CVEs published December 10, 2025
261 CVEs were published on December 10, 2025: 31 critical, 74 high. 1 is now in CISA KEV.
- Published
- 261
- Critical
- 31
- High
- 74
- Medium
- 151
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 61
Most affected products
- Adobe Experience Manager
- 115
- MailEnable
- 11
- Barracuda Networks RMM
- 4
- DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…
- 4
- EIBIZ Co. i-Media Server Digital Signage
- 4
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 4
- LXware 1Panel · github.com/1Panel-dev/1Panel
- 3
- SpenetiX AG Fusion Digital Signage
- 3
- EZCast Pro II
- 2
- HandL UTM Grabber / Tracker
- 2
Critical 31
- CVE-2025-67511Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolaliasrobotics cai · cai-framework
- CVE-2025-67510MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)neuron-core neuron-ai · neuron-core/neuron-ai
- CVE-2020-36902UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User PrivilegesUBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…
- CVE-2020-36897QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code ExecutionShenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…
- CVE-2020-36894Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation VulnerabilityEIBIZ Co. i-Media Server Digital Signage
- CVE-2020-36892Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege EscalationEIBIZ Co. i-Media Server Digital Signage
- CVE-2020-36885Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgiSony Electronics IPELA Network Camera
- CVE-2025-65950WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterWBCE_CMS
- CVE-2025-64537Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64539Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64538Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-13607D-Link CCTV camera model DCS-F5614-L1 Missing Authentication for Critical FunctionD-Link DCS-F5614-L1
- CVE-2025-34394Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCEBarracuda Networks RMM
- CVE-2025-34393Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEBarracuda Networks RMM
- CVE-2025-34392Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCEBarracuda Networks RMM
- CVE-2025-13184Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank passwordToto Link X5000R's
- CVE-2025-13953Bypass in the authentication method of the GTT Sistema de Información Tributario applicationGTT Sistema de Información Tributario
- CVE-2025-41732Stack-based buffer overflow via unsafe sscanf in check_cookie()WAGO Indsutrial-Managed-Switches
- CVE-2025-41730Stack-based buffer overflow via unsafe sscanf in check_account()WAGO Indsutrial-Managed-Switches
- CVE-2025-13955Predictable Default Wi-Fi Password in EZCast Pro II DongleEZCast Pro II
- CVE-2025-13954Hard-coded cryptographic keys in EZCast Pro II DongleEZCast Pro II
- CVE-2025-13613Elated Membership <= 1.2 - Authentication Bypass via Social LoginElated Themes Elated Membership
- CVE-2025-67506PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Uploadpipeshub-ai
- CVE-2025-65294Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechani
- CVE-2025-65602A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cra
- CVE-2025-65792DataGear v5.5.0 is vulnerable to Arbitrary File Deletion.
- CVE-2025-65820An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0.
- CVE-2025-65823The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on.
- CVE-2025-65826The mobile application was found to contain stored credentials for the network it was developed on.
- CVE-2025-65827The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP.
- CVE-2025-65830Due to a lack of certificate validation, all traffic from the mobile application can be intercepted.
High 74
- CVE-2025-67648Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Pageshopware · shopware/shopware +1
- CVE-2025-67644LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodlangchain-ai langgraph · langgraph-checkpoint-sqlite
- CVE-2025-67509MySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Writeneuron-core neuron-ai · neuron-core/neuron-ai
- CVE-2025-67505Race condition in the Okta Java SDKokta-sdk-java · com.okta.sdk:okta-sdk-root
- CVE-2025-66628ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)ImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2025-66474XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionxwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml
- CVE-2025-66473XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikisxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2024-58284PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata SettingsPopojiCMS
- CVE-2024-58283WBCE CMS 1.6.2 Remote Code Execution via Elfinder File UploadWBCE CMS
- CVE-2024-58282Serendipity 2.5.0 Remote Code Execution via Authenticated Media UploadSerendipity
- CVE-2024-58281Dotclear 2.29 Remote Code Execution via Authenticated File UploadDotclear
- CVE-2024-58280CMSimple 5.15 Remote Command Execution via Extensions ConfigurationCMSimple
- CVE-2024-58279appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager UploadappRain CMF
- CVE-2023-53776Screen SFT DAB 1.9.3 Authentication Bypass via Session Management WeaknessDB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…
- CVE-2023-53775Screen SFT DAB 1.9.3 Authentication Bypass via Session Management WeaknessDB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…
- CVE-2023-53740Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password ChangeDB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…
- CVE-2020-36901UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User ManagementUBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…
