CVE-2023-53778accel/qaic: Clean up integer overflow checking in map_user_pages()Linux
- CVE-2022-50656nfc: pn533: Clear nfc_target before being usedLinux
- CVE-2022-50650bpf: Fix reference state management for synchronous callbacksLinux
- CVE-2025-56704LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files
- CVE-2025-61075Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileg
- CVE-2025-61258Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the bo
- CVE-2025-65287An unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1 allows a remote attacker to read arbitrary fi
- CVE-2025-65513fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP vmcp-fetch-server
- CVE-2025-65573Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via
- CVE-2025-65594OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform
Medium, low and unrated 408
- CVE-2025-67502Taguette does not safeguard against Open Redirectremram44 taguette · taguette
- CVE-2025-67500Mastodon Error Handling Discrepancy Enables Private Status Existence Enumerationmastodon
- CVE-2025-61821ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe ColdFusion
- CVE-2025-64898ColdFusion | Insufficiently Protected Credentials (CWE-522)Adobe ColdFusion
- CVE-2025-61822ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-64897ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2025-61823ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe ColdFusion
- CVE-2025-67499CNI Plugins Portmap nftables backend intercepts non-local trafficcontainernetworking plugins · github.com/containernetworkin…
- CVE-2025-67496WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration PageLabRedesCefetRJ WeGIA
- CVE-2025-36437IBM Planning Analytics Local is vulnerable to disclosing sensitive informationIBM Planning Analytics Local
- CVE-2025-34425MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspxMailEnable
- CVE-2023-53774MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code ExecutionMiniDVBLinux Simple VideoDiskRecorder Protocol SVDRP (svdrp…
- CVE-2021-47729Selea Targa IP Camera Stored Cross-Site Scripting via Files Listselea s.r.l. Selea Targa IP OCR-ANPR Camera
- CVE-2021-47723STVS ProVision Cross-Site Request Forgery (Add Admin)STVS SA STVS ProVision
- CVE-2021-47717IntelliChoice eFORCE Software Suite Username EnumerationIntelliChoice eFORCE Software Suite
- CVE-2025-13743Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logsDocker Desktop
- CVE-2025-64896Creative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)Adobe Creative Cloud Desktop
- CVE-2021-47703OpenBMCS Server Side Request Forgery (SSRF) via /php/query.phpOPEN BMCS OpenBMCS
- CVE-2021-47702OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.phpOPEN BMCS OpenBMCS
- CVE-2025-64786Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)Adobe Acrobat Reader
- CVE-2025-64787Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)Adobe Acrobat Reader
- CVE-2025-66625Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityUmbraco-CMS · Umbraco.Cms
- CVE-2025-14337itsourcecode Student Management System new_grade.php sql injectionitsourcecode Student Management System
- CVE-2025-14336itsourcecode Student Management System promote.php sql injectionitsourcecode Student Management System
- CVE-2025-14335itsourcecode Student Management System new_school_year.php sql injectionitsourcecode Student Management System
- CVE-2025-9613CVE-2025-9613PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…
- CVE-2025-9614CVE-2025-9614PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…
- CVE-2025-9612CVE-2025-9612PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…
- CVE-2025-14334itsourcecode Student Management System new_adviser.php sql injectionitsourcecode Student Management System
- CVE-2025-11531HP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code ExecutionHP System Event Utility · HP Omen Gaming Hub
- CVE-2025-34408MailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspxMailEnable
- CVE-2025-34398MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspxMailEnable
- CVE-2025-34399MailEnable < 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspxMailEnable
- CVE-2025-34400MailEnable < 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspxMailEnable
- CVE-2025-34409MailEnable < 10.54 Reflected XSS in Failed Parameter of MAI/AddRecipientsResult.aspxMailEnable
- CVE-2025-34401MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspxMailEnable
- CVE-2025-34402MailEnable < 10.54 Reflected XSS in FieldCc Parameter of AddressBook.aspxMailEnable
- CVE-2025-34403MailEnable < 10.54 Reflected XSS in FieldTo Parameter of AddressBook.aspxMailEnable
- CVE-2025-34406MailEnable < 10.54 Reflected XSS in Id Parameter of Mobile/ContactDetails.aspxMailEnable
- CVE-2025-34404MailEnable < 10.54 Reflected XSS in InstanceScope Parameter of CAL/compose.aspxMailEnable
- CVE-2025-34397MailEnable < 10.54 Reflected XSS in Message Parameter of Mobile/Compose.aspxMailEnable
- CVE-2025-34407MailEnable < 10.54 Reflected XSS in theme Parameter of Statistics.aspxMailEnable
