# CVEs published 2025-12-12

226 CVEs were published on December 12, 2025: 10 critical, 51 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2025-54369](https://cve.now/CVE-2025-54369.md): Node-SAML SAML Authentication Bypass (CVSS 9.3, node-saml · @node-saml/node-saml)
- [CVE-2025-14585](https://cve.now/CVE-2025-14585.md): itsourcecode COVID Tracking System page sql injection (CVSS 6.9, itsourcecode COVID Tracking System)
- [CVE-2025-14584](https://cve.now/CVE-2025-14584.md): itsourcecode COVID Tracking System Admin Login login.php sql injection (CVSS 6.9, itsourcecode COVID Tracking System)
- [CVE-2025-67749](https://cve.now/CVE-2025-67749.md): PCSX2 has an Out-of-bounds Read due to unchecked offset and size passed to memcpy (CVSS 5.3, pcsx2)
- [CVE-2025-67721](https://cve.now/CVE-2025-67721.md): Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer (CVSS 6.3, airlift aircompressor · io.airlift:aircompressor-v3 +1)
- [CVE-2025-14583](https://cve.now/CVE-2025-14583.md): campcodes Online Student Enrollment System register.php unrestricted upload (CVSS 6.9, campcodes Online Student Enrollment System)
- [CVE-2025-14582](https://cve.now/CVE-2025-14582.md): campcodes Online Student Enrollment System index.php unrestricted upload (CVSS 5.1, campcodes Online Student Enrollment System)
- [CVE-2025-14611](https://cve.now/CVE-2025-14611.md): Gladinet CentreStack and TrioFox Hard Coded AES Keys (CVSS 7.1, KEV, Gladinet CentreStack and TrioFox)
- [CVE-2025-43518](https://cve.now/CVE-2025-43518.md): A logic issue was addressed with improved checks. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2025-43522](https://cve.now/CVE-2025-43522.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2025-43467](https://cve.now/CVE-2025-43467.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2025-43471](https://cve.now/CVE-2025-43471.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43406](https://cve.now/CVE-2025-43406.md): A logic issue was addressed with improved restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43410](https://cve.now/CVE-2025-43410.md): The issue was addressed with improved handling of caches. (CVSS 2.4, Apple macOS)
- [CVE-2025-43538](https://cve.now/CVE-2025-43538.md): A logging issue was addressed with improved data redaction. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43539](https://cve.now/CVE-2025-43539.md): The issue was addressed with improved bounds checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43542](https://cve.now/CVE-2025-43542.md): This issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2025-43470](https://cve.now/CVE-2025-43470.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43523](https://cve.now/CVE-2025-43523.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43466](https://cve.now/CVE-2025-43466.md): An injection issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-43519](https://cve.now/CVE-2025-43519.md): A permissions issue was addressed with additional restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2025-43512](https://cve.now/CVE-2025-43512.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43416](https://cve.now/CVE-2025-43416.md): A logic issue was addressed with improved restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-43482](https://cve.now/CVE-2025-43482.md): The issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-46287](https://cve.now/CVE-2025-46287.md): An inconsistent user interface issue was addressed with improved state management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43494](https://cve.now/CVE-2025-43494.md): A mail header parsing issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43461](https://cve.now/CVE-2025-43461.md): This issue was addressed with improved validation of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43532](https://cve.now/CVE-2025-43532.md): A memory corruption issue was addressed with improved bounds checking. (CVSS 2.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43437](https://cve.now/CVE-2025-43437.md): An information disclosure issue was addressed with improved privacy controls. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2025-43509](https://cve.now/CVE-2025-43509.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2025-43381](https://cve.now/CVE-2025-43381.md): This issue was addressed with improved handling of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43513](https://cve.now/CVE-2025-43513.md): A permissions issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-46285](https://cve.now/CVE-2025-46285.md): An integer overflow was addressed by adopting 64-bit timestamps. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43506](https://cve.now/CVE-2025-43506.md): A logic error was addressed with improved error handling. (CVSS 7.5, Apple macOS)
