CVEs published December 17, 2025
188 CVEs were published on December 17, 2025: 29 critical, 57 high. 3 are now in CISA KEV.
- Published
- 188
- Critical
- 29
- High
- 57
- Medium
- 90
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 78
Most affected products
- ChurchCRM CRM
- 15
- World Wide Broadcast Network AVideo
- 9
- Apple macOS
- 5
- Ulicms
- 4
- Apple Safari · Apple iOS and iPadOS +2
- 3
- modelcontextprotocol servers · mcp-server-git
- 3
- PodcastGenerator
- 3
- projectSend
- 3
- Apple iOS and iPadOS
- 2
- Apple iOS and iPadOS · Apple macOS +1
- 2
Critical 29
- CVE-2025-68435Zerobyte has Authentication Bypass by Primary Weaknessnicotsx zerobyte
- CVE-2023-53923UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account CreationUlicms
- CVE-2023-53922TinyWebGallery v2.5 Remote Code Execution via Unrestricted File UploadTinyWebGallery
- CVE-2023-53914UliCMS 2023.1 Authentication Bypass via Mass Assignment VulnerabilityUlicms
- CVE-2025-68275ChurchCRM vulnerable to Stored XSS - Group name > Person ListingChurchCRM CRM
- CVE-2025-68400ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.phpChurchCRM CRM
- CVE-2025-68112ChurchCRM has SQL injection in EditEventAttendees.phpChurchCRM CRM
- CVE-2025-68110ChurchCRM discloses database information on error messageChurchCRM CRM
- CVE-2025-68109ChurchCRM vulnerable to RCE with database restore functionalityChurchCRM CRM
- CVE-2025-67876ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session HijackingChurchCRM CRM
- CVE-2025-46279A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43526This issue was addressed with improved URL validation.Apple Safari · Apple macOS
- CVE-2025-43428A configuration issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-34434AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and DeletionWorld Wide Broadcast Network AVideo
- CVE-2025-62521ChurchCRM has unauthenticated RCE in its Install WizardChurchCRM CRM
- CVE-2025-20393Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityCisco Secure Email
- CVE-2025-44005An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain psmallstep Step-CA · github.com/smallstep/certificates
- CVE-2025-67895Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2Apache Software Foundation Apache Airflow Providers Edge… +1
- CVE-2025-59374"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced throASUS live update
- CVE-2025-14700Improper Neutralization of Special Elements Used in a Template Engine in Crafty ControllerArcadia Technology Crafty Controller
- CVE-2022-23851Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).
- CVE-2025-67073A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause
- CVE-2025-67164An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arpagekit/pagekit
- CVE-2025-67165An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.pagekit/pagekit
- CVE-2025-67781An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.
- CVE-2025-67787An issue was discovered in 25.1.2 before 25.1.5.
- CVE-2025-67790An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.
- CVE-2025-67791An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*.
- CVE-2025-67793An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6.
High 57
- CVE-2025-14202Cross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File UploadLinkDing
- CVE-2025-68433Zed IDE MCP Context Server Configuration Arbitrary Code Executionzed-industries zed
- CVE-2023-53917Affiliate Me 5.0.1 SQL Injection Vulnerability via Admin Panelpowerstonegh Affiliate Me
- CVE-2025-68432Zed IDE LSP Binary Configuration Arbitrary Code Executionzed-industries zed
- CVE-2023-53933Serendipity 2.4.0 Authenticated Remote Code Execution via File Uploads9y Serendipity
- CVE-2023-53930ProjectSend r1605 Insecure Direct Object Reference File Download VulnerabilityprojectSend
- CVE-2023-53926PHPJabbers Simple CMS 5.0 SQL Injection via Column ParameterPHPJabbers Simple CMS
- CVE-2023-53924UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar UploadUlicms
- CVE-2023-53921SitemagicCMS 4.4.3 Remote Code Execution via Unrestricted File UploadSitemagicCMS
- CVE-2023-53912USB Flash Drives Control 4.1.0.0 Unquoted Service Path Privilege EscalationBiniSoft USB Flash Drives Control
- CVE-2023-53908HiSecOS 04.0.01 Privilege Escalation via User Role ModificationBelden HiSecOS
- CVE-2023-53907Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup PluginBludit Backup Plugin
- CVE-2025-66029Open OnDemand affected by Apache proxy passing sensitive headersOSC ondemand
- CVE-2025-68429Storybook manager bundle may expose environment variables during buildstorybookjs storybook · storybook
- CVE-2025-68434opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creationopensourcepos
- CVE-2025-68147opensourcepos has a Cross-site Scripting vulnerabilityopensourcepos
- CVE-2025-68111ChurchCRM has SQL Injection in eGive Import FeatureChurchCRM CRM
- CVE-2025-67877ChurchCRM SQL Injection VulnerabilityChurchCRM CRM
- CVE-2025-67875ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingChurchCRM CRM
- CVE-2025-67493Homarr: missing input sanitization and possible privilege escalation through ldap search query injectionhomarr-labs homarr
- CVE-2025-46281A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-43529A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-53000nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windowsjupyter nbconvert · nbconvert
- CVE-2025-34437AVideo < 20.1 IDOR Arbitrary Comment Image UploadWorld Wide Broadcast Network AVideo
- CVE-2025-34435AVideo < 20.1 IDOR Arbitrary File DeletionWorld Wide Broadcast Network AVideo
- CVE-2025-34436AVideo < 20.1 IDOR Arbitrary File UploadWorld Wide Broadcast Network AVideo
- CVE-2025-66397ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access ControlChurchCRM CRM
- CVE-2025-66396ChurchCRM has SQL Injection in User Editor via `type` Parameter KeyChurchCRM CRM
- CVE-2025-66395SQL Injection in Event List via `WhichType` ParameterChurchCRM CRM
- CVE-2025-43873iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounceJohnson Control iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2…
- CVE-2025-14727NGINX Ingress Controller vulnerabilityF5 NGINX Ingress Controller
- CVE-2025-61736iSTAR- Improper Validation of Certificate ExpirationJohnson Controls iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR…
- CVE-2025-14097Remote Code Execution Vulnerability in Radiometer ProductsRadiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS An… +1
- CVE-2025-14096Credential Disclosure vulnerability in Radiometer ProductsRadiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS An… +1
- CVE-2025-14101IDOR in GG Soft's PaperWorkGG Soft Software Services PaperWork
- CVE-2025-11924Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Tokenkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-11901An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, ASUS B460 series · ASUS B560 series +11
- CVE-2025-14305Acer｜ListCheck.exe - Local Privilege EscalationAcer ListCheck.exe
- CVE-2025-14304ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism FailureASRock Intel 500 chipset motherboard · ASRockRack Intel… +10
- CVE-2025-14303MSI｜Motherboard - Protection Mechanism FailureMSI Intel 600 chipset motherboard · MSI Intel 700 chipset m…
- CVE-2025-14302GIGABYTE｜Motherboard - Protection Mechanism FailureGIGABYTE intel 600 chipset Motherboard · GIGABYTE intel… +4
- CVE-2025-53524Fuji Electric Monitouch V-SFT-6 Out-of-bounds WriteFuji Electric Monitouch V-SFT-6
- CVE-2025-14701Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerArcadia Technology Crafty Controller
- CVE-2024-29371In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token wiorg.bitbucket.b_c:jose4j
- CVE-2024-46060Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home direct
- CVE-2024-46062Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home direc
- CVE-2025-53398The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,
- CVE-2025-53919An issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder,
- CVE-2025-65203KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directiv
- CVE-2025-66921A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to in
- CVE-2025-66923A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to injec
- CVE-2025-66953CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based
- CVE-2025-67171Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.
- CVE-2025-67172RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.
- CVE-2025-67285A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0.
- CVE-2025-67792An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.
- CVE-2025-67794An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6.
Medium, low and unrated 102
- CVE-2025-14837ZZCMS Backend Website Settings siteconfig.php stripfxg code injectionZZCMS
- CVE-2025-14836ZZCMS User Data Storage user_save.php cleartext storage in fileZZCMS
- CVE-2025-14834code-projects Simple Stock System checkuser.php sql injectioncode-projects Simple Stock System
- CVE-2023-53932Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creations9y Serendipity
- CVE-2023-53931Revive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced Settingsrevive-adserver
- CVE-2023-53929phpMyFAQ 3.1.12 CSV Injection via User Profile ExportphpMyFAQ · thorsten/phpmyfaq +1
- CVE-2023-53928PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager UploadPhp-fusion PHPFusion
- CVE-2023-53927PHPJabbers Simple CMS 5.0 Stored Cross-Site Scripting via Section CreationPHPJabbers Simple CMS
- CVE-2023-53925UliCMS 2023.1 Stored Cross-Site Scripting via SVG File UploadUlicms
- CVE-2023-53920PodcastGenerator Stored Cross-Site Scripting via Podcast Title FieldPodcastGenerator
- CVE-2023-53919PodcastGenerator Stored Cross-Site Scripting via Freebox Content FieldPodcastGenerator
- CVE-2023-53918PodcastGenerator Stored Cross-Site Scripting via Episode Title FieldPodcastGenerator
- CVE-2023-53916Zenphoto 1.6 Stored Cross-Site Scripting via User Postal Code FieldZenphoto
- CVE-2023-53915Zenphoto 1.6 Stored Cross-Site Scripting via Album DescriptionZenphoto
- CVE-2023-53913Rukovoditel 3.3.1 CSV Injection via User Account ExportRukovoditel
- CVE-2023-53911Textpattern CMS 4.8.8 Authenticated Stored Cross-Site Scripting via Article ExcerptTmrswrr Textpattern CMS
- CVE-2023-53910WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Contentwbce-cms WBCE CMS
- CVE-2023-53909WBCE CMS 1.6.1 SVG File Content Cross-Site Scriptingwbce-cms WBCE CMS
- CVE-2023-53906ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets PageprojectSend
- CVE-2023-53905ProjectSend r1605 CSV Injection via User Account Export FunctionalityprojectSend
- CVE-2023-53904Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie CategoriesXenforo
- CVE-2025-14833code-projects Online Appointment Booking System deletemanagerclinic.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-68145mcp-server-git has missing path validation when using --repository flagmodelcontextprotocol servers · mcp-server-git
- CVE-2025-68144mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local filesmodelcontextprotocol servers · mcp-server-git
- CVE-2025-68143mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsmodelcontextprotocol servers · mcp-server-git
- CVE-2025-68129Auth0-PHP SDK has Improper Audience Validationauth0-PHP · auth0/auth0-php
- CVE-2025-14832itsourcecode Online Cake Ordering System updateproduct.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-68118Potential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf UsageFreeRDP
- CVE-2025-68401ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverChurchCRM CRM
- CVE-2025-68399ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.phpChurchCRM CRM
- CVE-2025-68114Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflowcapstone-engine capstone
- CVE-2025-67873Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflowcapstone-engine capstone
- CVE-2025-43514The issue was addressed with improved handling of caches.Apple macOS
- CVE-2025-46278The issue was addressed with improved handling of caches.Apple macOS
- CVE-2025-43535The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-46291A logic issue was addressed with improved validation.Apple macOS
- CVE-2025-43533The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43475A logging issue was addressed with improved data redaction.Apple iOS and iPadOS
- CVE-2025-46288A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-43531A race condition was addressed with improved state handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-55254HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)HCL Software BigFix Remote Control
- CVE-2025-46292This issue was addressed with additional entitlement checks.Apple iOS and iPadOS
- CVE-2025-43536A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +1
- CVE-2025-46283A logic issue was addressed with improved validation.Apple macOS
- CVE-2025-43541A type confusion issue was addressed with improved state handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-43501A buffer overflow issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-46282The issue was addressed with additional permissions checks.Apple Safari · Apple macOS
- CVE-2025-46277A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-59849HCL BigFix Remote Control is vulnerable to an insecure CSP configurationHCL Software BigFix Remote Control
- CVE-2025-66647RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reassRIOT-OS RIOT
- CVE-2025-14764Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introdAWS S3 Encryption Client for Go · github.com/aws/amazon-… +2
- CVE-2025-14763Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to intrAWS S3 Encryption Client for Java · software.amazon.encrypt…
- CVE-2025-14762Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatAWS SDK for Ruby · aws-sdk-s3
