CVEs published December 12, 2025
226 CVEs were published on December 12, 2025: 10 critical, 51 high. 4 are now in CISA KEV.
- Published
- 226
- Critical
- 10
- High
- 51
- Medium
- 147
- Low
- 17
- Unrated
- 1
- Now in CISA KEV
- 4
- Fix available
- 84
Most affected products
- Apple macOS
- 32
- Japan Total System Co. GroupSession Free edition · Japan… +1
- 10
- Apple iOS and iPadOS · Apple macOS +3
- 5
- Apple iOS and iPadOS · Apple macOS +2
- 4
- Apache Software Foundation Apache Fineract
- 3
- Apache Software Foundation Apache StreamPark · org.apache.s…
- 3
- Google Chrome
- 3
- SolarEdge SE3680H
- 3
- tornadoweb tornado · tornado
- 3
- Altera High Level Synthesis Compiler
- 2
Critical 10
- CVE-2025-54369Node-SAML SAML Authentication Bypassnode-saml · @node-saml/node-saml
- CVE-2025-43416A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-46287An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-58299PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' CommandPCMan FTP Server
- CVE-2025-58130Apache Fineract: Server Key not maskedApache Software Foundation Apache Fineract
- CVE-2025-67728Fireshare Public Uploads feature is vulnerable to OS Command Injection (RCE)ShaneIsrael fireshare
- CVE-2025-12963LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalationlazycoders LazyTasks – Project & Task Management with Colla…
- CVE-2025-14344Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletionsh1zen Multi Uploader for Gravity Forms
- CVE-2025-65854Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full accomineadmin/mineadmin
- CVE-2025-66430Plesk 18.0 has Incorrect Access Control.
High 51
- CVE-2025-14611Gladinet CentreStack and TrioFox Hard Coded AES KeysGladinet CentreStack and TrioFox
- CVE-2025-43467This issue was addressed with improved checks.Apple macOS
- CVE-2025-43539The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43542This issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-43519A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43512A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2025-43494A mail header parsing issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-46285An integer overflow was addressed by adopting 64-bit timestamps.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43506A logic error was addressed with improved error handling.Apple macOS
- CVE-2025-43510A memory corruption issue was addressed with improved lock state checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43402The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-43320The issue was addressed by adding additional logic.Apple macOS
- CVE-2025-43527A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-58316Online Shopping System Advanced 1.0 SQL Injection via Payment Success ParameterPuneethReddyHC online-shopping-system-advanced
- CVE-2025-67750Lightning Flow Scanner is Vulnerable to Code Injection via Unsafe Use of new Function() in APIVersion Rulelightning-flow-scanner
- CVE-2024-58314Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGIATCOM Technology co. 100M IP Phones
- CVE-2024-58311Dormakaba Saflok System 6000 Key Generation Cryptographic WeaknessDormakaba Saflok System
- CVE-2024-58305WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module InstallationWonderCMS
- CVE-2024-14010Typora 1.7.4 OS Command Injection via Export PDF PreferencesTypora
- CVE-2025-14572UTT 进取 512W formWebAuthGlobalConfig memory corruptionUTT 进取
- CVE-2025-8083Vuetify Prototype Pollution via Preset optionsVuetify
- CVE-2025-14174Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memoGoogle Chrome
- CVE-2025-13733BuhoNTFS 1.3.2 - Local Privilege EscalationDr.Buho BuhoNTFS
- CVE-2025-54981Apache StreamPark: Weak Encryption Algorithm in StreamParkApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2025-36743SolarEdge SE3680H - Exposed Debug interfaceSolarEdge SE3680H
- CVE-2025-36745SolarEdge SE3680H contains Linux Kernel vulnerabilitiesSolarEdge SE3680H
- CVE-2025-58770TCG2 TPM RT Not Locked IssueAMI AptioV
- CVE-2025-13506Improper Authorization in Nebim Neyir's Nebim V3 ERPNebim Neyir Computer Industry and Services Nebim V3 ERP
- CVE-2025-12835WooMulti <= 1.7 - Subscriber+ Arbitrary File DeletionWooMulti
- CVE-2025-26866Apache HugeGraph-Server: RAFT and deserialization vulnerabilityApache Software Foundation Apache HugeGraph-Server · org.ap…
- CVE-2025-58137Apache Fineract: IDOR via self-service APIApache Software Foundation Apache Fineract
- CVE-2025-23408Apache Fineract: weak password policyApache Software Foundation Apache Fineract
- CVE-2025-40829A vulnerability has been identified in Simcenter Femap (All versions < V2512).Siemens Simcenter Femap
- CVE-2025-67731Servify Express does not enforce rate limiting when parsing JSONAarondoran servify-express · servify-express
- CVE-2025-14169FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injectionamans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- CVE-2025-14068WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameterqdonow WPNakama – Team and multi-Client Collaboration, Edit…
- CVE-2025-12570Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Uploadradykal Fancy Product Designer
- CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameterstornadoweb tornado · tornado
- CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescingtornadoweb tornado · tornado
- CVE-2025-67508gardenctl is vulnerable to Command Injection when used with non‑POSIX shellsgardener gardenctl-v2 · github.com/gardener/gardenctl-v2
- CVE-2025-66492Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL ParameterMasaCMS
- CVE-2025-13334Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletionblazethemes Blaze Demo Importer
- CVE-2025-14044Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookierodgerholl Visitor Logic Lite
