# CVEs published 2025-12-09

667 CVEs were published on December 9, 2025: 42 critical, 217 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-67502](https://cve.now/CVE-2025-67502.md): Taguette does not safeguard against Open Redirect (CVSS 5.4, remram44 taguette · taguette)
- [CVE-2025-67501](https://cve.now/CVE-2025-67501.md): WeGIA is vulnerable to SQL Injection via editar\_categoria endpoint parameter (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-67500](https://cve.now/CVE-2025-67500.md): Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration (CVSS 3.7, mastodon)
- [CVE-2025-61808](https://cve.now/CVE-2025-61808.md): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-61813](https://cve.now/CVE-2025-61813.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 7.4, Adobe ColdFusion)
- [CVE-2025-61812](https://cve.now/CVE-2025-61812.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-61821](https://cve.now/CVE-2025-61821.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 6.8, Adobe ColdFusion)
- [CVE-2025-64898](https://cve.now/CVE-2025-64898.md): ColdFusion | Insufficiently Protected Credentials (CWE-522) (CVSS 5.3, Adobe ColdFusion)
- [CVE-2025-61810](https://cve.now/CVE-2025-61810.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-61809](https://cve.now/CVE-2025-61809.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-61822](https://cve.now/CVE-2025-61822.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 6.2, Adobe ColdFusion)
- [CVE-2025-64897](https://cve.now/CVE-2025-64897.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 5.6, Adobe ColdFusion)
- [CVE-2025-61823](https://cve.now/CVE-2025-61823.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 6.2, Adobe ColdFusion)
- [CVE-2025-61811](https://cve.now/CVE-2025-61811.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-67499](https://cve.now/CVE-2025-67499.md): CNI Plugins Portmap nftables backend intercepts non-local traffic (CVSS 6.6, containernetworking plugins · github.com/containernetworkin…)
- [CVE-2025-67496](https://cve.now/CVE-2025-67496.md): WeGia is Vulnerable to XSS through id\_pessoa Parameter on Password Configuration Page (CVSS 4.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-67495](https://cve.now/CVE-2025-67495.md): ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login (CVSS 8.0, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2025-67494](https://cve.now/CVE-2025-67494.md): ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login (CVSS 9.3, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2025-36437](https://cve.now/CVE-2025-36437.md): IBM Planning Analytics Local is vulnerable to disclosing sensitive information (CVSS 4.3, IBM Planning Analytics Local)
- [CVE-2025-66645](https://cve.now/CVE-2025-66645.md): NiceGUI Path Traversal Vulnerability in app.add\_media\_files() Allows Arbitrary File Reading (CVSS 7.5, zauberzeug nicegui · nicegui)
- [CVE-2025-66039](https://cve.now/CVE-2025-66039.md): FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header (CVSS 9.3, FreePBX framework)
- [CVE-2025-34425](https://cve.now/CVE-2025-34425.md): MailEnable \< 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx (CVSS 5.3, MailEnable)
- [CVE-2023-53774](https://cve.now/CVE-2023-53774.md): MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code Execution (CVSS 6.9, MiniDVBLinux Simple VideoDiskRecorder Protocol SVDRP (svdrp…)
- [CVE-2023-53773](https://cve.now/CVE-2023-53773.md): MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv\_action.sh (CVSS 8.7, MiniDVBLinux)
- [CVE-2023-53772](https://cve.now/CVE-2023-53772.md): MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page (CVSS 8.7, MiniDVBLinux)
- [CVE-2023-53771](https://cve.now/CVE-2023-53771.md): MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup (CVSS 9.3, MiniDVBLinux Change Root Password PoC)
- [CVE-2025-67489](https://cve.now/CVE-2025-67489.md): @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server (CVSS 9.8, vitejs vite-plugin-react · @vitejs/plugin-rsc)
- [CVE-2023-53770](https://cve.now/CVE-2023-53770.md): MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint (CVSS 8.7, MiniDVBLinux(TM) Distribution)
- [CVE-2023-53739](https://cve.now/CVE-2023-53739.md): Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure (CVSS 9.9, Tinycontrol LAN Controller v · Tinycontrol LK)
- [CVE-2021-47731](https://cve.now/CVE-2021-47731.md): Selea Targa IP Camera Developer Backdoor Configuration Overwrite (CVSS 9.3, Selea s.r.l. Selea Targa IP OCR-ANPR Camera)
- [CVE-2021-47730](https://cve.now/CVE-2021-47730.md): Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation (CVSS 8.5, Selea s.r.l. Selea Targa IP OCR-ANPR Camera)
- [CVE-2021-47729](https://cve.now/CVE-2021-47729.md): Selea Targa IP Camera Stored Cross-Site Scripting via Files List (CVSS 5.1, selea s.r.l. Selea Targa IP OCR-ANPR Camera)
- [CVE-2021-47728](https://cve.now/CVE-2021-47728.md): Selea Targa IP Camera Remote Code Execution via Utils (CVSS 9.3, Selea Targa IP OCR-ANPR Camera)
- [CVE-2021-47727](https://cve.now/CVE-2021-47727.md): Selea Targa IP Camera Unauthenticated Stream Disclosure (CVSS 8.7, Selea s.r.l. Selea Targa IP OCR-ANPR Camera)
- [CVE-2021-47724](https://cve.now/CVE-2021-47724.md): STVS ProVision Authenticated File Disclosure via archive.rb (CVSS 7.1, STVS SA STVS ProVision)
- [CVE-2021-47723](https://cve.now/CVE-2021-47723.md): STVS ProVision Cross-Site Request Forgery (Add Admin) (CVSS 6.9, STVS SA STVS ProVision)
- [CVE-2021-47719](https://cve.now/CVE-2021-47719.md): CNC\_Ctrl DllUnregisterServer f5501 Access Violation (CVSS 8.7, COMMAX Co. COMMAX WebViewer ActiveX Control)
- [CVE-2021-47718](https://cve.now/CVE-2021-47718.md): OpenBMCS Directory Listing Information Disclosure (CVSS 8.7, OPEN BMCS OpenBMCS)
- [CVE-2021-47717](https://cve.now/CVE-2021-47717.md): IntelliChoice eFORCE Software Suite Username Enumeration (CVSS 6.9, IntelliChoice eFORCE Software Suite)
- [CVE-2021-47710](https://cve.now/CVE-2021-47710.md): COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure (CVSS 8.7, COMMAX Co. Smart Home Ruvie CCTV Bridge DVR Service)
- [CVE-2025-13743](https://cve.now/CVE-2025-13743.md): Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs (CVSS 2.4, Docker Desktop)
- [CVE-2021-47709](https://cve.now/CVE-2021-47709.md): COMMAX Smart Home Ruvie CCTV Bridge DVR Service Config Write / DoS (CVSS 8.7, COMMAX Co. Smart Home Ruvie CCTV Bridge DVR Service)
- [CVE-2025-64896](https://cve.now/CVE-2025-64896.md): Creative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379) (CVSS 5.5, Adobe Creative Cloud Desktop)
- [CVE-2021-47708](https://cve.now/CVE-2021-47708.md): COMMAX Smart Home IoT Control System SQL Injection Authentication Bypass (CVSS 9.3, COMMAX Co. Smart Home IoT Control System)
- [CVE-2021-47707](https://cve.now/CVE-2021-47707.md): COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure (CVSS 9.3, COMMAX Co. COMMAX CVD-Axx DVR)
- [CVE-2021-47706](https://cve.now/CVE-2021-47706.md): COMMAX Biometric Access Control System Authentication Bypass (CVSS 8.7, COMMAX Co. COMMAX Biometric Access Control System)
- [CVE-2021-47705](https://cve.now/CVE-2021-47705.md): CNC\_Ctrl DllUnregisterServer Access Violation (CVSS 8.7, COMMAX Co. COMMAX UMS Client ActiveX Control)
- [CVE-2021-47704](https://cve.now/CVE-2021-47704.md): OpenBMCS SQL Injection via obix\_test.php (CVSS 8.7, OPEN BMCS OpenBMCS)
- [CVE-2021-47703](https://cve.now/CVE-2021-47703.md): OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php (CVSS 6.9, OPEN BMCS OpenBMCS)
- [CVE-2021-47702](https://cve.now/CVE-2021-47702.md): OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php (CVSS 5.3, OPEN BMCS OpenBMCS)
- [CVE-2021-47701](https://cve.now/CVE-2021-47701.md): OpenBMCS User Management Privilege Escalation (CVSS 8.7, OPEN BMCS OpenBMCS)
- [CVE-2025-67488](https://cve.now/CVE-2025-67488.md): SiYuan: ZipSlip -\> Arbitrary File Overwrite -\> RCE (CVSS 7.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2025-64899](https://cve.now/CVE-2025-64899.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-64785](https://cve.now/CVE-2025-64785.md): Acrobat Reader | Untrusted Search Path (CWE-426) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-64786](https://cve.now/CVE-2025-64786.md): Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2025-64787](https://cve.now/CVE-2025-64787.md): Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2025-66626](https://cve.now/CVE-2025-66626.md): argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links (CVSS 8.1, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2025-66625](https://cve.now/CVE-2025-66625.md): Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality (CVSS 4.9, Umbraco-CMS · Umbraco.Cms)
- [CVE-2025-66457](https://cve.now/CVE-2025-66457.md): Elysia affected by arbitrary code injection through cookie config (CVSS 7.5, elysiajs elysia · elysia)
- [CVE-2025-66456](https://cve.now/CVE-2025-66456.md): Elysia vulnerable to prototype pollution with multiple standalone schema validation (CVSS 9.1, elysiajs elysia · elysia)
- [CVE-2025-66214](https://cve.now/CVE-2025-66214.md): Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE) (CVSS 7.0, wearefrank ladybug)
- [CVE-2025-14337](https://cve.now/CVE-2025-14337.md): itsourcecode Student Management System new\_grade.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-64113](https://cve.now/CVE-2025-64113.md): Emby Server allows attackers to gain administrative server access without preconditions (CVSS 9.3, EmbySupport security)
- [CVE-2025-14336](https://cve.now/CVE-2025-14336.md): itsourcecode Student Management System promote.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-14335](https://cve.now/CVE-2025-14335.md): itsourcecode Student Management System new\_school\_year.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-9613](https://cve.now/CVE-2025-9613.md): CVE-2025-9613 (CVSS 6.5, PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…)
- [CVE-2025-9614](https://cve.now/CVE-2025-9614.md): CVE-2025-9614 (CVSS 6.5, PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…)
- [CVE-2025-9612](https://cve.now/CVE-2025-9612.md): CVE-2025-9612 (CVSS 5.1, PCI-SIG PCI Express Integrity and Data Encryption (PCIe IDE…)
- [CVE-2025-14334](https://cve.now/CVE-2025-14334.md): itsourcecode Student Management System new\_adviser.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-11531](https://cve.now/CVE-2025-11531.md): HP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code Execution (CVSS 4.8, HP System Event Utility · HP Omen Gaming Hub)
- [CVE-2025-34414](https://cve.now/CVE-2025-34414.md): Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE (CVSS 9.3, Entrust Instant Financial Issuance)
- [CVE-2025-34413](https://cve.now/CVE-2025-34413.md): Legality WHISTLEBLOWING Missing Critical HTTP Security Headers (CVSS 7.1, DigitalPA S.r.l. Legality WHISTLEBLOWING)
- [CVE-2025-34396](https://cve.now/CVE-2025-34396.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAINFY.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34408](https://cve.now/CVE-2025-34408.md): MailEnable \< 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34398](https://cve.now/CVE-2025-34398.md): MailEnable \< 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34399](https://cve.now/CVE-2025-34399.md): MailEnable \< 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34400](https://cve.now/CVE-2025-34400.md): MailEnable \< 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34409](https://cve.now/CVE-2025-34409.md): MailEnable \< 10.54 Reflected XSS in Failed Parameter of MAI/AddRecipientsResult.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34401](https://cve.now/CVE-2025-34401.md): MailEnable \< 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34402](https://cve.now/CVE-2025-34402.md): MailEnable \< 10.54 Reflected XSS in FieldCc Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34403](https://cve.now/CVE-2025-34403.md): MailEnable \< 10.54 Reflected XSS in FieldTo Parameter of AddressBook.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34406](https://cve.now/CVE-2025-34406.md): MailEnable \< 10.54 Reflected XSS in Id Parameter of Mobile/ContactDetails.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34404](https://cve.now/CVE-2025-34404.md): MailEnable \< 10.54 Reflected XSS in InstanceScope Parameter of CAL/compose.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34397](https://cve.now/CVE-2025-34397.md): MailEnable \< 10.54 Reflected XSS in Message Parameter of Mobile/Compose.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-34407](https://cve.now/CVE-2025-34407.md): MailEnable \< 10.54 Reflected XSS in theme Parameter of Statistics.aspx (CVSS 5.3, MailEnable)
- [CVE-2025-62221](https://cve.now/CVE-2025-62221.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-54100](https://cve.now/CVE-2025-54100.md): PowerShell Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-64680](https://cve.now/CVE-2025-64680.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-64679](https://cve.now/CVE-2025-64679.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-64678](https://cve.now/CVE-2025-64678.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-64672](https://cve.now/CVE-2025-64672.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.8, Microsoft SharePoint Server Subscription Edition)
- [CVE-2025-64671](https://cve.now/CVE-2025-64671.md): GitHub Copilot for Jetbrains Remote Code Execution Vulnerability (CVSS 8.4, Microsoft GitHub Copilot Plugin for JetBrains IDEs)
- [CVE-2025-64661](https://cve.now/CVE-2025-64661.md): Windows Shell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62565](https://cve.now/CVE-2025-62565.md): Windows File Explorer Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-62570](https://cve.now/CVE-2025-62570.md): Windows Camera Frame Server Monitor Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-62569](https://cve.now/CVE-2025-62569.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-62567](https://cve.now/CVE-2025-62567.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2025-62560](https://cve.now/CVE-2025-62560.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62559](https://cve.now/CVE-2025-62559.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-62558](https://cve.now/CVE-2025-62558.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-62557](https://cve.now/CVE-2025-62557.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-62556](https://cve.now/CVE-2025-62556.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62555](https://cve.now/CVE-2025-62555.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.0, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-62554](https://cve.now/CVE-2025-62554.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-62553](https://cve.now/CVE-2025-62553.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62552](https://cve.now/CVE-2025-62552.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2025-62550](https://cve.now/CVE-2025-62550.md): Azure Monitor Agent Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure Monitor)
- [CVE-2025-62474](https://cve.now/CVE-2025-62474.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62468](https://cve.now/CVE-2025-62468.md): Windows Defender Firewall Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-62467](https://cve.now/CVE-2025-62467.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-55233](https://cve.now/CVE-2025-55233.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62465](https://cve.now/CVE-2025-62465.md): DirectX Graphics Kernel Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-62464](https://cve.now/CVE-2025-62464.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62463](https://cve.now/CVE-2025-62463.md): DirectX Graphics Kernel Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-62462](https://cve.now/CVE-2025-62462.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62461](https://cve.now/CVE-2025-62461.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62455](https://cve.now/CVE-2025-62455.md): Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59517](https://cve.now/CVE-2025-59517.md): Windows Storage VSP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-59516](https://cve.now/CVE-2025-59516.md): Windows Storage VSP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-64673](https://cve.now/CVE-2025-64673.md): Windows Storage VSP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-64670](https://cve.now/CVE-2025-64670.md): Windows DirectX Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-64666](https://cve.now/CVE-2025-64666.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2025-64667](https://cve.now/CVE-2025-64667.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 5.3, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2025-64658](https://cve.now/CVE-2025-64658.md): Windows File Explorer Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-62573](https://cve.now/CVE-2025-62573.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-62572](https://cve.now/CVE-2025-62572.md): Application Information Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62571](https://cve.now/CVE-2025-62571.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62564](https://cve.now/CVE-2025-62564.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62563](https://cve.now/CVE-2025-62563.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62562](https://cve.now/CVE-2025-62562.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-62561](https://cve.now/CVE-2025-62561.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-62549](https://cve.now/CVE-2025-62549.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-62473](https://cve.now/CVE-2025-62473.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-62472](https://cve.now/CVE-2025-62472.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62470](https://cve.now/CVE-2025-62470.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62469](https://cve.now/CVE-2025-62469.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-62466](https://cve.now/CVE-2025-62466.md): Windows Client-Side Caching Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62458](https://cve.now/CVE-2025-62458.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62457](https://cve.now/CVE-2025-62457.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-62456](https://cve.now/CVE-2025-62456.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-62454](https://cve.now/CVE-2025-62454.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-33214](https://cve.now/CVE-2025-33214.md): NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. (CVSS 8.8, NVIDIA NVTabular)
- [CVE-2025-33213](https://cve.now/CVE-2025-33213.md): NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue (CVSS 8.8, NVIDIA Merlin Transformers4Rec)
- [CVE-2025-64784](https://cve.now/CVE-2025-64784.md): DNG SDK | Heap-based Buffer Overflow (CWE-122) (CVSS 7.1, Adobe DNG SDK)
- [CVE-2025-64894](https://cve.now/CVE-2025-64894.md): DNG SDK | Integer Overflow or Wraparound (CWE-190) (CVSS 5.5, Adobe DNG SDK)
- [CVE-2025-64893](https://cve.now/CVE-2025-64893.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 7.1, Adobe DNG SDK)
- [CVE-2025-64783](https://cve.now/CVE-2025-64783.md): DNG SDK | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe DNG SDK)
- [CVE-2025-46636](https://cve.now/CVE-2025-46636.md): Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. (CVSS 6.6, Dell Encryption)
- [CVE-2025-46637](https://cve.now/CVE-2025-46637.md): Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. (CVSS 7.3, Dell Encryption)
- [CVE-2025-13924](https://cve.now/CVE-2025-13924.md): Advanced Product Fields (Product Addons) for WooCommerce \<= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication (CVSS 4.3, maartenbelmans Advanced Product Fields (Product Addons) for…)
- [CVE-2024-47570](https://cve.now/CVE-2024-47570.md): An insertion of sensitive information into log file vulnerability \[CWE-532\] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all ver (CVSS 6.3, Fortinet FortiSASE · Fortinet FortiProxy +3)
- [CVE-2025-59718](https://cve.now/CVE-2025-59718.md): A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti (CVSS 9.1, KEV, Fortinet FortiSwitchManager · Fortinet FortiOS +1)
- [CVE-2025-59719](https://cve.now/CVE-2025-59719.md): An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t (CVSS 9.1, Fortinet FortiWeb)
- [CVE-2025-53679](https://cve.now/CVE-2025-53679.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] vulnerability in Fortin (CVSS 6.9, Fortinet FortiSandbox)
- [CVE-2025-54353](https://cve.now/CVE-2025-54353.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability \[CWE-79\] vulnerability in Fortinet For (CVSS 5.3, Fortinet FortiSandbox)
- [CVE-2025-53949](https://cve.now/CVE-2025-53949.md): An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability \[CWE-78\] vulnerability in Fortin (CVSS 7.0, Fortinet FortiSandbox)
- [CVE-2025-59810](https://cve.now/CVE-2025-59810.md): An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS (CVSS 6.2, Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS)
- [CVE-2025-59808](https://cve.now/CVE-2025-59808.md): An unverified password change vulnerability \[CWE-620\] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 thr (CVSS 6.5, Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS)
- [CVE-2025-54838](https://cve.now/CVE-2025-54838.md): An Incorrect Authorization vulnerability \[CWE-863\] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared (CVSS 6.4, Fortinet FortiPortal)
- [CVE-2025-62631](https://cve.now/CVE-2025-62631.md): An insufficient session expiration vulnerability \[CWE-613\] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 al (CVSS 5.3, Fortinet FortiOS)
- [CVE-2025-57823](https://cve.now/CVE-2025-57823.md): A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, (CVSS 2.6, Fortinet FortiAuthenticator)
- [CVE-2025-64153](https://cve.now/CVE-2025-64153.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, (CVSS 6.7, Fortinet FortiExtender)
- [CVE-2025-59923](https://cve.now/CVE-2025-59923.md): An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthe (CVSS 2.6, Fortinet FortiAuthenticator)
- [CVE-2025-64156](https://cve.now/CVE-2025-64156.md): An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7 (CVSS 6.8, Fortinet FortiVoice)
- [CVE-2025-64471](https://cve.now/CVE-2025-64471.md): A use of password hash instead of password for authentication vulnerability \[CWE-836\] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1 (CVSS 4.4, Fortinet FortiWeb)
- [CVE-2025-60024](https://cve.now/CVE-2025-60024.md): Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities \[CWE-22\] vulnerability in Fortinet (CVSS 7.7, Fortinet FortiVoice)
- [CVE-2025-64447](https://cve.now/CVE-2025-64447.md): A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 throu (CVSS 7.1, Fortinet FortiWeb)
- [CVE-2025-12946](https://cve.now/CVE-2025-12946.md): Improper input validation in NETGEAR Nighthawk routers (CVSS 4.4, NETGEAR RS700 · NETGEAR RAX54Sv2 +15)
- [CVE-2025-12945](https://cve.now/CVE-2025-12945.md): Improper input validation in NETGEAR Nighthawk router R7000P (CVSS 1.1, NETGEAR R7000P)
- [CVE-2025-12941](https://cve.now/CVE-2025-12941.md): Denial of Service Vulnerability in NETGEAR C6220 and C6230 (CVSS 5.0, NETGEAR C6220 · NETGEAR C6230)
- [CVE-2022-46845](https://cve.now/CVE-2022-46845.md): WordPress Slider a SlidersPack plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 5.3, Essential Plugin Slider a SlidersPack)
- [CVE-2022-47425](https://cve.now/CVE-2022-47425.md): WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin \<= 3.4.10 - Broken Access Control (CVSS 4.3, Repute Infosystems ARMember)
- [CVE-2023-22675](https://cve.now/CVE-2023-22675.md): WordPress WP Fast Cache plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Taylor Hawkes WP Fast Cache)
- [CVE-2023-23729](https://cve.now/CVE-2023-23729.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability (CVSS 5.4, Brainstorm Force Spectra)
- [CVE-2025-13662](https://cve.now/CVE-2025-13662.md): Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2025-13661](https://cve.now/CVE-2025-13661.md): Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs (CVSS 7.1, Ivanti Endpoint Manager)
- [CVE-2025-13659](https://cve.now/CVE-2025-13659.md): Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-9638](https://cve.now/CVE-2025-9638.md): i-Educar 2.10.0 - Stored Cross-Site Scripting (XSS) in admin panel (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-5469](https://cve.now/CVE-2025-5469.md): Dylib Hijacking in Yandex Messenger (CVSS 7.3, Yandex Messenger)
- [CVE-2025-10573](https://cve.now/CVE-2025-10573.md): Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript (CVSS 9.6, Ivanti Endpoint Manager)
- [CVE-2025-5471](https://cve.now/CVE-2025-5471.md): Dylib Hijacking in Yandex Telemost (CVSS 7.3, Yandex Telemost)
- [CVE-2025-5470](https://cve.now/CVE-2025-5470.md): Dylib Hijacking in Yandex Disk (CVSS 7.3, Yandex Disk)