- CVE-2025-14761Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that AWS SDK for PHP · aws/aws-sdk-php
- CVE-2025-14760Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that AWS SDK for C++
- CVE-2025-14759Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to intrAWS S3 Encryption Client for .NET · Amazon.Extensions.S3.En…
- CVE-2025-34438AVideo < 20.1 IDOR Arbitrary Video RotationWorld Wide Broadcast Network AVideo
- CVE-2025-34439AVideo < 20.1 Open Redirect via cancelUri ParameterWorld Wide Broadcast Network AVideo
- CVE-2025-34440AVideo < 20.1 Open Redirect via siteRedirectUri ParameterWorld Wide Broadcast Network AVideo
- CVE-2025-34442AVideo < 20.1 System Path Disclosure via Public APIWorld Wide Broadcast Network AVideo
- CVE-2025-34441AVideo < 20.1 User Information Disclosure via Public APIWorld Wide Broadcast Network AVideo
- CVE-2025-66646RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reassRIOT-OS RIOT
- CVE-2025-14081Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypassultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-13537Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptinglivecomposer Live Composer – Free WordPress Website Builder
- CVE-2025-13217Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'ultimatemember Ultimate Member – User Profile, Registration…
- CVE-2025-13326Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App StoreMattermost
- CVE-2025-13324Lack of Invalidation of Legacy Remote Cluster Invite Tokens After ConfirmationMattermost · github.com/mattermost/mattermost +4
- CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletionMattermost · mattermost-desktop
- CVE-2025-12689DoS in Calls plugin via malformed UTF-8 in WebSocket requestMattermost · github.com/mattermost/mattermost-plugin-calls
- CVE-2025-26381OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)Johnson Controls OpenBlue Workplace
- CVE-2025-14266CSRF in Ercom Cryptobox administration consoleErcom Cryptobox
- CVE-2025-62690Open redirect in error page when link opened in new tabMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2025-13352Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingMattermost · github.com/mattermost/mattermost +5
- CVE-2025-62190CSRF Allows Call Initiation and Message DeliveryMattermost · github.com/mattermost/mattermost-plugin-calls
- CVE-2025-14095Privilege boundary violation in Radiometer ProductsRadiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS An… +2
- CVE-2025-14347Reflected XSS in Proliz's OBSProliz Software OBS (Student Affairs Information System)0
- CVE-2025-14399Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archivalwpcodefactory Download Plugins and Themes in ZIP from Dashb…
- CVE-2025-12496Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgerydylanjkotze Zephyr Project Manager
- CVE-2025-13750Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpointmateuszgbiorczyk Converter for Media – Optimize images | Co…
- CVE-2025-14061Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletionwplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2025-14817Factory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADBTecno Pova6 Pro
- CVE-2025-14154Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scriptingwordplus Better Messages – Live Chat, Chat Rooms, Real-Time…
- CVE-2025-14385WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebrechtvds WP Recipe Maker
- CVE-2025-13880WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modificationadreastrian WP Social Ninja – Embed Social Feeds, User Revi…
- CVE-2025-13861HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scriptinglinksoftware HTML Forms – Simple WordPress Forms Plugin
- CVE-2025-11775An out-of-bounds read vulnerability has been identified in the asComSvc service.ASUS Armoury Crate
- CVE-2025-64700Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier.GROWI
- CVE-2025-13977Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2025-14801xiweicheng TMS create createComment cross site scriptingxiweicheng TMS
- CVE-2025-11369Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosurewpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2025-11009Information Disclosure Vulnerability in GT Designer3Mitsubishi Electric GT Designer3 Version1
- CVE-2024-29370In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by craftingpython-jose
- CVE-2025-65185There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by enteri
- CVE-2025-65233Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysco
- CVE-2025-65855The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentia
- CVE-2025-66924A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to injec
- CVE-2025-67074A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause
- CVE-2025-67168RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
- CVE-2025-67170A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's
- CVE-2025-67173A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via
- CVE-2025-67174A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal
- CVE-2025-67789An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.