# CVEs published 2025-12-10

261 CVEs were published on December 10, 2025: 31 critical, 74 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-67648](https://cve.now/CVE-2025-67648.md): Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page (CVSS 7.1, shopware · shopware/shopware +1)
- [CVE-2025-67646](https://cve.now/CVE-2025-67646.md): TableProgressTracking's missing CSRF protection allows unauthorized state changes (CVSS 3.5, Telepedia TableProgressTracking)
- [CVE-2025-67644](https://cve.now/CVE-2025-67644.md): LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method (CVSS 7.3, langchain-ai langgraph · langgraph-checkpoint-sqlite)
- [CVE-2025-67511](https://cve.now/CVE-2025-67511.md): Cybersecurity AI (CAI) vulnerable to Command Injection in run\_ssh\_command\_with\_credentials Agent tool (CVSS 9.7, aliasrobotics cai · cai-framework)
- [CVE-2025-67509](https://cve.now/CVE-2025-67509.md): MySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write (CVSS 8.2, neuron-core neuron-ai · neuron-core/neuron-ai)
- [CVE-2025-67510](https://cve.now/CVE-2025-67510.md): MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) (CVSS 9.4, neuron-core neuron-ai · neuron-core/neuron-ai)
- [CVE-2025-67513](https://cve.now/CVE-2025-67513.md): FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API (CVSS 6.9, FreePBX endpoint)
- [CVE-2025-67505](https://cve.now/CVE-2025-67505.md): Race condition in the Okta Java SDK (CVSS 8.4, okta-sdk-java · com.okta.sdk:okta-sdk-root)
- [CVE-2025-67490](https://cve.now/CVE-2025-67490.md): Auth0 Next.js SDK has Improper Request Caching Lookup (CVSS 5.4, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2025-66628](https://cve.now/CVE-2025-66628.md): ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only) (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +5)
- [CVE-2025-66474](https://cve.now/CVE-2025-66474.md): XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection (CVSS 8.7, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2025-66473](https://cve.now/CVE-2025-66473.md): XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-66033](https://cve.now/CVE-2025-66033.md): Improper Memory Cleanup in the Okta Java SDK (CVSS 5.3, okta-sdk-java · com.okta.sdk:okta-sdk-root)
- [CVE-2025-66472](https://cve.now/CVE-2025-66472.md): XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-flami… +1)
- [CVE-2024-58285](https://cve.now/CVE-2024-58285.md): Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title (CVSS 5.3, Chyrp)
- [CVE-2024-58284](https://cve.now/CVE-2024-58284.md): PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings (CVSS 8.6, PopojiCMS)
- [CVE-2024-58283](https://cve.now/CVE-2024-58283.md): WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload (CVSS 8.7, WBCE CMS)
- [CVE-2024-58282](https://cve.now/CVE-2024-58282.md): Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload (CVSS 8.6, Serendipity)
- [CVE-2024-58281](https://cve.now/CVE-2024-58281.md): Dotclear 2.29 Remote Code Execution via Authenticated File Upload (CVSS 8.7, Dotclear)
- [CVE-2024-58280](https://cve.now/CVE-2024-58280.md): CMSimple 5.15 Remote Command Execution via Extensions Configuration (CVSS 8.6, CMSimple)
- [CVE-2024-58279](https://cve.now/CVE-2024-58279.md): appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload (CVSS 8.6, appRain CMF)
- [CVE-2023-53776](https://cve.now/CVE-2023-53776.md): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (CVSS 8.7, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53775](https://cve.now/CVE-2023-53775.md): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (CVSS 7.1, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53741](https://cve.now/CVE-2023-53741.md): Screen SFT DAB 1.9.3 Authentication Bypass via IP Session Management (CVSS 5.1, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2023-53740](https://cve.now/CVE-2023-53740.md): Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change (CVSS 8.6, DB Elettronica Telecomunicazioni SpA Screen SFT DAB Series…)
- [CVE-2020-36902](https://cve.now/CVE-2020-36902.md): UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges (CVSS 9.3, UBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…)
- [CVE-2020-36901](https://cve.now/CVE-2020-36901.md): UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management (CVSS 8.6, UBICOD Co., Ltd. | MEDIVISION UBICOD Medivision Digital Sig…)
- [CVE-2020-36900](https://cve.now/CVE-2020-36900.md): All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management (CVSS 8.6, All-Dynamics Software Digital Signage System)
- [CVE-2020-36899](https://cve.now/CVE-2020-36899.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure (CVSS 8.7, Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…)
