CVEs published December 11, 2025
208 CVEs were published on December 11, 2025: 20 critical, 109 high.
- Published
- 208
- Critical
- 20
- High
- 109
- Medium
- 72
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- Google Android
- 22
- TeamViewer DEX
- 13
- GitLab
- 10
- The Biosig Project libbiosig
- 6
- AzeoTech DAQFactory
- 5
- baowzh hfly
- 4
- IBM Aspera Orchestrator
- 4
- JetBrains TeamCity
- 4
- danny-avila LibreChat
- 3
- xbtitFM
- 3
Critical 20
- CVE-2024-58308Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Loginopensolution Quick.CMS
- CVE-2024-58307CSZCMS 1.3.0 Authenticated SQL Injection via Members View EndpointCSZCMS
- CVE-2024-58301Purei CMS 1.0 SQL Injection via Multiple Vulnerable EndpointsPurei CMS
- CVE-2024-58298Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File UploadBMC Software Compuware iStrobe Web
- CVE-2024-58290Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections EndpointElements Xhibiter NFT Marketplace
- CVE-2024-58286dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Pathvexorian dizqueTV
- CVE-2025-64721Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromisesandboxie-plus Sandboxie
- CVE-2025-36937In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2025-14535UTT 进取 512W formConfigFastDirectionW strcpy buffer overflowUTT 进取
- CVE-2025-14534UTT 进取 512W Endpoint formNatStaticMap strcpy buffer overflowUTT 进取
- CVE-2025-13780Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)pgadmin.org pgAdmin · pgadmin4
- CVE-2025-66048Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-66047Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-66046Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-66045Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-66044Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-66043Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1.The Biosig Project libbiosig
- CVE-2025-14265Improper server-side validation in ScreenConnect extension frameworkConnectWise ScreenConnect
- CVE-2025-13764WP CarDealer <= 1.2.16 - Unauthenticated Privilege EscalationApusTheme WP CarDealer
- CVE-2025-65473An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administra
High 109
- CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacMeta react-server-dom-parcel · Meta react-server-dom-tur… +4
- CVE-2025-66450LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Uploaddanny-avila LibreChat
- CVE-2025-66446MaxKB has a Python sandbox LD_PRELOAD bypass1Panel-dev MaxKB
- CVE-2025-34506WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module UploadWBCE CMS
- CVE-2024-58313xbtitFM 4.1.18 Insecure File Upload in file_hosting FeaturexbtitFM
- CVE-2024-58312xbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.phpxbtitFM
- CVE-2024-58310APC Network Management Card 4 Path Traversal via Directory TraversalApc Network Management Card
- CVE-2024-58309xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.phpxbtitFM
- CVE-2024-58306minaliC 2.0.0 Denial of Service Vulnerability via Large GET RequestminaliC
- CVE-2024-58303FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template SettingsFriendsofFlarum Pretty Mail · fof/pretty-mail
- CVE-2024-58300Siklu MultiHaul TG Series <= 2.0.0 Unauthenticated Credential Disclosure VulnerabilitySiklu MultiHaul TG series
- CVE-2025-66419MaxKB vulnerable to privilege escalation through sandbox bypass1Panel-dev MaxKB
- CVE-2024-58295ElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme UploadElkArte Forum
- CVE-2024-58294FreePBX 16 Authenticated Remote Code Execution via API ModuleFreePBX
- CVE-2024-58293Akaunting 3.1.8 Server-Side Template Injection via Multiple Form FieldsAkaunting
- CVE-2024-58288Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege EscalationGenexus Protection Server
- CVE-2024-58287reNgine 2.2.0 Authenticated Command Injection via Scan Engine ConfigurationreNgine
- CVE-2025-66585Use After Free vulnerability in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-66586Type Confusion vulnerability in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-66588Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-66589Out-of-bounds Read vulnerability in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-66590Out-of-bounds Write vulnerability in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-55184A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-13214IBM Aspera Orchestrator SQL InjectionIBM Aspera Orchestrator
- CVE-2025-13148IBM Aspera Orchestrator Unverified Password ChangeIBM Aspera Orchestrator
- CVE-2025-13481IBM Aspera Orchestrator Command InjectionIBM Aspera Orchestrator
- CVE-2025-36936In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2025-36935In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data.Google Android
- CVE-2025-36934In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition.Google Android
- CVE-2025-36932In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validatiGoogle Android
- CVE-2025-36931In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-36930In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-36928In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2025-36927In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-36925In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-36924In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2025-36923In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2025-36919In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking.Google Android
- CVE-2025-36918In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation.Google Android
- CVE-2025-36916In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition.Google Android
- CVE-2025-64669Windows Admin Center Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center
- CVE-2025-14046Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsGitHub Enterprise Server
- CVE-2025-14526Tenda CH22 L7Im frmL7ImForm buffer overflowTenda CH22
- CVE-2024-8273Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1.HYPR Server
- CVE-2025-13124IDOR in Netiket''s ApplyLogicNetiket Information Technologies Ltd. ApplyLogic
- CVE-2025-14523Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)Red Hat Enterprise Linux
- CVE-2025-13003IDOR in Aksis Computer's AxOnboardAksis Computer Services and Consulting AxOnboard
- CVE-2025-64989Command Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash InstructionTeamViewer DEX
- CVE-2025-64988Command Injection in 1E-Nomad-GetCmContentLocations InstructionTeamViewer DEX
- CVE-2025-64987Command Injection in 1E-Explorer-TachyonCore-CheckSimpleIoC InstructionTeamViewer DEX
- CVE-2025-64986Command Injection in 1E-Explorer-TachyonCore-DevicesListeningOnAPort InstructionTeamViewer DEX
- CVE-2025-44016File Hash Validation Bypass in NomadBranch.exeTeamViewer DEX
- CVE-2025-64701QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to aQualitySoft QND Premium/Advance/Standard
- CVE-2025-12029Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-67738squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments.Webmin
- CVE-2025-8405Improper Encoding or Escaping of Output in GitLabGitLab
- CVE-2025-12562Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-12716Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-67719Ibexa User Bundle is missing password change validationibexa user · ibexa/user
- CVE-2025-67718Formio improperly authorized permission elevation through specially crafted request pathformio
- CVE-2025-55310An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.
