# CVEs published 2025-12-18 399 CVEs were published on December 18, 2025: 35 critical, 238 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2025-14898](https://cve.now/CVE-2025-14898.md): CodeAstro Real Estate Management System Administrator Endpoint userbuilderdelete.php sql injection (CVSS 5.1, CodeAstro Real Estate Management System) - [CVE-2025-14897](https://cve.now/CVE-2025-14897.md): CodeAstro Real Estate Management System Administrator Endpoint useragentdelete.php sql injection (CVSS 5.1, CodeAstro Real Estate Management System) - [CVE-2025-64675](https://cve.now/CVE-2025-64675.md): Azure Cosmos DB Spoofing Vulnerability (CVSS 8.3, Microsoft Azure Cosmos DB) - [CVE-2025-68398](https://cve.now/CVE-2025-68398.md): Weblate has git config file overwrite vulnerability that leads to remote code execution (CVSS 9.1, WeblateOrg weblate · weblate) - [CVE-2025-68279](https://cve.now/CVE-2025-68279.md): Weblate has an arbitrary file read via symbolic links (CVSS 7.7, WeblateOrg weblate · weblate) - [CVE-2025-68422](https://cve.now/CVE-2025-68422.md): Kibana Improper Authorization (CVSS 4.3, Elastic Kibana) - [CVE-2025-68386](https://cve.now/CVE-2025-68386.md): Kibana Improper Authorization (CVSS 4.3, Elastic Kibana) - [CVE-2025-68390](https://cve.now/CVE-2025-68390.md): Elasticsearch Allocation of Resources Without Limits or Throttling (CVSS 4.9, Elasticsearch · org.elasticsearch.plugin:x-pack-core) - [CVE-2025-68389](https://cve.now/CVE-2025-68389.md): Kibana Allocation of Resources Without Limits or Throttling (CVSS 6.5, Elastic Kibana) - [CVE-2025-68387](https://cve.now/CVE-2025-68387.md): Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 6.1, Elastic Kibana) - [CVE-2025-68385](https://cve.now/CVE-2025-68385.md): Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.2, Elastic Kibana) - [CVE-2025-68384](https://cve.now/CVE-2025-68384.md): Elasticsearch Allocation of Resources Without Limits or Throttling (CVSS 6.5, Elasticsearch · org.elasticsearch.plugin:x-pack-security) - [CVE-2025-64677](https://cve.now/CVE-2025-64677.md): Office Out-of-Box Experience Spoofing Vulnerability (CVSS 8.2, Microsoft Office Out-of-Box Experience) - [CVE-2025-64676](https://cve.now/CVE-2025-64676.md): Microsoft Purview eDiscovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Purview) - [CVE-2025-65037](https://cve.now/CVE-2025-65037.md): Azure Container Apps Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Azure Container Apps) - [CVE-2025-65041](https://cve.now/CVE-2025-65041.md): Microsoft Partner Center Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Partner Center) - [CVE-2025-64663](https://cve.now/CVE-2025-64663.md): Custom Question Answering Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure Cognitive Service for Language) - [CVE-2025-65046](https://cve.now/CVE-2025-65046.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 3.1, Microsoft Edge for Android) - [CVE-2025-68383](https://cve.now/CVE-2025-68383.md): Filebeat Improper Validation of Specified Index, Position, or Offset in Input (CVSS 6.5, Elastic Filebeat · github.com/elastic/beats +1) - [CVE-2025-13427](https://cve.now/CVE-2025-13427.md): Authentication Bypass in Dialogflow CX Messenger (CVSS 6.9, Google Cloud Dialogflow CX Messenger) - [CVE-2025-68382](https://cve.now/CVE-2025-68382.md): Packetbeat Out-of-bounds Read (CVSS 6.5, Elastic Packetbeat) - [CVE-2025-68381](https://cve.now/CVE-2025-68381.md): Packetbeat Improper Bounds Check (CVSS 6.5, Elastic Packetbeat) - [CVE-2025-68388](https://cve.now/CVE-2025-68388.md): Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPE (CVSS 5.3, Elastic Packetbeat · github.com/elastic/beats +1) - [CVE-2025-34452](https://cve.now/CVE-2025-34452.md): Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write (CVSS 8.7, Streama) - [CVE-2025-34451](https://cve.now/CVE-2025-34451.md): rofl0r/proxychains-ng \<= 4.17 Stack-based Buffer Overflow (CVSS 6.9, rofl0r proxychains-ng) - [CVE-2025-34450](https://cve.now/CVE-2025-34450.md): merbanan/rtl\_433 \<= 25.02 Stack-based Buffer Overflow (CVSS 6.9, merbanan rtl\_433) - [CVE-2025-34449](https://cve.now/CVE-2025-34449.md): Genymobile/scrcpy \<= 3.3.3 Global Buffer Overflow (CVSS 6.9, Genymobile scrcpy) - [CVE-2025-53710](https://cve.now/CVE-2025-53710.md): Network boundaries not respected in certain Foundry namespaces. (CVSS 7.5, com.palantir.compute:compute-service · com.palantir.codeass…) - [CVE-2025-68161](https://cve.now/CVE-2025-68161.md): Apache Log4j Core: Missing TLS hostname verification in Socket appender (CVSS 6.3, Apache Software Foundation Apache Log4j Core · org.apache.l…) - [CVE-2025-67653](https://cve.now/CVE-2025-67653.md): Advantech WebAccess/SCADA Path Traversal (CVSS 4.3, Advantech WebAccess/SCADA) - [CVE-2025-62004](https://cve.now/CVE-2025-62004.md): BullWall Server Intrusion Protection (SIP) initialization race condition (CVSS 7.7, BullWall Server Intrusion Protection) - [CVE-2025-62003](https://cve.now/CVE-2025-62003.md): BullWall Server Intrusion Protection RDP MFA connection delay (CVSS 7.5, BullWall Server Intrusion Protection) - [CVE-2025-46268](https://cve.now/CVE-2025-46268.md): Advantech WebAccess/SCADA SQL Injection (CVSS 6.3, Advantech WebAccess/SCADA) - [CVE-2025-14848](https://cve.now/CVE-2025-14848.md): Advantech WebAccess/SCADA Absolute Path Traversal (CVSS 4.3, Advantech WebAccess/SCADA) - [CVE-2025-62002](https://cve.now/CVE-2025-62002.md): BullWall Ransomware Containment file count detection bypass (CVSS 4.3, BullWall Ransomware Containment) - [CVE-2025-14849](https://cve.now/CVE-2025-14849.md): Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type (CVSS 8.8, Advantech WebAccess/SCADA) - [CVE-2025-62001](https://cve.now/CVE-2025-62001.md): BullWall Ransomware Containment hard-coded folder exclusions (CVSS 8.8, BullWall Ransomware Containment) - [CVE-2025-62000](https://cve.now/CVE-2025-62000.md): BullWall Ransomware Containment incomplete file inspection (CVSS 7.1, BullWall Ransomware Containment) - [CVE-2025-14850](https://cve.now/CVE-2025-14850.md): Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory (CVSS 8.1, Advantech WebAccess/SCADA) - [CVE-2025-59529](https://cve.now/CVE-2025-59529.md): Avahi: simple protocol server ignores accepts unlimited connections and logs failures without limit (CVSS 5.5, avahi) - [CVE-2025-13911](https://cve.now/CVE-2025-13911.md): Inductive Automation Ignition Execution with Unnecessary Privileges (CVSS 6.4, Inductive Automation Ignition) - [CVE-2025-14889](https://cve.now/CVE-2025-14889.md): Campcodes Advanced Voting Management System Password voters\_edit.php improper authorization (CVSS 5.3, Campcodes Advanced Voting Management System) - [CVE-2023-53940](https://cve.now/CVE-2023-53940.md): Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File (CVSS 8.4, Alfonzm Codigo Markdown Editor) - [CVE-2023-53937](https://cve.now/CVE-2023-53937.md): Hubstaff 1.6.13 and 1.6.14 DLL Search Order Hijacking via wow64log Library (CVSS 8.5, Hubstaff) - [CVE-2024-58323](https://cve.now/CVE-2024-58323.md): Kentico Xperience \<= 13.0.158 Checkbox Form Component Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2024-58322](https://cve.now/CVE-2024-58322.md): Kentico Xperience \<= 13.0.158 Shipping Options Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2024-58321](https://cve.now/CVE-2024-58321.md): Kentico Xperience \<= 13.0.159 Form Validation Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2024-58320](https://cve.now/CVE-2024-58320.md): Kentico Xperience \<= 13.0.159 Authentication Information Disclosure (CVSS 6.9, Kentico Xperience) - [CVE-2024-58319](https://cve.now/CVE-2024-58319.md): Kentico Xperience \<= 13.0.160 Pages Dashboard Widget Reflected XSS (CVSS 5.1, Kentico Xperience) - [CVE-2024-58318](https://cve.now/CVE-2024-58318.md): Kentico Xperience \<= 13.0.162 Rich Text Editor Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2024-58317](https://cve.now/CVE-2024-58317.md): Kentico Xperience \<= 13.0.164 Cookie Security Configuration (CVSS 6.9, Kentico Xperience) - [CVE-2023-53944](https://cve.now/CVE-2023-53944.md): EasyPHP Webserver 14.1 Path Traversal via Directory Traversal Sequences (CVSS 7.1, EasyPHP Webserver) - [CVE-2023-53943](https://cve.now/CVE-2023-53943.md): GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint (CVSS 6.9, Glpi-Project GLPI) - [CVE-2023-53942](https://cve.now/CVE-2023-53942.md): File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution (CVSS 9.4, leefish File Thingie) - [CVE-2023-53941](https://cve.now/CVE-2023-53941.md): EasyPHP Webserver 14.1 Remote Code Execution (CVSS 9.3, EasyPHP Webserver) - [CVE-2023-53939](https://cve.now/CVE-2023-53939.md): TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter (CVSS 5.1, TinyWebGallery) - [CVE-2023-53938](https://cve.now/CVE-2023-53938.md): RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters (CVSS 5.1, iwind RockMongo) - [CVE-2023-53936](https://cve.now/CVE-2023-53936.md): Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation (CVSS 5.1, tuzitio Cameleon CMS) - [CVE-2023-53935](https://cve.now/CVE-2023-53935.md): WBiz Desk 1.2 SQL Injection Vulnerability via ticket.php Parameter (CVSS 5.3, Codester WBiz Desk) - [CVE-2023-53934](https://cve.now/CVE-2023-53934.md): Kentico Xperience \<= 12.0.98 GetResource Handler Denial of Service (CVSS 8.7, Kentico Xperience) - [CVE-2023-53738](https://cve.now/CVE-2023-53738.md): Kentico Xperience \<= 13.0.109 Page Preview Reflected XSS (CVSS 5.1, Kentico Xperience) - [CVE-2023-53737](https://cve.now/CVE-2023-53737.md): Kentico Xperience \<= 13.0.101 Localization Application Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2023-53736](https://cve.now/CVE-2023-53736.md): Kentico Xperience \<= 13.0.120 Administration Interface Reflected XSS (CVSS 5.1, Kentico Xperience) - [CVE-2022-50686](https://cve.now/CVE-2022-50686.md): Kentico Xperience \<= 12.0 Portal Engine Form Control Information Disclosure (CVSS 6.9, Kentico Xperience) - [CVE-2022-50685](https://cve.now/CVE-2022-50685.md): Kentico Xperience \<= 13.0.56 File Upload Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2022-50684](https://cve.now/CVE-2022-50684.md): Kentico Xperience \<= 13.0.71 Form Emails HTML Injection (CVSS 5.1, Kentico Xperience) - [CVE-2022-50683](https://cve.now/CVE-2022-50683.md): Kentico Xperience \<= 13.0.74 Form Configuration Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2022-50682](https://cve.now/CVE-2022-50682.md): Kentico Xperience \<= 13.0.79 Routing Engine CRLF Injection (CVSS 6.9, Kentico Xperience) - [CVE-2022-50681](https://cve.now/CVE-2022-50681.md): Kentico Xperience \<= 13.0.88 Rich Text Editor Reflected XSS (CVSS 5.1, Kentico Xperience) - [CVE-2022-50680](https://cve.now/CVE-2022-50680.md): Kentico Xperience \<= 13.0.92 Email Marketing Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2021-47712](https://cve.now/CVE-2021-47712.md): Kentico Xperience \<= 12.0.102 URL Hashing Cryptography Vulnerability (CVSS 6.9, Kentico Xperience) - [CVE-2021-47711](https://cve.now/CVE-2021-47711.md): Kentico Xperience \<= 13.0.52 Online Marketing Macros SQL Injection (CVSS 8.7, Kentico Xperience) - [CVE-2020-36891](https://cve.now/CVE-2020-36891.md): Kentico Xperience \<= 12.0.49 File Upload Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2020-36890](https://cve.now/CVE-2020-36890.md): Kentico Xperience \<= 10 Administrator Access Control Bypass (CVSS 8.6, Kentico Xperience) - [CVE-2020-36889](https://cve.now/CVE-2020-36889.md): Kentico Xperience \<= 12.0.90 Administration Interface Stored XSS (CVSS 5.1, Kentico Xperience) - [CVE-2019-25230](https://cve.now/CVE-2019-25230.md): Kentico Xperience \<= 12.0.0 User Widget Information Disclosure (CVSS 5.3, Kentico Xperience) - [CVE-2019-25229](https://cve.now/CVE-2019-25229.md): Kentico Xperience \<= 12.0.29 MVC Forms Unrestricted File Upload (CVSS 8.7, Kentico Xperience) - [CVE-2019-25228](https://cve.now/CVE-2019-25228.md): Kentico Xperience \<= 12.0.47 Virtual Context Information Disclosure (CVSS 5.1, Kentico Xperience) - [CVE-2025-64400](https://cve.now/CVE-2025-64400.md): Insufficient permission checks when pre-enrolling users Summary (CVSS 4.1, com.palantir.controlpanel:control-panel) - [CVE-2025-67745](https://cve.now/CVE-2025-67745.md): Myhoard logs backup encryption key in plain text (CVSS 7.1, Aiven-Open myhoard) - [CVE-2025-14885](https://cve.now/CVE-2025-14885.md): SourceCodester Client Database Management System Leads Generation user\_leads.php unrestricted upload (CVSS 5.3, SourceCodester Client Database Management System) - [CVE-2025-59949](https://cve.now/CVE-2025-59949.md): FreshRSS has Logout CSRF that Leads to DoS via \ (CVSS 5.3, FreshRSS) - [CVE-2025-14739](https://cve.now/CVE-2025-14739.md): Uninitialized Pointer Vulnerability in TP-Link WR940N and WR941ND (CVSS 6.8, TP-Link Systems WR940N and WR941ND) - [CVE-2025-14738](https://cve.now/CVE-2025-14738.md): Configuration Disclosure Vulnerability in TP-Link WA850RE (CVSS 5.7, TP-Link Systems WA850RE) - [CVE-2025-14737](https://cve.now/CVE-2025-14737.md): Command Injection Vulnerability in TP-Link WA850RE (CVSS 7.1, TP-Link Systems WA850RE) - [CVE-2025-14884](https://cve.now/CVE-2025-14884.md): D-Link DIR-605 Firmware Update Service command injection (CVSS 8.6, D-Link DIR-605) - [CVE-2025-14879](https://cve.now/CVE-2025-14879.md): Tenda WH450 HTTP Request onSSIDChange stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-62960](https://cve.now/CVE-2025-62960.md): WordPress Construction Light theme \<= 1.6.7 - Broken Access Control vulnerability (CVSS 5.4, sparklewpthemes Construction Light) - [CVE-2025-62961](https://cve.now/CVE-2025-62961.md): WordPress Sparkle FSE theme \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.4, sparklewpthemes Sparkle FSE) - [CVE-2025-62998](https://cve.now/CVE-2025-62998.md): WordPress WP AI CoPilot plugin \<= 1.2.7 - Sensitive Data Exposure vulnerability (CVSS 5.0, WP Messiah WP AI CoPilot) - [CVE-2025-63002](https://cve.now/CVE-2025-63002.md): WordPress Sermon Manager plugin \<= 2.30.0 - Broken Access Control vulnerability (CVSS 5.3, wpforchurch Sermon Manager) - [CVE-2025-63043](https://cve.now/CVE-2025-63043.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, PickPlugins Post Grid and Gutenberg Blocks) - [CVE-2025-64235](https://cve.now/CVE-2025-64235.md): WordPress Tuturn plugin \< 3.6 - Arbitrary File Download vulnerability (CVSS 6.5, AmentoTech Tuturn) - [CVE-2025-64236](https://cve.now/CVE-2025-64236.md): WordPress Tuturn plugin \< 3.6 - Broken Authentication vulnerability (CVSS 9.8, AmentoTech Tuturn) - [CVE-2025-14896](https://cve.now/CVE-2025-14896.md): due to insufficient sanitazation in Vega’s \`convert()\` function when \`safeMode\` is enabled and the spec variable is an array. (CVSS 8.7, yuzutech kroki) - [CVE-2025-64282](https://cve.now/CVE-2025-64282.md): WordPress Radius Blocks plugin \<= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, RadiusTheme Radius Blocks) - [CVE-2025-64355](https://cve.now/CVE-2025-64355.md): WordPress JetElements For Elementor plugin \<= 2.7.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor) - [CVE-2025-66058](https://cve.now/CVE-2025-66058.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.17 - Broken Access Control vulnerability (CVSS 6.5, PickPlugins Post Grid and Gutenberg Blocks) - [CVE-2025-14878](https://cve.now/CVE-2025-14878.md): Tenda WH450 HTTP Request wirelessRestart stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-14877](https://cve.now/CVE-2025-14877.md): Campcodes Supplier Management System add\_retailer.php sql injection (CVSS 6.9, Campcodes Supplier Management System) - [CVE-2025-14823](https://cve.now/CVE-2025-14823.md): Certificate Signing Extension Returns Encrypted Values (CVSS 5.3, ConnectWise ScreenConnect) - [CVE-2025-68469](https://cve.now/CVE-2025-68469.md): ImageMagick vulnerable to heap-buffer-overflow (CVSS 2.0, ImageMagick · Magick.NET-Q16-AnyCPU +17) - [CVE-2025-68278](https://cve.now/CVE-2025-68278.md): tinacms vulnerable to arbitrary code execution (CVSS 7.3, tinacms · @tinacms/cli +1) - [CVE-2025-64724](https://cve.now/CVE-2025-64724.md): Arduino IDE for macOS has Insecure File Permissions (CVSS 4.8, arduino-ide) - [CVE-2025-64723](https://cve.now/CVE-2025-64723.md): Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection (CVSS 4.8, arduino-ide) - [CVE-2025-65011](https://cve.now/CVE-2025-65011.md): Unauthorized Access to files in WODESYS WD-R608U router (CVSS 7.1, WODESYS WD-R608U · WODESYS WDR28 +1) - [CVE-2025-65010](https://cve.now/CVE-2025-65010.md): Missing authorizations for admin panel password change in WODESYS WD-R608U router (CVSS 7.1, WODESYS WD-R608U · WODESYS WDR28 +1) - [CVE-2025-65009](https://cve.now/CVE-2025-65009.md): Insecure Password Storage in WODESYS WD-R608U router (CVSS 7.1, WODESYS WD-R608U · WODESYS WDR28 +1) - [CVE-2025-65008](https://cve.now/CVE-2025-65008.md): OS Command Injection in WODESYS WD-R608U router (CVSS 9.4, WODESYS WD-R608U · WODESYS WDR28 +1) - [CVE-2025-65007](https://cve.now/CVE-2025-65007.md): Missing Authentication for Critical Function in WODESYS WD-R608U router (CVSS 8.7, WODESYS WD-R608U · WODESYS WDR28 +1) - [CVE-2025-68325](https://cve.now/CVE-2025-68325.md): net/sched: sch\_cake: Fix incorrect qlen reduction in cake\_drop (no CVSS, Linux) - [CVE-2025-68324](https://cve.now/CVE-2025-68324.md): scsi: imm: Fix use-after-free bug caused by unfinished delayed work (no CVSS, Linux) - [CVE-2025-68323](https://cve.now/CVE-2025-68323.md): usb: typec: ucsi: fix use-after-free caused by uec-\>work (no CVSS, Linux) - [CVE-2025-64469](https://cve.now/CVE-2025-64469.md): Stack-based Buffer Overflow in LVResource::DetachResource() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-64468](https://cve.now/CVE-2025-64468.md): Use-after-Free in sentry!sentry\_span\_set\_data() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-7358](https://cve.now/CVE-2025-7358.md): Use of Hard-coded Credentials in Utarit Informatics' SoliClub (CVSS 7.5, Utarit Informatics Services SoliClub) - [CVE-2025-7047](https://cve.now/CVE-2025-7047.md): Missing Authorization in Utarit Informatics' SoliClub (CVSS 4.3, Utarit Informatics Services SoliClub) - [CVE-2025-64467](https://cve.now/CVE-2025-64467.md): Out-of-Bounds Read in LVResFile::FindRsrcListEntry() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-64466](https://cve.now/CVE-2025-64466.md): Out-of-Bounds Read in lvre!ExecPostedProcRecPost() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-64465](https://cve.now/CVE-2025-64465.md): Out-of-Bounds Read in lvre!DataSizeTDR() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-64464](https://cve.now/CVE-2025-64464.md): Out-of-Bounds Read in lvre!VisaWriteFromFile() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-64463](https://cve.now/CVE-2025-64463.md): Out-of-Bounds Read in LVResource::DetachResource() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-1031](https://cve.now/CVE-2025-1031.md): IDOR in Utarit Informatics' SoliClub (CVSS 7.5, Utarit Informatics Services SoliClub) - [CVE-2025-64462](https://cve.now/CVE-2025-64462.md): Out-of-Bounds Read in LVResFile::RGetMemFileHandle() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-1030](https://cve.now/CVE-2025-1030.md): Sensitive Data Exposure in Utarit Informatics' SoliClub (CVSS 7.5, Utarit Informatics Services SoliClub) - [CVE-2025-64461](https://cve.now/CVE-2025-64461.md): Out of Bounds Write in mgocre\_SH\_25\_3!RevBL() in NI LabVIEW (CVSS 7.8, NI LabVIEW) - [CVE-2025-14861](https://cve.now/CVE-2025-14861.md): Memory safety bugs fixed in Firefox 146.0.1 (CVSS 8.8, Mozilla Firefox) - [CVE-2025-14860](https://cve.now/CVE-2025-14860.md): Use-after-free in the Disability Access APIs component (CVSS 9.8, Mozilla Firefox) - [CVE-2025-14744](https://cve.now/CVE-2025-14744.md): Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS (CVSS 6.5, Mozilla Firefox for iOS) - [CVE-2025-1029](https://cve.now/CVE-2025-1029.md): Hardcoded Credentials in Utarit Informatics' SoliClub (CVSS 7.5, Utarit Information Services SoliClub) - [CVE-2025-9787](https://cve.now/CVE-2025-9787.md): Stored XSS (CVSS 6.1, Zohocorp ManageEngine Applications Manager) - [CVE-2025-65000](https://cve.now/CVE-2025-65000.md): Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule (CVSS 2.3, Checkmk) - [CVE-2025-40898](https://cve.now/CVE-2025-40898.md): Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2025-40893](https://cve.now/CVE-2025-40893.md): HTML injection in Asset List in Guardian/CMC before 25.5.0 (CVSS 5.3, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2025-40892](https://cve.now/CVE-2025-40892.md): Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0 (CVSS 7.1, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2025-40891](https://cve.now/CVE-2025-40891.md): HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0 (CVSS 2.3, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2025-13110](https://cve.now/CVE-2025-13110.md): HUSKY – Products Filter Professional for WooCommerce \<= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof\_add\_subscr' (CVSS 4.3, realmag777 HUSKY – Products Filter Professional for WooComm…) - [CVE-2025-14437](https://cve.now/CVE-2025-14437.md): Hummingbird \<= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File (CVSS 7.5, wpmudev Hummingbird Performance – Cache & Page Speed Optimi…) - [CVE-2025-14618](https://cve.now/CVE-2025-14618.md): Sweet Energy Efficiency \<= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion (CVSS 4.3, wpdirectorykit Sweet Energy Efficiency) - [CVE-2025-14277](https://cve.now/CVE-2025-14277.md): Prime Slider – Addons for Elementor \<= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 4.3, bdthemes Prime Slider – Addons for Elementor) - [CVE-2025-10910](https://cve.now/CVE-2025-10910.md): Gaining remote control over Govee devices (CVSS 9.3, Govee H6056) - [CVE-2025-40602](https://cve.now/CVE-2025-40602.md): A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). (CVSS 6.6, KEV, SonicWall SMA1000) - [CVE-2025-14364](https://cve.now/CVE-2025-14364.md): Demo Importer Plus \<= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation (CVSS 8.8, kraftplugins Demo Importer Plus) - [CVE-2025-13730](https://cve.now/CVE-2025-13730.md): OpenID Connect Generic Client \<= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, daggerhart OpenID Connect Generic Client) - [CVE-2025-13641](https://cve.now/CVE-2025-13641.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' (CVSS 8.8, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…) - [CVE-2025-64997](https://cve.now/CVE-2025-64997.md): Insufficient permission validation when showing agent information (CVSS 6.3, Checkmk) - [CVE-2025-14874](https://cve.now/CVE-2025-14874.md): Nodemailer: nodemailer: denial of service via crafted email address header (CVSS 7.5, nodemailer · Red Hat Advanced Cluster Management for Kub… +3) - [CVE-2025-14318](https://cve.now/CVE-2025-14318.md): Improper access validation in M-Files Server (CVSS 5.3, M-Files Server) - [CVE-2025-67546](https://cve.now/CVE-2025-67546.md): WordPress WP ERP plugin \<= 1.16.6 - Sensitive Data Exposure vulnerability (CVSS 6.5, weDevs WP ERP) - [CVE-2025-66119](https://cve.now/CVE-2025-66119.md): WordPress Hostel plugin \<= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Hostel) - [CVE-2025-66118](https://cve.now/CVE-2025-66118.md): WordPress Sprout Clients plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BoldGrid Sprout Clients) - [CVE-2025-66117](https://cve.now/CVE-2025-66117.md): WordPress Easy Form plugin \<= 2.7.8 - Broken Access Control vulnerability (CVSS 7.5, Ays Pro Easy Form) - [CVE-2025-66116](https://cve.now/CVE-2025-66116.md): WordPress Ultimate Member Widgets for Elementor plugin \<= 2.3 - Sensitive Data Exposure vulnerability (CVSS 7.5, UserElements Ultimate Member Widgets for Elementor) - [CVE-2025-66104](https://cve.now/CVE-2025-66104.md): WordPress Offload, AI & Optimize with Cloudflare Images plugin \<= 1.9.5 - Broken Access Control vulnerability (CVSS 6.5, Anton Vanyukov Offload, AI & Optimize with Cloudflare Images) - [CVE-2025-66102](https://cve.now/CVE-2025-66102.md): WordPress FV Antispam plugin \<= 2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FolioVision FV Antispam) - [CVE-2025-66100](https://cve.now/CVE-2025-66100.md): WordPress RestroPress plugin \<= 3.2.3.5 - Broken Access Control vulnerability (CVSS 6.5, Magnigenie RestroPress) - [CVE-2025-66088](https://cve.now/CVE-2025-66088.md): WordPress PropertyHive plugin \<= 2.1.12 - Broken Access Control vulnerability (CVSS 7.5, Property Hive PropertyHive) - [CVE-2025-66078](https://cve.now/CVE-2025-66078.md): WordPress Hotel Booking Lite plugin \<= 5.2.3 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, jetmonsters Hotel Booking Lite) - [CVE-2025-66074](https://cve.now/CVE-2025-66074.md): WordPress WP Webhooks plugin \<= 3.3.8 - Arbitrary File Upload vulnerability (CVSS 9.0, Cozmoslabs WP Webhooks) - [CVE-2025-66070](https://cve.now/CVE-2025-66070.md): WordPress wpForo Forum plugin \<= 2.4.10 - Broken Access Control vulnerability (CVSS 7.5, Tomdever wpForo Forum) - [CVE-2025-66068](https://cve.now/CVE-2025-66068.md): WordPress InstaWP Connect plugin \<= 0.1.1.9 - Broken Access Control vulnerability (CVSS 6.5, InstaWP Connect) - [CVE-2025-66054](https://cve.now/CVE-2025-66054.md): WordPress LearnPress plugin \<= 4.2.9.4 - Broken Access Control vulnerability (CVSS 7.5, ThimPress LearnPress) - [CVE-2025-64378](https://cve.now/CVE-2025-64378.md): WordPress ListingPro theme \< 2.9.10 - Broken Access Control vulnerability (CVSS 7.1, CridioStudio ListingPro) - [CVE-2025-64377](https://cve.now/CVE-2025-64377.md): WordPress ListingPro theme \< 2.9.10 - Local File Inclusion vulnerability (CVSS 8.1, CridioStudio ListingPro) - [CVE-2025-64376](https://cve.now/CVE-2025-64376.md): WordPress ListingPro theme \< 2.9.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CridioStudio ListingPro) - [CVE-2025-64375](https://cve.now/CVE-2025-64375.md): WordPress WP Social Ninja plugin \<= 3.20.1 - Broken Access Control vulnerability (CVSS 6.5, Mahmudul Hasan Arif WP Social Ninja) - [CVE-2025-64374](https://cve.now/CVE-2025-64374.md): WordPress Motors theme \<= 5.6.81 - Arbitrary File Upload vulnerability (CVSS 9.9, StylemixThemes Motors) - [CVE-2025-64373](https://cve.now/CVE-2025-64373.md): WordPress Traveler theme \< 3.2.6 - Local File Inclusion vulnerability (CVSS 8.1, shinetheme Traveler) - [CVE-2025-64372](https://cve.now/CVE-2025-64372.md): WordPress Traveler theme \< 3.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shinetheme Traveler) - [CVE-2025-64371](https://cve.now/CVE-2025-64371.md): WordPress Traveler theme \< 3.2.6 - SQL Injection vulnerability (CVSS 8.5, shinetheme Traveler) - [CVE-2025-64295](https://cve.now/CVE-2025-64295.md): WordPress All In One SEO Pack plugin \<= 4.8.6.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, Syed Balkhi All In One SEO Pack) - [CVE-2025-64273](https://cve.now/CVE-2025-64273.md): WordPress Email marketing for WordPress by GetResponse Official plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 6.5, Email marketing for WordPress by GetResponse Official) - [CVE-2025-64272](https://cve.now/CVE-2025-64272.md): WordPress Email marketing for WordPress by GetResponse Official plugin \<= 1.5.3 - Sensitive Data Exposure vulnerability (CVSS 6.5, Email marketing for WordPress by GetResponse Official) - [CVE-2025-64270](https://cve.now/CVE-2025-64270.md): WordPress Masteriyo - LMS plugin \<= 2.0.3 - Sensitive Data Exposure vulnerability (CVSS 6.5, Masteriyo - LMS) - [CVE-2025-64268](https://cve.now/CVE-2025-64268.md): WordPress Timetics plugin \<= 1.0.44 - Broken Access Control vulnerability (CVSS 7.5, Arraytics Timetics) - [CVE-2025-64266](https://cve.now/CVE-2025-64266.md): WordPress Booking and Rental Manager plugin \<= 2.5.4 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam Booking and Rental Manager) - [CVE-2025-64260](https://cve.now/CVE-2025-64260.md): WordPress ANAC XML Bandi di Gara plugin \<= 7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marco Milesi ANAC XML Bandi di Gara) - [CVE-2025-64258](https://cve.now/CVE-2025-64258.md): WordPress Follow My Blog Post plugin \<= 2.3.9 - Sensitive Data Exposure vulnerability (CVSS 7.5, wpweb Follow My Blog Post) - [CVE-2025-64233](https://cve.now/CVE-2025-64233.md): WordPress Codiqa theme \< 1.2.8 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Codiqa) - [CVE-2025-64231](https://cve.now/CVE-2025-64231.md): WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin \<= 3.0.0 - Arbitrary File Upload vulnerability (CVSS 9.9, RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet…) - [CVE-2025-64230](https://cve.now/CVE-2025-64230.md): WordPress Filr plugin \<= 1.2.10 - Arbitrary File Deletion vulnerability (CVSS 7.7, WP Chill Filr) - [CVE-2025-64227](https://cve.now/CVE-2025-64227.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.7 - PHP Object Injection vulnerability (CVSS 9.8, BoldGrid Client Invoicing by Sprout Invoices) - [CVE-2025-64225](https://cve.now/CVE-2025-64225.md): WordPress Stockie Extra plugin \<= 1.2.11 - Content Injection vulnerability (CVSS 6.5, colabrio Stockie Extra) - [CVE-2025-64223](https://cve.now/CVE-2025-64223.md): WordPress PenNews theme \< 6.7.3 - Local File Inclusion vulnerability (CVSS 8.1, PenciDesign PenNews) - [CVE-2025-64222](https://cve.now/CVE-2025-64222.md): WordPress WooCommerce Recover Abandoned Cart plugin \<= 24.6.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5, FantasticPlugins WooCommerce Recover Abandoned Cart) - [CVE-2025-64221](https://cve.now/CVE-2025-64221.md): WordPress Reservation Plugin plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, designthemes Reservation Plugin) - [CVE-2025-64218](https://cve.now/CVE-2025-64218.md): WordPress Passster plugin \<= 4.2.19 - Sensitive Data Exposure vulnerability (CVSS 7.5, WP Chill Passster) - [CVE-2025-64217](https://cve.now/CVE-2025-64217.md): WordPress Photography theme \<= 7.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Photography) - [CVE-2025-64214](https://cve.now/CVE-2025-64214.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Arbitrary Content Deletion vulnerability (CVSS 7.5, StylemixThemes MasterStudy LMS Pro) - [CVE-2025-64213](https://cve.now/CVE-2025-64213.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Sensitive Data Exposure vulnerability (CVSS 7.5, StylemixThemes MasterStudy LMS Pro) - [CVE-2025-64209](https://cve.now/CVE-2025-64209.md): WordPress Masterstudy theme \< 4.8.122 - Broken Access Control vulnerability (CVSS 7.5, StylemixThemes Masterstudy) - [CVE-2025-64207](https://cve.now/CVE-2025-64207.md): WordPress Jannah theme \<= 7.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TieLabs Jannah) - [CVE-2025-64206](https://cve.now/CVE-2025-64206.md): WordPress Jannah theme \<= 7.6.0 - PHP Object Injection vulnerability (CVSS 9.8, TieLabs Jannah) - [CVE-2025-64205](https://cve.now/CVE-2025-64205.md): WordPress Jannah theme \<= 7.6.0 - Local File Inclusion vulnerability (CVSS 8.1, TieLabs Jannah) - [CVE-2025-64203](https://cve.now/CVE-2025-64203.md): WordPress Mailster plugin \< 4.1.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EverPress Mailster) - [CVE-2025-64193](https://cve.now/CVE-2025-64193.md): WordPress XStore theme \< 9.6.1 - Local File Inclusion vulnerability (CVSS 7.5, 8theme XStore) - [CVE-2025-64192](https://cve.now/CVE-2025-64192.md): WordPress XStore theme \< 9.6 - Broken Access Control vulnerability (CVSS 6.3, 8theme XStore) - [CVE-2025-64191](https://cve.now/CVE-2025-64191.md): WordPress XStore theme \< 9.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 8theme XStore) - [CVE-2025-64189](https://cve.now/CVE-2025-64189.md): WordPress XStore Core plugin \< 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 8theme XStore Core) - [CVE-2025-64188](https://cve.now/CVE-2025-64188.md): WordPress Soledad theme \<= 8.6.9 - Privilege Escalation vulnerability (CVSS 9.8, PenciDesign Soledad) - [CVE-2025-6326](https://cve.now/CVE-2025-6326.md): WordPress Inset theme \<= 1.18.0 - Local File Inclusion Vulnerability (CVSS 8.1, AncoraThemes Inset) - [CVE-2025-6324](https://cve.now/CVE-2025-6324.md): WordPress Easy Invoice plugin \<= 2.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MatrixAddons Easy Invoice) - [CVE-2025-63039](https://cve.now/CVE-2025-63039.md): WordPress ListingPro theme \<= 2.9.9 - Broken Access Control vulnerability (CVSS 6.5, CridioStudio ListingPro) - [CVE-2025-60182](https://cve.now/CVE-2025-60182.md): WordPress Support Board plugin \< 3.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Schiocco Support Board) - [CVE-2025-60180](https://cve.now/CVE-2025-60180.md): WordPress WP Gravity Forms Salesforce plugin \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms Salesforce) - [CVE-2025-60178](https://cve.now/CVE-2025-60178.md): WordPress WP Gravity Forms HubSpot plugin \<= 1.2.6 - Deserialization of untrusted data vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms HubSpot) - [CVE-2025-60174](https://cve.now/CVE-2025-60174.md): WordPress WP Gravity Forms Constant Contact plugin plugin \<= 1.1.2 - Deserialization of untrusted data vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms Constant Contact Plugin) - [CVE-2025-60091](https://cve.now/CVE-2025-60091.md): WordPress WP Gravity Forms Zoho CRM and Bigin plugin \<= 1.2.9 - Deserialization of untrusted data vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms Zoho CRM and Bigin) - [CVE-2025-60090](https://cve.now/CVE-2025-60090.md): WordPress WP Gravity Forms Insightly plugin \<= 1.1.6 - Deserialization of untrusted data vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms Insightly) - [CVE-2025-60089](https://cve.now/CVE-2025-60089.md): WordPress WP Gravity Forms FreshDesk plugin plugin \<= 1.3.5 - Deserialization of untrusted data vulnerability (CVSS 9.8, CRM Perks WP Gravity Forms FreshDesk Plugin) - [CVE-2025-60088](https://cve.now/CVE-2025-60088.md): WordPress WebinarIgnition plugin \<= 4.06.04 - Broken Access Control vulnerability (CVSS 6.5, Saleswonder Team: Tobias WebinarIgnition) - [CVE-2025-60086](https://cve.now/CVE-2025-60086.md): WordPress WP Voting Contest plugin \<= 5.8 - Broken Access Control vulnerability (CVSS 7.5, Matt WP Voting Contest) - [CVE-2025-60084](https://cve.now/CVE-2025-60084.md): WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin \<= 6.5.0 - PHP Object Injection vulnerability (CVSS 8.8, add-ons.org PDF for Elementor Forms + Drag And Drop Templat…) - [CVE-2025-60083](https://cve.now/CVE-2025-60083.md): WordPress PDF Invoice Builder for WooCommerce plugin \<= 6.5.0 - Deserialization of untrusted data vulnerability (CVSS 8.8, add-ons.org PDF Invoice Builder for WooCommerce) - [CVE-2025-60082](https://cve.now/CVE-2025-60082.md): WordPress PDF for WPForms plugin \<= 6.5.0 - Deserialization of untrusted data vulnerability (CVSS 8.8, add-ons.org PDF for WPForms) - [CVE-2025-60081](https://cve.now/CVE-2025-60081.md): WordPress PDF for Contact Form 7 plugin \<= 6.5.0 - Deserialization of untrusted data vulnerability (CVSS 8.8, add-ons.org PDF for Contact Form) - [CVE-2025-60080](https://cve.now/CVE-2025-60080.md): WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin \<= 6.5.0 - PHP Object Injection vulnerability (CVSS 7.5, add-ons.org PDF for Gravity Forms + Drag And Drop Template…) - [CVE-2025-60079](https://cve.now/CVE-2025-60079.md): WordPress Parallax Section block plugin \<= 1.0.9 - Broken Authentication vulnerability (CVSS 7.1, bPlugins Parallax Section block) - [CVE-2025-60078](https://cve.now/CVE-2025-60078.md): WordPress Task Manager plugin \<= 3.0.2 - Local File Inclusion vulnerability (CVSS 7.5, Agence web Eoxia – Montpellier Task Manager) - [CVE-2025-60077](https://cve.now/CVE-2025-60077.md): WordPress YayPricing plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 7.5, YayCommerce YayPricing) - [CVE-2025-60076](https://cve.now/CVE-2025-60076.md): WordPress Ray Enterprise Translation plugin \<= 1.7.1 - Local File Inclusion vulnerability (CVSS 7.5, Jiro Sasamoto Ray Enterprise Translation) - [CVE-2025-60072](https://cve.now/CVE-2025-60072.md): WordPress Anchor smooth scroll plugin \<= 1.0.2 - Local File Inclusion vulnerability (CVSS 8.1, Processby Anchor smooth scroll) - [CVE-2025-60071](https://cve.now/CVE-2025-60071.md): WordPress Riode | Multi-Purpose WooCommerce theme \<= 1.6.23 - Local File Inclusion vulnerability (CVSS 8.1, don-themes Riode) - [CVE-2025-60070](https://cve.now/CVE-2025-60070.md): WordPress Molla - Multipurpose Responsive Shopify theme \<= 1.5.13 - Arbitrary Code Execution vulnerability (CVSS 6.5, The4 Molla) - [CVE-2025-60069](https://cve.now/CVE-2025-60069.md): WordPress MinimogWP theme \<= 3.9.6 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove MinimogWP) - [CVE-2025-60068](https://cve.now/CVE-2025-60068.md): WordPress Javo Core plugin \<= 3.0.0.266 - Arbitrary Code Execution vulnerability (CVSS 6.5, javothemes Javo Core) - [CVE-2025-60067](https://cve.now/CVE-2025-60067.md): WordPress Giardino theme \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Giardino) - [CVE-2025-60066](https://cve.now/CVE-2025-60066.md): WordPress Katelyn theme \<= 1.0.10 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Katelyn) - [CVE-2025-60065](https://cve.now/CVE-2025-60065.md): WordPress Pinevale theme \<= 1.0.14 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Pinevale) - [CVE-2025-60064](https://cve.now/CVE-2025-60064.md): WordPress Renewal theme \<= 1.2.2 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Renewal) - [CVE-2025-60063](https://cve.now/CVE-2025-60063.md): WordPress Rosalinda theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Rosalinda) - [CVE-2025-60062](https://cve.now/CVE-2025-60062.md): WordPress tPlayer plugin \<= 1.2.1.6 - SQL Injection vulnerability (CVSS 9.3, mmetrodw tPlayer) - [CVE-2025-60061](https://cve.now/CVE-2025-60061.md): WordPress Kicker theme \<= 2.2.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Kicker) - [CVE-2025-60060](https://cve.now/CVE-2025-60060.md): WordPress Pubzinne theme \<= 1.0.12 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Pubzinne) - [CVE-2025-60059](https://cve.now/CVE-2025-60059.md): WordPress smart SEO theme \<= 2.12 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes smart SEO) - [CVE-2025-60058](https://cve.now/CVE-2025-60058.md): WordPress DetailX theme \<= 1.10.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes DetailX) - [CVE-2025-60057](https://cve.now/CVE-2025-60057.md): WordPress DJ Rainflow theme \<= 1.3.13 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes DJ Rainflow) - [CVE-2025-60056](https://cve.now/CVE-2025-60056.md): WordPress Winger theme \<= 1.0.16 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Winger) - [CVE-2025-60055](https://cve.now/CVE-2025-60055.md): WordPress Fabrica theme \<= 1.8.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Fabrica) - [CVE-2025-60054](https://cve.now/CVE-2025-60054.md): WordPress OnLeash theme \<= 1.5.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes OnLeash) - [CVE-2025-60053](https://cve.now/CVE-2025-60053.md): WordPress MaxCube theme \<= 1.3.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes MaxCube) - [CVE-2025-60052](https://cve.now/CVE-2025-60052.md): WordPress W&D theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes W&D) - [CVE-2025-60051](https://cve.now/CVE-2025-60051.md): WordPress Rare Radio theme \<= 1.0.15.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Rare Radio) - [CVE-2025-60050](https://cve.now/CVE-2025-60050.md): WordPress Panda theme \<= 1.21 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Panda) - [CVE-2025-60049](https://cve.now/CVE-2025-60049.md): WordPress Soleil theme \<= 1.17 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Soleil) - [CVE-2025-60048](https://cve.now/CVE-2025-60048.md): WordPress Tripster theme \<= 1.0.10 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Tripster) - [CVE-2025-60047](https://cve.now/CVE-2025-60047.md): WordPress IPharm theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes IPharm) - [CVE-2025-60046](https://cve.now/CVE-2025-60046.md): WordPress HeartStar theme \<= 1.0.14 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes HeartStar) - [CVE-2025-60045](https://cve.now/CVE-2025-60045.md): WordPress IDonatePro plugin \<= 2.1.11 - Broken Access Control vulnerability (CVSS 7.5, ThemeAtelier IDonatePro) - [CVE-2025-60044](https://cve.now/CVE-2025-60044.md): WordPress Fribbo theme \<= 1.1.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Fribbo) - [CVE-2025-60043](https://cve.now/CVE-2025-60043.md): WordPress Wanderic theme \<= 1.0.10 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Wanderic) - [CVE-2025-60042](https://cve.now/CVE-2025-60042.md): WordPress Chinchilla theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Chinchilla) - [CVE-2025-59134](https://cve.now/CVE-2025-59134.md): WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme \<= 1.5.8 - Privilege Escalation vulnerability (CVSS 8.8, Jthemes Sale! Immigration law, Visa services support, Migra…) - [CVE-2025-58951](https://cve.now/CVE-2025-58951.md): WordPress Advance Seat Reservation Management for WooCommerce plugin \<= 3.1 - SQL Injection vulnerability (CVSS 9.3, smartcms Advance Seat Reservation Management for WooCommerce) - [CVE-2025-58950](https://cve.now/CVE-2025-58950.md): WordPress Lione theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Lione) - [CVE-2025-58949](https://cve.now/CVE-2025-58949.md): WordPress Spock theme \<= 1.17 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Spock) - [CVE-2025-58948](https://cve.now/CVE-2025-58948.md): WordPress Aromatica theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Aromatica) - [CVE-2025-58947](https://cve.now/CVE-2025-58947.md): WordPress Athos theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Athos) - [CVE-2025-58946](https://cve.now/CVE-2025-58946.md): WordPress Vocal theme \<= 1.12 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Vocal) - [CVE-2025-58945](https://cve.now/CVE-2025-58945.md): WordPress EcoGrow theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes EcoGrow) - [CVE-2025-58944](https://cve.now/CVE-2025-58944.md): WordPress Manufactory theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Manufactory) - [CVE-2025-58943](https://cve.now/CVE-2025-58943.md): WordPress Agricola theme \<= 1.1.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Agricola) - [CVE-2025-58942](https://cve.now/CVE-2025-58942.md): WordPress Dwell theme \<= 1.7.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Dwell) - [CVE-2025-58941](https://cve.now/CVE-2025-58941.md): WordPress Fabric theme \<= 1.5.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Fabric) - [CVE-2025-58940](https://cve.now/CVE-2025-58940.md): WordPress Basil theme \<= 1.3.12 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Basil) - [CVE-2025-58938](https://cve.now/CVE-2025-58938.md): WordPress IDonatePro plugin \<= 2.1.9 - Broken Access Control vulnerability (CVSS 7.5, ThemeAtelier IDonatePro) - [CVE-2025-58937](https://cve.now/CVE-2025-58937.md): WordPress Tacticool theme \<= 1.0.13 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Tacticool) - [CVE-2025-58936](https://cve.now/CVE-2025-58936.md): WordPress Catamaran theme \<= 1.15 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Catamaran) - [CVE-2025-58935](https://cve.now/CVE-2025-58935.md): WordPress Lunna theme \<= 1.15 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Lunna) - [CVE-2025-58934](https://cve.now/CVE-2025-58934.md): WordPress The Gig theme \<= 1.18.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes The Gig) - [CVE-2025-58933](https://cve.now/CVE-2025-58933.md): WordPress Anubis theme \<= 1.25 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Anubis) - [CVE-2025-58932](https://cve.now/CVE-2025-58932.md): WordPress Prisma theme \<= 1.10 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Prisma) - [CVE-2025-58931](https://cve.now/CVE-2025-58931.md): WordPress Palatio theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Palatio) - [CVE-2025-58930](https://cve.now/CVE-2025-58930.md): WordPress FitFlex theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes FitFlex) - [CVE-2025-58929](https://cve.now/CVE-2025-58929.md): WordPress Pantry theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Pantry) - [CVE-2025-58928](https://cve.now/CVE-2025-58928.md): WordPress Heart theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Heart) - [CVE-2025-58927](https://cve.now/CVE-2025-58927.md): WordPress Stallion theme \<= 1.17 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Stallion) - [CVE-2025-58926](https://cve.now/CVE-2025-58926.md): WordPress Cerebrum theme \<= 1.12 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Cerebrum) - [CVE-2025-58925](https://cve.now/CVE-2025-58925.md): WordPress Neptunus theme \<= 1.0.11 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Neptunus) - [CVE-2025-58923](https://cve.now/CVE-2025-58923.md): WordPress Critique theme \<= 1.17 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Critique) - [CVE-2025-58901](https://cve.now/CVE-2025-58901.md): WordPress Takeout theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Takeout) - [CVE-2025-58900](https://cve.now/CVE-2025-58900.md): WordPress UniTravel theme \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes UniTravel) - [CVE-2025-58899](https://cve.now/CVE-2025-58899.md): WordPress Frame theme \<= 2.4.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Frame) - [CVE-2025-58898](https://cve.now/CVE-2025-58898.md): WordPress HealthHub theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes HealthHub) - [CVE-2025-58896](https://cve.now/CVE-2025-58896.md): WordPress Otaku theme \<= 1.8.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Otaku) - [CVE-2025-58895](https://cve.now/CVE-2025-58895.md): WordPress Integro theme \<= 1.8.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Integro) - [CVE-2025-58894](https://cve.now/CVE-2025-58894.md): WordPress Good Mood theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Good Mood) - [CVE-2025-58893](https://cve.now/CVE-2025-58893.md): WordPress Alright theme \<= 1.6.1 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Alright) - [CVE-2025-58892](https://cve.now/CVE-2025-58892.md): WordPress Tourimo theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Tourimo) - [CVE-2025-58891](https://cve.now/CVE-2025-58891.md): WordPress Sanger theme \<= 1.24.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Sanger) - [CVE-2025-58890](https://cve.now/CVE-2025-58890.md): WordPress Playful theme \<= 1.19.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Playful) - [CVE-2025-58889](https://cve.now/CVE-2025-58889.md): WordPress Towny theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Towny) - [CVE-2025-58888](https://cve.now/CVE-2025-58888.md): WordPress The Flash theme \<= 1.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes The Flash) - [CVE-2025-58885](https://cve.now/CVE-2025-58885.md): WordPress Pathfinder theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Pathfinder) - [CVE-2025-58879](https://cve.now/CVE-2025-58879.md): WordPress Festy theme \<= 1.13.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Festy) - [CVE-2025-58877](https://cve.now/CVE-2025-58877.md): WordPress Javo Core plugin \<= 3.0.0.529 - Arbitrary Content Deletion vulnerability (CVSS 7.5, javothemes Javo Core) - [CVE-2025-58803](https://cve.now/CVE-2025-58803.md): WordPress Algenix theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Algenix) - [CVE-2025-58710](https://cve.now/CVE-2025-58710.md): WordPress Hotel Listing plugin \<= 1.4.0 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins Hotel Listing) - [CVE-2025-58709](https://cve.now/CVE-2025-58709.md): WordPress Legacy theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Legacy) - [CVE-2025-58708](https://cve.now/CVE-2025-58708.md): WordPress 777 theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes) - [CVE-2025-58706](https://cve.now/CVE-2025-58706.md): WordPress Woo Hoo theme \<= 1.25 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Woo Hoo) - [CVE-2025-58225](https://cve.now/CVE-2025-58225.md): WordPress Paragon theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Paragon) - [CVE-2025-57897](https://cve.now/CVE-2025-57897.md): WordPress Logtik theme \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, venusweb Logtik) - [CVE-2025-55707](https://cve.now/CVE-2025-55707.md): WordPress PostX Plugin \<= 4.1.35 - Privilege Escalation Vulnerability (CVSS 7.2, WPXPO PostX) - [CVE-2025-54751](https://cve.now/CVE-2025-54751.md): WordPress PostX plugin \<= 4.1.36 - Broken Access Control vulnerability (CVSS 7.1, WPXPO PostX) - [CVE-2025-54748](https://cve.now/CVE-2025-54748.md): WordPress MapSVG Plugin \< 8.6.12 - Arbitrary File Download Vulnerability (CVSS 6.5, RomanCode MapSVG) - [CVE-2025-54745](https://cve.now/CVE-2025-54745.md): WordPress miniOrange's Google Authenticator Plugin \<= 6.1.1 - Broken Access Control Vulnerability (CVSS 6.5, miniOrange's Google Authenticator) - [CVE-2025-54743](https://cve.now/CVE-2025-54743.md): WordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type Vulnerability (CVSS 5.8, mkscripts Download After Email) - [CVE-2025-54741](https://cve.now/CVE-2025-54741.md): WordPress Super Blank Plugin \<= 1.2.0 - Arbitrary Content Deletion Vulnerability (CVSS 6.5, Tyler Moore Super Blank) - [CVE-2025-54723](https://cve.now/CVE-2025-54723.md): WordPress DentiCare Theme \< 1.4.3 - PHP Object Injection Vulnerability (CVSS 9.8, BoldThemes DentiCare) - [CVE-2025-53453](https://cve.now/CVE-2025-53453.md): WordPress Hygia theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Hygia) - [CVE-2025-53449](https://cve.now/CVE-2025-53449.md): WordPress Convex theme \<= 1.11 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Convex) - [CVE-2025-53448](https://cve.now/CVE-2025-53448.md): WordPress Rally theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Rally) - [CVE-2025-53447](https://cve.now/CVE-2025-53447.md): WordPress Assembly theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Assembly) - [CVE-2025-53446](https://cve.now/CVE-2025-53446.md): WordPress Beautique theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Beautique) - [CVE-2025-53445](https://cve.now/CVE-2025-53445.md): WordPress Catwalk theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Catwalk) - [CVE-2025-53443](https://cve.now/CVE-2025-53443.md): WordPress Smash theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Smash) - [CVE-2025-53442](https://cve.now/CVE-2025-53442.md): WordPress Rentic theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Rentic) - [CVE-2025-53441](https://cve.now/CVE-2025-53441.md): WordPress Greeny theme \<= 2.6 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Greeny) - [CVE-2025-53439](https://cve.now/CVE-2025-53439.md): WordPress Harper theme \<= 1.13 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Harper) - [CVE-2025-53438](https://cve.now/CVE-2025-53438.md): WordPress FitLine theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes FitLine) - [CVE-2025-53437](https://cve.now/CVE-2025-53437.md): WordPress Greenorganic theme \<= 2.45 - Local File Inclusion vulnerability (CVSS 8.1, ApusTheme Greenorganic) - [CVE-2025-53436](https://cve.now/CVE-2025-53436.md): WordPress Monki theme \<= 2.0.5 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme Monki) - [CVE-2025-53435](https://cve.now/CVE-2025-53435.md): WordPress Plan My Day theme \<= 1.1.13 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Plan My Day) - [CVE-2025-53434](https://cve.now/CVE-2025-53434.md): WordPress ChildHope theme \<= 1.1.8 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes ChildHope) - [CVE-2025-53433](https://cve.now/CVE-2025-53433.md): WordPress EasyEat theme \<= 1.9.0 - Local File Inclusion vulnerability (CVSS 9.8, AncoraThemes EasyEat) - [CVE-2025-53432](https://cve.now/CVE-2025-53432.md): WordPress Echo theme \<= 1.15.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Echo) - [CVE-2025-53431](https://cve.now/CVE-2025-53431.md): WordPress Emberlyn theme \<= 1.3.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Emberlyn) - [CVE-2025-53430](https://cve.now/CVE-2025-53430.md): WordPress Etta theme \<= 1.14.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Etta) - [CVE-2025-53429](https://cve.now/CVE-2025-53429.md): WordPress Exit Game theme \<= 1.4.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Exit Game) - [CVE-2025-52768](https://cve.now/CVE-2025-52768.md): WordPress Faith & Hope theme \<= 2.13.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Faith & Hope) - [CVE-2025-52745](https://cve.now/CVE-2025-52745.md): WordPress Farm Agrico theme \<= 1.3.11 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Farm Agrico) - [CVE-2025-49943](https://cve.now/CVE-2025-49943.md): WordPress Femme theme \<= 1.3.11 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Femme) - [CVE-2025-49942](https://cve.now/CVE-2025-49942.md): WordPress Gardis theme \<= 1.2.13 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Gardis) - [CVE-2025-49941](https://cve.now/CVE-2025-49941.md): WordPress GlamChic theme \<= 1.0.11 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes GlamChic) - [CVE-2025-49919](https://cve.now/CVE-2025-49919.md): WordPress eRoom plugin \<= 1.5.6 - Sensitive Data Exposure vulnerability (CVSS 5.8, DigitalME eRoom) - [CVE-2025-49918](https://cve.now/CVE-2025-49918.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.2 - Sensitive Data Exposure vulnerability (CVSS 5.9, e4jvikwp VikBooking Hotel Booking Engine & PMS) - [CVE-2025-49914](https://cve.now/CVE-2025-49914.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.7 - Sensitive Data Exposure vulnerability (CVSS 6.5, jetmonsters Restaurant Menu by MotoPress) - [CVE-2025-49902](https://cve.now/CVE-2025-49902.md): WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 6.5, A WP Life Login Page Customizer – Customizer Login Page, Ad…) - [CVE-2025-49379](https://cve.now/CVE-2025-49379.md): WordPress Custom Fields Account Registration For Woocommerce plugin \<= 1.2 - Privilege Escalation vulnerability (CVSS 7.2, silverplugins217 Custom Fields Account Registration For Woo…) - [CVE-2025-49371](https://cve.now/CVE-2025-49371.md): WordPress Strux theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Strux) - [CVE-2025-49370](https://cve.now/CVE-2025-49370.md): WordPress Lymcoin theme \<= 1.3.12 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Lymcoin) - [CVE-2025-49369](https://cve.now/CVE-2025-49369.md): WordPress Lettuce theme \<= 1.1.7 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Lettuce) - [CVE-2025-49368](https://cve.now/CVE-2025-49368.md): WordPress Palladio theme \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Palladio) - [CVE-2025-49367](https://cve.now/CVE-2025-49367.md): WordPress Monyxi theme \<= 1.1.8 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Monyxi) - [CVE-2025-49366](https://cve.now/CVE-2025-49366.md): WordPress Hanani theme \<= 1.2.11 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Hanani) - [CVE-2025-49365](https://cve.now/CVE-2025-49365.md): WordPress Jack Well theme \<= 1.0.14 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Jack Well) - [CVE-2025-49364](https://cve.now/CVE-2025-49364.md): WordPress Ludos Paradise theme \<= 2.1.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Ludos Paradise) - [CVE-2025-49363](https://cve.now/CVE-2025-49363.md): WordPress Kings & Queens theme \<= 1.1.16 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Kings & Queens) - [CVE-2025-49362](https://cve.now/CVE-2025-49362.md): WordPress Gracioza theme \<= 1.0.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Gracioza) - [CVE-2025-49361](https://cve.now/CVE-2025-49361.md): WordPress Mamita theme \<= 1.0.9 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Mamita) - [CVE-2025-49360](https://cve.now/CVE-2025-49360.md): WordPress Militarology theme \<= 1.0.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Militarology) - [CVE-2025-49359](https://cve.now/CVE-2025-49359.md): WordPress ShieldGroup theme \<= 2.13 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes ShieldGroup) - [CVE-2025-49041](https://cve.now/CVE-2025-49041.md): WordPress Get Cash plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 6.5, The African Boss Get Cash) - [CVE-2025-14314](https://cve.now/CVE-2025-14314.md): WordPress PopupKit plugin \<= 2.1.5 - SQL Injection vulnerability (CVSS 8.5, Roxnor PopupKit) - [CVE-2025-10019](https://cve.now/CVE-2025-10019.md): WordPress Contact Form Email plugin \<= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, codepeople Contact Form Email) - [CVE-2025-13498](https://cve.now/CVE-2025-13498.md): Download Manager \<= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure (CVSS 4.3, codename065 Download Manager) - [CVE-2025-12976](https://cve.now/CVE-2025-12976.md): Events Manager \<= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events\_list\_grouped' Shortcode (CVSS 6.4, netweblogic Events Manager – Calendar, Bookings, Tickets, a…) - [CVE-2025-68459](https://cve.now/CVE-2025-68459.md): RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. (CVSS 7.2, Ruijie Networks Co. AP180-PE V3.xx · Ruijie Networks Co.… +7) - [CVE-2025-68463](https://cve.now/CVE-2025-68463.md): Bio.Entrez in Biopython through 186 allows doctype XXE. (CVSS 4.9, Biopython) - [CVE-2025-47387](https://cve.now/CVE-2025-47387.md): Untrusted Pointer Dereference in Camera (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47382](https://cve.now/CVE-2025-47382.md): Incorrect Authorization in Boot (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47372](https://cve.now/CVE-2025-47372.md): Buffer Copy Without Checking Size of Input in Boot (CVSS 9.0, Qualcomm Snapdragon) - [CVE-2025-47350](https://cve.now/CVE-2025-47350.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47325](https://cve.now/CVE-2025-47325.md): Untrusted Pointer Dereference in TZ Firmware (CVSS 6.5, Qualcomm Snapdragon) - [CVE-2025-47323](https://cve.now/CVE-2025-47323.md): Integer Overflow or Wraparound in Audio (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47322](https://cve.now/CVE-2025-47322.md): Use After Free in Automotive Linux OS (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47321](https://cve.now/CVE-2025-47321.md): Buffer Copy Without Checking Size of Input in Core Services (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47320](https://cve.now/CVE-2025-47320.md): Out-of-bounds Write in Audio (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-47319](https://cve.now/CVE-2025-47319.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS (CVSS 6.7, Qualcomm Snapdragon) - [CVE-2025-27063](https://cve.now/CVE-2025-27063.md): Use After Free in Video (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2025-68462](https://cve.now/CVE-2025-68462.md): Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. (CVSS 3.2, Debian FreedomBox) - [CVE-2025-68461](https://cve.now/CVE-2025-68461.md): Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d (CVSS 7.2, KEV, Roundcube Webmail) - [CVE-2025-68460](https://cve.now/CVE-2025-68460.md): Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. (CVSS 7.2, Roundcube Webmail) - [CVE-2025-12885](https://cve.now/CVE-2025-12885.md): Embed Any Document \<= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, awsmin Embed Any Document – Embed PDF, Word, PowerPoint and…) - [CVE-2025-14856](https://cve.now/CVE-2025-14856.md): y\_project RuoYi getnames code injection (CVSS 5.3, y\_project RuoYi) - [CVE-2025-14841](https://cve.now/CVE-2025-14841.md): OFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereference (CVSS 4.8, OFFIS DCMTK) - [CVE-2025-56157](https://cve.now/CVE-2025-56157.md): Default credentials in Dify thru 1.5.1. (CVSS 9.8) - [CVE-2025-63386](https://cve.now/CVE-2025-63386.md): A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. (CVSS 9.1) - [CVE-2025-63387](https://cve.now/CVE-2025-63387.md): Dify v1.9.1 is vulnerable to Insecure Permissions. (CVSS 7.5, dify-client) - [CVE-2025-63388](https://cve.now/CVE-2025-63388.md): A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. (CVSS 9.1) - [CVE-2025-63389](https://cve.now/CVE-2025-63389.md): A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. (CVSS 9.8, github.com/ollama/ollama) - [CVE-2025-63390](https://cve.now/CVE-2025-63390.md): An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. (CVSS 5.3) - [CVE-2025-63757](https://cve.now/CVE-2025-63757.md): Integer overflow vulnerability in the yuv2ya16\_X\_c\_template function in libswscale/output.c in FFmpeg 8.0. (CVSS 7.5) - [CVE-2025-63947](https://cve.now/CVE-2025-63947.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database\_mode.php file. (CVSS 5.4) - [CVE-2025-63948](https://cve.now/CVE-2025-63948.md): A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database\_mode.php file. (CVSS 5.4) - [CVE-2025-63949](https://cve.now/CVE-2025-63949.md): A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execut (CVSS 6.1) - [CVE-2025-63950](https://cve.now/CVE-2025-63950.md): An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b (CVSS 7.5) - [CVE-2025-63951](https://cve.now/CVE-2025-63951.md): An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0a (CVSS 7.5) - [CVE-2025-65559](https://cve.now/CVE-2025-65559.md): An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a (CVSS 7.5) - [CVE-2025-65561](https://cve.now/CVE-2025-65561.md): An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified imp (CVSS 7.5) - [CVE-2025-65562](https://cve.now/CVE-2025-65562.md): The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. (CVSS 7.5) - [CVE-2025-65563](https://cve.now/CVE-2025-65563.md): A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1. (CVSS 7.5) - [CVE-2025-65564](https://cve.now/CVE-2025-65564.md): A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. (CVSS 7.5) - [CVE-2025-65565](https://cve.now/CVE-2025-65565.md): A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. (CVSS 7.5) - [CVE-2025-65566](https://cve.now/CVE-2025-65566.md): A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. (CVSS 7.5) - [CVE-2025-65567](https://cve.now/CVE-2025-65567.md): A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. (CVSS 7.5) - [CVE-2025-65568](https://cve.now/CVE-2025-65568.md): A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. (CVSS 7.5) - [CVE-2025-67163](https://cve.now/CVE-2025-67163.md): A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML (CVSS 6.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-12-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.