- CVE-2025-12968Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File UploadInfility Global
- CVE-2025-12824Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusiontharkun69 Player Leaderboard
- CVE-2025-13053A missing encryption of sensitive data vulnerability was found in the UPS settings of ADMASUSTOR ADM
- CVE-2025-13052An improper certificates validation vulnerability was found in the Notification settings of ADMASUSTOR ADM
- CVE-2025-13886LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parametercvedovini LT Unleashed
- CVE-2025-10451H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)Insyde Software InsydeH2O
- CVE-2025-65530An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files
- CVE-2025-67818An issue was discovered in Weaviate OSS before 1.33.4.github.com/weaviate/weaviate
Medium, low and unrated 165
- CVE-2025-14585itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-14584itsourcecode COVID Tracking System Admin Login login.php sql injectionitsourcecode COVID Tracking System
- CVE-2025-67749PCSX2 has an Out-of-bounds Read due to unchecked offset and size passed to memcpypcsx2
- CVE-2025-67721Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output bufferairlift aircompressor · io.airlift:aircompressor-v3 +1
- CVE-2025-14583campcodes Online Student Enrollment System register.php unrestricted uploadcampcodes Online Student Enrollment System
- CVE-2025-14582campcodes Online Student Enrollment System index.php unrestricted uploadcampcodes Online Student Enrollment System
- CVE-2025-43518A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-43522A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-43471The issue was addressed with improved checks.Apple macOS
- CVE-2025-43406A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-43410The issue was addressed with improved handling of caches.Apple macOS
- CVE-2025-43538A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-43470A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43523A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43466An injection issue was addressed with improved validation.Apple macOS
- CVE-2025-43482The issue was addressed with improved input validation.Apple macOS
- CVE-2025-43461This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-43532A memory corruption issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43437An information disclosure issue was addressed with improved privacy controls.Apple iOS and iPadOS
- CVE-2025-43509This issue was addressed with improved data protection.Apple macOS
- CVE-2025-43381This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2025-43513A permissions issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-43530This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2025-46289A logic issue was addressed with improved file handling.Apple macOS
- CVE-2025-43463A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-43511A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +3
- CVE-2025-43497An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-43473This issue was addressed with improved state management.Apple macOS
- CVE-2025-46276An information disclosure issue was addressed with improved privacy controls.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-43465A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-43520A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43388An injection issue was addressed with improved validation.Apple macOS
- CVE-2025-43351A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43516A session management issue was addressed with improved checks.Apple macOS
- CVE-2025-43404A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-43393A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-43517A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2025-43464A denial-of-service issue was addressed with improved input validation.Apple macOS
- CVE-2025-43521A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-11266Grassroots DICOM (GDCM) Out-of-bounds WriteGrassroots DICOM · NumFocus SimpleITK +1
- CVE-2025-67634Software Acquisition Guide Supplier Response Web Tool XSSCISA Software Acquisition Guide Tool
- CVE-2025-14580Qualitor viewDocumento.php cross site scriptingQualitor
- CVE-2025-14578itsourcecode Student Management System update_account.php sql injectionitsourcecode Student Management System
- CVE-2025-67734Frappe Authenticated Users can Execute JavaScript through its Job Formfrappe lms
- CVE-2025-14373Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spooGoogle Chrome
- CVE-2025-14372Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escapGoogle Chrome
- CVE-2025-8082Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'Vuetify
- CVE-2025-14571projectworlds Advanced Library Management System borrow_book.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14570projectworlds Advanced Library Management System view_admin.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14569ggml-org whisper.cpp common-whisper.cpp read_audio_data use after freeggml-org whisper.cpp
- CVE-2025-14568haxxorsid Stock-Management-System User.php sql injectionhaxxorsid Stock-Management-System
- CVE-2025-40345usb: storage: sddr55: Reject out-of-bound new_pbaLinux
- CVE-2025-14567haxxorsid Stock-Management-System employees missing authenticationhaxxorsid Stock-Management-System
- CVE-2025-14566kidaze CourseSelectionSystem reg.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-14565kidaze CourseSelectionSystem login1.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-12843Code Injection in Wave Term v0.12.2 allowing TCC Bypasswaveterm
- CVE-2025-53960Apache StreamPark: Uses the user’s password as the secret keyApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2025-54947Apache StreamPark: Use hard-coded key vulnerabilityApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2025-36746SolarEdge Monitoring Platform contains a XSS upon report deletionSolarEdge Monitoring platform