- [CVE-2025-43510](https://cve.now/CVE-2025-43510.md): A memory corruption issue was addressed with improved lock state checking. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43402](https://cve.now/CVE-2025-43402.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2025-43530](https://cve.now/CVE-2025-43530.md): This issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-46289](https://cve.now/CVE-2025-46289.md): A logic issue was addressed with improved file handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-43463](https://cve.now/CVE-2025-43463.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-43320](https://cve.now/CVE-2025-43320.md): The issue was addressed by adding additional logic. (CVSS 7.8, Apple macOS)
- [CVE-2025-43527](https://cve.now/CVE-2025-43527.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43511](https://cve.now/CVE-2025-43511.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2025-43497](https://cve.now/CVE-2025-43497.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.2, Apple macOS)
- [CVE-2025-43473](https://cve.now/CVE-2025-43473.md): This issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2025-46276](https://cve.now/CVE-2025-46276.md): An information disclosure issue was addressed with improved privacy controls. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43465](https://cve.now/CVE-2025-43465.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 3.3, Apple macOS)
- [CVE-2025-43520](https://cve.now/CVE-2025-43520.md): A memory corruption issue was addressed with improved memory handling. (CVSS 5.5, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43388](https://cve.now/CVE-2025-43388.md): An injection issue was addressed with improved validation. (CVSS 3.3, Apple macOS)
- [CVE-2025-43351](https://cve.now/CVE-2025-43351.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43516](https://cve.now/CVE-2025-43516.md): A session management issue was addressed with improved checks. (CVSS 3.3, Apple macOS)
- [CVE-2025-43404](https://cve.now/CVE-2025-43404.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2025-43393](https://cve.now/CVE-2025-43393.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 5.2, Apple macOS)
- [CVE-2025-43517](https://cve.now/CVE-2025-43517.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2025-43464](https://cve.now/CVE-2025-43464.md): A denial-of-service issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2025-43521](https://cve.now/CVE-2025-43521.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-11266](https://cve.now/CVE-2025-11266.md): Grassroots DICOM (GDCM) Out-of-bounds Write (CVSS 6.8, Grassroots DICOM · NumFocus SimpleITK +1)
- [CVE-2025-67634](https://cve.now/CVE-2025-67634.md): Software Acquisition Guide Supplier Response Web Tool XSS (CVSS 4.6, CISA Software Acquisition Guide Tool)
- [CVE-2025-14580](https://cve.now/CVE-2025-14580.md): Qualitor viewDocumento.php cross site scripting (CVSS 5.1, Qualitor)
- [CVE-2024-58316](https://cve.now/CVE-2024-58316.md): Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter (CVSS 8.7, PuneethReddyHC online-shopping-system-advanced)
- [CVE-2025-67750](https://cve.now/CVE-2025-67750.md): Lightning Flow Scanner is Vulnerable to Code Injection via Unsafe Use of new Function() in APIVersion Rule (CVSS 8.4, lightning-flow-scanner)
- [CVE-2025-14578](https://cve.now/CVE-2025-14578.md): itsourcecode Student Management System update\_account.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2024-58314](https://cve.now/CVE-2024-58314.md): Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI (CVSS 8.7, ATCOM Technology co. 100M IP Phones)
- [CVE-2024-58311](https://cve.now/CVE-2024-58311.md): Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness (CVSS 8.7, Dormakaba Saflok System)
- [CVE-2024-58305](https://cve.now/CVE-2024-58305.md): WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation (CVSS 8.6, WonderCMS)
- [CVE-2024-58299](https://cve.now/CVE-2024-58299.md): PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command (CVSS 9.3, PCMan FTP Server)
- [CVE-2024-14010](https://cve.now/CVE-2024-14010.md): Typora 1.7.4 OS Command Injection via Export PDF Preferences (CVSS 8.5, Typora)