- [CVE-2025-13642](https://cve.now/CVE-2025-13642.md): ProfilePress \<= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2025-67467](https://cve.now/CVE-2025-67467.md): WordPress GiveWP plugin \<= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, StellarWP GiveWP)
- [CVE-2025-66533](https://cve.now/CVE-2025-66533.md): WordPress GiveWP plugin \<= 4.13.1 - Arbitrary Shortocde Execution vulnerability (CVSS 6.5, Liquid Web / StellarWP GiveWP)
- [CVE-2025-2296](https://cve.now/CVE-2025-2296.md): Un-verified kernel bypass Secure Boot mechanism in direct boot mode (CVSS 8.4, TianoCore EDK2)
- [CVE-2025-14345](https://cve.now/CVE-2025-14345.md): Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server (CVSS 4.2, MongoDB Server)
- [CVE-2024-38798](https://cve.now/CVE-2024-38798.md): Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege (CVSS 5.8, TianoCore EDK2)
- [CVE-2025-63077](https://cve.now/CVE-2025-63077.md): WordPress Happy Addons for Elementor plugin \<= 3.20.3 - Broken Access Control vulnerability (CVSS 4.3, HappyMonster Happy Addons for Elementor)
- [CVE-2025-63076](https://cve.now/CVE-2025-63076.md): WordPress The7 Elements plugin \<= 2.7.11 - Local File Inclusion vulnerability (CVSS 7.5, Dream-Theme The7 Elements)
- [CVE-2025-63075](https://cve.now/CVE-2025-63075.md): WordPress Betheme theme \<= 28.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, muffingroup Betheme)
- [CVE-2025-63074](https://cve.now/CVE-2025-63074.md): WordPress The7 theme \< 12.8.1.1 - Local File Inclusion vulnerability (CVSS 7.5, Dream-Theme The7)
- [CVE-2025-63073](https://cve.now/CVE-2025-63073.md): WordPress The7 theme \< 12.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dream-Theme The7)
- [CVE-2025-63072](https://cve.now/CVE-2025-63072.md): WordPress Cornerstone plugin \<= 7.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, THEMECO Cornerstone)
- [CVE-2025-63071](https://cve.now/CVE-2025-63071.md): WordPress Shortcodes and extra features for Phlox theme plugin \<= 2.17.15 - Sensitive Data Exposure vulnerability (CVSS 5.3, averta Shortcodes and extra features for Phlox theme)
- [CVE-2025-63070](https://cve.now/CVE-2025-63070.md): WordPress Download Manager plugin \<= 3.3.32 - Sensitive Data Exposure vulnerability (CVSS 4.3, Shahjada Download Manager)
- [CVE-2025-63069](https://cve.now/CVE-2025-63069.md): WordPress Ivory Search plugin \<= 5.5.12 - Broken Access Control vulnerability (CVSS 5.3, Vinod Dalvi Ivory Search)
- [CVE-2025-63068](https://cve.now/CVE-2025-63068.md): WordPress Contact Form 7 Dynamic Text Extension plugin \<= 5.0.5 - Content Injection vulnerability (CVSS 5.3, sevenspark Contact Form 7 – Dynamic Text Extension)
- [CVE-2025-63067](https://cve.now/CVE-2025-63067.md): WordPress Porto Theme - Functionality plugin \< 3.7.3 - Broken Access Control vulnerability (CVSS 4.3, p-themes Porto Theme - Functionality)
- [CVE-2025-63066](https://cve.now/CVE-2025-63066.md): WordPress Porto Theme - Functionality plugin \< 3.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, p-themes Porto Theme - Functionality)
- [CVE-2025-63065](https://cve.now/CVE-2025-63065.md): WordPress Media LIbrary Assistant plugin \<= 3.29 - Broken Access Control vulnerability (CVSS 5.3, David Lingren Media LIbrary Assistant)
- [CVE-2025-63064](https://cve.now/CVE-2025-63064.md): WordPress EventON plugin \<= 4.9.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ashanjay EventON)
- [CVE-2025-63063](https://cve.now/CVE-2025-63063.md): WordPress Yandex.Metrica plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.3, Yandex Metrika Yandex.Metrica)
- [CVE-2025-63062](https://cve.now/CVE-2025-63062.md): WordPress UDesign Core plugin \<= 4.14.0 - Local File Inclusion vulnerability (CVSS 7.5, AndonDesign UDesign Core)
- [CVE-2025-63061](https://cve.now/CVE-2025-63061.md): WordPress KALLYAS theme \< 4.25.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hogash KALLYAS)
- [CVE-2025-63060](https://cve.now/CVE-2025-63060.md): WordPress KALLYAS theme \< 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, hogash KALLYAS)
- [CVE-2025-63059](https://cve.now/CVE-2025-63059.md): WordPress Ninja Popups plugin \<= 4.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, arscode Ninja Popups)
- [CVE-2025-63058](https://cve.now/CVE-2025-63058.md): WordPress Custom Field Template plugin \<= 2.7.6 - Sensitive Data Exposure vulnerability (CVSS 4.3, Hiroaki Miyashita Custom Field Template)
- [CVE-2025-63057](https://cve.now/CVE-2025-63057.md): WordPress Wp Ultimate Review plugin \<= 2.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Roxnor Wp Ultimate Review)
- [CVE-2025-63056](https://cve.now/CVE-2025-63056.md): WordPress Contact Form by BestWebSoft plugin \<= 4.3.6 - Broken Access Control vulnerability (CVSS 4.3, Contact Form by BestWebSoft)
- [CVE-2025-63055](https://cve.now/CVE-2025-63055.md): WordPress Master Addons for Elementor plugin \<= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liton Arefin Master Addons for Elementor)
- [CVE-2025-63054](https://cve.now/CVE-2025-63054.md): WordPress Quiz And Survey Master plugin \<= 10.3.2 - Broken Access Control vulnerability (CVSS 5.3, ExpressTech Systems Quiz And Survey Master)
- [CVE-2025-63052](https://cve.now/CVE-2025-63052.md): WordPress SimpLy Gallery plugin \<= 3.3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GalleryCreator SimpLy Gallery)
- [CVE-2025-63050](https://cve.now/CVE-2025-63050.md): WordPress REHub Framework plugin \< 19.9.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sizam REHub Framework)
- [CVE-2025-63049](https://cve.now/CVE-2025-63049.md): WordPress ListingPro Lead Form plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3, CridioStudio ListingPro Lead Form)
- [CVE-2025-63048](https://cve.now/CVE-2025-63048.md): WordPress ListingPro Lead Form plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CridioStudio ListingPro Lead Form)
- [CVE-2025-63047](https://cve.now/CVE-2025-63047.md): WordPress ListingPro theme \<= 2.9.9 - Broken Access Control vulnerability (CVSS 5.3, CridioStudio ListingPro)
- [CVE-2025-63046](https://cve.now/CVE-2025-63046.md): WordPress ListingPro plugin \<= 2.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CridioStudio ListingPro)
- [CVE-2025-63045](https://cve.now/CVE-2025-63045.md): WordPress Master Slider Pro plugin \<= 3.7.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, averta Master Slider Pro)
- [CVE-2025-63044](https://cve.now/CVE-2025-63044.md): WordPress Xpro Elementor Addons plugin \<= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xpro Elementor Addons)
- [CVE-2025-63042](https://cve.now/CVE-2025-63042.md): WordPress Tutor LMS Elementor Addons plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum Tutor LMS Elementor Addons)
- [CVE-2025-63037](https://cve.now/CVE-2025-63037.md): WordPress Ronneby Theme Core plugin \<= 1.5.68 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DFDevelopment Ronneby Theme Core)
- [CVE-2025-63036](https://cve.now/CVE-2025-63036.md): WordPress Ronneby Theme Core plugin \<= 1.5.68 - Local File Inclusion vulnerability (CVSS 7.5, DFDevelopment Ronneby Theme Core)
- [CVE-2025-63035](https://cve.now/CVE-2025-63035.md): WordPress WPLMS plugin \<= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VibeThemes WPLMS)
- [CVE-2025-63034](https://cve.now/CVE-2025-63034.md): WordPress Page View Count plugin \<= 2.9.0 - Settings Change vulnerability (CVSS 5.4, Steve Truman Page View Count)
- [CVE-2025-63033](https://cve.now/CVE-2025-63033.md): WordPress Make Section & Column Clickable For Elementor plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Riyadh Ahmed Make Section & Column Clickable For Elementor)
- [CVE-2025-63030](https://cve.now/CVE-2025-63030.md): WordPress New User Approve plugin \<= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Saad Iqbal New User Approve)
- [CVE-2025-63028](https://cve.now/CVE-2025-63028.md): WordPress Traveler theme \<= 3.2.6 - Broken Access Control vulnerability (CVSS 5.3, shinetheme Traveler)
- [CVE-2025-63025](https://cve.now/CVE-2025-63025.md): WordPress Xagio SEO plugin \<= 7.1.0.37 - Broken Access Control vulnerability (CVSS 4.3, Xagio SEO)
- [CVE-2025-63024](https://cve.now/CVE-2025-63024.md): WordPress Order Delivery Date for WooCommerce plugin \<= 4.3.1 - Broken Access Control vulnerability (CVSS 5.4, tychesoftwares Order Delivery Date for WooCommerce)
- [CVE-2025-63023](https://cve.now/CVE-2025-63023.md): WordPress Payment Gateway for PayPal on WooCommerce plugin \<= 9.0.53 - Broken Access Control vulnerability (CVSS 5.3, Easy Payment Payment Gateway for PayPal on WooCommerce)
- [CVE-2025-63015](https://cve.now/CVE-2025-63015.md): WordPress WooCommerce Payment Gateway – Paysera plugin \<= 3.10.0 - Broken Access Control vulnerability (CVSS 4.3, WooCommerce Payment Gateway - Paysera)
- [CVE-2025-63013](https://cve.now/CVE-2025-63013.md): WordPress WP Hotel Booking plugin \<= 2.2.7 - Sensitive Data Exposure vulnerability (CVSS 4.3, ThimPress WP Hotel Booking)
- [CVE-2025-63012](https://cve.now/CVE-2025-63012.md): WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThimPress WP Hotel Booking)
- [CVE-2025-63011](https://cve.now/CVE-2025-63011.md): WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThimPress WP Hotel Booking)
- [CVE-2025-63010](https://cve.now/CVE-2025-63010.md): WordPress Hercules Core plugin \<= 7.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, ThemesInflow Hercules Core)
- [CVE-2025-63009](https://cve.now/CVE-2025-63009.md): WordPress WP Google Analytics Events plugin \<= 2.8.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, yuvalo WP Google Analytics Events)
- [CVE-2025-63008](https://cve.now/CVE-2025-63008.md): WordPress WP ERP plugin \<= 1.16.7 - Broken Access Control vulnerability (CVSS 5.3, weDevs WP ERP)
- [CVE-2025-63007](https://cve.now/CVE-2025-63007.md): WordPress EventPrime plugin \<= 4.2.4.1 - Sensitive Data Exposure vulnerability (CVSS 4.3, Metagauss EventPrime)
- [CVE-2025-63006](https://cve.now/CVE-2025-63006.md): WordPress EventPrime plugin \<= 4.2.4.1 - Broken Access Control vulnerability (CVSS 4.3, Metagauss EventPrime)
- [CVE-2025-63003](https://cve.now/CVE-2025-63003.md): WordPress North - Required Plugin plugin \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 7.5, fuelthemes North - Required Plugin)
- [CVE-2025-62999](https://cve.now/CVE-2025-62999.md): WordPress Litho Addons plugin \<= 3.5 - Broken Access Control vulnerability (CVSS 5.4, themezaa Litho Addons)
- [CVE-2025-62997](https://cve.now/CVE-2025-62997.md): WordPress WP EasyCart plugin \<= 5.8.11 - Sensitive Data Exposure vulnerability (CVSS 5.3, levelfourdevelopment WP EasyCart)
- [CVE-2025-62996](https://cve.now/CVE-2025-62996.md): WordPress Custom Layouts – Post + Product grids made easy plugin \<= 1.4.12 - Broken Access Control vulnerability (CVSS 4.3, Code Amp Custom Layouts – Post + Product grids made easy)
- [CVE-2025-62995](https://cve.now/CVE-2025-62995.md): WordPress MultiParcels Shipping For WooCommerce plugin \<= 1.30.12 - Broken Access Control vulnerability (CVSS 4.3, MultiParcels Shipping For WooCommerce)
- [CVE-2025-62994](https://cve.now/CVE-2025-62994.md): WordPress WP AI CoPilot plugin \<= 1.2.7 - Sensitive Data Exposure vulnerability (CVSS 4.3, WP Messiah WP AI CoPilot)
- [CVE-2025-62993](https://cve.now/CVE-2025-62993.md): WordPress Notification for Telegram plugin \<= 3.5.1 - Broken Access Control vulnerability (CVSS 4.3, rainafarai Notification for Telegram)
- [CVE-2025-62873](https://cve.now/CVE-2025-62873.md): WordPress WP Flashy Marketing Automation plugin \<= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Flashyapp WP Flashy Marketing Automation)
- [CVE-2025-62872](https://cve.now/CVE-2025-62872.md): WordPress Social Photo Fetcher plugin \<= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, JK Social Photo Fetcher)
- [CVE-2025-62871](https://cve.now/CVE-2025-62871.md): WordPress Just TinyMCE Custom Styles plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Alex Prokopenko / JustCoded Just TinyMCE Custom Styles)
- [CVE-2025-62870](https://cve.now/CVE-2025-62870.md): WordPress Eupago Gateway For Woocommerce plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 5.3, Eupago Gateway For Woocommerce)
- [CVE-2025-62869](https://cve.now/CVE-2025-62869.md): WordPress Gravitec.net – Web Push Notifications plugin \<= 2.9.17 - Broken Access Control vulnerability (CVSS 4.3, Gravitec.net - Web Push Notifications Gravitec.net – Web Pu…)
- [CVE-2025-62867](https://cve.now/CVE-2025-62867.md): WordPress Ergonet Cache plugin \<= 1.0.13 - Broken Access Control vulnerability (CVSS 4.3, Ergonet Cache)