- CVE-2020-36900All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User ManagementAll-Dynamics Software Digital Signage System
- CVE-2020-36899QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File DisclosureShenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…
- CVE-2020-36898QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File DeletionShenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…
- CVE-2020-36896QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials DisclosureShenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…
- CVE-2020-36895EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration DisclosureEIBIZ Co. i-Media Server Digital Signage
- CVE-2020-36893Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal VulnerabilityEIBIZ Co. i-Media Server Digital Signage
- CVE-2020-36887SpinetiX Fusion Digital Signage 3.4.8 Unauthenticated Database Backup DisclosureSpinetiX AG Fusion Digital Signage
- CVE-2020-36883SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File OperationsSpenetiX AG Fusion Digital Signage
- CVE-2025-67460Zoom Rooms for Windows - Software Downgrade Protection Mechanism FailureZoom Communications Zoom Rooms
- CVE-2025-34427MailEnable < 10.54 Cleartext Credential Storage in AUTH.TABMailEnable
- CVE-2025-34428MailEnable < 10.54 Cleartext Credential Storage in AUTH.SAVMailEnable
- CVE-2025-344291Panel CSRF Web Port Configuration ChangeLXware 1Panel · github.com/1Panel-dev/1Panel
- CVE-2025-65199Windscribe for Linux 'changeMTU' local privilege escalationWindscribe for Linux Desktop App
- CVE-2025-67641Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage resJenkins Project Jenkins Coverage Plugin · io.jenkins.plugin…
- CVE-2025-67635Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corJenkins Project Jenkins · org.jenkins-ci.main:jenkins-co… +1
- CVE-2025-34421MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISP.DLLMailEnable
- CVE-2025-34417MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISO.DLLMailEnable
- CVE-2025-34419MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISM.DLLMailEnable
- CVE-2025-34416MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPO.DLLMailEnable
- CVE-2025-34422MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPC.DLLMailEnable
- CVE-2025-34418MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIMF.DLLMailEnable
- CVE-2025-34424MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIDP.DLLMailEnable
- CVE-2025-34423MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLLMailEnable
- CVE-2025-34420MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAM.DLLMailEnable
- CVE-2025-344101Panel CSRF in Change Username Functionality Allows Account LockoutLXware 1Panel · github.com/1Panel-dev/1Panel
- CVE-2025-34395Barracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCEBarracuda Networks RMM
- CVE-2025-13155An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code withLenovo Baiying Client
- CVE-2025-13152A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local auLenovo One Client
- CVE-2025-12046A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated usLenovo App Store · Lenovo Browser
- CVE-2025-8110File overwrite in file update API in GogsGogs · gogs.io/gogs
- CVE-2024-2104JBL: Improper BLE security configurations and lack of authentication on the device's GATT serverJBL LIVE PRO 2 TWS · JBL TUNE FLEX
- CVE-2025-41358Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2ACronosWeb i2A CronosWeb
- CVE-2025-7073Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total SecurityBitdefender Total Security · Bitdefender Internet Securi… +1
- CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2025-14390Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Uploadvideomerchant Video Merchant
- CVE-2025-1161Improper Authorization in Nomysoft Informatics' NomysemNomySoft Information Technology Training and Consulting Nom…
- CVE-2025-12952Privilege Escalation in Dialogflow CX via Webhook Admin RoleGoogle Cloud Dialogflow CX
- CVE-2025-9571Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact UploadGoogle Cloud Cloud Data Fusion
- CVE-2025-13073HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_pageHandL UTM Grabber / Tracker
- CVE-2025-13072HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_sourceHandL UTM Grabber / Tracker
- CVE-2025-13339Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Readhippooo Hippoo Mobile App for WooCommerce
- CVE-2025-67507Filament's multi-factor authentication (app) recovery codes can be used multiple timesfilamentphp filament · filament/filament
- CVE-2025-24857Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019
- CVE-2025-56430Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th
- CVE-2025-56431Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th
- CVE-2025-63094XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers
- CVE-2025-63895An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (
- CVE-2025-65290Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during H
- CVE-2025-65291Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS conne
- CVE-2025-65292Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows att
- CVE-2025-65295Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devi
- CVE-2025-65297Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted
- CVE-2025-65512A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 an
- CVE-2025-65807An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.sd
- CVE-2025-65821As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret
- CVE-2025-65824An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bl
- CVE-2025-65831The application uses an insecure hashing algorithm (MD5) to hash passwords.