- CVE-2025-55312An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.
- CVE-2025-55313An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.
- CVE-2025-55314An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.
- CVE-2025-56077OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requ
- CVE-2025-56079OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a cra
- CVE-2025-56082OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t
- CVE-2025-56083OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56084OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands
- CVE-2025-56085OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitra
- CVE-2025-56086OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitra
- CVE-2025-56087OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t
- CVE-2025-56088OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to
- CVE-2025-56089OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafte
- CVE-2025-56090OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c
- CVE-2025-56091OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a cr
- CVE-2025-56092OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted P
- CVE-2025-56093OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56094OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56095OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c
- CVE-2025-56096OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t
- CVE-2025-56097OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands
- CVE-2025-56098OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56099OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted P
- CVE-2025-56101OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafte
- CVE-2025-56102OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a cr
- CVE-2025-56106OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a cr
- CVE-2025-56107OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t
- CVE-2025-56108OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56109OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to
- CVE-2025-56110OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to
- CVE-2025-56111OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to
- CVE-2025-56113OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary comma
- CVE-2025-56114OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafte
- CVE-2025-56117OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST
- CVE-2025-56118OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via
- CVE-2025-56120OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via
- CVE-2025-56122OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands
- CVE-2025-56123OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c
- CVE-2025-56124OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via
- CVE-2025-56127OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t
- CVE-2025-56129OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to
- CVE-2025-56130OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a craft
- CVE-2025-59802Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG.
- CVE-2025-65471An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute ar
- CVE-2025-65472A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate pr
- CVE-2025-65474An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute ar
- CVE-2025-66429An issue was discovered in cPanel 110 through 132.
- CVE-2025-66918edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
Medium, low and unrated 79
- CVE-2025-67780SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRSpaceX Starlink Dish
- CVE-2025-66452LibreChat's lack of JSON parsing error handling can lead to XSSdanny-avila LibreChat
- CVE-2025-66451LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changesdanny-avila LibreChat
- CVE-2025-13668Quartus Prime Pro Edition AdvisoryAltera Quartus Prime Pro
- CVE-2025-34504KodExplorer 4.52 Open Redirect Vulnerability via User Login Endpointkodcloud KodExplorer
- CVE-2025-34499AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation VulnerabilityAnyDesk
- CVE-2024-58304SPA-CART CMS < 2.0.0 Stored Cross-Site ScriptingSPA-CART CMS
- CVE-2024-58302FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template SettingsFriendsofFlarum Pretty Mail
- CVE-2024-58297PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin RedirectsPyroCMS
- CVE-2024-58296CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.phpPhoenixCart CE Phoenix
- CVE-2024-58292XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templatesxmbforum2 XMB Forum
- CVE-2024-58291Flatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information FieldFlatboard
- CVE-2024-58289Microweber 2.0.15 Stored Cross-Site Scripting via User Profile FieldsMicroweber
- CVE-2025-14538yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scriptingyangshare warehouseManager 仓库管理系统
- CVE-2025-64702quic-go HTTP/3 QPACK Header Expansion DoSquic-go · github.com/quic-go/quic-go
- CVE-2025-13664Quartus Prime Standard Security AdvisoryAltera Quartus Prime Standard
- CVE-2025-13663Quartus Prime Pro Edition Installer AdvisoryAltera Quartus Prime Pro
- CVE-2025-14537code-projects Class and Exam Timetable Management preview7.php sql injectioncode-projects Class and Exam Timetable Management
- CVE-2025-14293WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Readwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2025-55183An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-14536code-projects Class and Exam Timetable Management Login index.php sql injectioncode-projects Class and Exam Timetable Management