- [CVE-2025-62866](https://cve.now/CVE-2025-62866.md): WordPress Auto Alt Text plugin \<= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Valerio Monti Auto Alt Text)
- [CVE-2025-62865](https://cve.now/CVE-2025-62865.md): WordPress Post Cloner plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 5.3, Evan Herman Post Cloner)
- [CVE-2025-62762](https://cve.now/CVE-2025-62762.md): WordPress SMTP Mail plugin \<= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, photoboxone SMTP Mail)
- [CVE-2025-62740](https://cve.now/CVE-2025-62740.md): WordPress WP-CRM System plugin \<= 3.4.6 - Broken Access Control vulnerability (CVSS 5.3, Mario Peshev WP-CRM System)
- [CVE-2025-62739](https://cve.now/CVE-2025-62739.md): WordPress Add Custom Codes plugin \<= 4.80 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, SaifuMak Add Custom Codes)
- [CVE-2025-62738](https://cve.now/CVE-2025-62738.md): WordPress Formstack Online Forms plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 5.3, mmattax Formstack Online Forms)
- [CVE-2025-62737](https://cve.now/CVE-2025-62737.md): WordPress Image Cleanup plugin \<= 1.9.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, opicron Image Cleanup)
- [CVE-2025-62736](https://cve.now/CVE-2025-62736.md): WordPress Image Cleanup plugin \<= 1.9.2 - Broken Access Control vulnerability (CVSS 4.3, opicron Image Cleanup)
- [CVE-2025-62735](https://cve.now/CVE-2025-62735.md): WordPress User Spam Remover plugin \<= 1.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, Joel User Spam Remover)
- [CVE-2025-62734](https://cve.now/CVE-2025-62734.md): WordPress Media Library Downloader plugin \<= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, M.Code Media Library Downloader)
- [CVE-2025-62733](https://cve.now/CVE-2025-62733.md): WordPress Custom Sidebars by ProteusThemes plugin \<= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Custom Sidebars by ProteusThemes)
- [CVE-2025-62153](https://cve.now/CVE-2025-62153.md): WordPress Quick Interest Slider plugin \<= 3.1.7 - Broken Access Control vulnerability (CVSS 5.3, Graham Quick Interest Slider)
- [CVE-2025-62152](https://cve.now/CVE-2025-62152.md): WordPress ConveyThis plugin \<= 269.2 - Broken Access Control vulnerability (CVSS 5.3, ConveyThis)
- [CVE-2025-62151](https://cve.now/CVE-2025-62151.md): WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin \<= 3.6.3 - Broken Access Control vulnerability (CVSS 5.3, Virtuaria PagBank / PagSeguro para Woocommerce)
- [CVE-2025-62109](https://cve.now/CVE-2025-62109.md): WordPress Geo Controller plugin \<= 8.9.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, INFINITUM FORM Geo Controller)
- [CVE-2025-62103](https://cve.now/CVE-2025-62103.md): WordPress Media Library File Download plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpmediadownload Media Library File Download)
- [CVE-2025-62102](https://cve.now/CVE-2025-62102.md): WordPress DoFollow Case by Case plugin \<= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, apasionados DoFollow Case by Case)
- [CVE-2025-62100](https://cve.now/CVE-2025-62100.md): WordPress ThemeRain Core plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 5.3, ThemeRain Core)
- [CVE-2025-62093](https://cve.now/CVE-2025-62093.md): WordPress Image&Video FullScreen Background plugin \<= 1.6.7 - SQL Injection vulnerability (CVSS 8.5, LambertGroup Image&Video FullScreen Background)
- [CVE-2025-62090](https://cve.now/CVE-2025-62090.md): WordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 6.5, Jegstudio Gutenverse News – Advanced News Magazine Blog Gut…)
- [CVE-2025-62086](https://cve.now/CVE-2025-62086.md): WordPress Яндекс Доставка (Boxberry) plugin \<= 2.34 - Broken Access Control vulnerability (CVSS 5.4, akazanstev Яндекс Доставка)
- [CVE-2025-62085](https://cve.now/CVE-2025-62085.md): WordPress BERTHA AI plugin \<= 1.13 - Broken Access Control vulnerability (CVSS 5.3, Bertha AI – Andrew Palmer BERTHA AI)
- [CVE-2025-62082](https://cve.now/CVE-2025-62082.md): WordPress Generic Elements plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nasir Uddin Generic Elements)
- [CVE-2025-59132](https://cve.now/CVE-2025-59132.md): WordPress Duplicate Content Cure plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Badi Jones Duplicate Content Cure)
- [CVE-2025-49351](https://cve.now/CVE-2025-49351.md): WordPress Create Posts & Terms plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Valentin Agachi Create Posts & Terms)
- [CVE-2025-49350](https://cve.now/CVE-2025-49350.md): WordPress Actionwear products sync plugin \<= 2.3.3 - Broken Access Control vulnerability (CVSS 4.3, marcoingraiti Actionwear products sync)
- [CVE-2025-49348](https://cve.now/CVE-2025-49348.md): WordPress Hype plugin \<= 1.0.5 - Broken Access Control vulnerability (CVSS 5.3, Hype)
- [CVE-2025-49347](https://cve.now/CVE-2025-49347.md): WordPress WP sIFR plugin \<= 0.6.8.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Jupitercow WP sIFR)
- [CVE-2025-49341](https://cve.now/CVE-2025-49341.md): WordPress PDF Creator Lite plugin \<= 1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Alex Furr PDF Creator Lite)
- [CVE-2025-10655](https://cve.now/CVE-2025-10655.md): Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get\_dashboard\_data (CVSS 8.6, Frappe HelpDesk)
- [CVE-2025-12504](https://cve.now/CVE-2025-12504.md): SQLi in Talent Software's UNIS (CVSS 9.8, Talent Software UNIS)
- [CVE-2025-6923](https://cve.now/CVE-2025-6923.md): Reflected XSS in Talent Software's UNIS (CVSS 5.4, Talent Software UNIS)
- [CVE-2025-67599](https://cve.now/CVE-2025-67599.md): WordPress WebToffee eCommerce Marketing Automation plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3, WebToffee eCommerce Marketing Automation)
- [CVE-2025-67598](https://cve.now/CVE-2025-67598.md): WordPress SupportCandy plugin \<= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PSM Plugins SupportCandy)
- [CVE-2025-67597](https://cve.now/CVE-2025-67597.md): WordPress Fluent Booking plugin \<= 1.9.11 - Broken Access Control vulnerability (CVSS 4.3, Shahjahan Jewel Fluent Booking)
- [CVE-2025-67596](https://cve.now/CVE-2025-67596.md): WordPress Business Directory plugin \<= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Strategy11 Team Business Directory)
- [CVE-2025-67595](https://cve.now/CVE-2025-67595.md): WordPress Quiz Maker plugin \<= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ays Pro Quiz Maker)
- [CVE-2025-67594](https://cve.now/CVE-2025-67594.md): WordPress Thim Elementor Kit plugin \<= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, ThimPress Thim Elementor Kit)
- [CVE-2025-67593](https://cve.now/CVE-2025-67593.md): WordPress UsersWP plugin \<= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Stiofan UsersWP)
- [CVE-2025-67592](https://cve.now/CVE-2025-67592.md): WordPress My Calendar plugin \<= 3.6.16 - Broken Access Control vulnerability (CVSS 4.3, Joe Dolson My Calendar)
- [CVE-2025-67591](https://cve.now/CVE-2025-67591.md): WordPress JNews Paywall plugin \< 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, jegtheme JNews Paywall)
- [CVE-2025-67590](https://cve.now/CVE-2025-67590.md): WordPress Ultimate FAQ plugin \<= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rustaurius Ultimate FAQ)
- [CVE-2025-67589](https://cve.now/CVE-2025-67589.md): WordPress WooCommerce PDF Invoices & Packing Slips plugin \<= 4.9.1 - Broken Access Control vulnerability (CVSS 4.3, WP Overnight WooCommerce PDF Invoices & Packing Slips)
- [CVE-2025-67588](https://cve.now/CVE-2025-67588.md): WordPress Elementor Website Builder plugin \<= 3.33.0 - Broken Access Control vulnerability (CVSS 4.3, Elementor Website Builder)
- [CVE-2025-67587](https://cve.now/CVE-2025-67587.md): WordPress WP Gravity Forms FreshDesk Plugin plugin \<= 1.3.5 - Open Redirection vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms FreshDesk Plugin)
- [CVE-2025-67586](https://cve.now/CVE-2025-67586.md): WordPress Highlight and Share plugin \<= 5.2.0 - Broken Access Control vulnerability (CVSS 4.7, Ronald Huereca Highlight and Share)
- [CVE-2025-67585](https://cve.now/CVE-2025-67585.md): WordPress Flexmls® IDX plugin \<= 3.15.7 - Open Redirection vulnerability (CVSS 4.7, Flexmls® IDX)
- [CVE-2025-67584](https://cve.now/CVE-2025-67584.md): WordPress GoDAM plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 5.3, rtCamp GoDAM)
- [CVE-2025-67583](https://cve.now/CVE-2025-67583.md): WordPress IDonate plugin \<= 2.1.15 - Broken Access Control vulnerability (CVSS 5.3, Foysal Imran IDonate)
- [CVE-2025-67582](https://cve.now/CVE-2025-67582.md): WordPress Wbcom Designs plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 5.3, wbcomdesigns Wbcom Designs)
- [CVE-2025-67581](https://cve.now/CVE-2025-67581.md): WordPress TrueBooker plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, themetechmount TrueBooker)
- [CVE-2025-67580](https://cve.now/CVE-2025-67580.md): WordPress Constant Contact + WooCommerce plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.3, Constant Contact + WooCommerce)
- [CVE-2025-67579](https://cve.now/CVE-2025-67579.md): WordPress User Extra Fields plugin \<= 16.8 - Broken Access Control vulnerability (CVSS 5.3, vanquish User Extra Fields)
- [CVE-2025-67578](https://cve.now/CVE-2025-67578.md): WordPress WP Email Capture plugin \<= 3.12.4 - Broken Access Control vulnerability (CVSS 5.3, Rhys Wynne WP Email Capture)
- [CVE-2025-67577](https://cve.now/CVE-2025-67577.md): WordPress Easy Form Builder plugin \<= 3.8.20 - Broken Access Control vulnerability (CVSS 5.3, hassantafreshi Easy Form Builder)
- [CVE-2025-67576](https://cve.now/CVE-2025-67576.md): WordPress Simple Link Directory plugin \<= 8.8.3 - Broken Access Control vulnerability (CVSS 5.3, QuantumCloud Simple Link Directory)
- [CVE-2025-67575](https://cve.now/CVE-2025-67575.md): WordPress Sitewide Notice WP plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.3, Andrew Lima Sitewide Notice WP)
- [CVE-2025-67574](https://cve.now/CVE-2025-67574.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.30 - Broken Access Control vulnerability (CVSS 5.3, wpdevart Booking calendar, Appointment Booking System)
- [CVE-2025-67573](https://cve.now/CVE-2025-67573.md): WordPress Sailing theme \< 4.4.6 - Broken Access Control vulnerability (CVSS 5.3, ThimPress Sailing)
- [CVE-2025-67572](https://cve.now/CVE-2025-67572.md): WordPress PenNews theme \< 6.7.4 - Broken Access Control vulnerability (CVSS 5.3, PenciDesign PenNews)
- [CVE-2025-67571](https://cve.now/CVE-2025-67571.md): WordPress WPFunnels plugin \<= 3.6.2 - Broken Access Control vulnerability (CVSS 5.3, WPFunnels)
- [CVE-2025-67570](https://cve.now/CVE-2025-67570.md): WordPress WPForms Google Sheet Connector plugin \<= 4.0.0 - Broken Access Control vulnerability (CVSS 5.3, WesternDeal WPForms Google Sheet Connector)
- [CVE-2025-67569](https://cve.now/CVE-2025-67569.md): WordPress AdForest theme \<= 6.0.11 - Broken Access Control vulnerability (CVSS 5.3, scriptsbundle AdForest)
- [CVE-2025-67568](https://cve.now/CVE-2025-67568.md): WordPress Basel theme \<= 5.9.1 - Broken Access Control vulnerability (CVSS 5.3, xtemos Basel)
- [CVE-2025-67567](https://cve.now/CVE-2025-67567.md): WordPress Sober theme \<= 3.5.11 - Sensitive Data Exposure vulnerability (CVSS 5.3, uixthemes Sober)
- [CVE-2025-67566](https://cve.now/CVE-2025-67566.md): WordPress Woffice Core plugin \<= 5.4.30 - Broken Access Control vulnerability (CVSS 5.3, WofficeIO Woffice Core)
- [CVE-2025-67565](https://cve.now/CVE-2025-67565.md): WordPress Rehub theme \<= 19.9.9.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, sizam Rehub)
- [CVE-2025-67564](https://cve.now/CVE-2025-67564.md): WordPress Pixel Manager for WooCommerce plugin \<= 1.51.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, alekv Pixel Manager for WooCommerce)
- [CVE-2025-67563](https://cve.now/CVE-2025-67563.md): WordPress Post SMTP plugin \<= 3.6.1 - Broken Access Control vulnerability (CVSS 5.3, Saad Iqbal Post SMTP)
- [CVE-2025-67562](https://cve.now/CVE-2025-67562.md): WordPress Image Caption Hover Pro plugin \< 20.0 - Broken Access Control vulnerability (CVSS 5.4, WebCodingPlace Image Caption Hover Pro)
- [CVE-2025-67561](https://cve.now/CVE-2025-67561.md): WordPress Debug Log Viewer plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.4, Oleksandr Lysyi Debug Log Viewer)
- [CVE-2025-67560](https://cve.now/CVE-2025-67560.md): WordPress Listdom plugin \<= 5.0.1 - Broken Access Control vulnerability (CVSS 5.4, Webilia Listdom)