- [CVE-2020-36898](https://cve.now/CVE-2020-36898.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion (CVSS 8.8, Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…)
- [CVE-2020-36897](https://cve.now/CVE-2020-36897.md): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution (CVSS 9.3, Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng A…)
- [CVE-2020-36896](https://cve.now/CVE-2020-36896.md): QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure (CVSS 8.7, Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Au…)
- [CVE-2020-36895](https://cve.now/CVE-2020-36895.md): EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure (CVSS 8.7, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36894](https://cve.now/CVE-2020-36894.md): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation Vulnerability (CVSS 9.3, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36893](https://cve.now/CVE-2020-36893.md): Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability (CVSS 8.7, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36892](https://cve.now/CVE-2020-36892.md): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation (CVSS 9.3, EIBIZ Co. i-Media Server Digital Signage)
- [CVE-2020-36888](https://cve.now/CVE-2020-36888.md): SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script (CVSS 6.9, SpenetiX AG Fusion Digital Signage)
- [CVE-2020-36887](https://cve.now/CVE-2020-36887.md): SpinetiX Fusion Digital Signage 3.4.8 Unauthenticated Database Backup Disclosure (CVSS 8.7, SpinetiX AG Fusion Digital Signage)
- [CVE-2020-36886](https://cve.now/CVE-2020-36886.md): SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation (CVSS 6.9, SpenetiX AG Fusion Digital Signage)
- [CVE-2020-36885](https://cve.now/CVE-2020-36885.md): Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi (CVSS 9.3, Sony Electronics IPELA Network Camera)
- [CVE-2020-36884](https://cve.now/CVE-2020-36884.md): BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF (CVSS 6.9, BrightSign Digital Signage Diagnostic Web Server)
- [CVE-2020-36883](https://cve.now/CVE-2020-36883.md): SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations (CVSS 8.8, SpenetiX AG Fusion Digital Signage)
- [CVE-2025-62181](https://cve.now/CVE-2025-62181.md): Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. (CVSS 5.3, Pegasystems Pega Infinity)
- [CVE-2025-65950](https://cve.now/CVE-2025-65950.md): WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups\[\] Parameter (CVSS 9.4, WBCE\_CMS)
- [CVE-2025-67460](https://cve.now/CVE-2025-67460.md): Zoom Rooms for Windows - Software Downgrade Protection Mechanism Failure (CVSS 7.8, Zoom Communications Zoom Rooms)
- [CVE-2025-67461](https://cve.now/CVE-2025-67461.md): Zoom Rooms for macOS - External Control of File Name or Path (CVSS 5.0, Zoom Communications Zoom Rooms)
- [CVE-2025-64622](https://cve.now/CVE-2025-64622.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64582](https://cve.now/CVE-2025-64582.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64547](https://cve.now/CVE-2025-64547.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64833](https://cve.now/CVE-2025-64833.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64613](https://cve.now/CVE-2025-64613.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64829](https://cve.now/CVE-2025-64829.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64553](https://cve.now/CVE-2025-64553.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64545](https://cve.now/CVE-2025-64545.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64546](https://cve.now/CVE-2025-64546.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64537](https://cve.now/CVE-2025-64537.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-64574](https://cve.now/CVE-2025-64574.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64550](https://cve.now/CVE-2025-64550.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64827](https://cve.now/CVE-2025-64827.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64602](https://cve.now/CVE-2025-64602.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64593](https://cve.now/CVE-2025-64593.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64539](https://cve.now/CVE-2025-64539.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-34427](https://cve.now/CVE-2025-34427.md): MailEnable \< 10.54 Cleartext Credential Storage in AUTH.TAB (CVSS 8.4, MailEnable)