- [CVE-2025-67734](https://cve.now/CVE-2025-67734.md): Frappe Authenticated Users can Execute JavaScript through its Job Form (CVSS 5.1, frappe lms)
- [CVE-2025-14572](https://cve.now/CVE-2025-14572.md): UTT 进取 512W formWebAuthGlobalConfig memory corruption (CVSS 8.7, UTT 进取)
- [CVE-2025-8083](https://cve.now/CVE-2025-8083.md): Vuetify Prototype Pollution via Preset options (CVSS 8.6, Vuetify)
- [CVE-2025-14373](https://cve.now/CVE-2025-14373.md): Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoo (CVSS 4.3, Google Chrome)
- [CVE-2025-14372](https://cve.now/CVE-2025-14372.md): Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escap (CVSS 6.1, Google Chrome)
- [CVE-2025-14174](https://cve.now/CVE-2025-14174.md): Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memo (CVSS 8.8, KEV, Google Chrome)
- [CVE-2025-8082](https://cve.now/CVE-2025-8082.md): Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker' (CVSS 6.3, Vuetify)
- [CVE-2025-14571](https://cve.now/CVE-2025-14571.md): projectworlds Advanced Library Management System borrow\_book.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System)
- [CVE-2025-14570](https://cve.now/CVE-2025-14570.md): projectworlds Advanced Library Management System view\_admin.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System)
- [CVE-2025-14569](https://cve.now/CVE-2025-14569.md): ggml-org whisper.cpp common-whisper.cpp read\_audio\_data use after free (CVSS 4.8, ggml-org whisper.cpp)
- [CVE-2025-14568](https://cve.now/CVE-2025-14568.md): haxxorsid Stock-Management-System User.php sql injection (CVSS 5.3, haxxorsid Stock-Management-System)
- [CVE-2025-40345](https://cve.now/CVE-2025-40345.md): usb: storage: sddr55: Reject out-of-bound new\_pba (no CVSS, Linux)
- [CVE-2025-14567](https://cve.now/CVE-2025-14567.md): haxxorsid Stock-Management-System employees missing authentication (CVSS 6.9, haxxorsid Stock-Management-System)
- [CVE-2025-13733](https://cve.now/CVE-2025-13733.md): BuhoNTFS 1.3.2 - Local Privilege Escalation (CVSS 8.5, Dr.Buho BuhoNTFS)
- [CVE-2025-14566](https://cve.now/CVE-2025-14566.md): kidaze CourseSelectionSystem reg.php sql injection (CVSS 6.9, kidaze CourseSelectionSystem)
- [CVE-2025-14565](https://cve.now/CVE-2025-14565.md): kidaze CourseSelectionSystem login1.php sql injection (CVSS 6.9, kidaze CourseSelectionSystem)
- [CVE-2025-12843](https://cve.now/CVE-2025-12843.md): Code Injection in Wave Term v0.12.2 allowing TCC Bypass (CVSS 6.9, waveterm)
- [CVE-2025-53960](https://cve.now/CVE-2025-53960.md): Apache StreamPark: Uses the user’s password as the secret key (CVSS 5.9, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2025-54947](https://cve.now/CVE-2025-54947.md): Apache StreamPark: Use hard-coded key vulnerability (CVSS 5.3, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2025-54981](https://cve.now/CVE-2025-54981.md): Apache StreamPark: Weak Encryption Algorithm in StreamPark (CVSS 7.5, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2025-36746](https://cve.now/CVE-2025-36746.md): SolarEdge Monitoring Platform contains a XSS upon report deletion (CVSS 4.8, SolarEdge Monitoring platform)
- [CVE-2025-36743](https://cve.now/CVE-2025-36743.md): SolarEdge SE3680H - Exposed Debug interface (CVSS 8.6, SolarEdge SE3680H)
- [CVE-2025-36744](https://cve.now/CVE-2025-36744.md): SolarEdge SE3680H - Information Exposure during Bootloader Loop (CVSS 2.4, SolarEdge SE3680H)
- [CVE-2025-36745](https://cve.now/CVE-2025-36745.md): SolarEdge SE3680H contains Linux Kernel vulnerabilities (CVSS 8.6, SolarEdge SE3680H)
- [CVE-2025-58770](https://cve.now/CVE-2025-58770.md): TCG2 TPM RT Not Locked Issue (CVSS 7.2, AMI AptioV)
- [CVE-2025-36755](https://cve.now/CVE-2025-36755.md): CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboard (CVSS 2.4, CleverDisplay B.V. BlueOne)
- [CVE-2025-13506](https://cve.now/CVE-2025-13506.md): Improper Authorization in Nebim Neyir's Nebim V3 ERP (CVSS 8.8, Nebim Neyir Computer Industry and Services Nebim V3 ERP)
- [CVE-2025-14030](https://cve.now/CVE-2025-14030.md): AI Feeds \<= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife\_post\_meta' Shortcode (CVSS 6.4, soportecibeles AI Feeds)
- [CVE-2025-12407](https://cve.now/CVE-2025-12407.md): Events Manager – Calendar, Bookings, Tickets, and more! \<= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion (CVSS 4.3, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2025-12408](https://cve.now/CVE-2025-12408.md): Events Manager \<= 7.2.2.2 - Unauthenticated Information Exposure (CVSS 5.3, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2025-12965](https://cve.now/CVE-2025-12965.md): Magical Posts Display \<= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget (CVSS 6.4, nalam-1 Magical Posts Display – Elementor Advanced Posts wi…)