- [CVE-2025-67559](https://cve.now/CVE-2025-67559.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Broken Access Control vulnerability (CVSS 5.4, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2025-67558](https://cve.now/CVE-2025-67558.md): WordPress Rencontre plugin \<= 3.13.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jacques Malgrange Rencontre)
- [CVE-2025-67557](https://cve.now/CVE-2025-67557.md): WordPress WP eBay Product Feeds plugin \<= 3.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rhys Wynne WP eBay Product Feeds)
- [CVE-2025-67556](https://cve.now/CVE-2025-67556.md): WordPress Advanced FAQ Manager plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThemeHigh Advanced FAQ Manager)
- [CVE-2025-67555](https://cve.now/CVE-2025-67555.md): WordPress UseStrict's Calendly Embedder plugin \<= 1.1.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, UseStrict's Calendly Embedder)
- [CVE-2025-67554](https://cve.now/CVE-2025-67554.md): WordPress Cookie Notice & Compliance for GDPR / CCPA plugin \<= 2.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Humanityco Cookie Notice & Compliance for GDPR / CCPA)
- [CVE-2025-67553](https://cve.now/CVE-2025-67553.md): WordPress Advanced FAQ Manager plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeHigh Advanced FAQ Manager)
- [CVE-2025-67552](https://cve.now/CVE-2025-67552.md): WordPress Walker Core plugin \<= 1.3.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WalkerWP Walker Core)
- [CVE-2025-67551](https://cve.now/CVE-2025-67551.md): WordPress Wappointment plugin \<= 2.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wappointment team Wappointment)
- [CVE-2025-67550](https://cve.now/CVE-2025-67550.md): WordPress Donation Thermometer plugin \<= 2.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, rhewlif Donation Thermometer)
- [CVE-2025-67549](https://cve.now/CVE-2025-67549.md): WordPress oik plugin \<= 4.15.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bobbingwide oik)
- [CVE-2025-67548](https://cve.now/CVE-2025-67548.md): WordPress WP Delicious plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 6.5, WP Delicious)
- [CVE-2025-67545](https://cve.now/CVE-2025-67545.md): WordPress FireBox plugin \<= 3.1.0-free - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FirePlugins FireBox)
- [CVE-2025-67544](https://cve.now/CVE-2025-67544.md): WordPress Shopkeeper Extender plugin \< 7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Get Bowtied Shopkeeper Extender)
- [CVE-2025-67543](https://cve.now/CVE-2025-67543.md): WordPress Essential Widgets plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Catch Themes Essential Widgets)
- [CVE-2025-67542](https://cve.now/CVE-2025-67542.md): WordPress Multi-Step Checkout for WooCommerce plugin \<= 2.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SilkyPress Multi-Step Checkout for WooCommerce)
- [CVE-2025-67541](https://cve.now/CVE-2025-67541.md): WordPress WP-ShowHide plugin \<= 1.05 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lester Chan WP-ShowHide)
- [CVE-2025-67540](https://cve.now/CVE-2025-67540.md): WordPress Animation Addons for Elementor plugin \<= 2.4.5 - Arbitrary Content Deletion vulnerability (CVSS 6.5, Wealcoder Animation Addons for Elementor)
- [CVE-2025-67539](https://cve.now/CVE-2025-67539.md): WordPress Select Core plugin \< 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Select-Themes Select Core)
- [CVE-2025-67538](https://cve.now/CVE-2025-67538.md): WordPress JNews Gallery plugin \< 12.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jegtheme JNews Gallery)
- [CVE-2025-67537](https://cve.now/CVE-2025-67537.md): WordPress ThirstyAffiliates plugin \<= 3.11.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Blair Williams ThirstyAffiliates)
- [CVE-2025-67536](https://cve.now/CVE-2025-67536.md): WordPress LearnPress plugin \<= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThimPress LearnPress)
- [CVE-2025-67535](https://cve.now/CVE-2025-67535.md): WordPress WP Maps plugin \<= 4.8.6 - PHP Object Injection vulnerability (CVSS 6.6, Flipper Code - WordPress Development Company WP Maps)
- [CVE-2025-67534](https://cve.now/CVE-2025-67534.md): WordPress Rencontre plugin \<= 3.13.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Jacques Malgrange Rencontre)
- [CVE-2025-67533](https://cve.now/CVE-2025-67533.md): WordPress Themify Portfolio Post plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, themifyme Themify Portfolio Post)
- [CVE-2025-67532](https://cve.now/CVE-2025-67532.md): WordPress Hara theme \<= 1.2.17 - Local File Inclusion vulnerability (CVSS 7.5, thembay Hara)
- [CVE-2025-67531](https://cve.now/CVE-2025-67531.md): WordPress Turitor theme \< 1.5.3 - Local File Inclusion vulnerability (CVSS 7.5, trippleS Turitor)
- [CVE-2025-67530](https://cve.now/CVE-2025-67530.md): WordPress Besa theme \<= 2.3.15 - Local File Inclusion vulnerability (CVSS 7.5, thembay Besa)
- [CVE-2025-67529](https://cve.now/CVE-2025-67529.md): WordPress Fashion theme \< 5.3.0 - Local File Inclusion vulnerability (CVSS 7.5, Opal\_WP Fashion)
- [CVE-2025-67528](https://cve.now/CVE-2025-67528.md): WordPress Urna theme \<= 2.5.12 - Local File Inclusion vulnerability (CVSS 7.5, thembay Urna)
- [CVE-2025-67527](https://cve.now/CVE-2025-67527.md): WordPress Digiqole theme \< 2.2.7 - Local File Inclusion vulnerability (CVSS 7.5, trippleS Digiqole)
- [CVE-2025-67526](https://cve.now/CVE-2025-67526.md): WordPress Sailing theme \< 4.4.6 - Local File Inclusion vulnerability (CVSS 7.5, ThimPress Sailing)
- [CVE-2025-67525](https://cve.now/CVE-2025-67525.md): WordPress ekommart theme \< 4.3.1 - Local File Inclusion vulnerability (CVSS 7.5, Opal\_WP ekommart)
- [CVE-2025-67524](https://cve.now/CVE-2025-67524.md): WordPress Jobmonster Elementor Addon plugin \<= 1.1.4 - Local File Inclusion vulnerability (CVSS 7.5, NooTheme Jobmonster Elementor Addon)
- [CVE-2025-67523](https://cve.now/CVE-2025-67523.md): WordPress Exhibz theme \<= 3.0.9 - Local File Inclusion vulnerability (CVSS 7.5, trippleS Exhibz)
- [CVE-2025-67522](https://cve.now/CVE-2025-67522.md): WordPress Jobmonster theme \<= 4.8.2 - Local File Inclusion vulnerability (CVSS 7.5, NooTheme Jobmonster)
- [CVE-2025-67521](https://cve.now/CVE-2025-67521.md): WordPress Select Core plugin \< 2.6 - Local File Inclusion vulnerability (CVSS 7.5, Select-Themes Select Core)
- [CVE-2025-67520](https://cve.now/CVE-2025-67520.md): WordPress Media Library Tools plugin \<= 1.6.15 - SQL Injection vulnerability (CVSS 7.6, Tiny Solutions Media Library Tools)
- [CVE-2025-67519](https://cve.now/CVE-2025-67519.md): WordPress Ninja Tables plugin \<= 5.2.3 - SQL Injection vulnerability (CVSS 7.6, Shahjahan Jewel Ninja Tables)
- [CVE-2025-67518](https://cve.now/CVE-2025-67518.md): WordPress Accordion Slider PRO plugin \<= 1.2 - SQL Injection vulnerability (CVSS 8.5, LambertGroup Accordion Slider PRO)
- [CVE-2025-67517](https://cve.now/CVE-2025-67517.md): WordPress ArtPlacer Widget plugin \<= 2.22.9.2 - SQL Injection vulnerability (CVSS 8.5, ArtPlacer Widget)
- [CVE-2025-67516](https://cve.now/CVE-2025-67516.md): WordPress Store Locator WordPress plugin \<= 1.6.2 - SQL Injection vulnerability (CVSS 8.5, Agile Logix Store Locator WordPress)
- [CVE-2025-67515](https://cve.now/CVE-2025-67515.md): WordPress Wilmër theme \< 3.5 - Local File Inclusion vulnerability (CVSS 8.8, Mikado-Themes Wilmër)
- [CVE-2025-67474](https://cve.now/CVE-2025-67474.md): WordPress ForumWP plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 4.3, Ultimate Member ForumWP)
- [CVE-2025-67473](https://cve.now/CVE-2025-67473.md): WordPress CWW Companion plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, codeworkweb CWW Companion)
- [CVE-2025-67472](https://cve.now/CVE-2025-67472.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2025-67471](https://cve.now/CVE-2025-67471.md): WordPress Quick Contact Form plugin \<= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saad Iqbal Quick Contact Form)
- [CVE-2025-67470](https://cve.now/CVE-2025-67470.md): WordPress Portfolio and Projects plugin \<= 1.5.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, Essential Plugin Portfolio and Projects)
- [CVE-2025-67469](https://cve.now/CVE-2025-67469.md): WordPress PDF Thumbnail Generator plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, kubiq PDF Thumbnail Generator)
- [CVE-2025-67468](https://cve.now/CVE-2025-67468.md): WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 4.3, CRM Perks Integration for Salesforce and Contact Form 7, WP…)
- [CVE-2025-67466](https://cve.now/CVE-2025-67466.md): WordPress Trinity Audio plugin \<= 5.23.3 - Broken Access Control vulnerability (CVSS 4.3, sergiotrinity Trinity Audio)
- [CVE-2025-67465](https://cve.now/CVE-2025-67465.md): WordPress Simple Link Directory plugin \<= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, QuantumCloud Simple Link Directory)
- [CVE-2025-66534](https://cve.now/CVE-2025-66534.md): WordPress The Aisle theme \<= 2.9 - Broken Access Control vulnerability (CVSS 4.3, Elated-Themes The Aisle)
- [CVE-2025-66532](https://cve.now/CVE-2025-66532.md): WordPress Powerlift theme \< 3.2.1 - Broken Access Control vulnerability (CVSS 4.3, Mikado-Themes Powerlift)
- [CVE-2025-66531](https://cve.now/CVE-2025-66531.md): WordPress Salon booking system plugin \<= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dimitri Grassi Salon booking system)
- [CVE-2025-66530](https://cve.now/CVE-2025-66530.md): WordPress Webba Booking plugin \<= 6.2.1 - Broken Access Control vulnerability (CVSS 4.3, Webba Appointment Booking Webba Booking)
- [CVE-2025-66529](https://cve.now/CVE-2025-66529.md): WordPress Chartify plugin \<= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ays Pro Chartify)
- [CVE-2025-66528](https://cve.now/CVE-2025-66528.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.1.8 - Broken Access Control vulnerability (CVSS 4.3, VillaTheme Thank You Page Customizer for WooCommerce)
- [CVE-2025-66527](https://cve.now/CVE-2025-66527.md): WordPress Lobo theme \<= 2.8.6 - Broken Access Control vulnerability (CVSS 4.3, VanKarWai Lobo)
- [CVE-2025-66526](https://cve.now/CVE-2025-66526.md): WordPress Tablesome plugin \<= 1.1.34 - Broken Access Control vulnerability (CVSS 4.3, Essekia Tablesome)
- [CVE-2025-66525](https://cve.now/CVE-2025-66525.md): WordPress Elastic Email Sender plugin \<= 1.2.20 - Broken Access Control vulnerability (CVSS 4.3, Elastic Email Sender)
- [CVE-2025-64257](https://cve.now/CVE-2025-64257.md): WordPress My Tickets plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3, Joe Dolson My Tickets)
- [CVE-2025-64256](https://cve.now/CVE-2025-64256.md): WordPress Simple Folio plugin \<= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PressTigers Simple Folio)
- [CVE-2025-64255](https://cve.now/CVE-2025-64255.md): WordPress Admin and Site Enhancements (ASE) plugin \<= 8.0.8 - Broken Access Control vulnerability (CVSS 2.7, Bowo Admin and Site Enhancements)
- [CVE-2025-64254](https://cve.now/CVE-2025-64254.md): WordPress Photo Block plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 2.7, Ronald Huereca Photo Block)
- [CVE-2025-9368](https://cve.now/CVE-2025-9368.md): 432ES-IG3 Series A Denial-of-Service Vulnerability (CVSS 8.7, Rockwell Automation 432ES-IG3 Series A)
- [CVE-2025-12807](https://cve.now/CVE-2025-12807.md): FactoryTalk® DataMosaix™ Private Cloud SQL Injection (CVSS 8.7, Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud)
- [CVE-2025-12558](https://cve.now/CVE-2025-12558.md): Beaver Builder – WordPress Page Builder \<= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2025-12705](https://cve.now/CVE-2025-12705.md): Social Reviews & Recommendations \<= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews (CVSS 7.2, widgetpack Reviews Widgets for Google, Yelp & TripAdvisor)
- [CVE-2025-10876](https://cve.now/CVE-2025-10876.md): XSS in Talent Software's e-Bap (CVSS 5.3, Talent Software e-BAP Automation)
- [CVE-2025-12381](https://cve.now/CVE-2025-12381.md): Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer (CVSS 6.1, AlgoSec Firewall Analyzer)
- [CVE-2025-6924](https://cve.now/CVE-2025-6924.md): Reflected XSS in Talent Software's e-BAP (CVSS 5.4, Talent Software e-BAP Automation)