- CVE-2025-36744SolarEdge SE3680H - Information Exposure during Bootloader LoopSolarEdge SE3680H
- CVE-2025-36755CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboardCleverDisplay B.V. BlueOne
- CVE-2025-14030AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcodesoportecibeles AI Feeds
- CVE-2025-12407Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletionnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-12408Events Manager <= 7.2.2.2 - Unauthenticated Information Exposurenetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-12965Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widgetnalam-1 Magical Posts Display – Elementor Advanced Posts wi…
- CVE-2025-14159Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Exportays-pro Secure Copy Content Protection and Content Locking
- CVE-2025-14442Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export Fileays-pro Secure Copy Content Protection and Content Locking
- CVE-2025-14065Simple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposurerodolforizzo76 Simple Bike Rental
- CVE-2025-12841Bookit < 2.5.1 – Unauthenticated Settings UpdateBookit
- CVE-2025-12348Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Executionicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2025-13993MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingMailerLite – Signup forms
- CVE-2025-14074PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplicationaddonsorg PDF for Contact Form 7 + Drag and Drop Template B…
- CVE-2025-12960Simple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Readiworks Simple CSV Table
- CVE-2025-67730Frappe authenticated users can execute XSS through form description fieldsfrappe lms
- CVE-2025-10583WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgeryemrevona WP Fastest Cache Premium
- CVE-2025-13891Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listingwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2025-14049VikRentItems Flexible Rental Management System <= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parametere4jvikwp VikRentItems Flexible Rental Management System
- CVE-2025-4970BSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Uploadbannersky BSK PDF Manager
- CVE-2025-11876Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingjbrinley Mailgun Subscriptions
- CVE-2025-67737AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCEAzuraCast · azuracast/azuracast
- CVE-2025-67727Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Managementparse-community parse-server
- CVE-2025-12655Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Writehippooo Hippoo Mobile App for WooCommerce
- CVE-2025-14356Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDFthemefic Ultra Addons for Contact Form
- CVE-2025-13660Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpointrcatheme Guest Support
- CVE-2025-10684Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin ActivationConstruction Light
- CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argumenttornadoweb tornado · tornado
- CVE-2025-64781In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External pJapan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-62192SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-58576Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-61987GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-61950In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented.Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-65120Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-57883Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, Japan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-66284Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, anJapan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-53523Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, anJapan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-54407Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, andJapan Total System Co. GroupSession Free edition · Japan… +1
- CVE-2025-14138WPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']wpletsgo WPLG Default Mail From
- CVE-2025-13975Contact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' Settingsizuchy Contact Form 7 with ChatWork
- CVE-2025-13843VigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attributesusantabeura VigLink SpotLight By ShortCode
- CVE-2025-14391Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Updatedarendev Simple Theme Changer
- CVE-2025-13366Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Resetfrapesce Rabbit Hole
- CVE-2025-13747NewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingice00 NewStatPress
- CVE-2025-13850LS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesladislavsoukupgmailcom LS Google Map Router
- CVE-2025-14137Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']alexdtn Simple AL Slider
- CVE-2025-12650Simple post listing <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesgcoskey Simple post listing
- CVE-2025-12834Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_messagezealopensource Accept Stripe Payments Using Contact Form
- CVE-2025-12830Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widgetwpdive Better Addons for Elementor
- CVE-2025-14160Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Updatejustdave Upcoming for Calendly
- CVE-2025-13963FX Currency Converter <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesfalselight FX Currency Converter
- CVE-2025-13962Divelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesklemmkeil Divelogs Widget