- [CVE-2025-64887](https://cve.now/CVE-2025-64887.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64548](https://cve.now/CVE-2025-64548.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64563](https://cve.now/CVE-2025-64563.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64800](https://cve.now/CVE-2025-64800.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64559](https://cve.now/CVE-2025-64559.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64817](https://cve.now/CVE-2025-64817.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64888](https://cve.now/CVE-2025-64888.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64600](https://cve.now/CVE-2025-64600.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64583](https://cve.now/CVE-2025-64583.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64826](https://cve.now/CVE-2025-64826.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64538](https://cve.now/CVE-2025-64538.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 9.3, Adobe Experience Manager)
- [CVE-2025-64605](https://cve.now/CVE-2025-64605.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64875](https://cve.now/CVE-2025-64875.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64598](https://cve.now/CVE-2025-64598.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64558](https://cve.now/CVE-2025-64558.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64616](https://cve.now/CVE-2025-64616.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64820](https://cve.now/CVE-2025-64820.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64861](https://cve.now/CVE-2025-64861.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64801](https://cve.now/CVE-2025-64801.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64620](https://cve.now/CVE-2025-64620.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64601](https://cve.now/CVE-2025-64601.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34428](https://cve.now/CVE-2025-34428.md): MailEnable \< 10.54 Cleartext Credential Storage in AUTH.SAV (CVSS 8.4, MailEnable)
- [CVE-2025-64560](https://cve.now/CVE-2025-64560.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64556](https://cve.now/CVE-2025-64556.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64565](https://cve.now/CVE-2025-64565.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64606](https://cve.now/CVE-2025-64606.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64823](https://cve.now/CVE-2025-64823.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64596](https://cve.now/CVE-2025-64596.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64572](https://cve.now/CVE-2025-64572.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64541](https://cve.now/CVE-2025-64541.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64609](https://cve.now/CVE-2025-64609.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64822](https://cve.now/CVE-2025-64822.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64789](https://cve.now/CVE-2025-64789.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64881](https://cve.now/CVE-2025-64881.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64825](https://cve.now/CVE-2025-64825.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64845](https://cve.now/CVE-2025-64845.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64626](https://cve.now/CVE-2025-64626.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64544](https://cve.now/CVE-2025-64544.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64597](https://cve.now/CVE-2025-64597.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64611](https://cve.now/CVE-2025-64611.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64821](https://cve.now/CVE-2025-64821.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64580](https://cve.now/CVE-2025-64580.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64586](https://cve.now/CVE-2025-64586.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64627](https://cve.now/CVE-2025-64627.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64566](https://cve.now/CVE-2025-64566.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64604](https://cve.now/CVE-2025-64604.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64599](https://cve.now/CVE-2025-64599.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64804](https://cve.now/CVE-2025-64804.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64623](https://cve.now/CVE-2025-64623.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64858](https://cve.now/CVE-2025-64858.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64847](https://cve.now/CVE-2025-64847.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64607](https://cve.now/CVE-2025-64607.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64803](https://cve.now/CVE-2025-64803.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34429](https://cve.now/CVE-2025-34429.md): 1Panel CSRF Web Port Configuration Change (CVSS 7.0, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-64577](https://cve.now/CVE-2025-64577.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64863](https://cve.now/CVE-2025-64863.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64853](https://cve.now/CVE-2025-64853.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64814](https://cve.now/CVE-2025-64814.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64612](https://cve.now/CVE-2025-64612.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64857](https://cve.now/CVE-2025-64857.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64794](https://cve.now/CVE-2025-64794.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64591](https://cve.now/CVE-2025-64591.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64555](https://cve.now/CVE-2025-64555.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64549](https://cve.now/CVE-2025-64549.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64808](https://cve.now/CVE-2025-64808.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64840](https://cve.now/CVE-2025-64840.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64564](https://cve.now/CVE-2025-64564.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64551](https://cve.now/CVE-2025-64551.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64569](https://cve.now/CVE-2025-64569.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64850](https://cve.now/CVE-2025-64850.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64592](https://cve.now/CVE-2025-64592.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64543](https://cve.now/CVE-2025-64543.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64578](https://cve.now/CVE-2025-64578.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64839](https://cve.now/CVE-2025-64839.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-34430](https://cve.now/CVE-2025-34430.md): 1Panel CSRF Panel Name Modification (CVSS 5.1, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-64554](https://cve.now/CVE-2025-64554.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64791](https://cve.now/CVE-2025-64791.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64841](https://cve.now/CVE-2025-64841.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64619](https://cve.now/CVE-2025-64619.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64799](https://cve.now/CVE-2025-64799.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64581](https://cve.now/CVE-2025-64581.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64852](https://cve.now/CVE-2025-64852.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64576](https://cve.now/CVE-2025-64576.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64615](https://cve.now/CVE-2025-64615.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64873](https://cve.now/CVE-2025-64873.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64590](https://cve.now/CVE-2025-64590.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64557](https://cve.now/CVE-2025-64557.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64790](https://cve.now/CVE-2025-64790.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64585](https://cve.now/CVE-2025-64585.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64797](https://cve.now/CVE-2025-64797.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64579](https://cve.now/CVE-2025-64579.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64869](https://cve.now/CVE-2025-64869.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64796](https://cve.now/CVE-2025-64796.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64603](https://cve.now/CVE-2025-64603.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64792](https://cve.now/CVE-2025-64792.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64575](https://cve.now/CVE-2025-64575.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64802](https://cve.now/CVE-2025-64802.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64793](https://cve.now/CVE-2025-64793.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64594](https://cve.now/CVE-2025-64594.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64614](https://cve.now/CVE-2025-64614.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-64872](https://cve.now/CVE-2025-64872.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Experience Manager)
- [CVE-2025-64562](https://cve.now/CVE-2025-64562.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-65199](https://cve.now/CVE-2025-65199.md): Windscribe for Linux 'changeMTU' local privilege escalation (CVSS 7.8, Windscribe for Linux Desktop App)
- [CVE-2025-5467](https://cve.now/CVE-2025-5467.md): Ubuntu Apport Insecure File Permissions Vulnerability (CVSS 1.9, Canonical apport)
- [CVE-2025-13607](https://cve.now/CVE-2025-13607.md): D-Link CCTV camera model DCS-F5614-L1 Missing Authentication for Critical Function (CVSS 9.3, D-Link DCS-F5614-L1)