- [CVE-2025-14333](https://cve.now/CVE-2025-14333.md): Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14332](https://cve.now/CVE-2025-14332.md): Memory safety bugs fixed in Firefox 146 and Thunderbird 146 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14331](https://cve.now/CVE-2025-14331.md): Same-origin policy bypass in the Request Handling component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14330](https://cve.now/CVE-2025-14330.md): JIT miscompilation in the JavaScript Engine: JIT component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14329](https://cve.now/CVE-2025-14329.md): Privilege escalation in the Netmonitor component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14328](https://cve.now/CVE-2025-14328.md): Privilege escalation in the Netmonitor component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14327](https://cve.now/CVE-2025-14327.md): Spoofing issue in the Downloads Panel component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14326](https://cve.now/CVE-2025-14326.md): Use-after-free in the Audio/Video: GMP component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14325](https://cve.now/CVE-2025-14325.md): JIT miscompilation in the JavaScript Engine: JIT component (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14324](https://cve.now/CVE-2025-14324.md): JIT miscompilation in the JavaScript Engine: JIT component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14323](https://cve.now/CVE-2025-14323.md): Privilege escalation in the DOM: Notifications component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14322](https://cve.now/CVE-2025-14322.md): Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-14321](https://cve.now/CVE-2025-14321.md): Use-after-free in the WebRTC: Signaling component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-56464](https://cve.now/CVE-2024-56464.md): IBM QRadar SIEM is affected by an information disclosure vulnerability (CVSS 2.7, IBM QRadar SIEM)
- [CVE-2025-11022](https://cve.now/CVE-2025-11022.md): CSRF in Panilux (CVSS 9.6, Personal Project Panilux)
- [CVE-2025-40941](https://cve.now/CVE-2025-40941.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0.1). (CVSS 4.3, Siemens SIMATIC CN)
- [CVE-2025-40940](https://cve.now/CVE-2025-40940.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0.1). (CVSS 4.9, Siemens SIMATIC CN)
- [CVE-2025-40939](https://cve.now/CVE-2025-40939.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0.1). (CVSS 4.6, Siemens SIMATIC CN)
- [CVE-2025-40938](https://cve.now/CVE-2025-40938.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0.1). (CVSS 8.1, Siemens SIMATIC CN)
- [CVE-2025-40937](https://cve.now/CVE-2025-40937.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0.1). (CVSS 8.3, Siemens SIMATIC CN)
- [CVE-2025-40935](https://cve.now/CVE-2025-40935.md): A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions \< V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions \< V5.10.1), RU (CVSS 4.3, Siemens RUGGEDCOM RMC8388 V5.X · Siemens RUGGEDCOM RS41… +19)
- [CVE-2025-40831](https://cve.now/CVE-2025-40831.md): A vulnerability has been identified in SINEC Security Monitor (All versions \< V4.10.0). (CVSS 6.5, Siemens SINEC Security Monitor)
- [CVE-2025-40830](https://cve.now/CVE-2025-40830.md): A vulnerability has been identified in SINEC Security Monitor (All versions \< V4.10.0). (CVSS 6.7, Siemens SINEC Security Monitor)
- [CVE-2025-40820](https://cve.now/CVE-2025-40820.md): Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. (CVSS 7.5, Siemens SIDOOR ATD430W · Siemens SIDOOR ATE530G COATED +138)
- [CVE-2025-40819](https://cve.now/CVE-2025-40819.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP4). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2025-40818](https://cve.now/CVE-2025-40818.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP4). (CVSS 3.3, Siemens SINEMA Remote Connect Server)
- [CVE-2025-40807](https://cve.now/CVE-2025-40807.md): A vulnerability has been identified in Gridscale X Prepay (All versions \< V4.2.1). (CVSS 6.3, Siemens Gridscale X Prepay)
- [CVE-2025-40806](https://cve.now/CVE-2025-40806.md): A vulnerability has been identified in Gridscale X Prepay (All versions \< V4.2.1). (CVSS 5.3, Siemens Gridscale X Prepay)
- [CVE-2025-40801](https://cve.now/CVE-2025-40801.md): A vulnerability has been identified in COMOS V10.6 (All versions \< V10.6.1), COMOS V10.6 (All versions \< V10.6.1), JT Bi-Directional Transla (CVSS 8.1, Siemens COMOS · Siemens JT Bi-Directional Translator for… +3)
- [CVE-2025-40800](https://cve.now/CVE-2025-40800.md): A vulnerability has been identified in COMOS V10.6 (All versions \< V10.6.1), COMOS V10.6 (All versions \< V10.6.1), NX V2412 (All versions \< (CVSS 7.4, Siemens COMOS · Siemens NX +3)
- [CVE-2024-56840](https://cve.now/CVE-2024-56840.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 7.2, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-56839](https://cve.now/CVE-2024-56839.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 7.2, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-56838](https://cve.now/CVE-2024-56838.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 7.2, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-56837](https://cve.now/CVE-2024-56837.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 7.2, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-56836](https://cve.now/CVE-2024-56836.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 7.5, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-56835](https://cve.now/CVE-2024-56835.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.17.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.17.0), RUGGE (CVSS 8.8, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2025-59029](https://cve.now/CVE-2025-59029.md): Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor (CVSS 5.3, PowerDNS Recursor)
- [CVE-2025-59030](https://cve.now/CVE-2025-59030.md): Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor (CVSS 7.5, PowerDNS Recursor)
- [CVE-2025-66271](https://cve.now/CVE-2025-66271.md): Clone for Windows provided by ELECOM CO.,LTD. (CVSS 6.7, ELECOM CO. Clone for Windows)
- [CVE-2025-64696](https://cve.now/CVE-2025-64696.md): Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. (CVSS 3.3, Brother Industries Android App "Brother iPrint&Scan")
- [CVE-2025-41693](https://cve.now/CVE-2025-41693.md): Authenticated Denial-of-Service via SSH (CVSS 4.3, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41696](https://cve.now/CVE-2025-41696.md): Hardcoded User Password (CVSS 4.6, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41694](https://cve.now/CVE-2025-41694.md): Authenticated Denial-of-Service via Webshell (CVSS 6.5, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41692](https://cve.now/CVE-2025-41692.md): Weak/Predictable root Password (CVSS 6.8, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41697](https://cve.now/CVE-2025-41697.md): Shell access to UART Console (CVSS 6.8, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41695](https://cve.now/CVE-2025-41695.md): Reflected XSS vulnerability in dyn\_conn.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41745](https://cve.now/CVE-2025-41745.md): Reflected XSS vulnerability in pxc\_portCntr2.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41746](https://cve.now/CVE-2025-41746.md): Reflected XSS vulnerability in pxc\_portSecCfg.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41747](https://cve.now/CVE-2025-41747.md): Reflected XSS vulnerability in pxc\_vlanIntfCfg.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41748](https://cve.now/CVE-2025-41748.md): Reflected XSS vulnerability in pxc\_Dot1xCfg.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41749](https://cve.now/CVE-2025-41749.md): Reflected XSS vulnerability in port\_util.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41750](https://cve.now/CVE-2025-41750.md): Reflected XSS vulnerability in pxc\_PortCfg.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41751](https://cve.now/CVE-2025-41751.md): Reflected XSS vulnerability in pxc\_portCntr.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-41752](https://cve.now/CVE-2025-41752.md): Reflected XSS vulnerability in pxc\_portSfp.php (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-14311](https://cve.now/CVE-2025-14311.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3. (CVSS 6.8, JMRI)
- [CVE-2025-14310](https://cve.now/CVE-2025-14310.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb.This issue affects rethinkdb: before 2.4.4 (CVSS 9.3, rethinkdb)
- [CVE-2025-14309](https://cve.now/CVE-2025-14309.md): NULL Pointer Dereference vulnerability in ravynsoft ravynos.This issue affects ravynos: through 0.5.2. (CVSS 7.5, ravynsoft ravynos)
- [CVE-2025-14308](https://cve.now/CVE-2025-14308.md): Integer Overflow in Robocode's Buffer Write Method (CVSS 10.0, Robocode Project Robocode)
- [CVE-2025-14307](https://cve.now/CVE-2025-14307.md): Insecure Temporary File Creation in Robocode's AutoExtract Component (CVSS 9.3, Robocode Project Robocode · net.sf.robocode:robocode.battle)
- [CVE-2025-14306](https://cve.now/CVE-2025-14306.md): Directory Traversal in Robocode's CacheCleaner Component (CVSS 10.0, Robocode Project Robocode · net.sf.robocode:robocode.core)
- [CVE-2025-13428](https://cve.now/CVE-2025-13428.md): RCE in SecOps SOAR server via user-provided Python packages (CVSS 8.6, Google Cloud SecOps SOAR)
- [CVE-2025-13071](https://cve.now/CVE-2025-13071.md): Custom Admin Menu \<= 1.0.0 - Reflected XSS (CVSS 7.1, Custom Admin Menu)
- [CVE-2025-13070](https://cve.now/CVE-2025-13070.md): CSV to SortTable \<= 4.2 - Contributor+ LFI (CVSS 6.6, CSV to SortTable)
- [CVE-2025-13031](https://cve.now/CVE-2025-13031.md): WPeMatico RSS Feed Fetcher \< 2.8.13 - Contributor+ Stored XSS (CVSS 5.9, WPeMatico RSS Feed Fetcher)
- [CVE-2025-14284](https://cve.now/CVE-2025-14284.md): Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allo (CVSS 5.1, @tiptap/extension-link)
- [CVE-2025-13604](https://cve.now/CVE-2025-13604.md): Login Security, FireWall, Malware removal by CleanTalk \<= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL (CVSS 7.2, Login Security, FireWall, Malware removal by CleanTalk)
- [CVE-2025-40344](https://cve.now/CVE-2025-40344.md): ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (CVSS 7.8, Linux)
- [CVE-2025-40343](https://cve.now/CVE-2025-40343.md): nvmet-fc: avoid scheduling association deletion twice (CVSS 9.8, Linux)
- [CVE-2025-40342](https://cve.now/CVE-2025-40342.md): nvme-fc: use lock accessing port\_state and rport state (CVSS 8.8, Linux)
- [CVE-2025-40341](https://cve.now/CVE-2025-40341.md): futex: Don't leak robust\_list pointer on exec race (no CVSS, Linux)
- [CVE-2025-40340](https://cve.now/CVE-2025-40340.md): drm/xe: Fix oops in xe\_gem\_fault when running core\_hotunplug test. (no CVSS, Linux)
- [CVE-2025-40339](https://cve.now/CVE-2025-40339.md): drm/amdgpu: fix nullptr err of vm\_handle\_moved (no CVSS, Linux)
- [CVE-2025-40338](https://cve.now/CVE-2025-40338.md): ASoC: Intel: avs: Do not share the name pointer between components (no CVSS, Linux)
- [CVE-2025-40337](https://cve.now/CVE-2025-40337.md): net: stmmac: Correctly handle Rx checksum offload errors (CVSS 8.2, Linux)
- [CVE-2025-40336](https://cve.now/CVE-2025-40336.md): drm/gpusvm: fix hmm\_pfn\_to\_map\_order() usage (CVSS 8.8, Linux)
- [CVE-2025-40335](https://cve.now/CVE-2025-40335.md): drm/amdgpu: validate userq input args (no CVSS, Linux)
- [CVE-2025-40334](https://cve.now/CVE-2025-40334.md): drm/amdgpu: validate userq buffer virtual address and size (CVSS 7.3, Linux)
- [CVE-2025-40333](https://cve.now/CVE-2025-40333.md): f2fs: fix infinite loop in \_\_insert\_extent\_tree() (no CVSS, Linux)
- [CVE-2025-40332](https://cve.now/CVE-2025-40332.md): drm/amdkfd: Fix mmap write lock not release (no CVSS, Linux)
- [CVE-2025-40331](https://cve.now/CVE-2025-40331.md): sctp: Prevent TOCTOU out-of-bounds write (CVSS 7.8, Linux)
- [CVE-2025-40330](https://cve.now/CVE-2025-40330.md): bnxt\_en: Shutdown FW DMA in bnxt\_shutdown() (no CVSS, Linux)
- [CVE-2025-40329](https://cve.now/CVE-2025-40329.md): drm/sched: Fix deadlock in drm\_sched\_entity\_kill\_jobs\_cb (no CVSS, Linux)
- [CVE-2025-40328](https://cve.now/CVE-2025-40328.md): smb: client: fix potential UAF in smb2\_close\_cached\_fid() (CVSS 8.8, Linux)
- [CVE-2025-40327](https://cve.now/CVE-2025-40327.md): perf/core: Fix system hang caused by cpu-clock usage (no CVSS, Linux)
- [CVE-2025-67487](https://cve.now/CVE-2025-67487.md): Static Web Server is vulnerable to symbolic link Path Traversal (CVSS 5.5, static-web-server)
- [CVE-2025-67504](https://cve.now/CVE-2025-67504.md): WBCE CMS has Weak Random Number Generator in Password Generation Function (CVSS 9.1, WBCE\_CMS)