- CVE-2025-62567Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-62468Windows Defender Firewall Service Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-62465DirectX Graphics Kernel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-62463DirectX Graphics Kernel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-64670Windows DirectX Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-64667Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2025-62473Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-64894DNG SDK | Integer Overflow or Wraparound (CWE-190)Adobe DNG SDK
- CVE-2025-46636Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability.Dell Encryption
- CVE-2025-13924Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publicationmaartenbelmans Advanced Product Fields (Product Addons) for…
- CVE-2024-47570An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all verFortinet FortiSASE · Fortinet FortiProxy +3
- CVE-2025-53679An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiSandbox
- CVE-2025-54353An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2025-59810An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2025-59808An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 thrFortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2025-54838An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a sharedFortinet FortiPortal
- CVE-2025-62631An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 alFortinet FortiOS
- CVE-2025-57823A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, Fortinet FortiAuthenticator
- CVE-2025-64153A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, Fortinet FortiExtender
- CVE-2025-59923An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAutheFortinet FortiAuthenticator
- CVE-2025-64156An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7Fortinet FortiVoice
- CVE-2025-64471A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1Fortinet FortiWeb
- CVE-2025-12946Improper input validation in NETGEAR Nighthawk routersNETGEAR RS700 · NETGEAR RAX54Sv2 +15
- CVE-2025-12945Improper input validation in NETGEAR Nighthawk router R7000PNETGEAR R7000P
- CVE-2025-12941Denial of Service Vulnerability in NETGEAR C6220 and C6230NETGEAR C6220 · NETGEAR C6230
- CVE-2022-46845WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerabilityEssential Plugin Slider a SlidersPack
- CVE-2022-47425WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access ControlRepute Infosystems ARMember
- CVE-2023-22675WordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerabilityTaylor Hawkes WP Fast Cache
- CVE-2023-23729WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change VulnerabilityBrainstorm Force Spectra
- CVE-2025-9638i-Educar 2.10.0 - Stored Cross-Site Scripting (XSS) in admin panelPortabilis i-Educar
- CVE-2025-13642ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Executionproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2025-67467WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityStellarWP GiveWP
- CVE-2025-66533WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerabilityLiquid Web / StellarWP GiveWP
- CVE-2025-14345Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerMongoDB Server
- CVE-2024-38798Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilegeTianoCore EDK2
- CVE-2025-63077WordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerabilityHappyMonster Happy Addons for Elementor
- CVE-2025-63075WordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerabilitymuffingroup Betheme
- CVE-2025-63073WordPress The7 theme < 12.9.0 - Cross Site Scripting (XSS) vulnerabilityDream-Theme The7
- CVE-2025-63072WordPress Cornerstone plugin <= 7.7.3 - Cross Site Scripting (XSS) vulnerabilityTHEMECO Cornerstone
- CVE-2025-63071WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerabilityaverta Shortcodes and extra features for Phlox theme
- CVE-2025-63070WordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerabilityShahjada Download Manager
- CVE-2025-63069WordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerabilityVinod Dalvi Ivory Search
- CVE-2025-63068WordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerabilitysevenspark Contact Form 7 – Dynamic Text Extension
- CVE-2025-63067WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerabilityp-themes Porto Theme - Functionality
- CVE-2025-63066WordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerabilityp-themes Porto Theme - Functionality
- CVE-2025-63065WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2025-63064WordPress EventON plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerabilityashanjay EventON
- CVE-2025-63063WordPress Yandex.Metrica plugin <= 1.2.2 - Broken Access Control vulnerabilityYandex Metrika Yandex.Metrica
- CVE-2025-63061WordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerabilityhogash KALLYAS
- CVE-2025-63060WordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerabilityhogash KALLYAS
- CVE-2025-63059WordPress Ninja Popups plugin <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityarscode Ninja Popups
- CVE-2025-63058WordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerabilityHiroaki Miyashita Custom Field Template