- [CVE-2025-14159](https://cve.now/CVE-2025-14159.md): Secure Copy Content Protection and Content Locking \<= 4.9.2 - Cross-Site Request Forgery to Data Export (CVSS 4.3, ays-pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-14442](https://cve.now/CVE-2025-14442.md): Secure Copy Content Protection and Content Locking \<= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File (CVSS 5.3, ays-pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-14065](https://cve.now/CVE-2025-14065.md): Simple Bike Rental \<= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure (CVSS 4.3, rodolforizzo76 Simple Bike Rental)
- [CVE-2025-12835](https://cve.now/CVE-2025-12835.md): WooMulti \<= 1.7 - Subscriber+ Arbitrary File Deletion (CVSS 7.3, WooMulti)
- [CVE-2025-12841](https://cve.now/CVE-2025-12841.md): Bookit \< 2.5.1 – Unauthenticated Settings Update (CVSS 5.3, Bookit)
- [CVE-2025-26866](https://cve.now/CVE-2025-26866.md): Apache HugeGraph-Server: RAFT and deserialization vulnerability (CVSS 8.8, Apache Software Foundation Apache HugeGraph-Server · org.ap…)
- [CVE-2025-58137](https://cve.now/CVE-2025-58137.md): Apache Fineract: IDOR via self-service API (CVSS 8.1, Apache Software Foundation Apache Fineract)
- [CVE-2025-12348](https://cve.now/CVE-2025-12348.md): Email Subscribers & Newsletters \<= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution (CVSS 5.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2025-13993](https://cve.now/CVE-2025-13993.md): MailerLite – Signup forms (official) \<= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, MailerLite – Signup forms)
- [CVE-2025-14074](https://cve.now/CVE-2025-14074.md): PDF for Contact Form 7 + Drag and Drop Template Builder \<= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication (CVSS 4.3, addonsorg PDF for Contact Form 7 + Drag and Drop Template B…)
- [CVE-2025-58130](https://cve.now/CVE-2025-58130.md): Apache Fineract: Server Key not masked (CVSS 9.1, Apache Software Foundation Apache Fineract)
- [CVE-2025-23408](https://cve.now/CVE-2025-23408.md): Apache Fineract: weak password policy (CVSS 8.5, Apache Software Foundation Apache Fineract)
- [CVE-2025-40829](https://cve.now/CVE-2025-40829.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2025-12960](https://cve.now/CVE-2025-12960.md): Simple CSV Table \<= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, iworks Simple CSV Table)
- [CVE-2025-67731](https://cve.now/CVE-2025-67731.md): Servify Express does not enforce rate limiting when parsing JSON (CVSS 8.7, Aarondoran servify-express · servify-express)
- [CVE-2025-67730](https://cve.now/CVE-2025-67730.md): Frappe authenticated users can execute XSS through form description fields (CVSS 5.1, frappe lms)
- [CVE-2025-14169](https://cve.now/CVE-2025-14169.md): FunnelKit – Funnel Builder for WooCommerce Checkout \<= 3.13.1.5 - Unauthenticated SQL Injection (CVSS 7.5, amans2k FunnelKit – Funnel Builder for WooCommerce Checkout)
- [CVE-2025-10583](https://cve.now/CVE-2025-10583.md): WP Fastest Cache Premium \<= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery (CVSS 3.5, emrevona WP Fastest Cache Premium)
- [CVE-2025-13891](https://cve.now/CVE-2025-13891.md): Image Gallery – Photo Grid & Video Gallery (Modula) \<= 2.13.3 - Missing Authorization to Arbitrary Directory Listing (CVSS 6.5, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-14049](https://cve.now/CVE-2025-14049.md): VikRentItems Flexible Rental Management System \<= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter (CVSS 6.1, e4jvikwp VikRentItems Flexible Rental Management System)
- [CVE-2025-4970](https://cve.now/CVE-2025-4970.md): BSK PDF Manager \<= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.5, bannersky BSK PDF Manager)
- [CVE-2025-11876](https://cve.now/CVE-2025-11876.md): Mailgun Subscriptions \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jbrinley Mailgun Subscriptions)
- [CVE-2025-67728](https://cve.now/CVE-2025-67728.md): Fireshare Public Uploads feature is vulnerable to OS Command Injection (RCE) (CVSS 9.8, ShaneIsrael fireshare)
- [CVE-2025-67737](https://cve.now/CVE-2025-67737.md): AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE (CVSS 3.1, AzuraCast · azuracast/azuracast)