Medium, low and unrated 156
- CVE-2025-67646TableProgressTracking's missing CSRF protection allows unauthorized state changesTelepedia TableProgressTracking
- CVE-2025-67513FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST APIFreePBX endpoint
- CVE-2025-67490Auth0 Next.js SDK has Improper Request Caching Lookupnextjs-auth0 · @auth0/nextjs-auth0
- CVE-2025-66033Improper Memory Cleanup in the Okta Java SDKokta-sdk-java · com.okta.sdk:okta-sdk-root
- CVE-2025-66472XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationxwiki-platform · org.xwiki.platform:xwiki-platform-flami… +1
- CVE-2024-58285Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post TitleChyrp
- CVE-2023-53741Screen SFT DAB 1.9.3 Authentication Bypass via IP Session ManagementDB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…
- CVE-2020-36888SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login ScriptSpenetiX AG Fusion Digital Signage
- CVE-2020-36886SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User CreationSpenetiX AG Fusion Digital Signage
- CVE-2020-36884BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRFBrightSign Digital Signage Diagnostic Web Server
- CVE-2025-62181Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.Pegasystems Pega Infinity
- CVE-2025-67461Zoom Rooms for macOS - External Control of File Name or PathZoom Communications Zoom Rooms
- CVE-2025-64622Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64582Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64547Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64833Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64613Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64829Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64553Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64545Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64546Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64574Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64550Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64827Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64602Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64593Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64887Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64548Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64563Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64800Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64559Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64817Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64888Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64600Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64583Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64826Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64605Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64875Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64598Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64558Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64616Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64820Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64861Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64801Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64620Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64601Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64560Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64556Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64565Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64606Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64823Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64596Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64572Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64541Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64609Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64822Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64789Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64881Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64825Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64845Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64626Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64544Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64597Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64611Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64821Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64580Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64586Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64627Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64566Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64604Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64599Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64804Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64623Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64858Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64847Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64607Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64803Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64577Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64863Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64853Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64814Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64612Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64857Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64794Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64591Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64555Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64549Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64808Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64840Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64564Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64551Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64569Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64850Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64592Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64543Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64578Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64839Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-344301Panel CSRF Panel Name ModificationLXware 1Panel · github.com/1Panel-dev/1Panel
- CVE-2025-64554Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64791Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64841Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64619Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64799Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64581Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64852Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64576Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64615Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64873Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64590Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64557Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64790Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64585Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64797Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64579Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64869Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64796Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64603Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64792Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64575Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64802Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64793Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64594Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64614Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64872Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-64562Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-5467Ubuntu Apport Insecure File Permissions VulnerabilityCanonical apport
- CVE-2025-67643Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workJenkins Project Jenkins Redpen - Pipeline Reporter for Jira…
- CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing aJenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2025-67640Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a teJenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2025-67639A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users intoJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67638Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67637Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins contJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67636A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypteJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-13125IDOR in Im Park's DijiDemiIm Park Information Technology, Electronics, Press, Publish…
- CVE-2025-13127XSS in TACAS Consulting's GoldenHornTAC Information Services Internal and External Trade Golden…
- CVE-2024-2105JBL: Improper validation of ICM field in connection requestsJBL Flip · JBL Pulse +2
- CVE-2025-66004Local privilege escalation in usbmuxd from arbitrary local user to usbmuxlibimobiledevice usbmuxd
- CVE-2025-14082Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosureRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2025-14087Glib: glib: buffer underflow in gvariant parser leads to heap corruptionGNOME glib · Red Hat Enterprise Linux +8
- CVE-2025-9315Unauthenticated Device Registration Vulnerability in MXsecurity SeriesMoxa MXsecurity Series
- CVE-2025-9056Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.TECNO com.transsion.audiosmartconnect
- CVE-2025-13677Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversalspecialk Simple Download Counter
- CVE-2025-67485HTTP/HTTPS Traffic Interception Bypass in mad-proxymachphy mad-proxy · mad-proxy
- CVE-2025-52493PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page.
- CVE-2025-56429Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information vi
- CVE-2025-65293Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges throu
- CVE-2025-65296NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing
- CVE-2025-65754Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filgithub.com/xyproto/algernon
- CVE-2025-65803An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (
- CVE-2025-65814A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a direc
- CVE-2025-65815A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a dir
- CVE-2025-65822The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled.
- CVE-2025-65825The firmware on the basestation of the Meatmeet is not encrypted.
- CVE-2025-65828An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devi
- CVE-2025-65829The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot.
- CVE-2025-65832The mobile application insecurely handles information stored within memory.