- CVE-2025-63057WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerabilityRoxnor Wp Ultimate Review
- CVE-2025-63056WordPress Contact Form by BestWebSoft plugin <= 4.3.6 - Broken Access Control vulnerabilityContact Form by BestWebSoft
- CVE-2025-63055WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerabilityLiton Arefin Master Addons for Elementor
- CVE-2025-63054WordPress Quiz And Survey Master plugin <= 10.3.2 - Broken Access Control vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2025-63052WordPress SimpLy Gallery plugin <= 3.3.2.1 - Cross Site Scripting (XSS) vulnerabilityGalleryCreator SimpLy Gallery
- CVE-2025-63050WordPress REHub Framework plugin < 19.9.9.7 - Cross Site Scripting (XSS) vulnerabilitysizam REHub Framework
- CVE-2025-63049WordPress ListingPro Lead Form plugin <= 1.0.7 - Broken Access Control vulnerabilityCridioStudio ListingPro Lead Form
- CVE-2025-63048WordPress ListingPro Lead Form plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro Lead Form
- CVE-2025-63047WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerabilityCridioStudio ListingPro
- CVE-2025-63046WordPress ListingPro plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro
- CVE-2025-63045WordPress Master Slider Pro plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerabilityaverta Master Slider Pro
- CVE-2025-63044WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerabilityXpro Elementor Addons
- CVE-2025-63042WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS Elementor Addons
- CVE-2025-63037WordPress Ronneby Theme Core plugin <= 1.5.68 - Cross Site Scripting (XSS) vulnerabilityDFDevelopment Ronneby Theme Core
- CVE-2025-63035WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerabilityVibeThemes WPLMS
- CVE-2025-63034WordPress Page View Count plugin <= 2.9.0 - Settings Change vulnerabilitySteve Truman Page View Count
- CVE-2025-63033WordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityRiyadh Ahmed Make Section & Column Clickable For Elementor
- CVE-2025-63028WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerabilityshinetheme Traveler
- CVE-2025-63025WordPress Xagio SEO plugin <= 7.1.0.37 - Broken Access Control vulnerabilityXagio SEO
- CVE-2025-63024WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerabilitytychesoftwares Order Delivery Date for WooCommerce
- CVE-2025-63023WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerabilityEasy Payment Payment Gateway for PayPal on WooCommerce
- CVE-2025-63015WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerabilityWooCommerce Payment Gateway - Paysera
- CVE-2025-63013WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerabilityThimPress WP Hotel Booking
- CVE-2025-63012WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerabilityThimPress WP Hotel Booking
- CVE-2025-63011WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerabilityThimPress WP Hotel Booking
- CVE-2025-63010WordPress Hercules Core plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerabilityThemesInflow Hercules Core
- CVE-2025-63009WordPress WP Google Analytics Events plugin <= 2.8.2 - Sensitive Data Exposure vulnerabilityyuvalo WP Google Analytics Events
- CVE-2025-63008WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerabilityweDevs WP ERP
- CVE-2025-63007WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerabilityMetagauss EventPrime
- CVE-2025-63006WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerabilityMetagauss EventPrime
- CVE-2025-62999WordPress Litho Addons plugin <= 3.5 - Broken Access Control vulnerabilitythemezaa Litho Addons
- CVE-2025-62997WordPress WP EasyCart plugin <= 5.8.11 - Sensitive Data Exposure vulnerabilitylevelfourdevelopment WP EasyCart
- CVE-2025-62996WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerabilityCode Amp Custom Layouts – Post + Product grids made easy
- CVE-2025-62995WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerabilityMultiParcels Shipping For WooCommerce
- CVE-2025-62994WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerabilityWP Messiah WP AI CoPilot
- CVE-2025-62993WordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerabilityrainafarai Notification for Telegram
- CVE-2025-62873WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityFlashyapp WP Flashy Marketing Automation
- CVE-2025-62872WordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerabilityJK Social Photo Fetcher
- CVE-2025-62871WordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityAlex Prokopenko / JustCoded Just TinyMCE Custom Styles
- CVE-2025-62870WordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerabilityEupago Gateway For Woocommerce
- CVE-2025-62869WordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerabilityGravitec.net - Web Push Notifications Gravitec.net – Web Pu…
- CVE-2025-62867WordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerabilityErgonet Cache
- CVE-2025-62866WordPress Auto Alt Text plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityValerio Monti Auto Alt Text
- CVE-2025-62865WordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerabilityEvan Herman Post Cloner
- CVE-2025-62762WordPress SMTP Mail plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerabilityphotoboxone SMTP Mail