- [CVE-2025-67727](https://cve.now/CVE-2025-67727.md): Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management (CVSS 6.9, parse-community parse-server)
- [CVE-2025-12655](https://cve.now/CVE-2025-12655.md): Hippoo Mobile App for WooCommerce \<= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write (CVSS 5.3, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2025-14068](https://cve.now/CVE-2025-14068.md): WPNakama \<= 0.6.3 - Unauthenticated SQL Injection via 'order\_by' Parameter (CVSS 7.5, qdonow WPNakama – Team and multi-Client Collaboration, Edit…)
- [CVE-2025-14356](https://cve.now/CVE-2025-14356.md): Ultra Addons for Contact Form 7 \<= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF (CVSS 4.3, themefic Ultra Addons for Contact Form)
- [CVE-2025-12570](https://cve.now/CVE-2025-12570.md): Fancy Product Designer \<= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2, radykal Fancy Product Designer)
- [CVE-2025-13660](https://cve.now/CVE-2025-13660.md): Guest Support \<= 1.2.3 - Unauthenticated User Email Disclosure in guest\_support\_handler AJAX Endpoint (CVSS 5.3, rcatheme Guest Support)
- [CVE-2025-67726](https://cve.now/CVE-2025-67726.md): Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters (CVSS 7.5, tornadoweb tornado · tornado)
- [CVE-2025-10684](https://cve.now/CVE-2025-10684.md): Construction Light \< 1.6.8 - Subscriber+ Arbitrary Plugin Activation (CVSS 4.3, Construction Light)
- [CVE-2025-67725](https://cve.now/CVE-2025-67725.md): Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing (CVSS 7.5, tornadoweb tornado · tornado)
- [CVE-2025-67724](https://cve.now/CVE-2025-67724.md): Tornado vulnerable to Header Injection and XSS via reason argument (CVSS 5.4, tornadoweb tornado · tornado)
- [CVE-2025-67508](https://cve.now/CVE-2025-67508.md): gardenctl is vulnerable to Command Injection when used with non‑POSIX shells (CVSS 8.0, gardener gardenctl-v2 · github.com/gardener/gardenctl-v2)
- [CVE-2025-64781](https://cve.now/CVE-2025-64781.md): In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External p (CVSS 4.7, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-62192](https://cve.now/CVE-2025-62192.md): SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession (CVSS 5.4, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-58576](https://cve.now/CVE-2025-58576.md): Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and (CVSS 4.3, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-61987](https://cve.now/CVE-2025-61987.md): GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. (CVSS 5.3, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-61950](https://cve.now/CVE-2025-61950.md): In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. (CVSS 4.3, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-65120](https://cve.now/CVE-2025-65120.md): Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, (CVSS 6.1, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-57883](https://cve.now/CVE-2025-57883.md): Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, (CVSS 6.1, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-66284](https://cve.now/CVE-2025-66284.md): Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, an (CVSS 5.4, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-53523](https://cve.now/CVE-2025-53523.md): Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, an (CVSS 5.4, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-54407](https://cve.now/CVE-2025-54407.md): Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and (CVSS 6.1, Japan Total System Co. GroupSession Free edition · Japan… +1)
- [CVE-2025-66492](https://cve.now/CVE-2025-66492.md): Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter (CVSS 8.2, MasaCMS)
- [CVE-2025-14138](https://cve.now/CVE-2025-14138.md): WPLG Default Mail From \<= 1.0.0 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, wpletsgo WPLG Default Mail From)
- [CVE-2025-13975](https://cve.now/CVE-2025-13975.md): Contact Form 7 with ChatWork \<= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api\_token' and 'roomid' Settings (CVSS 4.4, izuchy Contact Form 7 with ChatWork)
- [CVE-2025-13843](https://cve.now/CVE-2025-13843.md): VigLink SpotLight By ShortCode \<= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attribute (CVSS 6.4, susantabeura VigLink SpotLight By ShortCode)
- [CVE-2025-14391](https://cve.now/CVE-2025-14391.md): Simple Theme Changer \<= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update (CVSS 4.3, darendev Simple Theme Changer)