- [CVE-2025-66631](https://cve.now/CVE-2025-66631.md): CSLA .NET is vulnerable to Remote Code Execution via WcfProxy (CVSS 7.2, MarimerLLC csla · Csla)
- [CVE-2025-66627](https://cve.now/CVE-2025-66627.md): Wasmi's Linear Memory has a Critical Use After Free Vulnerability (CVSS 8.4, wasmi-labs wasmi · wasmi)
- [CVE-2025-66578](https://cve.now/CVE-2025-66578.md): robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation (CVSS 6.0, robrichards xmlseclibs · robrichards/xmlseclibs)
- [CVE-2025-42928](https://cve.now/CVE-2025-42928.md): Deserialization Vulnerability in SAP jConnect - SDK for ASE (CVSS 9.1, SAP\_SE SAP jConnect - SDK for ASE)
- [CVE-2025-42904](https://cve.now/CVE-2025-42904.md): Information Disclosure vulnerability in Application Server ABAP (CVSS 6.5, SAP\_SE Application Server ABAP)
- [CVE-2025-42896](https://cve.now/CVE-2025-42896.md): Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform (CVSS 5.4, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2025-42891](https://cve.now/CVE-2025-42891.md): Missing Authorization check in SAP Enterprise Search for ABAP (CVSS 5.5, SAP\_SE SAP Enterprise Search for ABAP)
- [CVE-2025-42880](https://cve.now/CVE-2025-42880.md): Code Injection vulnerability in SAP Solution Manager (CVSS 9.9, SAP\_SE SAP Solution Manager)
- [CVE-2025-42878](https://cve.now/CVE-2025-42878.md): Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) (CVSS 8.2, SAP\_SE SAP Web Dispatcher and Internet Communication Manager)
- [CVE-2025-42877](https://cve.now/CVE-2025-42877.md): Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server (CVSS 7.5, SAP\_SE SAP Web Dispatcher, Internet Communication Manager a…)
- [CVE-2025-42876](https://cve.now/CVE-2025-42876.md): Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) (CVSS 7.1, SAP\_SE SAP S/4 HANA Private Cloud)
- [CVE-2025-42875](https://cve.now/CVE-2025-42875.md): Missing Authentication check in SAP NetWeaver Internet Communication Framework (CVSS 6.6, SAP\_SE SAP NetWeaver Internet Communication Framework)
- [CVE-2025-42874](https://cve.now/CVE-2025-42874.md): Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius) (CVSS 7.9, SAP\_SE SAP NetWeaver)
- [CVE-2025-42873](https://cve.now/CVE-2025-42873.md): Denial of Service (DoS) in SAPUI5 framework (Markdown-it component) (CVSS 5.9, SAP\_SE SAPUI5 framework)
- [CVE-2025-42872](https://cve.now/CVE-2025-42872.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1, SAP\_SE SAP NetWeaver Enterprise Portal)
- [CVE-2025-66622](https://cve.now/CVE-2025-66622.md): matrix-sdk-base is vulnerable to DoS via custom m.room.join\_rules event values (CVSS 1.3, matrix-org matrix-rust-sdk · matrix-sdk-base)
- [CVE-2025-66568](https://cve.now/CVE-2025-66568.md): ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation (CVSS 9.3, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2025-66567](https://cve.now/CVE-2025-66567.md): ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) (CVSS 9.3, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2025-66565](https://cve.now/CVE-2025-66565.md): Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values (CVSS 9.3, gofiber utils · github.com/gofiber/utils/v2 +1)
- [CVE-2025-66508](https://cve.now/CVE-2025-66508.md): 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers (CVSS 6.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel +1)
- [CVE-2025-14286](https://cve.now/CVE-2025-14286.md): Tenda AC9 Configuration File DownloadCfg.jpg information disclosure (CVSS 6.9, Tenda AC9)
- [CVE-2023-53866](https://cve.now/CVE-2023-53866.md): ASoC: soc-compress: Reposition and add pcm\_mutex (CVSS 7.8, Linux)
- [CVE-2023-53865](https://cve.now/CVE-2023-53865.md): btrfs: fix warning when putting transaction with qgroups enabled after abort (no CVSS, Linux)
- [CVE-2023-53864](https://cve.now/CVE-2023-53864.md): drm/mxsfb: Disable overlay plane in mxsfb\_plane\_overlay\_atomic\_disable() (no CVSS, Linux)
- [CVE-2023-53863](https://cve.now/CVE-2023-53863.md): netlink: do not hard code device address lenth in fdb dumps (no CVSS, Linux)
- [CVE-2023-53862](https://cve.now/CVE-2023-53862.md): hfs: fix missing hfs\_bnode\_get() in \_\_hfs\_bnode\_create (CVSS 7.8, Linux)
- [CVE-2023-53861](https://cve.now/CVE-2023-53861.md): ext4: correct grp validation in ext4\_mb\_good\_group (no CVSS, Linux)
- [CVE-2023-53860](https://cve.now/CVE-2023-53860.md): dm: don't attempt to queue IO under RCU protection (CVSS 7.8, Linux)
- [CVE-2023-53859](https://cve.now/CVE-2023-53859.md): s390/idle: mark arch\_cpu\_idle() noinstr (no CVSS, Linux)
- [CVE-2023-53858](https://cve.now/CVE-2023-53858.md): tty: serial: samsung\_tty: Fix a memory leak in s3c24xx\_serial\_getclk() in case of error (no CVSS, Linux)
- [CVE-2023-53857](https://cve.now/CVE-2023-53857.md): bpf: bpf\_sk\_storage: Fix invalid wait context lockdep report (no CVSS, Linux)
- [CVE-2023-53856](https://cve.now/CVE-2023-53856.md): of: overlay: Call of\_changeset\_init() early (no CVSS, Linux)
- [CVE-2023-53855](https://cve.now/CVE-2023-53855.md): net: dsa: ocelot: call dsa\_tag\_8021q\_unregister() under rtnl\_lock() on driver remove (no CVSS, Linux)
- [CVE-2023-53854](https://cve.now/CVE-2023-53854.md): ASoC: mediatek: mt8186: Fix use-after-free in driver remove path (no CVSS, Linux)
- [CVE-2023-53853](https://cve.now/CVE-2023-53853.md): netlink: annotate accesses to nlk-\>cb\_running (no CVSS, Linux)
- [CVE-2023-53852](https://cve.now/CVE-2023-53852.md): nvme-core: fix memory leak in dhchap\_secret\_store (no CVSS, Linux)
- [CVE-2023-53851](https://cve.now/CVE-2023-53851.md): drm/msm/dp: Drop aux devices together with DP controller (CVSS 8.4, Linux)
- [CVE-2023-53850](https://cve.now/CVE-2023-53850.md): iavf: use internal state to free traffic IRQs (no CVSS, Linux)
- [CVE-2023-53849](https://cve.now/CVE-2023-53849.md): drm/msm: fix workqueue leak on bind errors (no CVSS, Linux)
- [CVE-2023-53848](https://cve.now/CVE-2023-53848.md): md/raid5-cache: fix a deadlock in r5l\_exit\_log() (no CVSS, Linux)
- [CVE-2023-53847](https://cve.now/CVE-2023-53847.md): usb-storage: alauda: Fix uninit-value in alauda\_check\_media() (no CVSS, Linux)
- [CVE-2023-53846](https://cve.now/CVE-2023-53846.md): f2fs: fix to do sanity check on direct node in truncate\_dnode() (CVSS 7.8, Linux)
- [CVE-2023-53845](https://cve.now/CVE-2023-53845.md): nilfs2: fix infinite loop in nilfs\_mdt\_get\_block() (no CVSS, Linux)
- [CVE-2023-53844](https://cve.now/CVE-2023-53844.md): drm/ttm: Don't leak a resource on swapout move error (CVSS 7.8, Linux)
- [CVE-2023-53843](https://cve.now/CVE-2023-53843.md): net: openvswitch: reject negative ifindex (no CVSS, Linux)
- [CVE-2023-53842](https://cve.now/CVE-2023-53842.md): ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove (no CVSS, Linux)
- [CVE-2023-53841](https://cve.now/CVE-2023-53841.md): devlink: report devlink\_port\_type\_warn source device (no CVSS, Linux)
- [CVE-2023-53840](https://cve.now/CVE-2023-53840.md): usb: early: xhci-dbc: Fix a potential out-of-bound memory access (no CVSS, Linux)
- [CVE-2023-53839](https://cve.now/CVE-2023-53839.md): dccp: fix data-race around dp-\>dccps\_mss\_cache (no CVSS, Linux)
- [CVE-2023-53838](https://cve.now/CVE-2023-53838.md): f2fs: synchronize atomic write aborts (CVSS 7.8, Linux)
- [CVE-2023-53837](https://cve.now/CVE-2023-53837.md): drm/msm: fix NULL-deref on snapshot tear down (no CVSS, Linux)
- [CVE-2023-53836](https://cve.now/CVE-2023-53836.md): bpf, sockmap: Fix skb refcnt race after locking changes (CVSS 7.8, Linux)
- [CVE-2023-53834](https://cve.now/CVE-2023-53834.md): iio: adc: ina2xx: avoid NULL pointer dereference on OF device match (no CVSS, Linux)
- [CVE-2023-53833](https://cve.now/CVE-2023-53833.md): drm/i915: Fix NULL ptr deref by checking new\_crtc\_state (no CVSS, Linux)
- [CVE-2023-53832](https://cve.now/CVE-2023-53832.md): md/raid10: fix null-ptr-deref in raid10\_sync\_request (no CVSS, Linux)
- [CVE-2023-53831](https://cve.now/CVE-2023-53831.md): net: read sk-\>sk\_family once in sk\_mc\_loop() (no CVSS, Linux)
- [CVE-2023-53830](https://cve.now/CVE-2023-53830.md): platform/x86: think-lmi: Fix memory leak when showing current settings (no CVSS, Linux)
- [CVE-2023-53829](https://cve.now/CVE-2023-53829.md): f2fs: flush inode if atomic file is aborted (CVSS 7.8, Linux)
- [CVE-2023-53828](https://cve.now/CVE-2023-53828.md): Bluetooth: hci\_sync: Avoid use-after-free in dbg for hci\_add\_adv\_monitor() (CVSS 7.8, Linux)
- [CVE-2023-53827](https://cve.now/CVE-2023-53827.md): Bluetooth: L2CAP: Fix use-after-free in l2cap\_disconnect\_{req,rsp} (CVSS 8.8, Linux)
- [CVE-2023-53826](https://cve.now/CVE-2023-53826.md): ubi: Fix UAF wear-leveling entry in eraseblk\_count\_seq\_show() (no CVSS, Linux)
- [CVE-2023-53825](https://cve.now/CVE-2023-53825.md): kcm: Fix error handling for SOCK\_DGRAM in kcm\_sendmsg(). (no CVSS, Linux)
- [CVE-2023-53824](https://cve.now/CVE-2023-53824.md): netlink: annotate lockless accesses to nlk-\>max\_recvmsg\_len (CVSS 7.8, Linux)
- [CVE-2023-53823](https://cve.now/CVE-2023-53823.md): block/rq\_qos: protect rq\_qos apis with a new lock (CVSS 7.8, Linux)
- [CVE-2023-53822](https://cve.now/CVE-2023-53822.md): wifi: ath11k: Ignore frags from uninitialized peer in dp. (CVSS 8.8, Linux)
- [CVE-2023-53821](https://cve.now/CVE-2023-53821.md): ip6\_vti: fix slab-use-after-free in decode\_session6 (no CVSS, Linux)
- [CVE-2022-50679](https://cve.now/CVE-2022-50679.md): i40e: Fix DMA mappings leak (no CVSS, Linux)
- [CVE-2022-50678](https://cve.now/CVE-2022-50678.md): wifi: brcmfmac: fix invalid address access when enabling SCAN log level (no CVSS, Linux)
- [CVE-2022-50677](https://cve.now/CVE-2022-50677.md): ipmi: fix use after free in \_ipmi\_destroy\_user() (CVSS 7.0, Linux)
- [CVE-2022-50676](https://cve.now/CVE-2022-50676.md): net: rds: don't hold sock lock when cancelling work from rds\_tcp\_reset\_callbacks() (CVSS 7.5, Linux)
- [CVE-2022-50675](https://cve.now/CVE-2022-50675.md): arm64: mte: Avoid setting PG\_mte\_tagged if no tags cleared or restored (no CVSS, Linux)
- [CVE-2022-50674](https://cve.now/CVE-2022-50674.md): riscv: vdso: fix NULL deference in vdso\_join\_timens() when vfork (no CVSS, Linux)
- [CVE-2022-50673](https://cve.now/CVE-2022-50673.md): ext4: fix use-after-free in ext4\_orphan\_cleanup (CVSS 7.8, Linux)
- [CVE-2022-50672](https://cve.now/CVE-2022-50672.md): mailbox: zynq-ipi: fix error handling while device\_register() fails (no CVSS, Linux)
- [CVE-2022-50671](https://cve.now/CVE-2022-50671.md): RDMA/rxe: Fix "kernel NULL pointer dereference" error (CVSS 7.5, Linux)
- [CVE-2022-50670](https://cve.now/CVE-2022-50670.md): mmc: omap\_hsmmc: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50669](https://cve.now/CVE-2022-50669.md): misc: ocxl: fix possible name leak in ocxl\_file\_register\_afu() (no CVSS, Linux)
- [CVE-2022-50668](https://cve.now/CVE-2022-50668.md): ext4: fix deadlock due to mbcache entry corruption (CVSS 7.5, Linux)
- [CVE-2022-50667](https://cve.now/CVE-2022-50667.md): drm/vmwgfx: Fix memory leak in vmw\_mksstat\_add\_ioctl() (no CVSS, Linux)
- [CVE-2022-50666](https://cve.now/CVE-2022-50666.md): RDMA/siw: Fix QP destroy to wait for all references dropped. (CVSS 9.8, Linux)
- [CVE-2022-50665](https://cve.now/CVE-2022-50665.md): wifi: ath11k: fix failed to find the peer with peer\_id 0 when disconnected (CVSS 7.1, Linux)
- [CVE-2022-50664](https://cve.now/CVE-2022-50664.md): media: dvb-frontends: fix leak of memory fw (no CVSS, Linux)
- [CVE-2022-50663](https://cve.now/CVE-2022-50663.md): net: stmmac: fix possible memory leak in stmmac\_dvr\_probe() (no CVSS, Linux)
- [CVE-2022-50662](https://cve.now/CVE-2022-50662.md): RDMA/hns: fix memory leak in hns\_roce\_alloc\_mr() (no CVSS, Linux)
- [CVE-2022-50661](https://cve.now/CVE-2022-50661.md): seccomp: Move copy\_seccomp() to no failure path. (no CVSS, Linux)
- [CVE-2022-50660](https://cve.now/CVE-2022-50660.md): wifi: ipw2200: fix memory leak in ipw\_wdev\_init() (no CVSS, Linux)
- [CVE-2022-50659](https://cve.now/CVE-2022-50659.md): hwrng: geode - Fix PCI device refcount leak (no CVSS, Linux)
- [CVE-2022-50658](https://cve.now/CVE-2022-50658.md): cpufreq: qcom: fix memory leak in error path (no CVSS, Linux)
- [CVE-2022-50657](https://cve.now/CVE-2022-50657.md): riscv: mm: add missing memcpy in kasan\_init (no CVSS, Linux)
- [CVE-2025-66507](https://cve.now/CVE-2025-66507.md): 1Panel – CAPTCHA Bypass via Client-Controlled Flag (CVSS 7.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel +1)
- [CVE-2023-53820](https://cve.now/CVE-2023-53820.md): loop: loop\_set\_status\_from\_info() check before assignment (no CVSS, Linux)
- [CVE-2025-14285](https://cve.now/CVE-2025-14285.md): code-projects Employee Profile Management System edit\_personnel.php sql injection (CVSS 6.9, code-projects Employee Profile Management System)
- [CVE-2025-66491](https://cve.now/CVE-2025-66491.md): Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider (CVSS 5.9, traefik · github.com/traefik/traefik +2)
- [CVE-2025-66490](https://cve.now/CVE-2025-66490.md): Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules (CVSS 6.9, traefik · github.com/traefik/traefik +2)
- [CVE-2025-66481](https://cve.now/CVE-2025-66481.md): DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content (CVSS 9.7, ThinkInAIXYZ deepchat)
- [CVE-2013-10031](https://cve.now/CVE-2013-10031.md): Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks (CVSS 7.5, MIYAGAWA Plack::Middleware::Session)
- [CVE-2025-66470](https://cve.now/CVE-2025-66470.md): NiceGUI Stored/Reflected XSS in ui.interactive\_image via unsanitized SVG content (CVSS 6.1, zauberzeug nicegui · nicegui)
- [CVE-2023-53819](https://cve.now/CVE-2023-53819.md): amdgpu: validate offset\_in\_bo of drm\_amdgpu\_gem\_va (CVSS 7.8, Linux)
- [CVE-2023-53818](https://cve.now/CVE-2023-53818.md): ARM: zynq: Fix refcount leak in zynq\_early\_slcr\_init (no CVSS, Linux)
- [CVE-2023-53817](https://cve.now/CVE-2023-53817.md): crypto: lib/mpi - avoid null pointer deref in mpi\_cmp\_ui() (CVSS 7.5, Linux)
- [CVE-2023-53816](https://cve.now/CVE-2023-53816.md): drm/amdkfd: fix potential kgd\_mem UAFs (CVSS 7.8, Linux)
- [CVE-2023-53815](https://cve.now/CVE-2023-53815.md): posix-timers: Prevent RT livelock in itimer\_delete() (no CVSS, Linux)
- [CVE-2023-53814](https://cve.now/CVE-2023-53814.md): PCI: Fix dropping valid root bus resources with .end = zero (no CVSS, Linux)
- [CVE-2023-53813](https://cve.now/CVE-2023-53813.md): ext4: fix rbtree traversal bug in ext4\_mb\_use\_preallocated (no CVSS, Linux)
- [CVE-2023-53812](https://cve.now/CVE-2023-53812.md): media: mediatek: vcodec: fix decoder disable pm crash (no CVSS, Linux)
- [CVE-2023-53811](https://cve.now/CVE-2023-53811.md): RDMA/irdma: Cap MSIX used to online CPUs + 1 (no CVSS, Linux)
- [CVE-2023-53810](https://cve.now/CVE-2023-53810.md): blk-mq: release crypto keyslot before reporting I/O complete (CVSS 7.8, Linux)
- [CVE-2023-53809](https://cve.now/CVE-2023-53809.md): l2tp: Avoid possible recursive deadlock in l2tp\_tunnel\_register() (no CVSS, Linux)
- [CVE-2023-53808](https://cve.now/CVE-2023-53808.md): wifi: mwifiex: fix memory leak in mwifiex\_histogram\_read() (no CVSS, Linux)
- [CVE-2023-53807](https://cve.now/CVE-2023-53807.md): clk: clocking-wizard: Fix Oops in clk\_wzrd\_register\_divider() (no CVSS, Linux)
- [CVE-2023-53806](https://cve.now/CVE-2023-53806.md): drm/amd/display: populate subvp cmd info only for the top pipe (CVSS 7.8, Linux)
- [CVE-2023-53804](https://cve.now/CVE-2023-53804.md): nilfs2: fix use-after-free bug of nilfs\_root in nilfs\_evict\_inode() (CVSS 7.8, Linux)
- [CVE-2023-53803](https://cve.now/CVE-2023-53803.md): scsi: ses: Fix slab-out-of-bounds in ses\_enclosure\_data\_process() (CVSS 8.1, Linux)
- [CVE-2023-53802](https://cve.now/CVE-2023-53802.md): wifi: ath9k: htc\_hst: free skb in ath9k\_htc\_rx\_msg() if there is no callback function (no CVSS, Linux)
- [CVE-2023-53801](https://cve.now/CVE-2023-53801.md): iommu/sprd: Release dma buffer to avoid memory leak (no CVSS, Linux)
- [CVE-2023-53800](https://cve.now/CVE-2023-53800.md): ubi: Fix use-after-free when volume resizing failed (CVSS 7.8, Linux)
- [CVE-2023-53799](https://cve.now/CVE-2023-53799.md): crypto: api - Use work queue in crypto\_destroy\_instance (no CVSS, Linux)
- [CVE-2023-53798](https://cve.now/CVE-2023-53798.md): ethtool: Fix uninitialized number of lanes (no CVSS, Linux)
- [CVE-2023-53797](https://cve.now/CVE-2023-53797.md): HID: wacom: Use ktime\_t rather than int when dealing with timestamps (CVSS 7.1, Linux)
- [CVE-2023-53796](https://cve.now/CVE-2023-53796.md): f2fs: fix information leak in f2fs\_move\_inline\_dirents() (no CVSS, Linux)
- [CVE-2023-53795](https://cve.now/CVE-2023-53795.md): iommufd: IOMMUFD\_DESTROY should not increase the refcount (CVSS 7.8, Linux)
- [CVE-2023-53794](https://cve.now/CVE-2023-53794.md): cifs: fix session state check in reconnect to avoid use-after-free issue (CVSS 9.8, Linux)
- [CVE-2023-53793](https://cve.now/CVE-2023-53793.md): perf tool x86: Fix perf\_env memory leak (no CVSS, Linux)
- [CVE-2023-53792](https://cve.now/CVE-2023-53792.md): nvme-core: fix memory leak in dhchap\_ctrl\_secret (no CVSS, Linux)
- [CVE-2023-53791](https://cve.now/CVE-2023-53791.md): md: fix warning for holder mismatch from export\_rdev() (no CVSS, Linux)
- [CVE-2023-53790](https://cve.now/CVE-2023-53790.md): bpf: Zeroing allocated object from slab in bpf memory allocator (CVSS 7.8, Linux)
- [CVE-2023-53789](https://cve.now/CVE-2023-53789.md): iommu/amd: Improve page fault error reporting (no CVSS, Linux)
- [CVE-2023-53788](https://cve.now/CVE-2023-53788.md): ALSA: hda/ca0132: fixup buffer overrun at tuning\_ctl\_set() (no CVSS, Linux)
- [CVE-2023-53787](https://cve.now/CVE-2023-53787.md): regulator: da9063: fix null pointer deref with partial DT config (no CVSS, Linux)
- [CVE-2023-53786](https://cve.now/CVE-2023-53786.md): dm flakey: fix a crash with invalid table line (no CVSS, Linux)
- [CVE-2023-53785](https://cve.now/CVE-2023-53785.md): mt76: mt7921: don't assume adequate headroom for SDIO headers (CVSS 8.8, Linux)
- [CVE-2023-53784](https://cve.now/CVE-2023-53784.md): drm: bridge: dw\_hdmi: fix connector access for scdc (no CVSS, Linux)
- [CVE-2023-53783](https://cve.now/CVE-2023-53783.md): blk-iocost: fix divide by 0 error in calc\_lcoefs() (no CVSS, Linux)
- [CVE-2023-53782](https://cve.now/CVE-2023-53782.md): dccp: Fix out of bounds access in DCCP error handler (no CVSS, Linux)
- [CVE-2023-53781](https://cve.now/CVE-2023-53781.md): smc: Fix use-after-free in tcp\_write\_timer\_handler(). (CVSS 7.8, Linux)
- [CVE-2023-53780](https://cve.now/CVE-2023-53780.md): drm/amd/display: fix FCLK pstate change underflow (no CVSS, Linux)
- [CVE-2023-53778](https://cve.now/CVE-2023-53778.md): accel/qaic: Clean up integer overflow checking in map\_user\_pages() (CVSS 7.8, Linux)
- [CVE-2023-53777](https://cve.now/CVE-2023-53777.md): erofs: kill hooked chains to avoid loops on deduplicated compressed images (no CVSS, Linux)
- [CVE-2022-50656](https://cve.now/CVE-2022-50656.md): nfc: pn533: Clear nfc\_target before being used (CVSS 8.1, Linux)
- [CVE-2022-50655](https://cve.now/CVE-2022-50655.md): ppp: associate skb with a device at tx (no CVSS, Linux)
- [CVE-2022-50654](https://cve.now/CVE-2022-50654.md): bpf: Fix panic due to wrong pageattr of im-\>image (no CVSS, Linux)
- [CVE-2022-50653](https://cve.now/CVE-2022-50653.md): mmc: atmel-mci: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50652](https://cve.now/CVE-2022-50652.md): uio: uio\_dmem\_genirq: Fix missing unlock in irq configuration (no CVSS, Linux)
- [CVE-2022-50651](https://cve.now/CVE-2022-50651.md): ethtool: eeprom: fix null-deref on genl\_info in dump (no CVSS, Linux)
- [CVE-2022-50650](https://cve.now/CVE-2022-50650.md): bpf: Fix reference state management for synchronous callbacks (CVSS 7.8, Linux)
- [CVE-2022-50649](https://cve.now/CVE-2022-50649.md): power: supply: adp5061: fix out-of-bounds read in adp5061\_get\_chg\_type() (no CVSS, Linux)
- [CVE-2022-50648](https://cve.now/CVE-2022-50648.md): ftrace: Fix recursive locking direct\_mutex in ftrace\_modify\_direct\_caller (no CVSS, Linux)
- [CVE-2022-50647](https://cve.now/CVE-2022-50647.md): RISC-V: Make port I/O string accessors actually work (no CVSS, Linux)
- [CVE-2022-50646](https://cve.now/CVE-2022-50646.md): scsi: hpsa: Fix possible memory leak in hpsa\_init\_one() (no CVSS, Linux)
- [CVE-2022-50645](https://cve.now/CVE-2022-50645.md): EDAC/i10nm: fix refcount leak in pci\_get\_dev\_wrapper() (no CVSS, Linux)
- [CVE-2022-50644](https://cve.now/CVE-2022-50644.md): clk: ti: dra7-atl: Fix reference leak in of\_dra7\_atl\_clk\_probe (no CVSS, Linux)
- [CVE-2022-50643](https://cve.now/CVE-2022-50643.md): cifs: Fix xid leak in cifs\_copy\_file\_range() (no CVSS, Linux)
- [CVE-2022-50642](https://cve.now/CVE-2022-50642.md): platform/chrome: cros\_ec\_typec: zero out stale pointers (no CVSS, Linux)
- [CVE-2022-50641](https://cve.now/CVE-2022-50641.md): HSI: omap\_ssi: Fix refcount leak in ssi\_probe (no CVSS, Linux)
- [CVE-2022-50640](https://cve.now/CVE-2022-50640.md): mmc: core: Fix kernel panic when remove non-standard SDIO card (no CVSS, Linux)
- [CVE-2022-50639](https://cve.now/CVE-2022-50639.md): io-wq: Fix memory leak in worker creation (no CVSS, Linux)
- [CVE-2022-50638](https://cve.now/CVE-2022-50638.md): ext4: fix bug\_on in \_\_es\_tree\_search caused by bad boot loader inode (no CVSS, Linux)
- [CVE-2022-50637](https://cve.now/CVE-2022-50637.md): cpufreq: qcom-hw: Fix memory leak in qcom\_cpufreq\_hw\_read\_lut() (no CVSS, Linux)
- [CVE-2022-50636](https://cve.now/CVE-2022-50636.md): PCI: Fix pci\_device\_is\_present() for VFs by checking PF (no CVSS, Linux)
- [CVE-2022-50635](https://cve.now/CVE-2022-50635.md): powerpc/kprobes: Fix null pointer reference in arch\_prepare\_kprobe() (no CVSS, Linux)
- [CVE-2022-50634](https://cve.now/CVE-2022-50634.md): power: supply: cw2015: Fix potential null-ptr-deref in cw\_bat\_probe() (no CVSS, Linux)
- [CVE-2022-50633](https://cve.now/CVE-2022-50633.md): usb: dwc3: qcom: Fix memory leak in dwc3\_qcom\_interconnect\_init (no CVSS, Linux)
- [CVE-2025-56704](https://cve.now/CVE-2025-56704.md): LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files (CVSS 8.8)
- [CVE-2025-61074](https://cve.now/CVE-2025-61074.md): A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 a (CVSS 4.6)
- [CVE-2025-61075](https://cve.now/CVE-2025-61075.md): Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileg (CVSS 8.1)
- [CVE-2025-61078](https://cve.now/CVE-2025-61078.md): Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML (CVSS 6.1)
- [CVE-2025-61258](https://cve.now/CVE-2025-61258.md): Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the bo (CVSS 7.5)
- [CVE-2025-63737](https://cve.now/CVE-2025-63737.md): Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attack (CVSS 6.1)
- [CVE-2025-63738](https://cve.now/CVE-2025-63738.md): An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via th (CVSS 4.3)
- [CVE-2025-63739](https://cve.now/CVE-2025-63739.md): An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing (CVSS 4.3)
- [CVE-2025-63740](https://cve.now/CVE-2025-63740.md): SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sen (CVSS 4.3)
- [CVE-2025-63742](https://cve.now/CVE-2025-63742.md): SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attac (CVSS 9.8)
- [CVE-2025-64085](https://cve.now/CVE-2025-64085.md): A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a De (CVSS 6.5)
- [CVE-2025-64086](https://cve.now/CVE-2025-64086.md): A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to caus (CVSS 6.5)
- [CVE-2025-65287](https://cve.now/CVE-2025-65287.md): An unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1 allows a remote attacker to read arbitrary fi (CVSS 7.5)
- [CVE-2025-65288](https://cve.now/CVE-2025-65288.md): A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long (CVSS 6.5)
- [CVE-2025-65289](https://cve.now/CVE-2025-65289.md): A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote att (CVSS 6.1)
- [CVE-2025-65300](https://cve.now/CVE-2025-65300.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set (CVSS 5.4)
- [CVE-2025-65513](https://cve.now/CVE-2025-65513.md): fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP v (CVSS 7.5, mcp-fetch-server)
- [CVE-2025-65572](https://cve.now/CVE-2025-65572.md): Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06\_06 allows remote attackers to execute arbitrary code via the (1) c (CVSS 6.1)
- [CVE-2025-65573](https://cve.now/CVE-2025-65573.md): Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06\_06 allows remote attackers to cause a denial of service via (CVSS 8.8)
- [CVE-2025-65594](https://cve.now/CVE-2025-65594.md): OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform (CVSS 8.1)
- [CVE-2025-65741](https://cve.now/CVE-2025-65741.md): Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. (CVSS 9.8)
- [CVE-2025-65882](https://cve.now/CVE-2025-65882.md): An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function crea (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.