- CVE-2025-62740WordPress WP-CRM System plugin <= 3.4.6 - Broken Access Control vulnerabilityMario Peshev WP-CRM System
- CVE-2025-62739WordPress Add Custom Codes plugin <= 4.80 - Cross Site Request Forgery (CSRF) vulnerabilitySaifuMak Add Custom Codes
- CVE-2025-62738WordPress Formstack Online Forms plugin <= 2.0.2 - Broken Access Control vulnerabilitymmattax Formstack Online Forms
- CVE-2025-62737WordPress Image Cleanup plugin <= 1.9.2 - Sensitive Data Exposure vulnerabilityopicron Image Cleanup
- CVE-2025-62736WordPress Image Cleanup plugin <= 1.9.2 - Broken Access Control vulnerabilityopicron Image Cleanup
- CVE-2025-62735WordPress User Spam Remover plugin <= 1.1 - Sensitive Data Exposure vulnerabilityJoel User Spam Remover
- CVE-2025-62734WordPress Media Library Downloader plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityM.Code Media Library Downloader
- CVE-2025-62733WordPress Custom Sidebars by ProteusThemes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerabilityCustom Sidebars by ProteusThemes
- CVE-2025-62153WordPress Quick Interest Slider plugin <= 3.1.7 - Broken Access Control vulnerabilityGraham Quick Interest Slider
- CVE-2025-62152WordPress ConveyThis plugin <= 269.2 - Broken Access Control vulnerabilityConveyThis
- CVE-2025-62151WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerabilityVirtuaria PagBank / PagSeguro para Woocommerce
- CVE-2025-62109WordPress Geo Controller plugin <= 8.9.4 - Sensitive Data Exposure vulnerabilityINFINITUM FORM Geo Controller
- CVE-2025-62103WordPress Media Library File Download plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitywpmediadownload Media Library File Download
- CVE-2025-62102WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityapasionados DoFollow Case by Case
- CVE-2025-62100WordPress ThemeRain Core plugin <= 1.1.9 - Broken Access Control vulnerabilityThemeRain Core
- CVE-2025-62090WordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulnerabilityJegstudio Gutenverse News – Advanced News Magazine Blog Gut…
- CVE-2025-62086WordPress Яндекс Доставка (Boxberry) plugin <= 2.34 - Broken Access Control vulnerabilityakazanstev Яндекс Доставка
- CVE-2025-62085WordPress BERTHA AI plugin <= 1.13 - Broken Access Control vulnerabilityBertha AI – Andrew Palmer BERTHA AI
- CVE-2025-62082WordPress Generic Elements plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityNasir Uddin Generic Elements
- CVE-2025-59132WordPress Duplicate Content Cure plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityBadi Jones Duplicate Content Cure
- CVE-2025-49350WordPress Actionwear products sync plugin <= 2.3.3 - Broken Access Control vulnerabilitymarcoingraiti Actionwear products sync
- CVE-2025-49348WordPress Hype plugin <= 1.0.5 - Broken Access Control vulnerabilityHype
- CVE-2025-6923Reflected XSS in Talent Software's UNISTalent Software UNIS
- CVE-2025-67599WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerabilityWebToffee eCommerce Marketing Automation
- CVE-2025-67598WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityPSM Plugins SupportCandy
- CVE-2025-67597WordPress Fluent Booking plugin <= 1.9.11 - Broken Access Control vulnerabilityShahjahan Jewel Fluent Booking
- CVE-2025-67596WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerabilityStrategy11 Team Business Directory
- CVE-2025-67595WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerabilityAys Pro Quiz Maker
- CVE-2025-67594WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerabilityThimPress Thim Elementor Kit
- CVE-2025-67593WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerabilityStiofan UsersWP
- CVE-2025-67592WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerabilityJoe Dolson My Calendar
- CVE-2025-67591WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerabilityjegtheme JNews Paywall
- CVE-2025-67590WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityRustaurius Ultimate FAQ
- CVE-2025-67589WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerabilityWP Overnight WooCommerce PDF Invoices & Packing Slips
- CVE-2025-67588WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerabilityElementor Website Builder
- CVE-2025-67587WordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerabilityCRM Perks WP Gravity Forms FreshDesk Plugin
- CVE-2025-67586WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerabilityRonald Huereca Highlight and Share
- CVE-2025-67585WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerabilityFlexmls® IDX
- CVE-2025-67584WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerabilityrtCamp GoDAM
- CVE-2025-67583WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerabilityFoysal Imran IDonate
- CVE-2025-67582WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerabilitywbcomdesigns Wbcom Designs
- CVE-2025-67581WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerabilitythemetechmount TrueBooker
- CVE-2025-67580WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerabilityConstant Contact + WooCommerce
- CVE-2025-67579WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerabilityvanquish User Extra Fields