- [CVE-2025-13366](https://cve.now/CVE-2025-13366.md): Rabbit Hole \<= 1.1 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3, frapesce Rabbit Hole)
- [CVE-2025-13747](https://cve.now/CVE-2025-13747.md): NewStatPress \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ice00 NewStatPress)
- [CVE-2025-13850](https://cve.now/CVE-2025-13850.md): LS Google Map Router \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ladislavsoukupgmailcom LS Google Map Router)
- [CVE-2025-14137](https://cve.now/CVE-2025-14137.md): Simple AL Slider \<= 1.2.10 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, alexdtn Simple AL Slider)
- [CVE-2025-12650](https://cve.now/CVE-2025-12650.md): Simple post listing \<= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, sgcoskey Simple post listing)
- [CVE-2025-12834](https://cve.now/CVE-2025-12834.md): Accept Stripe Payments Using Contact Form 7 \<= 3.1 - Reflected Cross-Site Scripting via failure\_message (CVSS 6.1, zealopensource Accept Stripe Payments Using Contact Form)
- [CVE-2025-13334](https://cve.now/CVE-2025-13334.md): Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion (CVSS 8.1, blazethemes Blaze Demo Importer)
- [CVE-2025-12830](https://cve.now/CVE-2025-12830.md): Better Elementor Addons \<= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget (CVSS 6.4, wpdive Better Addons for Elementor)
- [CVE-2025-14160](https://cve.now/CVE-2025-14160.md): Upcoming for Calendly \<= 1.2.4 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, justdave Upcoming for Calendly)
- [CVE-2025-13963](https://cve.now/CVE-2025-13963.md): FX Currency Converter \<= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, falselight FX Currency Converter)
- [CVE-2025-13962](https://cve.now/CVE-2025-13962.md): Divelogs Widget \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, klemmkeil Divelogs Widget)
- [CVE-2025-13987](https://cve.now/CVE-2025-13987.md): Purchase and Expense Manager \<= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion (CVSS 4.3, codnloc Purchase and Expense Manager)
- [CVE-2025-13314](https://cve.now/CVE-2025-13314.md): Product Filtering by Categories, Tags, Price Range for WooCommerce \<= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification (CVSS 5.3, markutos987 Filter Plus – Product Filter & WordPress Filter)
- [CVE-2025-13885](https://cve.now/CVE-2025-13885.md): Zenost Shortcodes \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, imran3229 Zenost Shortcodes)
- [CVE-2025-14062](https://cve.now/CVE-2025-14062.md): Animated Pixel Marquee Creator \<= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter (CVSS 4.3, tekafran Animated Pixel Marquee Creator)
- [CVE-2025-12963](https://cve.now/CVE-2025-12963.md): LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart \<= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation (CVSS 9.8, lazycoders LazyTasks – Project & Task Management with Colla…)
- [CVE-2025-14132](https://cve.now/CVE-2025-14132.md): Category Dropdown List \<= 1.0 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, pandikamal03 Category Dropdown List)
- [CVE-2025-13971](https://cve.now/CVE-2025-13971.md): TWW Protein Calculator \<= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting (CVSS 4.4, thewellnessway TWW Protein Calculator)
- [CVE-2025-13906](https://cve.now/CVE-2025-13906.md): WP Flot \<= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ysh WP Flot)
- [CVE-2025-13988](https://cve.now/CVE-2025-13988.md): 评论小秘书 \<= 1.3.2 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, thobian 评论小秘书)
- [CVE-2025-13966](https://cve.now/CVE-2025-13966.md): Paypal Payment Shortcode \<= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom\_image' Shortcode Attribute (CVSS 6.4, sonlamtn200 Paypal Payment Shortcode)
- [CVE-2025-13961](https://cve.now/CVE-2025-13961.md): Data Visualizer \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, subhransu-sekhar Data Visualizer)
- [CVE-2025-13884](https://cve.now/CVE-2025-13884.md): Hide Email Address \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, buntegiraffe Hide Email Address)
- [CVE-2025-14035](https://cve.now/CVE-2025-14035.md): DebateMaster \<= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode (CVSS 4.4, jeremybmerrill DebateMaster)
- [CVE-2025-13840](https://cve.now/CVE-2025-13840.md): BUKAZU Search widget \<= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute (CVSS 6.4, bobvanoorschot Bukazu Search Widget)