- [CVE-2025-67643](https://cve.now/CVE-2025-67643.md): Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b\_9517b\_6b\_202 and earlier does not correctly perform path validation of the work (CVSS 4.3, Jenkins Project Jenkins Redpen - Pipeline Reporter for Jira…)
- [CVE-2025-67642](https://cve.now/CVE-2025-67642.md): Jenkins HashiCorp Vault Plugin 371.v884a\_4dd60fb\_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing a (CVSS 4.3, Jenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2025-67641](https://cve.now/CVE-2025-67641.md): Jenkins Coverage Plugin 2.3054.ve1ff7b\_a\_a\_123b\_ and earlier does not validate the configured coverage results ID when creating coverage res (CVSS 8.0, Jenkins Project Jenkins Coverage Plugin · io.jenkins.plugin…)
- [CVE-2025-67640](https://cve.now/CVE-2025-67640.md): Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a te (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-67639](https://cve.now/CVE-2025-67639.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into (CVSS 3.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67638](https://cve.now/CVE-2025-67638.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increas (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67637](https://cve.now/CVE-2025-67637.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins cont (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67636](https://cve.now/CVE-2025-67636.md): A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypte (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67635](https://cve.now/CVE-2025-67635.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes cor (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-co… +1)
- [CVE-2025-34421](https://cve.now/CVE-2025-34421.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISP.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34417](https://cve.now/CVE-2025-34417.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISO.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34419](https://cve.now/CVE-2025-34419.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAISM.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34416](https://cve.now/CVE-2025-34416.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIPO.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34422](https://cve.now/CVE-2025-34422.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIPC.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34418](https://cve.now/CVE-2025-34418.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIMF.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34424](https://cve.now/CVE-2025-34424.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIDP.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34423](https://cve.now/CVE-2025-34423.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34420](https://cve.now/CVE-2025-34420.md): MailEnable \< 10.54 DLL Hijacking via Unsafe Loading of MEAIAM.DLL (CVSS 8.5, MailEnable)
- [CVE-2025-34410](https://cve.now/CVE-2025-34410.md): 1Panel CSRF in Change Username Functionality Allows Account Lockout (CVSS 7.0, LXware 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2025-34395](https://cve.now/CVE-2025-34395.md): Barracuda RMM \< 2025.1.1 Service Center .NET Remoting Path Traversal RCE (CVSS 8.7, Barracuda Networks RMM)
- [CVE-2025-34394](https://cve.now/CVE-2025-34394.md): Barracuda RMM \< 2025.1.1 Service Center .NET Remoting Deserialization RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-34393](https://cve.now/CVE-2025-34393.md): Barracuda RMM \< 2025.1.1 Service Center Insecure Reflection RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-34392](https://cve.now/CVE-2025-34392.md): Barracuda RMM \< 2025.1.1 Service Center Absolute Path Traversal RCE (CVSS 10.0, Barracuda Networks RMM)
- [CVE-2025-13125](https://cve.now/CVE-2025-13125.md): IDOR in Im Park's DijiDemi (CVSS 4.3, Im Park Information Technology, Electronics, Press, Publish…)
- [CVE-2025-13155](https://cve.now/CVE-2025-13155.md): An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with (CVSS 8.5, Lenovo Baiying Client)
- [CVE-2025-13152](https://cve.now/CVE-2025-13152.md): A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local au (CVSS 8.5, Lenovo One Client)
- [CVE-2025-12046](https://cve.now/CVE-2025-12046.md): A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated us (CVSS 8.5, Lenovo App Store · Lenovo Browser)
- [CVE-2025-13127](https://cve.now/CVE-2025-13127.md): XSS in TACAS Consulting's GoldenHorn (CVSS 3.5, TAC Information Services Internal and External Trade Golden…)
- [CVE-2025-8110](https://cve.now/CVE-2025-8110.md): File overwrite in file update API in Gogs (CVSS 8.7, KEV, Gogs · gogs.io/gogs)
- [CVE-2024-2105](https://cve.now/CVE-2024-2105.md): JBL: Improper validation of ICM field in connection requests (CVSS 6.5, JBL Flip · JBL Pulse +2)
- [CVE-2024-2104](https://cve.now/CVE-2024-2104.md): JBL: Improper BLE security configurations and lack of authentication on the device's GATT server (CVSS 8.8, JBL LIVE PRO 2 TWS · JBL TUNE FLEX)
- [CVE-2025-13184](https://cve.now/CVE-2025-13184.md): Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password (CVSS 9.8, Toto Link X5000R's)
- [CVE-2025-13953](https://cve.now/CVE-2025-13953.md): Bypass in the authentication method of the GTT Sistema de Información Tributario application (CVSS 9.3, GTT Sistema de Información Tributario)
- [CVE-2025-41358](https://cve.now/CVE-2025-41358.md): Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A (CVSS 8.3, CronosWeb i2A CronosWeb)
- [CVE-2025-41732](https://cve.now/CVE-2025-41732.md): Stack-based buffer overflow via unsafe sscanf in check\_cookie() (CVSS 9.8, WAGO Indsutrial-Managed-Switches)
- [CVE-2025-41730](https://cve.now/CVE-2025-41730.md): Stack-based buffer overflow via unsafe sscanf in check\_account() (CVSS 9.8, WAGO Indsutrial-Managed-Switches)
- [CVE-2025-7073](https://cve.now/CVE-2025-7073.md): Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security (CVSS 8.8, Bitdefender Total Security · Bitdefender Internet Securi… +1)
- [CVE-2025-66675](https://cve.now/CVE-2025-66675.md): Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed (CVSS 8.2, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2025-14390](https://cve.now/CVE-2025-14390.md): Video Merchant \<= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, videomerchant Video Merchant)
- [CVE-2025-66004](https://cve.now/CVE-2025-66004.md): Local privilege escalation in usbmuxd from arbitrary local user to usbmux (CVSS 5.1, libimobiledevice usbmuxd)
- [CVE-2025-14082](https://cve.now/CVE-2025-14082.md): Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure (CVSS 2.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2025-1161](https://cve.now/CVE-2025-1161.md): Improper Authorization in Nomysoft Informatics' Nomysem (CVSS 7.1, NomySoft Information Technology Training and Consulting Nom…)
- [CVE-2025-14087](https://cve.now/CVE-2025-14087.md): Glib: glib: buffer underflow in gvariant parser leads to heap corruption (CVSS 5.6, GNOME glib · Red Hat Enterprise Linux +8)
- [CVE-2025-9315](https://cve.now/CVE-2025-9315.md): Unauthenticated Device Registration Vulnerability in MXsecurity Series (CVSS 6.3, Moxa MXsecurity Series)
- [CVE-2025-13955](https://cve.now/CVE-2025-13955.md): Predictable Default Wi-Fi Password in EZCast Pro II Dongle (CVSS 9.3, EZCast Pro II)
- [CVE-2025-13954](https://cve.now/CVE-2025-13954.md): Hard-coded cryptographic keys in EZCast Pro II Dongle (CVSS 9.3, EZCast Pro II)
- [CVE-2025-12952](https://cve.now/CVE-2025-12952.md): Privilege Escalation in Dialogflow CX via Webhook Admin Role (CVSS 8.7, Google Cloud Dialogflow CX)
- [CVE-2025-9571](https://cve.now/CVE-2025-9571.md): Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload (CVSS 8.7, Google Cloud Cloud Data Fusion)
- [CVE-2025-13073](https://cve.now/CVE-2025-13073.md): HandL UTM Grabber / Tracker \< 2.8.1 - Reflected XSS via handl\_landing\_page (CVSS 7.1, HandL UTM Grabber / Tracker)
- [CVE-2025-13072](https://cve.now/CVE-2025-13072.md): HandL UTM Grabber / Tracker \< 2.8.1 - Reflected XSS via utm\_source (CVSS 7.1, HandL UTM Grabber / Tracker)
- [CVE-2025-13339](https://cve.now/CVE-2025-13339.md): Hippoo Mobile App for WooCommerce \<= 1.7.1 - Unauthenticated Arbitrary File Read (CVSS 7.5, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2025-9056](https://cve.now/CVE-2025-9056.md): Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. (CVSS 5.3, TECNO com.transsion.audiosmartconnect)
- [CVE-2025-13677](https://cve.now/CVE-2025-13677.md): Simple Download Counter \<= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal (CVSS 4.9, specialk Simple Download Counter)
- [CVE-2025-13613](https://cve.now/CVE-2025-13613.md): Elated Membership \<= 1.2 - Authentication Bypass via Social Login (CVSS 9.8, Elated Themes Elated Membership)
- [CVE-2025-67507](https://cve.now/CVE-2025-67507.md): Filament's multi-factor authentication (app) recovery codes can be used multiple times (CVSS 8.1, filamentphp filament · filament/filament)
- [CVE-2025-67506](https://cve.now/CVE-2025-67506.md): PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload (CVSS 9.8, pipeshub-ai)
- [CVE-2025-67485](https://cve.now/CVE-2025-67485.md): HTTP/HTTPS Traffic Interception Bypass in mad-proxy (CVSS 5.3, machphy mad-proxy · mad-proxy)
- [CVE-2025-24857](https://cve.now/CVE-2025-24857.md): Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019 (CVSS 7.6)
- [CVE-2025-52493](https://cve.now/CVE-2025-52493.md): PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. (CVSS 6.5)