- CVE-2025-67578WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerabilityRhys Wynne WP Email Capture
- CVE-2025-67577WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerabilityhassantafreshi Easy Form Builder
- CVE-2025-67576WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerabilityQuantumCloud Simple Link Directory
- CVE-2025-67575WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerabilityAndrew Lima Sitewide Notice WP
- CVE-2025-67574WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerabilitywpdevart Booking calendar, Appointment Booking System
- CVE-2025-67573WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerabilityThimPress Sailing
- CVE-2025-67572WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerabilityPenciDesign PenNews
- CVE-2025-67571WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerabilityWPFunnels
- CVE-2025-67570WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerabilityWesternDeal WPForms Google Sheet Connector
- CVE-2025-67569WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerabilityscriptsbundle AdForest
- CVE-2025-67568WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerabilityxtemos Basel
- CVE-2025-67567WordPress Sober theme <= 3.5.11 - Sensitive Data Exposure vulnerabilityuixthemes Sober
- CVE-2025-67566WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerabilityWofficeIO Woffice Core
- CVE-2025-67565WordPress Rehub theme <= 19.9.9.1 - Sensitive Data Exposure vulnerabilitysizam Rehub
- CVE-2025-67564WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerabilityalekv Pixel Manager for WooCommerce
- CVE-2025-67563WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerabilitySaad Iqbal Post SMTP
- CVE-2025-67562WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerabilityWebCodingPlace Image Caption Hover Pro
- CVE-2025-67561WordPress Debug Log Viewer plugin <= 2.0.3 - Broken Access Control vulnerabilityOleksandr Lysyi Debug Log Viewer
- CVE-2025-67560WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerabilityWebilia Listdom
- CVE-2025-67559WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2025-67558WordPress Rencontre plugin <= 3.13.7 - Cross Site Scripting (XSS) vulnerabilityJacques Malgrange Rencontre
- CVE-2025-67557WordPress WP eBay Product Feeds plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerabilityRhys Wynne WP eBay Product Feeds
- CVE-2025-67556WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityThemeHigh Advanced FAQ Manager
- CVE-2025-67555WordPress UseStrict's Calendly Embedder plugin <= 1.1.7.2 - Cross Site Scripting (XSS) vulnerabilityUseStrict's Calendly Embedder
- CVE-2025-67554WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerabilityHumanityco Cookie Notice & Compliance for GDPR / CCPA
- CVE-2025-67553WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityThemeHigh Advanced FAQ Manager
- CVE-2025-67552WordPress Walker Core plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerabilityWalkerWP Walker Core
- CVE-2025-67551WordPress Wappointment plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerabilityWappointment team Wappointment
- CVE-2025-67550WordPress Donation Thermometer plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityrhewlif Donation Thermometer
- CVE-2025-67549WordPress oik plugin <= 4.15.3 - Cross Site Scripting (XSS) vulnerabilitybobbingwide oik
- CVE-2025-67548WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerabilityWP Delicious
- CVE-2025-67545WordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerabilityFirePlugins FireBox
- CVE-2025-67544WordPress Shopkeeper Extender plugin < 7.0 - Cross Site Scripting (XSS) vulnerabilityGet Bowtied Shopkeeper Extender
- CVE-2025-67543WordPress Essential Widgets plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityCatch Themes Essential Widgets
- CVE-2025-67542WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerabilitySilkyPress Multi-Step Checkout for WooCommerce
- CVE-2025-67541WordPress WP-ShowHide plugin <= 1.05 - Cross Site Scripting (XSS) vulnerabilityLester Chan WP-ShowHide
- CVE-2025-67540WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerabilityWealcoder Animation Addons for Elementor
- CVE-2025-67539WordPress Select Core plugin < 2.6 - Cross Site Scripting (XSS) vulnerabilitySelect-Themes Select Core
- CVE-2025-67538WordPress JNews Gallery plugin < 12.0.1 - Cross Site Scripting (XSS) vulnerabilityjegtheme JNews Gallery
- CVE-2025-67537WordPress ThirstyAffiliates plugin <= 3.11.8 - Cross Site Scripting (XSS) vulnerabilityBlair Williams ThirstyAffiliates
- CVE-2025-67536WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerabilityThimPress LearnPress
- CVE-2025-67535WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerabilityFlipper Code - WordPress Development Company WP Maps
- CVE-2025-67474WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerabilityUltimate Member ForumWP
- CVE-2025-67473WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerabilitycodeworkweb CWW Companion
- CVE-2025-67472WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2025-67471WordPress Quick Contact Form plugin <= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerabilitySaad Iqbal Quick Contact Form