- [CVE-2025-13960](https://cve.now/CVE-2025-13960.md): GPXpress \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, davidkeen GPXpress)
- [CVE-2025-13320](https://cve.now/CVE-2025-13320.md): WP User Manager \<= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current\_user\_avatar' Parameter (CVSS 6.8, wpusermanager WP User Manager – User Profile Builder & Memb…)
- [CVE-2025-13440](https://cve.now/CVE-2025-13440.md): Premmerce Wishlist for WooCommerce \<= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion (CVSS 5.3, Premmerce Wishlist for WooCommerce)
- [CVE-2025-14392](https://cve.now/CVE-2025-14392.md): Simple Theme Changer \<= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions (CVSS 4.3, darendev Simple Theme Changer)
- [CVE-2025-14032](https://cve.now/CVE-2025-14032.md): Bold Timeline Lite \<= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold\_timeline\_group' Shortcode (CVSS 6.4, boldthemes Bold Timeline Lite)
- [CVE-2025-13969](https://cve.now/CVE-2025-13969.md): Reviews Sorted \<= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute (CVSS 6.4, eurisko Reviews Sorted)
- [CVE-2025-14161](https://cve.now/CVE-2025-14161.md): Truefy Embed \<= 1.1.0 - Cross-Site Request Forgery to 'truefy\_embed\_options\_update' Settings Update (CVSS 4.3, Truefy Embed)
- [CVE-2025-14354](https://cve.now/CVE-2025-14354.md): Resource Library for Logged In Users \<= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions (CVSS 4.3, doubledome Resource Library for Logged In Users)
- [CVE-2025-14165](https://cve.now/CVE-2025-14165.md): Kirim.Email WooCommerce Integration \<= 1.2.9 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, developerke Kirim.Email WooCommerce Integration)
- [CVE-2025-13846](https://cve.now/CVE-2025-13846.md): Easy Map Creator \<= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, qrevo Easy Map Creator)
- [CVE-2025-13363](https://cve.now/CVE-2025-13363.md): IMAQ Core \<= 1.2.1 - Cross-Site Request Forgery to URL Structure Update (CVSS 4.3, imaqpress IMAQ CORE)
- [CVE-2025-12783](https://cve.now/CVE-2025-12783.md): Premmerce Brands for WooCommerce \<= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update (CVSS 4.3, Premmerce Brands for WooCommerce)
- [CVE-2025-14044](https://cve.now/CVE-2025-14044.md): Visitor Logic Lite \<= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie (CVSS 8.1, rodgerholl Visitor Logic Lite)
- [CVE-2025-14166](https://cve.now/CVE-2025-14166.md): WPMasterToolKit (WPMTK) \<= 2.13.0 - Authenticated (Contributor+) Code Injection (CVSS 5.3, ludwigyou WPMasterToolKit (WPMTK) – All in one plugin)
- [CVE-2025-14119](https://cve.now/CVE-2025-14119.md): App Landing Template Blocks for WPBakery Page Builder \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, themebon App Landing Template Blocks for WPBakery (Visual C…)
- [CVE-2025-14158](https://cve.now/CVE-2025-14158.md): Coding Blocks \<= 1.1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, octagonsimon Coding Blocks)
- [CVE-2025-13904](https://cve.now/CVE-2025-13904.md): WPGancio \<= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, lesion WPGancio)
- [CVE-2025-14045](https://cve.now/CVE-2025-14045.md): URL Media Uploader \<= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload (CVSS 4.3, apprhyme URL Media Uploader)
- [CVE-2025-12968](https://cve.now/CVE-2025-12968.md): Infility Global \<= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, Infility Global)
- [CVE-2025-12824](https://cve.now/CVE-2025-12824.md): Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, tharkun69 Player Leaderboard)
- [CVE-2025-13408](https://cve.now/CVE-2025-13408.md): Foxtool All-in-One: Contact chat button, Custom login, Media optimize images \<= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection (CVSS 4.3, foxtheme Foxtool All-in-One: Contact chat button, Custom lo…)
- [CVE-2025-14344](https://cve.now/CVE-2025-14344.md): Multi Uploader for Gravity Forms \<= 1.1.7 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, sh1zen Multi Uploader for Gravity Forms)
- [CVE-2025-12883](https://cve.now/CVE-2025-12883.md): Campay Woocommerce Payment Gateway \<= 1.2.2 - Unauthenticated Payment Bypass (CVSS 5.3, Campay Woocommerce Payment Gateway)
- [CVE-2025-14048](https://cve.now/CVE-2025-14048.md): SimplyConvert \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert\_hash' Option (CVSS 4.4, jonahsc SimplyConvert)
- [CVE-2025-14129](https://cve.now/CVE-2025-14129.md): Like DisLike Voting \<= 1.0.1 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, wasiul99 Like DisLike Voting)