- CVE-2025-13987Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletioncodnloc Purchase and Expense Manager
- CVE-2025-13314Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modificationmarkutos987 Filter Plus – Product Filter & WordPress Filter
- CVE-2025-13885Zenost Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesimran3229 Zenost Shortcodes
- CVE-2025-14062Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parametertekafran Animated Pixel Marquee Creator
- CVE-2025-14132Category Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']pandikamal03 Category Dropdown List
- CVE-2025-13971TWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Settingthewellnessway TWW Protein Calculator
- CVE-2025-13906WP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesysh WP Flot
- CVE-2025-13988评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']thobian 评论小秘书
- CVE-2025-13966Paypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attributesonlamtn200 Paypal Payment Shortcode
- CVE-2025-13961Data Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessubhransu-sekhar Data Visualizer
- CVE-2025-13884Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbuntegiraffe Hide Email Address
- CVE-2025-14035DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcodejeremybmerrill DebateMaster
- CVE-2025-13840BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attributebobvanoorschot Bukazu Search Widget
- CVE-2025-13960GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdavidkeen GPXpress
- CVE-2025-13320WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameterwpusermanager WP User Manager – User Profile Builder & Memb…
- CVE-2025-13440Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist DeletionPremmerce Wishlist for WooCommerce
- CVE-2025-14392Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actionsdarendev Simple Theme Changer
- CVE-2025-14032Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcodeboldthemes Bold Timeline Lite
- CVE-2025-13969Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attributeeurisko Reviews Sorted
- CVE-2025-14161Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings UpdateTruefy Embed
- CVE-2025-14354Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actionsdoubledome Resource Library for Logged In Users
- CVE-2025-14165Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Updatedeveloperke Kirim.Email WooCommerce Integration
- CVE-2025-13846Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesqrevo Easy Map Creator
- CVE-2025-13363IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Updateimaqpress IMAQ CORE
- CVE-2025-12783Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings UpdatePremmerce Brands for WooCommerce
- CVE-2025-14166WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injectionludwigyou WPMasterToolKit (WPMTK) – All in one plugin
- CVE-2025-14119App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesthemebon App Landing Template Blocks for WPBakery (Visual C…
- CVE-2025-14158Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Updateoctagonsimon Coding Blocks
- CVE-2025-13904WPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeslesion WPGancio
- CVE-2025-14045URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Uploadapprhyme URL Media Uploader
- CVE-2025-13408Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connectionfoxtheme Foxtool All-in-One: Contact chat button, Custom lo…
- CVE-2025-12883Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment BypassCampay Woocommerce Payment Gateway
- CVE-2025-14048SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Optionjonahsc SimplyConvert
- CVE-2025-14129Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']wasiul99 Like DisLike Voting
- CVE-2025-13989WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attributenazsabuz WP Dropzone
- CVE-2025-14125Complag <= 1.0.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']andru1 Complag
- CVE-2025-14393Wpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingawanhrp Wpik WordPress Basic Ajax Form
- CVE-2025-14143Ayo Shortcodes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attributeayothemes Ayo Shortcodes
- CVE-2025-13972WatchTowerHQ <= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' ParameterWatchTowerHQ
- CVE-2025-14064BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulationcytechltd BuddyTask
- CVE-2025-14467WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Fieldwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2025-13889Simple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributestmus Simple Nivo Slider
- CVE-2025-14170Vimeo SimpleGallery <= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modificationstiand Vimeo SimpleGallery
- CVE-2025-13866Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow_flow_social_auth AJAX actionlooks_awesome Flow-Flow Social Feed Stream
- CVE-2025-14162BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletionmagblogapi BMLT WordPress Satellite
- CVE-2025-13670High Level Synthesis Compiler Security AdvisoryAltera High Level Synthesis Compiler
- CVE-2025-13669High Level Synthesis Compiler Security AdvisoryAltera High Level Synthesis Compiler
- CVE-2025-13839LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attributejenyay LJUsers
- CVE-2025-13665Quartus Prime Standard Security AdvisoryAltera Quartus Prime Standard
- CVE-2023-29144Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios.
- CVE-2025-64011Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint.
- CVE-2025-67341jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.
- CVE-2025-67342RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint.
- CVE-2025-67344jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
- CVE-2025-67819An issue was discovered in Weaviate OSS before 1.33.4.github.com/weaviate/weaviate