- CVE-2025-67470WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerabilityEssential Plugin Portfolio and Projects
- CVE-2025-67469WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitykubiq PDF Thumbnail Generator
- CVE-2025-67468WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerabilityCRM Perks Integration for Salesforce and Contact Form 7, WP…
- CVE-2025-67466WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerabilitysergiotrinity Trinity Audio
- CVE-2025-67465WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerabilityQuantumCloud Simple Link Directory
- CVE-2025-66534WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerabilityElated-Themes The Aisle
- CVE-2025-66532WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerabilityMikado-Themes Powerlift
- CVE-2025-66531WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerabilityDimitri Grassi Salon booking system
- CVE-2025-66530WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerabilityWebba Appointment Booking Webba Booking
- CVE-2025-66529WordPress Chartify plugin <= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerabilityAys Pro Chartify
- CVE-2025-66528WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerabilityVillaTheme Thank You Page Customizer for WooCommerce
- CVE-2025-66527WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerabilityVanKarWai Lobo
- CVE-2025-66526WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerabilityEssekia Tablesome
- CVE-2025-66525WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerabilityElastic Email Sender
- CVE-2025-64257WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerabilityJoe Dolson My Tickets
- CVE-2025-64256WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityPressTigers Simple Folio
- CVE-2025-64255WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerabilityBowo Admin and Site Enhancements
- CVE-2025-64254WordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerabilityRonald Huereca Photo Block
- CVE-2025-12558Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposurebeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2025-10876XSS in Talent Software's e-BapTalent Software e-BAP Automation
- CVE-2025-12381Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall AnalyzerAlgoSec Firewall Analyzer
- CVE-2025-6924Reflected XSS in Talent Software's e-BAPTalent Software e-BAP Automation
- CVE-2025-14331Same-origin policy bypass in the Request Handling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2024-56464IBM QRadar SIEM is affected by an information disclosure vulnerabilityIBM QRadar SIEM
- CVE-2025-40941A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1).Siemens SIMATIC CN
- CVE-2025-40940A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1).Siemens SIMATIC CN
- CVE-2025-40939A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1).Siemens SIMATIC CN
- CVE-2025-40935A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUSiemens RUGGEDCOM RMC8388 V5.X · Siemens RUGGEDCOM RS41… +19
- CVE-2025-40831A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0).Siemens SINEC Security Monitor
- CVE-2025-40830A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0).Siemens SINEC Security Monitor
- CVE-2025-40819A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4).Siemens SINEMA Remote Connect Server
- CVE-2025-40818A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4).Siemens SINEMA Remote Connect Server
- CVE-2025-40807A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1).Siemens Gridscale X Prepay
- CVE-2025-40806A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1).Siemens Gridscale X Prepay
- CVE-2025-59029Internal logic flaw in cache management can lead to a denial of service in PowerDNS RecursorPowerDNS Recursor
- CVE-2025-66271Clone for Windows provided by ELECOM CO.,LTD.ELECOM CO. Clone for Windows
- CVE-2025-64696Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory.Brother Industries Android App "Brother iPrint&Scan"
- CVE-2025-41693Authenticated Denial-of-Service via SSHPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41696Hardcoded User PasswordPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41694Authenticated Denial-of-Service via WebshellPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41692Weak/Predictable root PasswordPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-41697Shell access to UART ConsolePhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-14311Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3.JMRI
- CVE-2025-13070CSV to SortTable <= 4.2 - Contributor+ LFICSV to SortTable
- CVE-2025-13031WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSSWPeMatico RSS Feed Fetcher
- CVE-2025-14284Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allo@tiptap/extension-link
- CVE-2025-40341futex: Don't leak robust_list pointer on exec raceLinux
- CVE-2025-40340drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.Linux
- CVE-2025-40339drm/amdgpu: fix nullptr err of vm_handle_movedLinux
- CVE-2025-40338ASoC: Intel: avs: Do not share the name pointer between componentsLinux
- CVE-2025-40335drm/amdgpu: validate userq input argsLinux
- CVE-2025-40333f2fs: fix infinite loop in __insert_extent_tree()Linux
- CVE-2025-40332drm/amdkfd: Fix mmap write lock not releaseLinux
- CVE-2025-40330bnxt_en: Shutdown FW DMA in bnxt_shutdown()Linux
- CVE-2025-40329drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cbLinux
- CVE-2025-40327perf/core: Fix system hang caused by cpu-clock usageLinux
- CVE-2025-67487Static Web Server is vulnerable to symbolic link Path Traversalstatic-web-server
- CVE-2025-66578robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validationrobrichards xmlseclibs · robrichards/xmlseclibs
- CVE-2025-42904Information Disclosure vulnerability in Application Server ABAPSAP_SE Application Server ABAP
- CVE-2025-42896Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2025-42891Missing Authorization check in SAP Enterprise Search for ABAPSAP_SE SAP Enterprise Search for ABAP
- CVE-2025-42875Missing Authentication check in SAP NetWeaver Internet Communication FrameworkSAP_SE SAP NetWeaver Internet Communication Framework
- CVE-2025-42873Denial of Service (DoS) in SAPUI5 framework (Markdown-it component)SAP_SE SAPUI5 framework
- CVE-2025-42872Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalSAP_SE SAP NetWeaver Enterprise Portal
- CVE-2025-66622matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuesmatrix-org matrix-rust-sdk · matrix-sdk-base
- CVE-2025-665081Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers1Panel-dev 1Panel · github.com/1Panel-dev/1Panel +1
- CVE-2025-14286Tenda AC9 Configuration File DownloadCfg.jpg information disclosureTenda AC9
- CVE-2023-53865btrfs: fix warning when putting transaction with qgroups enabled after abortLinux
- CVE-2023-53864drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable()Linux
- CVE-2023-53863netlink: do not hard code device address lenth in fdb dumpsLinux
- CVE-2023-53861ext4: correct grp validation in ext4_mb_good_groupLinux
- CVE-2023-53859s390/idle: mark arch_cpu_idle() noinstrLinux
- CVE-2023-53858tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of errorLinux
- CVE-2023-53857bpf: bpf_sk_storage: Fix invalid wait context lockdep reportLinux
- CVE-2023-53856of: overlay: Call of_changeset_init() earlyLinux
- CVE-2023-53855net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver removeLinux
- CVE-2023-53854ASoC: mediatek: mt8186: Fix use-after-free in driver remove pathLinux
- CVE-2023-53853netlink: annotate accesses to nlk->cb_runningLinux
- CVE-2023-53852nvme-core: fix memory leak in dhchap_secret_storeLinux
- CVE-2023-53850iavf: use internal state to free traffic IRQsLinux
- CVE-2023-53849drm/msm: fix workqueue leak on bind errorsLinux
- CVE-2023-53848md/raid5-cache: fix a deadlock in r5l_exit_log()Linux
- CVE-2023-53847usb-storage: alauda: Fix uninit-value in alauda_check_media()Linux
- CVE-2023-53845nilfs2: fix infinite loop in nilfs_mdt_get_block()Linux
- CVE-2023-53843net: openvswitch: reject negative ifindexLinux
- CVE-2023-53842ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component removeLinux
- CVE-2023-53841devlink: report devlink_port_type_warn source deviceLinux
- CVE-2023-53840usb: early: xhci-dbc: Fix a potential out-of-bound memory accessLinux
- CVE-2023-53839dccp: fix data-race around dp->dccps_mss_cacheLinux
- CVE-2023-53837drm/msm: fix NULL-deref on snapshot tear downLinux
- CVE-2023-53834iio: adc: ina2xx: avoid NULL pointer dereference on OF device matchLinux
- CVE-2023-53833drm/i915: Fix NULL ptr deref by checking new_crtc_stateLinux
- CVE-2023-53832md/raid10: fix null-ptr-deref in raid10_sync_requestLinux
- CVE-2023-53831net: read sk->sk_family once in sk_mc_loop()Linux
- CVE-2023-53830platform/x86: think-lmi: Fix memory leak when showing current settingsLinux
- CVE-2023-53826ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()Linux
- CVE-2023-53825kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().Linux
- CVE-2023-53821ip6_vti: fix slab-use-after-free in decode_session6Linux
- CVE-2022-50679i40e: Fix DMA mappings leakLinux
- CVE-2022-50678wifi: brcmfmac: fix invalid address access when enabling SCAN log levelLinux
- CVE-2022-50675arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restoredLinux
- CVE-2022-50674riscv: vdso: fix NULL deference in vdso_join_timens() when vforkLinux
- CVE-2022-50672mailbox: zynq-ipi: fix error handling while device_register() failsLinux
- CVE-2022-50670mmc: omap_hsmmc: fix return value check of mmc_add_host()Linux
- CVE-2022-50669misc: ocxl: fix possible name leak in ocxl_file_register_afu()Linux
- CVE-2022-50667drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()Linux
- CVE-2022-50664media: dvb-frontends: fix leak of memory fwLinux
- CVE-2022-50663net: stmmac: fix possible memory leak in stmmac_dvr_probe()Linux
- CVE-2022-50662RDMA/hns: fix memory leak in hns_roce_alloc_mr()Linux
- CVE-2022-50661seccomp: Move copy_seccomp() to no failure path.Linux
- CVE-2022-50660wifi: ipw2200: fix memory leak in ipw_wdev_init()Linux
- CVE-2022-50659hwrng: geode - Fix PCI device refcount leakLinux
- CVE-2022-50658cpufreq: qcom: fix memory leak in error pathLinux
- CVE-2022-50657riscv: mm: add missing memcpy in kasan_initLinux
- CVE-2023-53820loop: loop_set_status_from_info() check before assignmentLinux
- CVE-2025-14285code-projects Employee Profile Management System edit_personnel.php sql injectioncode-projects Employee Profile Management System
- CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx Providertraefik · github.com/traefik/traefik +2
- CVE-2025-66490Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rulestraefik · github.com/traefik/traefik +2
- CVE-2025-66470NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentzauberzeug nicegui · nicegui
- CVE-2023-53818ARM: zynq: Fix refcount leak in zynq_early_slcr_initLinux
- CVE-2023-53815posix-timers: Prevent RT livelock in itimer_delete()Linux
- CVE-2023-53814PCI: Fix dropping valid root bus resources with .end = zeroLinux
- CVE-2023-53813ext4: fix rbtree traversal bug in ext4_mb_use_preallocatedLinux
- CVE-2023-53812media: mediatek: vcodec: fix decoder disable pm crashLinux
- CVE-2023-53811RDMA/irdma: Cap MSIX used to online CPUs + 1Linux
- CVE-2023-53809l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()Linux
- CVE-2023-53808wifi: mwifiex: fix memory leak in mwifiex_histogram_read()Linux
- CVE-2023-53807clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()Linux
- CVE-2023-53802wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback functionLinux
- CVE-2023-53801iommu/sprd: Release dma buffer to avoid memory leakLinux
- CVE-2023-53799crypto: api - Use work queue in crypto_destroy_instanceLinux
- CVE-2023-53798ethtool: Fix uninitialized number of lanesLinux
- CVE-2023-53796f2fs: fix information leak in f2fs_move_inline_dirents()Linux
- CVE-2023-53793perf tool x86: Fix perf_env memory leakLinux
- CVE-2023-53792nvme-core: fix memory leak in dhchap_ctrl_secretLinux
- CVE-2023-53791md: fix warning for holder mismatch from export_rdev()Linux
- CVE-2023-53789iommu/amd: Improve page fault error reportingLinux
- CVE-2023-53788ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()Linux
- CVE-2023-53787regulator: da9063: fix null pointer deref with partial DT configLinux
- CVE-2023-53786dm flakey: fix a crash with invalid table lineLinux
- CVE-2023-53784drm: bridge: dw_hdmi: fix connector access for scdcLinux
- CVE-2023-53783blk-iocost: fix divide by 0 error in calc_lcoefs()Linux
- CVE-2023-53782dccp: Fix out of bounds access in DCCP error handlerLinux
- CVE-2023-53780drm/amd/display: fix FCLK pstate change underflowLinux
- CVE-2023-53777erofs: kill hooked chains to avoid loops on deduplicated compressed imagesLinux
- CVE-2022-50655ppp: associate skb with a device at txLinux
- CVE-2022-50654bpf: Fix panic due to wrong pageattr of im->imageLinux
- CVE-2022-50653mmc: atmel-mci: fix return value check of mmc_add_host()Linux
- CVE-2022-50652uio: uio_dmem_genirq: Fix missing unlock in irq configurationLinux
- CVE-2022-50651ethtool: eeprom: fix null-deref on genl_info in dumpLinux
- CVE-2022-50649power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()Linux
- CVE-2022-50648ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_callerLinux
- CVE-2022-50647RISC-V: Make port I/O string accessors actually workLinux
- CVE-2022-50646scsi: hpsa: Fix possible memory leak in hpsa_init_one()Linux
- CVE-2022-50645EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()Linux
- CVE-2022-50644clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probeLinux
- CVE-2022-50643cifs: Fix xid leak in cifs_copy_file_range()Linux
- CVE-2022-50642platform/chrome: cros_ec_typec: zero out stale pointersLinux
- CVE-2022-50641HSI: omap_ssi: Fix refcount leak in ssi_probeLinux
- CVE-2022-50640mmc: core: Fix kernel panic when remove non-standard SDIO cardLinux
- CVE-2022-50639io-wq: Fix memory leak in worker creationLinux
- CVE-2022-50638ext4: fix bug_on in __es_tree_search caused by bad boot loader inodeLinux
- CVE-2022-50637cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()Linux
- CVE-2022-50636PCI: Fix pci_device_is_present() for VFs by checking PFLinux
- CVE-2022-50635powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()Linux
- CVE-2022-50634power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()Linux
- CVE-2022-50633usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_initLinux
- CVE-2025-61074A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 a
- CVE-2025-61078Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML
- CVE-2025-63737Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attack
- CVE-2025-63738An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via th
- CVE-2025-63739An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing
- CVE-2025-63740SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sen
- CVE-2025-64085A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a De
- CVE-2025-64086A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to caus
- CVE-2025-65288A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long
- CVE-2025-65289A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote att
- CVE-2025-65300A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set
- CVE-2025-65572Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) c