- [CVE-2025-56429](https://cve.now/CVE-2025-56429.md): Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information vi (CVSS 6.1)
- [CVE-2025-56430](https://cve.now/CVE-2025-56430.md): Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th (CVSS 7.5)
- [CVE-2025-56431](https://cve.now/CVE-2025-56431.md): Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th (CVSS 7.5)
- [CVE-2025-63094](https://cve.now/CVE-2025-63094.md): XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers (CVSS 7.5)
- [CVE-2025-63895](https://cve.now/CVE-2025-63895.md): An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service ( (CVSS 7.5)
- [CVE-2025-65290](https://cve.now/CVE-2025-65290.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 fail to validate server certificates during H (CVSS 7.4)
- [CVE-2025-65291](https://cve.now/CVE-2025-65291.md): Aqara Hub devices including Hub M2 4.3.6\_0027, Hub M3 4.3.6\_0025, Camera Hub G3 4.1.9\_0027 fail to validate server certificates in TLS conne (CVSS 7.4)
- [CVE-2025-65292](https://cve.now/CVE-2025-65292.md): Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 allows att (CVSS 7.3)
- [CVE-2025-65293](https://cve.now/CVE-2025-65293.md): Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9\_0027 allow attackers to execute arbitrary commands with root privileges throu (CVSS 6.6)
- [CVE-2025-65294](https://cve.now/CVE-2025-65294.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 contain an undocumented remote access mechani (CVSS 9.8)
- [CVE-2025-65295](https://cve.now/CVE-2025-65295.md): Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 devi (CVSS 8.1)
- [CVE-2025-65296](https://cve.now/CVE-2025-65296.md): NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6\_0027, Hub M3 4.3.6\_0025, and Camera Hub G3 4.1.9\_0027 in the JSON processing (CVSS 6.5)
- [CVE-2025-65297](https://cve.now/CVE-2025-65297.md): Aqara Hub devices including Camera Hub G3 4.1.9\_0027, Hub M2 4.3.6\_0027, and Hub M3 4.3.6\_0025 automatically collect and upload unencrypted (CVSS 7.5)
- [CVE-2025-65512](https://cve.now/CVE-2025-65512.md): A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 an (CVSS 7.5)
- [CVE-2025-65602](https://cve.now/CVE-2025-65602.md): A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cra (CVSS 9.8)
- [CVE-2025-65754](https://cve.now/CVE-2025-65754.md): Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil (CVSS 6.1, github.com/xyproto/algernon)
- [CVE-2025-65792](https://cve.now/CVE-2025-65792.md): DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. (CVSS 9.1)
- [CVE-2025-65803](https://cve.now/CVE-2025-65803.md): An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service ( (CVSS 6.5)
- [CVE-2025-65807](https://cve.now/CVE-2025-65807.md): An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. (CVSS 8.4, sd)
- [CVE-2025-65814](https://cve.now/CVE-2025-65814.md): A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a direc (CVSS 6.5)
- [CVE-2025-65815](https://cve.now/CVE-2025-65815.md): A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a dir (CVSS 6.5)
- [CVE-2025-65820](https://cve.now/CVE-2025-65820.md): An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. (CVSS 9.8)
- [CVE-2025-65821](https://cve.now/CVE-2025-65821.md): As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret (CVSS 7.5)
- [CVE-2025-65822](https://cve.now/CVE-2025-65822.md): The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. (CVSS 6.8)
- [CVE-2025-65823](https://cve.now/CVE-2025-65823.md): The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. (CVSS 9.8)
- [CVE-2025-65824](https://cve.now/CVE-2025-65824.md): An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bl (CVSS 8.8)
- [CVE-2025-65825](https://cve.now/CVE-2025-65825.md): The firmware on the basestation of the Meatmeet is not encrypted. (CVSS 4.6)
- [CVE-2025-65826](https://cve.now/CVE-2025-65826.md): The mobile application was found to contain stored credentials for the network it was developed on. (CVSS 9.8)
- [CVE-2025-65827](https://cve.now/CVE-2025-65827.md): The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. (CVSS 9.1)
- [CVE-2025-65828](https://cve.now/CVE-2025-65828.md): An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devi (CVSS 6.5)
- [CVE-2025-65829](https://cve.now/CVE-2025-65829.md): The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. (CVSS 6.8)
- [CVE-2025-65830](https://cve.now/CVE-2025-65830.md): Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. (CVSS 9.1)
- [CVE-2025-65831](https://cve.now/CVE-2025-65831.md): The application uses an insecure hashing algorithm (MD5) to hash passwords. (CVSS 7.5)
- [CVE-2025-65832](https://cve.now/CVE-2025-65832.md): The mobile application insecurely handles information stored within memory. (CVSS 4.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.