- [CVE-2025-13989](https://cve.now/CVE-2025-13989.md): WP Dropzone \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute (CVSS 6.4, nazsabuz WP Dropzone)
- [CVE-2025-14125](https://cve.now/CVE-2025-14125.md): Complag \<= 1.0.2 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, andru1 Complag)
- [CVE-2025-14393](https://cve.now/CVE-2025-14393.md): Wpik WordPress Basic Ajax Form \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, awanhrp Wpik WordPress Basic Ajax Form)
- [CVE-2025-14143](https://cve.now/CVE-2025-14143.md): Ayo Shortcodes \<= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4, ayothemes Ayo Shortcodes)
- [CVE-2025-13972](https://cve.now/CVE-2025-13972.md): WatchTowerHQ \<= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht\_download\_big\_object\_origin' Parameter (CVSS 4.9, WatchTowerHQ)
- [CVE-2025-14064](https://cve.now/CVE-2025-14064.md): BuddyTask \<= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation (CVSS 5.4, cytechltd BuddyTask)
- [CVE-2025-14467](https://cve.now/CVE-2025-14467.md): WP Job Portal \<= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field (CVSS 4.4, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2025-13889](https://cve.now/CVE-2025-13889.md): Simple Nivo Slider \<= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, tmus Simple Nivo Slider)
- [CVE-2025-14170](https://cve.now/CVE-2025-14170.md): Vimeo SimpleGallery \<= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification (CVSS 4.3, stiand Vimeo SimpleGallery)
- [CVE-2025-13866](https://cve.now/CVE-2025-13866.md): Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow\_flow\_social\_auth AJAX action (CVSS 6.4, looks\_awesome Flow-Flow Social Feed Stream)
- [CVE-2025-14162](https://cve.now/CVE-2025-14162.md): BMLT WordPress Plugin \<= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion (CVSS 4.3, magblogapi BMLT WordPress Satellite)
- [CVE-2025-13053](https://cve.now/CVE-2025-13053.md): A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM (CVSS 7.0, ASUSTOR ADM)
- [CVE-2025-13670](https://cve.now/CVE-2025-13670.md): High Level Synthesis Compiler Security Advisory (CVSS 5.4, Altera High Level Synthesis Compiler)
- [CVE-2025-13052](https://cve.now/CVE-2025-13052.md): An improper certificates validation vulnerability was found in the Notification settings of ADM (CVSS 7.0, ASUSTOR ADM)
- [CVE-2025-13669](https://cve.now/CVE-2025-13669.md): High Level Synthesis Compiler Security Advisory (CVSS 5.4, Altera High Level Synthesis Compiler)
- [CVE-2025-13886](https://cve.now/CVE-2025-13886.md): LT Unleashed \<= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter (CVSS 7.5, cvedovini LT Unleashed)
- [CVE-2025-13839](https://cve.now/CVE-2025-13839.md): LJUsers \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (CVSS 6.4, jenyay LJUsers)
- [CVE-2025-13665](https://cve.now/CVE-2025-13665.md): Quartus Prime Standard Security Advisory (CVSS 5.4, Altera Quartus Prime Standard)
- [CVE-2025-10451](https://cve.now/CVE-2025-10451.md): H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write) (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2023-29144](https://cve.now/CVE-2023-29144.md): Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. (CVSS 3.3)
- [CVE-2025-64011](https://cve.now/CVE-2025-64011.md): Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. (CVSS 4.3)
- [CVE-2025-65530](https://cve.now/CVE-2025-65530.md): An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files (CVSS 8.8)
- [CVE-2025-65854](https://cve.now/CVE-2025-65854.md): Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full acco (CVSS 9.8, mineadmin/mineadmin)
- [CVE-2025-66430](https://cve.now/CVE-2025-66430.md): Plesk 18.0 has Incorrect Access Control. (CVSS 9.1)
- [CVE-2025-67341](https://cve.now/CVE-2025-67341.md): jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. (CVSS 4.6)
- [CVE-2025-67342](https://cve.now/CVE-2025-67342.md): RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. (CVSS 4.6)
- [CVE-2025-67344](https://cve.now/CVE-2025-67344.md): jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. (CVSS 4.6)
- [CVE-2025-67818](https://cve.now/CVE-2025-67818.md): An issue was discovered in Weaviate OSS before 1.33.4. (CVSS 7.2, github.com/weaviate/weaviate)
- [CVE-2025-67819](https://cve.now/CVE-2025-67819.md): An issue was discovered in Weaviate OSS before 1.33.4. (CVSS 4.9, github.com/weaviate/weaviate)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.