- CVE-2025-13211IBM Aspera Orchestrator Denial of ServiceIBM Aspera Orchestrator
- CVE-2024-42197HCL Workload Scheduler is vulnerable to plain text storage of a passwordHCL Software Workload Scheduler
- CVE-2025-36938In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code.Google Android
- CVE-2025-36929In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation.Google Android
- CVE-2025-36922In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free.Google Android
- CVE-2025-36921In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2025-36917In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check.Google Android
- CVE-2025-36912In cellular modem, there is a possible denial of service due to a logic error in the code.Google Android
- CVE-2025-36889In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy.Google Android
- CVE-2025-14531code-projects Rental Management System Log Transaction.java crlf injectioncode-projects Rental Management System
- CVE-2025-14530SourceCodester Real Estate Property Listing App property.php unrestricted uploadSourceCodester Real Estate Property Listing App
- CVE-2025-14529Campcodes Retro Basketball Shoes Online Store admin_running.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-13912Potential non-constant time compiled code with Clang LLVMwolfSSL
- CVE-2025-14528D-Link DIR-803 Configuration getcfg.php information disclosureD-Link DIR-803
- CVE-2025-14527projectworlds Advanced Library Management System view_book.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14522baowzh hfly upload_json.php unrestricted uploadbaowzh hfly
- CVE-2025-14521baowzh hfly download path traversalbaowzh hfly
- CVE-2025-14520baowzh hfly delfile path traversalbaowzh hfly
- CVE-2025-67742In JetBrains TeamCity before 2025.11 path traversal was possible via file uploadJetBrains TeamCity
- CVE-2025-67741In JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeJetBrains TeamCity
- CVE-2025-67740In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataJetBrains TeamCity
- CVE-2025-67739In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureJetBrains TeamCity
- CVE-2025-14519baowzh hfly advtext add cross site scriptingbaowzh hfly
- CVE-2025-14518PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgeryPowerJob · tech.powerjob:powerjob-common
- CVE-2024-40593A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 alFortinet FortiAnalyzer · Fortinet FortiPortal +2
- CVE-2025-14517Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application componentsYalantis uCrop
- CVE-2025-14516Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgeryYalantis uCrop
- CVE-2025-14515Campcodes Supplier Management System add_unit.php sql injectionCampcodes Supplier Management System
- CVE-2025-14514Campcodes Supplier Management System add_distributor.php sql injectionCampcodes Supplier Management System
- CVE-2025-64995Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instructionTeamViewer DEX
- CVE-2025-64994Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instructionTeamViewer DEX
- CVE-2025-64993Command Injection in 1E-ConfigMgrConsoleExtensions InstructionsTeamViewer DEX
- CVE-2025-64992Command Injection in 1E-Nomad-PauseNomadJobQueue InstructionTeamViewer DEX
- CVE-2025-64991Command Injection in 1E-PatchInsights-Deploy InstructionTeamViewer DEX
- CVE-2025-64990Command Injection in 1E-Explorer-TachyonCore-LogoffUser InstructionTeamViewer DEX
- CVE-2025-46266Unauthenticated Transmission of Data in NomadBranch.exeTeamViewer DEX
- CVE-2025-12687Denial-of-Service Vulnerability in NomadBranch.exeTeamViewer DEX
- CVE-2025-12734Improper Encoding or Escaping of Output in GitLabGitLab
- CVE-2025-14512Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowGNOME glib · Red Hat Enterprise Linux +8
- CVE-2025-4097Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-11247Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-11984Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2025-13978Generation of Error Message Containing Sensitive Information in GitLabGitLab
- CVE-2025-14157Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-9436Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcodetrustindex Widgets for Google Reviews
- CVE-2025-10163List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcodefernandobt List category posts
- CVE-2025-14485EFM ipTIME A3004T Administrator Password timepro.cgi show_debug_screen command injectionEFM ipTIME A3004T
- CVE-2025-11467RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgerythemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2025-67720Pyrofork has a Path Traversal in download_media MethodMayuri-Chan pyrofork · pyrofork
- CVE-2025-67717Zitadel Discloses the Total Number of Instance Userszitadel · github.com/zitadel/zitadel
- CVE-2025-67716Auth0 Next.js SDK has Improper Validation of Query Parametersnextjs-auth0 · @auth0/nextjs-auth0
- CVE-2025-67713Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`miniflux · miniflux.app/v2 +1
- CVE-2025-55307An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.
- CVE-2025-55308An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.
- CVE-2025-55309An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.
- CVE-2025-55311An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.
- CVE-2025-55816HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.
- CVE-2025-59803Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers.