# CVEs published 2025-12-24

494 CVEs were published on December 24, 2025: 20 critical, 139 high. Days are UTC.

- [CVE-2025-68922](https://cve.now/CVE-2025-68922.md): OpenOps before 0.6.11 allows remote code execution in the Terraform block. (CVSS 7.4, OpenOps)
- [CVE-2025-15073](https://cve.now/CVE-2025-15073.md): itsourcecode Online Frozen Foods Ordering System contact\_us.php sql injection (CVSS 6.9, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2025-68920](https://cve.now/CVE-2025-68920.md): C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local sy (CVSS 8.9, kermitproject C-Kermit)
- [CVE-2025-68919](https://cve.now/CVE-2025-68919.md): Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenanc (CVSS 5.6, Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express)
- [CVE-2025-68917](https://cve.now/CVE-2025-68917.md): ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. (CVSS 6.4, ONLYOFFICE Document Server)
- [CVE-2025-8769](https://cve.now/CVE-2025-8769.md): MegaSys Computer Technologies Telenium Online Web Application Improper Input Validation (CVSS 9.8, MegaSys Computer Technologies Telenium Online Web Applicati…)
- [CVE-2025-3232](https://cve.now/CVE-2025-3232.md): Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function (CVSS 7.5, Mitsubishi Electric Europe smartRTU)
- [CVE-2025-68916](https://cve.now/CVE-2025-68916.md): Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code ex (CVSS 9.1, Riello NetMan)
- [CVE-2025-68915](https://cve.now/CVE-2025-68915.md): Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner\_w.cgi XSS via a crafted banner. (CVSS 5.5, Riello NetMan)
- [CVE-2025-68914](https://cve.now/CVE-2025-68914.md): Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. (CVSS 6.5, Riello NetMan)
- [CVE-2019-25258](https://cve.now/CVE-2019-25258.md): LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities (CVSS 7.1, LogicalDOC Srl LogicalDOC Enterprise)
- [CVE-2019-25257](https://cve.now/CVE-2019-25257.md): LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation (CVSS 8.7, LogicalDOC Srl LogicalDOC Enterprise)
- [CVE-2019-25256](https://cve.now/CVE-2019-25256.md): VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal (CVSS 7.1, VideoFlow Digital Video Protection DVP)
- [CVE-2019-25255](https://cve.now/CVE-2019-25255.md): VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution (CVSS 8.7, VideoFlow Digital Video Protection DVP)
- [CVE-2019-25254](https://cve.now/CVE-2019-25254.md): KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration (CVSS 5.1, KYOCERA Net Admin)
- [CVE-2019-25253](https://cve.now/CVE-2019-25253.md): KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection (CVSS 7.1, KYOCERA Net Admin)
- [CVE-2019-25252](https://cve.now/CVE-2019-25252.md): Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change (CVSS 5.1, Teradek VidiU Pro)
- [CVE-2019-25251](https://cve.now/CVE-2019-25251.md): Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings (CVSS 6.9, Teradek VidiU Pro)
- [CVE-2019-25250](https://cve.now/CVE-2019-25250.md): Devolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery (CVSS 5.1, devolo AG dLAN 550 duo+ Starter Kit)
- [CVE-2019-25249](https://cve.now/CVE-2019-25249.md): devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr (CVSS 8.7, devolo AG dLAN 550 duo+ Starter Kit)
- [CVE-2019-25248](https://cve.now/CVE-2019-25248.md): Beward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure (CVSS 8.7, Beward N100 H.264 VGA IP Camera)
- [CVE-2019-25247](https://cve.now/CVE-2019-25247.md): Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability (CVSS 5.1, Beward R&D Co. N100 H.264 VGA IP Camera)
- [CVE-2019-25246](https://cve.now/CVE-2019-25246.md): Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure (CVSS 7.1, Beward R&D Co. N100 H.264 VGA IP Camera)
- [CVE-2019-25245](https://cve.now/CVE-2019-25245.md): Ross Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions (CVSS 8.5, Ross Video DashBoard)
- [CVE-2019-25244](https://cve.now/CVE-2019-25244.md): Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities (CVSS 5.1, BTicino S.p.A. Legrand BTicino Driver Manager F454)
- [CVE-2019-25243](https://cve.now/CVE-2019-25243.md): FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test (CVSS 8.7, iWT FaceSentry Access Control System)
- [CVE-2019-25242](https://cve.now/CVE-2019-25242.md): FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface (CVSS 5.1, iWT FaceSentry Access Control System)
- [CVE-2019-25241](https://cve.now/CVE-2019-25241.md): FaceSentry Access Control System 6.4.8 Remote SSH Root Access (CVSS 9.8, iWT FaceSentry Access Control System)
- [CVE-2019-25240](https://cve.now/CVE-2019-25240.md): Rifatron 5brid DVR 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504) Unauthenticated Live Stream Disclosure via animate.cgi (CVSS 8.7, Rifatron Co. DVR)
- [CVE-2019-25239](https://cve.now/CVE-2019-25239.md): V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download (CVSS 8.7, Guangzhou V-SOLUTION Electronic Technology GPON/EPON OLT Pl…)
- [CVE-2019-25238](https://cve.now/CVE-2019-25238.md): V-SOL GPON/EPON OLT Platform 2.03 Cross-Site Request Forgery Vulnerability (CVSS 5.1, Guangzhou V-SOLUTION Electronic Technology Co. SOL GPON/EPO…)
- [CVE-2019-25237](https://cve.now/CVE-2019-25237.md): V-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter (CVSS 8.7, Guangzhou V-SOLUTION Electronic Technology Co. SOL GPON/EPO…)
- [CVE-2019-25236](https://cve.now/CVE-2019-25236.md): iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure (CVSS 8.7, iSeeQ Hybrid DVR WH-H4)
- [CVE-2019-25235](https://cve.now/CVE-2019-25235.md): Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages (CVSS 8.8, Smartwares HOME easy)
- [CVE-2019-25234](https://cve.now/CVE-2019-25234.md): Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS (CVSS 5.1, Carlo Gavazzi AB SmartHouse Webapp)
- [CVE-2019-25233](https://cve.now/CVE-2019-25233.md): AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities (CVSS 5.1, AVE S.p.A. DOMINAplus)
- [CVE-2018-25156](https://cve.now/CVE-2018-25156.md): Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change (CVSS 5.1, Teradek Cube)
- [CVE-2018-25155](https://cve.now/CVE-2018-25155.md): Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change (CVSS 5.1, Teradek Slice)
- [CVE-2018-25154](https://cve.now/CVE-2018-25154.md): GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism (CVSS 8.5, The GNU Project | Free Software Foundation GNU Barcode)
- [CVE-2018-25152](https://cve.now/CVE-2018-25152.md): Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration (CVSS 5.1, Ecessa Edge EV150)
- [CVE-2018-25151](https://cve.now/CVE-2018-25151.md): Ecessa WANWorx WVR-30 \< 10.7.4 Cross-Site Request Forgery via User Configuration (CVSS 5.1, Ecessa WANWorx WVR-30)
- [CVE-2018-25150](https://cve.now/CVE-2018-25150.md): Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration (CVSS 5.1, Ecessa ShieldLink SL175EHQ)
- [CVE-2018-25149](https://cve.now/CVE-2018-25149.md): Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface (CVSS 5.1, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25148](https://cve.now/CVE-2018-25148.md): Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface (CVSS 8.7, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25147](https://cve.now/CVE-2018-25147.md): Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass (CVSS 9.3, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25146](https://cve.now/CVE-2018-25146.md): Microhard Systems IPn4G 1.1.0 Service Control Denial of Service (CVSS 7.1, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25145](https://cve.now/CVE-2018-25145.md): Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download (CVSS 7.1, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25144](https://cve.now/CVE-2018-25144.md): Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor (CVSS 8.7, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25143](https://cve.now/CVE-2018-25143.md): Microhard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service (CVSS 8.7, Microhard Systems 3G/4G Cellular Ethernet and Serial Gatewa…)
- [CVE-2018-25142](https://cve.now/CVE-2018-25142.md): NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection (CVSS 7.1, NovaRad NovaPACS Diagnostics Viewer)
- [CVE-2018-25141](https://cve.now/CVE-2018-25141.md): FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure (CVSS 8.7, FLIR Thermal Traffic Cameras)
- [CVE-2018-25140](https://cve.now/CVE-2018-25140.md): FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation (CVSS 9.3, FLIR Systems Thermal Traffic Cameras)
- [CVE-2018-25139](https://cve.now/CVE-2018-25139.md): FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure (CVSS 8.7, FLIR Systems FLIR AX8 Thermal Camera)
- [CVE-2018-25138](https://cve.now/CVE-2018-25138.md): FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass (CVSS 9.3, FLIR Systems FLIR AX8 Thermal Camera)
- [CVE-2018-25137](https://cve.now/CVE-2018-25137.md): FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure (CVSS 8.7, FLIR Systems FLIR Brickstream 3D+)
- [CVE-2018-25136](https://cve.now/CVE-2018-25136.md): FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure (CVSS 8.7, FLIR Systems Brickstream 3D+)
- [CVE-2018-25135](https://cve.now/CVE-2018-25135.md): Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import (CVSS 9.3, Anviz Biometric Technology Co. Anviz AIM CrossChex Standard)
- [CVE-2018-25134](https://cve.now/CVE-2018-25134.md): Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi (CVSS 9.3, Synaccess Networks netBooter NP-02x/NP-08x)
- [CVE-2018-25133](https://cve.now/CVE-2018-25133.md): Synaccess netBooter NP-0801DU 7.4 Cross-Site Request Forgery via Admin Interface (CVSS 5.1, Synaccess Networks netBooter NP-0801DU)
- [CVE-2018-25131](https://cve.now/CVE-2018-25131.md): Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Stored XSS via Config Upload (CVSS 5.1, Leica Geosystems AG GR10/GR25/GR30/GR50 GNSS)
- [CVE-2018-25130](https://cve.now/CVE-2018-25130.md): Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database (CVSS 6.8, Beward R&D Co. BEWARD Intercom)
- [CVE-2018-25129](https://cve.now/CVE-2018-25129.md): SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints (CVSS 7.1, SOCA Technology Co. SOCA Access Control System)
- [CVE-2018-25128](https://cve.now/CVE-2018-25128.md): SOCA Access Control System 180612 SQL Injection and Authentication Bypass (CVSS 9.3, SOCA Technology Co. SOCA Access Control System)
- [CVE-2018-25127](https://cve.now/CVE-2018-25127.md): SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface (CVSS 5.1, SOCA Technology Co. SOCA Access Control System)
- [CVE-2025-36154](https://cve.now/CVE-2025-36154.md): IBM Concert Software Cleartext Storage in a File or on Disk. (CVSS 6.2, IBM Concert)
- [CVE-2025-2515](https://cve.now/CVE-2025-2515.md): Bluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies (CVSS 7.2, Eclipse Foundation BlueChi)
- [CVE-2025-68750](https://cve.now/CVE-2025-68750.md): usb: potential integer overflow in usbg\_make\_tpg() (no CVSS, Linux)
- [CVE-2025-43876](https://cve.now/CVE-2025-43876.md): iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings (CVSS 8.7, Johnson Controls iSTAR Ultra, iSTAR Ultra SE · Johnson Cont…)
- [CVE-2025-43875](https://cve.now/CVE-2025-43875.md): iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo (CVSS 8.7, Johnson Controls iSTAR Ultra, iSTAR Ultra SE · Johnson Cont…)
- [CVE-2025-2155](https://cve.now/CVE-2025-2155.md): Arbitrary File Upload in EchoCCS's Specto CM (CVSS 8.8, Echo Call Center Services Trade and Industry Specto CM)
- [CVE-2025-2154](https://cve.now/CVE-2025-2154.md): Stored XSS in EchoCCS's Specto CM (CVSS 5.4, Echo Call Center Services Trade and Industry Specto CM)
- [CVE-2025-68606](https://cve.now/CVE-2025-68606.md): WordPress PostX plugin \<= 5.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, WPXPO PostX)
- [CVE-2025-68605](https://cve.now/CVE-2025-68605.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Post Grid and Gutenberg Blocks)
- [CVE-2025-68603](https://cve.now/CVE-2025-68603.md): WordPress Editorial Calendar plugin \<= 3.8.8 - Broken Access Control vulnerability (CVSS 5.4, Marketing Fire Editorial Calendar)
- [CVE-2025-68602](https://cve.now/CVE-2025-68602.md): WordPress Accept Donations with PayPal plugin \<= 1.5.2 - Open Redirection vulnerability (CVSS 4.7, Scott Paterson Accept Donations with PayPal & Stripe)
- [CVE-2025-68601](https://cve.now/CVE-2025-68601.md): WordPress Five Star Restaurant Reservations plugin \<= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Rustaurius Five Star Restaurant Reservations)
- [CVE-2025-68600](https://cve.now/CVE-2025-68600.md): WordPress Link Library plugin \<= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Yannick Lefebvre Link Library)
- [CVE-2025-68599](https://cve.now/CVE-2025-68599.md): WordPress YouTube Embed plugin \<= 5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Embeds For YouTube Plugin Support YouTube Embed)
- [CVE-2025-68598](https://cve.now/CVE-2025-68598.md): WordPress Page Builder: Live Composer plugin \<= 2.1.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Live Composer Team Page Builder: Live Composer)
- [CVE-2025-68597](https://cve.now/CVE-2025-68597.md): WordPress Jobs for WordPress plugin \<= 2.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BlueGlass Interactive AG Jobs for WordPress)
- [CVE-2025-68596](https://cve.now/CVE-2025-68596.md): WordPress Bit Assist plugin \<= 1.5.11 - Broken Access Control vulnerability (CVSS 5.3, Bit Apps Bit Assist)
- [CVE-2025-68595](https://cve.now/CVE-2025-68595.md): WordPress Widgets for Social Photo Feed plugin \<= 1.8 - Broken Access Control vulnerability (CVSS 5.3, Trustindex Widgets for Social Photo Feed)
- [CVE-2025-68594](https://cve.now/CVE-2025-68594.md): WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin \<= 19.12.0 - Broken Access Control vulnerability (CVSS 5.3, Poll, Survey & Quiz Maker Plugin by Opinion Stage)
- [CVE-2025-68593](https://cve.now/CVE-2025-68593.md): WordPress WP Adminify plugin \<= 4.0.6.1 - Broken Access Control vulnerability (CVSS 5.4, Liton Arefin WP Adminify)
- [CVE-2025-68592](https://cve.now/CVE-2025-68592.md): WordPress WP Adminify plugin \<= 4.0.6.1 - Broken Access Control vulnerability (CVSS 4.3, Liton Arefin WP Adminify)
- [CVE-2025-68591](https://cve.now/CVE-2025-68591.md): WordPress Simple File List plugin \<= 6.1.18 - Broken Access Control vulnerability (CVSS 5.4, Mitchell Bennis Simple File List)
- [CVE-2025-68590](https://cve.now/CVE-2025-68590.md): WordPress Integration for Contact Form 7 HubSpot plugin \<= 1.4.2 - SQL Injection vulnerability (CVSS 7.6, CRM Perks Integration for Contact Form 7 HubSpot)
- [CVE-2025-68589](https://cve.now/CVE-2025-68589.md): WordPress WP Telegram Widget and Join Link plugin \<= 2.2.12 - Broken Access Control vulnerability (CVSS 5.3, WP Socio WP Telegram Widget and Join Link)
- [CVE-2025-68588](https://cve.now/CVE-2025-68588.md): WordPress TS Poll plugin \<= 2.5.5 - Broken Access Control vulnerability (CVSS 4.3, totalsoft TS Poll)
- [CVE-2025-68587](https://cve.now/CVE-2025-68587.md): WordPress Watu Quiz plugin \<= 3.4.5 - Broken Access Control vulnerability (CVSS 4.3, Bob Watu Quiz)
- [CVE-2025-68586](https://cve.now/CVE-2025-68586.md): WordPress Cooked plugin \<= 1.11.3 - Broken Access Control vulnerability (CVSS 5.3, Gora Tech Cooked)
- [CVE-2025-68585](https://cve.now/CVE-2025-68585.md): WordPress WP Document Revisions plugin \<= 3.7.2 - Broken Access Control vulnerability (CVSS 2.7, Ben Balter WP Document Revisions)
- [CVE-2025-68584](https://cve.now/CVE-2025-68584.md): WordPress Vimeotheque plugin \<= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Constantin Boiangiu Vimeotheque)
- [CVE-2025-68583](https://cve.now/CVE-2025-68583.md): WordPress Fast User Switching plugin \<= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tikweb Management Fast User Switching)
- [CVE-2025-68582](https://cve.now/CVE-2025-68582.md): WordPress Funnelforms Free plugin \<= 3.8 - Broken Access Control vulnerability (CVSS 5.3, Funnelforms Free)
- [CVE-2025-68581](https://cve.now/CVE-2025-68581.md): WordPress YITH Slider for page builders plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 5.4, YITHEMES YITH Slider for page builders)
- [CVE-2025-68580](https://cve.now/CVE-2025-68580.md): WordPress Advanced Classifieds & Directory Pro plugin \<= 3.2.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, pluginsware Advanced Classifieds & Directory Pro)
- [CVE-2025-68579](https://cve.now/CVE-2025-68579.md): WordPress FV Simpler SEO plugin \<= 1.9.6 - Broken Access Control vulnerability (CVSS 5.3, FolioVision FV Simpler SEO)
- [CVE-2025-68578](https://cve.now/CVE-2025-68578.md): WordPress Addonify plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 5.3, Addonify)
- [CVE-2025-68577](https://cve.now/CVE-2025-68577.md): WordPress Virusdie plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 4.3, Virusdie)
- [CVE-2025-68576](https://cve.now/CVE-2025-68576.md): WordPress Virusdie plugin \<= 1.1.6 - Sensitive Data Exposure vulnerability (CVSS 4.3, Virusdie)
- [CVE-2025-68575](https://cve.now/CVE-2025-68575.md): WordPress Wappointment plugin \<= 2.7.6 - Broken Access Control vulnerability (CVSS 5.3, Wappointment team Wappointment)
- [CVE-2025-68574](https://cve.now/CVE-2025-68574.md): WordPress WPBakery Visual Composer WHMCS Elements plugin \<= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, voidcoders WPBakery Visual Composer WHMCS Elements)
- [CVE-2025-68573](https://cve.now/CVE-2025-68573.md): WordPress Simple Keyword to Link plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Alessandro Piconi Simple Keyword to Link)
- [CVE-2025-68572](https://cve.now/CVE-2025-68572.md): WordPress BBP Core plugin \<= 1.4.1 - Broken Access Control vulnerability (CVSS 5.3, Spider Themes BBP Core)
- [CVE-2025-68571](https://cve.now/CVE-2025-68571.md): WordPress SALESmanago plugin \<= 3.9.0 - Broken Access Control vulnerability (CVSS 5.3, SALESmanago & Leadoo)
- [CVE-2025-68570](https://cve.now/CVE-2025-68570.md): WordPress Captivate Sync plugin \<= 3.2.2 - SQL Injection vulnerability (CVSS 7.6, captivateaudio Captivate Sync)
- [CVE-2025-68569](https://cve.now/CVE-2025-68569.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.39 - Broken Access Control vulnerability (CVSS 6.5, codepeople WP Time Slots Booking Form)
- [CVE-2025-68568](https://cve.now/CVE-2025-68568.md): WordPress Claspo – Popups, Spin the Wheel & Email Capture plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3, Claspo Popup Builders Claspo – Popups, Spin the Wheel & Ema…)
- [CVE-2025-68567](https://cve.now/CVE-2025-68567.md): WordPress My auctions allegro plugin \<= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, wphocus My auctions allegro)
- [CVE-2025-68566](https://cve.now/CVE-2025-68566.md): WordPress My auctions allegro plugin \<= 3.6.35 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wphocus My auctions allegro)
- [CVE-2025-68565](https://cve.now/CVE-2025-68565.md): WordPress Twitch Player plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 5.3, JayBee Twitch Player)
- [CVE-2025-68506](https://cve.now/CVE-2025-68506.md): WordPress Docket Cache plugin \<= 24.07.03 - Local File Inclusion vulnerability (CVSS 8.1, Nawawi Jamili Docket Cache)
- [CVE-2025-68038](https://cve.now/CVE-2025-68038.md): WordPress Icegram Express Pro plugin \< 5.9.14 - PHP Object Injection vulnerability (CVSS 7.2, Icegram Express Pro)
- [CVE-2025-67909](https://cve.now/CVE-2025-67909.md): WordPress Membership For WooCommerce plugin \<= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, WP Swings Membership For WooCommerce)
- [CVE-2025-67633](https://cve.now/CVE-2025-67633.md): WordPress Greenhouse Job Board plugin \<= 2.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, brownbagmarketing Greenhouse Job Board)
- [CVE-2025-67632](https://cve.now/CVE-2025-67632.md): WordPress Google AdSense for Responsive Design – GARD plugin \<= 2.23 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, The Plugin Factory Google AdSense for Responsive Design – G…)
- [CVE-2025-67631](https://cve.now/CVE-2025-67631.md): WordPress Gift Hunt plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ecommerce Platforms Gift Hunt)
- [CVE-2025-67630](https://cve.now/CVE-2025-67630.md): WordPress WH Tweaks plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, webheadcoder WH Tweaks)
- [CVE-2025-67629](https://cve.now/CVE-2025-67629.md): WordPress Basticom Framework plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Basticom Framework)
- [CVE-2025-67628](https://cve.now/CVE-2025-67628.md): WordPress Review Disclaimer plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AMP-MODE Review Disclaimer)
- [CVE-2025-67627](https://cve.now/CVE-2025-67627.md): WordPress Draft Notify plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, TouchOfTech Draft Notify)
- [CVE-2025-67625](https://cve.now/CVE-2025-67625.md): WordPress Trade Runner plugin \<= 3.14 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, tmtraderunner Trade Runner)
- [CVE-2025-67623](https://cve.now/CVE-2025-67623.md): WordPress 6Storage Rentals plugin \<= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, 6Storage Rentals)
- [CVE-2025-67622](https://cve.now/CVE-2025-67622.md): WordPress Evergreen Post Tweeter plugin \<= 1.8.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, titopandub Evergreen Post Tweeter)
- [CVE-2025-67621](https://cve.now/CVE-2025-67621.md): WordPress Eight Day Week Print Workflow plugin \<= 1.2.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, 10up Eight Day Week Print Workflow)
- [CVE-2023-54160](https://cve.now/CVE-2023-54160.md): firmware: arm\_sdei: Fix sleep from invalid context BUG (no CVSS, Linux)
- [CVE-2023-54159](https://cve.now/CVE-2023-54159.md): usb: mtu3: fix kernel panic at qmu transfer done irq handler (no CVSS, Linux)
- [CVE-2023-54158](https://cve.now/CVE-2023-54158.md): btrfs: don't free qgroup space unless specified (no CVSS, Linux)
- [CVE-2023-54157](https://cve.now/CVE-2023-54157.md): binder: fix UAF of alloc-\>vma in race with munmap() (CVSS 7.8, Linux)
- [CVE-2023-54156](https://cve.now/CVE-2023-54156.md): sfc: fix crash when reading stats while NIC is resetting (CVSS 7.8, Linux)
- [CVE-2023-54155](https://cve.now/CVE-2023-54155.md): net: core: remove unnecessary frame\_sz check in bpf\_xdp\_adjust\_tail() (no CVSS, Linux)
- [CVE-2023-54154](https://cve.now/CVE-2023-54154.md): scsi: target: core: Fix target\_cmd\_counter leak (no CVSS, Linux)
- [CVE-2023-54153](https://cve.now/CVE-2023-54153.md): ext4: turn quotas off if mount failed after enabling quotas (CVSS 7.8, Linux)
- [CVE-2023-54152](https://cve.now/CVE-2023-54152.md): can: j1939: prevent deadlock by moving j1939\_sk\_errqueue() (no CVSS, Linux)
- [CVE-2023-54151](https://cve.now/CVE-2023-54151.md): f2fs: Fix system crash due to lack of free space in LFS (CVSS 7.8, Linux)
- [CVE-2023-54150](https://cve.now/CVE-2023-54150.md): drm/amd: Fix an out of bounds error in BIOS parser (no CVSS, Linux)
- [CVE-2023-54149](https://cve.now/CVE-2023-54149.md): net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses (CVSS 7.5, Linux)
- [CVE-2023-54148](https://cve.now/CVE-2023-54148.md): net/mlx5e: Move representor neigh cleanup to profile cleanup\_tx (no CVSS, Linux)
- [CVE-2023-54147](https://cve.now/CVE-2023-54147.md): media: platform: mtk-mdp3: Add missing check and free for ida\_alloc (no CVSS, Linux)
- [CVE-2023-54146](https://cve.now/CVE-2023-54146.md): x86/kexec: Fix double-free of elf header buffer (no CVSS, Linux)
- [CVE-2023-54145](https://cve.now/CVE-2023-54145.md): bpf: drop unnecessary user-triggerable WARN\_ONCE in verifierl log (no CVSS, Linux)
- [CVE-2023-54144](https://cve.now/CVE-2023-54144.md): drm/amdkfd: Fix kernel warning during topology setup (no CVSS, Linux)
- [CVE-2023-54143](https://cve.now/CVE-2023-54143.md): media: mediatek: vcodec: fix resource leaks in vdec\_msg\_queue\_init() (no CVSS, Linux)
- [CVE-2023-54142](https://cve.now/CVE-2023-54142.md): gtp: Fix use-after-free in \_\_gtp\_encap\_destroy(). (CVSS 7.8, Linux)
- [CVE-2023-54141](https://cve.now/CVE-2023-54141.md): wifi: ath11k: Add missing hw\_ops-\>get\_ring\_selector() for IPQ5018 (no CVSS, Linux)
- [CVE-2023-54140](https://cve.now/CVE-2023-54140.md): nilfs2: fix WARNING in mark\_buffer\_dirty due to discarded buffer reuse (CVSS 7.8, Linux)
- [CVE-2023-54139](https://cve.now/CVE-2023-54139.md): tracing/user\_events: Ensure write index cannot be negative (CVSS 7.8, Linux)
- [CVE-2023-54138](https://cve.now/CVE-2023-54138.md): drm/msm: fix NULL-deref on irq uninstall (no CVSS, Linux)
- [CVE-2023-54137](https://cve.now/CVE-2023-54137.md): vfio/type1: fix cap\_migration information leak (no CVSS, Linux)
- [CVE-2023-54136](https://cve.now/CVE-2023-54136.md): serial: sprd: Fix DMA buffer leak issue (no CVSS, Linux)
- [CVE-2023-54135](https://cve.now/CVE-2023-54135.md): maple\_tree: fix potential out-of-bounds access in mas\_wr\_end\_piv() (CVSS 7.8, Linux)
- [CVE-2023-54134](https://cve.now/CVE-2023-54134.md): autofs: fix memory leak of waitqueues in autofs\_catatonic\_mode (no CVSS, Linux)
- [CVE-2023-54133](https://cve.now/CVE-2023-54133.md): nfp: clean mc addresses in application firmware when closing port (no CVSS, Linux)
- [CVE-2023-54132](https://cve.now/CVE-2023-54132.md): erofs: stop parsing non-compact HEAD index if clusterofs is invalid (CVSS 7.8, Linux)
- [CVE-2023-54131](https://cve.now/CVE-2023-54131.md): wifi: rt2x00: Fix memory leak when handling surveys (no CVSS, Linux)
- [CVE-2023-54130](https://cve.now/CVE-2023-54130.md): hfs/hfsplus: avoid WARN\_ON() for sanity check, use proper error handling (CVSS 7.8, Linux)
- [CVE-2023-54129](https://cve.now/CVE-2023-54129.md): octeontx2-af: Add validation for lmac type (CVSS 7.1, Linux)
- [CVE-2023-54128](https://cve.now/CVE-2023-54128.md): fs: drop peer group ids under namespace lock (CVSS 7.8, Linux)
- [CVE-2023-54127](https://cve.now/CVE-2023-54127.md): fs/jfs: prevent double-free in dbUnmount() after failed jfs\_remount() (CVSS 7.8, Linux)
- [CVE-2023-54126](https://cve.now/CVE-2023-54126.md): crypto: safexcel - Cleanup ring IRQ workqueues on load failure (no CVSS, Linux)
- [CVE-2023-54125](https://cve.now/CVE-2023-54125.md): fs/ntfs3: Return error for inconsistent extended attributes (CVSS 7.8, Linux)
- [CVE-2023-54124](https://cve.now/CVE-2023-54124.md): f2fs: fix to drop all dirty pages during umount() if cp\_error is set (CVSS 7.8, Linux)
- [CVE-2023-54123](https://cve.now/CVE-2023-54123.md): md/raid10: fix memleak for 'conf-\>bio\_split' (no CVSS, Linux)
- [CVE-2023-54122](https://cve.now/CVE-2023-54122.md): drm/msm/dpu: Add check for cstate (no CVSS, Linux)
- [CVE-2023-54121](https://cve.now/CVE-2023-54121.md): btrfs: fix incorrect splitting in btrfs\_drop\_extent\_map\_range (CVSS 7.8, Linux)
- [CVE-2023-54120](https://cve.now/CVE-2023-54120.md): Bluetooth: Fix race condition in hidp\_session\_thread (CVSS 8.8, Linux)
- [CVE-2023-54119](https://cve.now/CVE-2023-54119.md): inotify: Avoid reporting event with invalid wd (no CVSS, Linux)
- [CVE-2023-54118](https://cve.now/CVE-2023-54118.md): serial: sc16is7xx: setup GPIO controller later in probe (no CVSS, Linux)
- [CVE-2023-54117](https://cve.now/CVE-2023-54117.md): s390/dcssblk: fix kernel crash with list\_add corruption (no CVSS, Linux)
- [CVE-2023-54116](https://cve.now/CVE-2023-54116.md): drm/fbdev-generic: prohibit potential out-of-bounds access (CVSS 7.8, Linux)
- [CVE-2023-54115](https://cve.now/CVE-2023-54115.md): pcmcia: rsrc\_nonstatic: Fix memory leak in nonstatic\_release\_resource\_db() (no CVSS, Linux)
- [CVE-2023-54114](https://cve.now/CVE-2023-54114.md): net: nsh: Use correct mac\_offset to unwind gso skb in nsh\_gso\_segment() (no CVSS, Linux)
- [CVE-2023-54113](https://cve.now/CVE-2023-54113.md): rcu: dump vmalloc memory info safely (no CVSS, Linux)
- [CVE-2023-54112](https://cve.now/CVE-2023-54112.md): kcm: Fix memory leak in error path of kcm\_sendmsg() (no CVSS, Linux)
- [CVE-2023-54111](https://cve.now/CVE-2023-54111.md): pinctrl: rockchip: Fix refcount leak in rockchip\_pinctrl\_parse\_groups (no CVSS, Linux)
- [CVE-2023-54110](https://cve.now/CVE-2023-54110.md): usb: rndis\_host: Secure rndis\_query check against int overflow (no CVSS, Linux)
- [CVE-2023-54109](https://cve.now/CVE-2023-54109.md): media: rcar\_fdp1: Fix refcount leak in probe and remove function (no CVSS, Linux)
- [CVE-2023-54108](https://cve.now/CVE-2023-54108.md): scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests (no CVSS, Linux)
- [CVE-2023-54107](https://cve.now/CVE-2023-54107.md): blk-cgroup: dropping parent refcount after pd\_free\_fn() is done (CVSS 7.8, Linux)
- [CVE-2023-54106](https://cve.now/CVE-2023-54106.md): net/mlx5: fix potential memory leak in mlx5e\_init\_rep\_rx (no CVSS, Linux)
- [CVE-2023-54105](https://cve.now/CVE-2023-54105.md): can: isotp: check CAN address family in isotp\_bind() (no CVSS, Linux)
- [CVE-2023-54104](https://cve.now/CVE-2023-54104.md): mtd: rawnand: fsl\_upm: Fix an off-by one test in fun\_exec\_op() (CVSS 7.8, Linux)
- [CVE-2023-54102](https://cve.now/CVE-2023-54102.md): scsi: lpfc: Prevent lpfc\_debugfs\_lockstat\_write() buffer overflow (no CVSS, Linux)
- [CVE-2023-54101](https://cve.now/CVE-2023-54101.md): driver: soc: xilinx: use \_safe loop iterator to avoid a use after free (no CVSS, Linux)
- [CVE-2023-54100](https://cve.now/CVE-2023-54100.md): scsi: qedi: Fix use after free bug in qedi\_remove() (CVSS 7.8, Linux)
- [CVE-2023-54099](https://cve.now/CVE-2023-54099.md): fs: Protect reconfiguration of sb read-write from racing writes (no CVSS, Linux)
- [CVE-2023-54098](https://cve.now/CVE-2023-54098.md): drm/i915/gvt: fix gvt debugfs destroy (CVSS 7.3, Linux)
- [CVE-2023-54097](https://cve.now/CVE-2023-54097.md): regulator: stm32-pwr: fix of\_iomap leak (no CVSS, Linux)
- [CVE-2023-54096](https://cve.now/CVE-2023-54096.md): soundwire: fix enumeration completion (CVSS 7.8, Linux)
- [CVE-2023-54095](https://cve.now/CVE-2023-54095.md): powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (CVSS 7.0, Linux)
- [CVE-2023-54094](https://cve.now/CVE-2023-54094.md): net: prevent skb corruption on frag list segmentation (CVSS 9.8, Linux)
- [CVE-2023-54093](https://cve.now/CVE-2023-54093.md): media: anysee: fix null-ptr-deref in anysee\_master\_xfer (no CVSS, Linux)
- [CVE-2023-54092](https://cve.now/CVE-2023-54092.md): KVM: s390: pv: fix index value of replaced ASCE (CVSS 8.8, Linux)
- [CVE-2023-54091](https://cve.now/CVE-2023-54091.md): drm/client: Fix memory leak in drm\_client\_target\_cloned (no CVSS, Linux)
- [CVE-2023-54090](https://cve.now/CVE-2023-54090.md): ixgbe: Fix panic during XDP\_TX with \> 64 CPUs (CVSS 9.8, Linux)
- [CVE-2023-54089](https://cve.now/CVE-2023-54089.md): virtio\_pmem: add the missing REQ\_OP\_WRITE for flush bio (no CVSS, Linux)
- [CVE-2023-54088](https://cve.now/CVE-2023-54088.md): blk-cgroup: hold queue\_lock when removing blkg-\>q\_node (CVSS 7.8, Linux)
- [CVE-2023-54087](https://cve.now/CVE-2023-54087.md): ubi: Fix possible null-ptr-deref in ubi\_free\_volume() (no CVSS, Linux)
- [CVE-2023-54086](https://cve.now/CVE-2023-54086.md): bpf: Add preempt\_count\_{sub,add} into btf id deny list (no CVSS, Linux)
- [CVE-2023-54085](https://cve.now/CVE-2023-54085.md): mptcp: fix NULL pointer dereference on fastopen early fallback (CVSS 7.5, Linux)
- [CVE-2023-54084](https://cve.now/CVE-2023-54084.md): ALSA: firewire-digi00x: prevent potential use after free (no CVSS, Linux)
- [CVE-2023-54083](https://cve.now/CVE-2023-54083.md): phy: tegra: xusb: Clear the driver reference in usb-phy dev (CVSS 7.8, Linux)
- [CVE-2023-54081](https://cve.now/CVE-2023-54081.md): xen: speed up grant-table reclaim (no CVSS, Linux)
- [CVE-2023-54080](https://cve.now/CVE-2023-54080.md): btrfs: zoned: skip splitting and logical rewriting on pre-alloc write (no CVSS, Linux)
- [CVE-2023-54079](https://cve.now/CVE-2023-54079.md): power: supply: bq27xxx: Fix poll\_interval handling and races on remove (CVSS 7.8, Linux)
- [CVE-2023-54078](https://cve.now/CVE-2023-54078.md): media: max9286: Free control handler (no CVSS, Linux)
- [CVE-2022-50783](https://cve.now/CVE-2022-50783.md): mptcp: use proper req destructor for IPv6 (no CVSS, Linux)
- [CVE-2022-50782](https://cve.now/CVE-2022-50782.md): ext4: fix bug\_on in \_\_es\_tree\_search caused by bad quota inode (no CVSS, Linux)
- [CVE-2022-50781](https://cve.now/CVE-2022-50781.md): amdgpu/pm: prevent array underflow in vega20\_odn\_edit\_dpm\_table() (no CVSS, Linux)
- [CVE-2022-50780](https://cve.now/CVE-2022-50780.md): net: fix UAF issue in nfqnl\_nf\_hook\_drop() when ops\_init() failed (CVSS 7.8, Linux)
- [CVE-2022-50779](https://cve.now/CVE-2022-50779.md): orangefs: Fix kmemleak in orangefs\_prepare\_debugfs\_help\_string() (no CVSS, Linux)
- [CVE-2022-50778](https://cve.now/CVE-2022-50778.md): fortify: Fix \_\_compiletime\_strlen() under UBSAN\_BOUNDS\_LOCAL (no CVSS, Linux)
- [CVE-2022-50777](https://cve.now/CVE-2022-50777.md): net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii\_probe (no CVSS, Linux)
- [CVE-2022-50776](https://cve.now/CVE-2022-50776.md): clk: st: Fix memory leak in st\_of\_quadfs\_setup() (no CVSS, Linux)
- [CVE-2022-50775](https://cve.now/CVE-2022-50775.md): RDMA/hns: Fix refcount leak in hns\_roce\_mmap (no CVSS, Linux)
- [CVE-2022-50774](https://cve.now/CVE-2022-50774.md): crypto: qat - fix DMA transfer direction (no CVSS, Linux)
- [CVE-2022-50773](https://cve.now/CVE-2022-50773.md): ALSA: mts64: fix possible null-ptr-defer in snd\_mts64\_interrupt (no CVSS, Linux)
- [CVE-2022-50772](https://cve.now/CVE-2022-50772.md): netdevsim: fix memory leak in nsim\_bus\_dev\_new() (no CVSS, Linux)
- [CVE-2022-50771](https://cve.now/CVE-2022-50771.md): rcu: Fix \_\_this\_cpu\_read() lockdep warning in rcu\_force\_quiescent\_state() (no CVSS, Linux)
- [CVE-2022-50770](https://cve.now/CVE-2022-50770.md): ocfs2: fix memory leak in ocfs2\_mount\_volume() (no CVSS, Linux)
- [CVE-2022-50769](https://cve.now/CVE-2022-50769.md): mmc: mxcmmc: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50768](https://cve.now/CVE-2022-50768.md): scsi: smartpqi: Correct device removal for multi-actuator devices (no CVSS, Linux)
- [CVE-2022-50767](https://cve.now/CVE-2022-50767.md): fbdev: smscufx: Fix several use-after-free bugs (no CVSS, Linux)
- [CVE-2022-50766](https://cve.now/CVE-2022-50766.md): btrfs: set generation before calling btrfs\_clean\_tree\_block in btrfs\_init\_new\_buffer (no CVSS, Linux)
- [CVE-2022-50765](https://cve.now/CVE-2022-50765.md): RISC-V: kexec: Fix memory leak of elf header buffer (no CVSS, Linux)
- [CVE-2022-50764](https://cve.now/CVE-2022-50764.md): ipv6/sit: use DEV\_STATS\_INC() to avoid data-races (no CVSS, Linux)
- [CVE-2022-50763](https://cve.now/CVE-2022-50763.md): crypto: marvell/octeontx - prevent integer overflows (no CVSS, Linux)
- [CVE-2022-50762](https://cve.now/CVE-2022-50762.md): fs/ntfs3: Avoid UBSAN error on true\_sectors\_per\_clst() (no CVSS, Linux)
- [CVE-2022-50761](https://cve.now/CVE-2022-50761.md): x86/xen: Fix memory leak in xen\_init\_lock\_cpu() (no CVSS, Linux)
- [CVE-2022-50760](https://cve.now/CVE-2022-50760.md): drm/amdgpu: Fix PCI device refcount leak in amdgpu\_atrm\_get\_bios() (no CVSS, Linux)
- [CVE-2022-50759](https://cve.now/CVE-2022-50759.md): media: i2c: ov5648: Free V4L2 fwnode data on unbind (no CVSS, Linux)
- [CVE-2022-50758](https://cve.now/CVE-2022-50758.md): staging: vt6655: fix potential memory leak (CVSS 7.8, Linux)
- [CVE-2022-50757](https://cve.now/CVE-2022-50757.md): media: camss: Clean up received buffers on failed start of streaming (CVSS 7.8, Linux)
- [CVE-2022-50756](https://cve.now/CVE-2022-50756.md): nvme-pci: fix mempool alloc size (CVSS 7.8, Linux)
- [CVE-2022-50755](https://cve.now/CVE-2022-50755.md): udf: Avoid double brelse() in udf\_rename() (CVSS 7.8, Linux)
- [CVE-2022-50754](https://cve.now/CVE-2022-50754.md): apparmor: fix a memleak in multi\_transaction\_new() (no CVSS, Linux)
- [CVE-2022-50753](https://cve.now/CVE-2022-50753.md): f2fs: fix to do sanity check on summary info (CVSS 7.8, Linux)
- [CVE-2022-50752](https://cve.now/CVE-2022-50752.md): md/raid5: Remove unnecessary bio\_put() in raid5\_read\_one\_chunk() (CVSS 7.8, Linux)
- [CVE-2022-50751](https://cve.now/CVE-2022-50751.md): configfs: fix possible memory leak in configfs\_create\_dir() (no CVSS, Linux)
- [CVE-2022-50750](https://cve.now/CVE-2022-50750.md): drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure (CVSS 7.8, Linux)
- [CVE-2022-50749](https://cve.now/CVE-2022-50749.md): acct: fix potential integer overflow in encode\_comp\_t() (no CVSS, Linux)
- [CVE-2022-50748](https://cve.now/CVE-2022-50748.md): ipc: mqueue: fix possible memory leak in init\_mqueue\_fs() (no CVSS, Linux)
- [CVE-2022-50747](https://cve.now/CVE-2022-50747.md): hfs: Fix OOB Write in hfs\_asc2mac (CVSS 7.8, Linux)
- [CVE-2022-50746](https://cve.now/CVE-2022-50746.md): erofs: validate the extent length for uncompressed pclusters (CVSS 8.4, Linux)
- [CVE-2022-50745](https://cve.now/CVE-2022-50745.md): staging: media: tegra-video: fix device\_node use after free (CVSS 7.8, Linux)
- [CVE-2022-50744](https://cve.now/CVE-2022-50744.md): scsi: lpfc: Fix hard lockup when reading the rx\_monitor from debugfs (no CVSS, Linux)
- [CVE-2022-50743](https://cve.now/CVE-2022-50743.md): erofs: Fix pcluster memleak when its block address is zero (no CVSS, Linux)
- [CVE-2022-50742](https://cve.now/CVE-2022-50742.md): misc: ocxl: fix possible refcount leak in afu\_ioctl() (no CVSS, Linux)
- [CVE-2022-50741](https://cve.now/CVE-2022-50741.md): media: imx-jpeg: Disable useless interrupt to avoid kernel panic (no CVSS, Linux)
- [CVE-2022-50740](https://cve.now/CVE-2022-50740.md): wifi: ath9k: hif\_usb: fix memory leak of urbs in ath9k\_hif\_usb\_dealloc\_tx\_urbs() (no CVSS, Linux)
- [CVE-2022-50739](https://cve.now/CVE-2022-50739.md): fs/ntfs3: Add null pointer check for inode operations (no CVSS, Linux)
- [CVE-2022-50738](https://cve.now/CVE-2022-50738.md): vhost-vdpa: fix an iotlb memory leak (no CVSS, Linux)
- [CVE-2022-50737](https://cve.now/CVE-2022-50737.md): fs/ntfs3: Validate index root when initialize NTFS security (CVSS 7.8, Linux)
- [CVE-2023-54077](https://cve.now/CVE-2023-54077.md): fs/ntfs3: Fix memory leak if ntfs\_read\_mft failed (CVSS 7.8, Linux)
- [CVE-2023-40679](https://cve.now/CVE-2023-40679.md): WordPress Master Elementor Addons plugin \<= 2.0.5.3 - Broken Access Control vulnerability (CVSS 6.5, Jewel Theme Master Addons for Elementor)
- [CVE-2023-36525](https://cve.now/CVE-2023-36525.md): WordPress WPJobBoard plugin \<= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability (CVSS 8.6, WPJobBoard)
- [CVE-2023-32120](https://cve.now/CVE-2023-32120.md): WordPress Hostel plugin \<= 1.1.5.1 - Cross Site Scripting (XSS) (CVSS 5.9, Bob Hostel)
- [CVE-2023-28619](https://cve.now/CVE-2023-28619.md): WordPress Resoto theme \<= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation (CVSS 4.3, bnayawpguy Resoto)
- [CVE-2025-68608](https://cve.now/CVE-2025-68608.md): WordPress Userpro plugin \<= 5.1.9 - Broken Access Control vulnerability (CVSS 7.5, DeluxeThemes Userpro)
- [CVE-2025-68563](https://cve.now/CVE-2025-68563.md): WordPress Subscribe to Unlock Lite plugin \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 7.5, WP Shuffle Subscribe to Unlock Lite)
- [CVE-2025-68540](https://cve.now/CVE-2025-68540.md): WordPress Fana theme \<= 1.1.35 - Local File Inclusion vulnerability (CVSS 7.5, thembay Fana)
- [CVE-2025-68537](https://cve.now/CVE-2025-68537.md): WordPress Zota theme \<= 1.3.14 - Local File Inclusion vulnerability (CVSS 7.5, thembay Zota)
- [CVE-2025-68535](https://cve.now/CVE-2025-68535.md): WordPress Sunshine Photo Cart plugin \<= 3.5.7.1 - Broken Access Control vulnerability (CVSS 4.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2025-68533](https://cve.now/CVE-2025-68533.md): WordPress WC Builder plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes WC Builder)
- [CVE-2025-68532](https://cve.now/CVE-2025-68532.md): WordPress ModelTheme Addons for WPBakery and Elementor plugin \< 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ModelTheme Addons for WPBakery and Elementor)
- [CVE-2025-68530](https://cve.now/CVE-2025-68530.md): WordPress Bookory theme \<= 2.2.7 - Local File Inclusion vulnerability (CVSS 7.5, pavothemes Bookory)
- [CVE-2025-68529](https://cve.now/CVE-2025-68529.md): WordPress WP Email Capture plugin \<= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rhys Wynne WP Email Capture)
- [CVE-2025-68528](https://cve.now/CVE-2025-68528.md): WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin \<= 2.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPFactory Free Shipping Bar: Amount Left for Free Shipping…)
- [CVE-2025-68527](https://cve.now/CVE-2025-68527.md): WordPress Academy LMS plugin \<= 3.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kodezen Academy LMS)
- [CVE-2025-68525](https://cve.now/CVE-2025-68525.md): WordPress Category Icon plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, pixelgrade Category Icon)
- [CVE-2025-68523](https://cve.now/CVE-2025-68523.md): WordPress Spiffy Calendar plugin \<= 5.0.7 - Broken Access Control vulnerability (CVSS 4.3, Spiffy Plugins Spiffy Calendar)
- [CVE-2025-68522](https://cve.now/CVE-2025-68522.md): WordPress WpStream plugin \<= 4.9.5 - Broken Access Control vulnerability (CVSS 4.3, WpStream)
- [CVE-2025-68521](https://cve.now/CVE-2025-68521.md): WordPress WpStream plugin \<= 4.9.5 - Broken Access Control vulnerability (CVSS 5.3, WpStream)
- [CVE-2025-68519](https://cve.now/CVE-2025-68519.md): WordPress Brands for WooCommerce plugin \<= 3.8.6.3 - SQL Injection vulnerability (CVSS 8.5, BeRocket Brands for WooCommerce)
- [CVE-2025-68517](https://cve.now/CVE-2025-68517.md): WordPress Tablesome plugin \<= 1.1.35.1 - Broken Access Control vulnerability (CVSS 5.4, Essekia Tablesome)
- [CVE-2025-68516](https://cve.now/CVE-2025-68516.md): WordPress Tablesome plugin \<= 1.1.35.1 - Sensitive Data Exposure vulnerability (CVSS 5.0, Essekia Tablesome)
- [CVE-2025-68513](https://cve.now/CVE-2025-68513.md): WordPress Bold Timeline Lite plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Timeline Lite)
- [CVE-2025-68512](https://cve.now/CVE-2025-68512.md): WordPress Real 3D FlipBook plugin \<= 4.11.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, creativeinteractivemedia Real 3D FlipBook)
- [CVE-2025-68511](https://cve.now/CVE-2025-68511.md): WordPress Gutenverse Form plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 6.5, Jegstudio Gutenverse Form)
- [CVE-2025-68509](https://cve.now/CVE-2025-68509.md): WordPress User Submitted Posts plugin \<= 20251121 - Open Redirection vulnerability (CVSS 4.7, Jeff Starr User Submitted Posts)
- [CVE-2025-68508](https://cve.now/CVE-2025-68508.md): WordPress Brave plugin \<= 0.8.3 - Broken Access Control vulnerability (CVSS 5.3, Brave)
- [CVE-2025-68505](https://cve.now/CVE-2025-68505.md): WordPress H5P plugin \<= 1.16.1 - Broken Access Control vulnerability (CVSS 5.3, icc0rz H5P)
- [CVE-2025-68500](https://cve.now/CVE-2025-68500.md): WordPress Prime Slider – Addons For Elementor plugin \<= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, bdthemes Prime Slider – Addons For Elementor)
- [CVE-2025-68497](https://cve.now/CVE-2025-68497.md): WordPress Astra Widgets plugin \<= 1.2.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Brainstorm Force Astra Widgets)
- [CVE-2025-68496](https://cve.now/CVE-2025-68496.md): WordPress User Feedback plugin \<= 1.10.0 - SQL Injection vulnerability (CVSS 7.6, Syed Balkhi User Feedback)
- [CVE-2025-68494](https://cve.now/CVE-2025-68494.md): WordPress Premium Addons for Elementor plugin \<= 4.11.53 - Sensitive Data Exposure vulnerability (CVSS 5.3, Leap13 Premium Addons for Elementor)
- [CVE-2023-54076](https://cve.now/CVE-2023-54076.md): smb: client: fix missed ses refcounting (CVSS 9.8, Linux)
- [CVE-2023-54075](https://cve.now/CVE-2023-54075.md): ASoC: mediatek: common: Fix refcount leak in parse\_dai\_link\_info (no CVSS, Linux)
- [CVE-2023-54074](https://cve.now/CVE-2023-54074.md): net/mlx5e: Use correct encap attribute during invalidation (CVSS 7.8, Linux)
- [CVE-2023-54073](https://cve.now/CVE-2023-54073.md): tpm: Add !tpm\_amd\_is\_rng\_defective() to the hwrng\_unregister() call site (no CVSS, Linux)
- [CVE-2023-54072](https://cve.now/CVE-2023-54072.md): ALSA: pcm: Fix potential data race at PCM memory allocation helpers (no CVSS, Linux)
- [CVE-2023-54071](https://cve.now/CVE-2023-54071.md): wifi: rtw88: use work to update rate to avoid RCU warning (CVSS 8.8, Linux)
- [CVE-2023-54070](https://cve.now/CVE-2023-54070.md): igb: clean up in all error paths when enabling SR-IOV (no CVSS, Linux)
- [CVE-2023-54069](https://cve.now/CVE-2023-54069.md): ext4: fix BUG in ext4\_mb\_new\_inode\_pa() due to overflow (no CVSS, Linux)
- [CVE-2023-54068](https://cve.now/CVE-2023-54068.md): f2fs: compress: fix to call f2fs\_wait\_on\_page\_writeback() in f2fs\_write\_raw\_pages() (CVSS 7.8, Linux)
- [CVE-2023-54067](https://cve.now/CVE-2023-54067.md): btrfs: fix race when deleting free space root from the dirty cow roots list (CVSS 7.8, Linux)
- [CVE-2023-54066](https://cve.now/CVE-2023-54066.md): media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861\_i2c\_master\_xfer (no CVSS, Linux)
- [CVE-2023-54065](https://cve.now/CVE-2023-54065.md): net: dsa: realtek: fix out-of-bounds access (CVSS 7.8, Linux)
- [CVE-2023-54064](https://cve.now/CVE-2023-54064.md): ipmi:ssif: Fix a memory leak when scanning for an adapter (no CVSS, Linux)
- [CVE-2023-54063](https://cve.now/CVE-2023-54063.md): fs/ntfs3: Fix OOB read in indx\_insert\_into\_buffer (CVSS 7.8, Linux)
- [CVE-2023-54062](https://cve.now/CVE-2023-54062.md): ext4: fix invalid free tracking in ext4\_xattr\_move\_to\_block() (CVSS 7.8, Linux)
- [CVE-2023-54060](https://cve.now/CVE-2023-54060.md): iommufd: Set end correctly when doing batch carry (CVSS 8.8, Linux)
- [CVE-2023-54059](https://cve.now/CVE-2023-54059.md): soc: mediatek: mtk-svs: Enable the IRQ later (no CVSS, Linux)
- [CVE-2023-54058](https://cve.now/CVE-2023-54058.md): firmware: arm\_ffa: Check if ffa\_driver remove is present before executing (no CVSS, Linux)
- [CVE-2023-54057](https://cve.now/CVE-2023-54057.md): iommu/amd: Add a length limitation for the ivrs\_acpihid command-line parameter (no CVSS, Linux)
- [CVE-2023-54056](https://cve.now/CVE-2023-54056.md): kheaders: Use array declaration instead of char (no CVSS, Linux)
- [CVE-2023-54055](https://cve.now/CVE-2023-54055.md): RDMA/irdma: Fix memory leak of PBLE objects (no CVSS, Linux)
- [CVE-2023-54053](https://cve.now/CVE-2023-54053.md): wifi: iwlwifi: pcie: fix possible NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-54052](https://cve.now/CVE-2023-54052.md): wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU (no CVSS, Linux)
- [CVE-2023-54051](https://cve.now/CVE-2023-54051.md): net: do not allow gso\_size to be set to GSO\_BY\_FRAGS (no CVSS, Linux)
- [CVE-2023-54050](https://cve.now/CVE-2023-54050.md): ubifs: Fix memleak when insert\_old\_idx() failed (CVSS 7.8, Linux)
- [CVE-2023-54049](https://cve.now/CVE-2023-54049.md): rpmsg: glink: Add check for kstrdup (no CVSS, Linux)
- [CVE-2023-54048](https://cve.now/CVE-2023-54048.md): RDMA/bnxt\_re: Prevent handling any completions after qp destroy (CVSS 7.8, Linux)
- [CVE-2023-54047](https://cve.now/CVE-2023-54047.md): drm/rockchip: dw\_hdmi: cleanup drm encoder during unbind (no CVSS, Linux)
- [CVE-2023-54046](https://cve.now/CVE-2023-54046.md): crypto: essiv - Handle EBUSY correctly (CVSS 7.8, Linux)
- [CVE-2023-54045](https://cve.now/CVE-2023-54045.md): audit: fix possible soft lockup in \_\_audit\_inode\_child() (no CVSS, Linux)
- [CVE-2023-54044](https://cve.now/CVE-2023-54044.md): spmi: Add a check for remove callback when removing a SPMI driver (no CVSS, Linux)
- [CVE-2023-54043](https://cve.now/CVE-2023-54043.md): iommufd: Do not add the same hwpt to the ioas-\>hwpt\_list twice (CVSS 8.8, Linux)
- [CVE-2022-50736](https://cve.now/CVE-2022-50736.md): RDMA/siw: Fix immediate work request flush to completion queue (CVSS 7.1, Linux)
- [CVE-2022-50735](https://cve.now/CVE-2022-50735.md): wifi: mt76: do not run mt76u\_status\_worker if the device is not running (no CVSS, Linux)
- [CVE-2022-50734](https://cve.now/CVE-2022-50734.md): nvmem: core: Fix memleak in nvmem\_register() (no CVSS, Linux)
- [CVE-2022-50733](https://cve.now/CVE-2022-50733.md): usb: idmouse: fix an uninit-value in idmouse\_open (no CVSS, Linux)
- [CVE-2022-50732](https://cve.now/CVE-2022-50732.md): staging: rtl8192u: Fix use after free in ieee80211\_rx() (CVSS 8.8, Linux)
- [CVE-2022-50731](https://cve.now/CVE-2022-50731.md): crypto: akcipher - default implementation for setting a private key (no CVSS, Linux)
- [CVE-2022-50730](https://cve.now/CVE-2022-50730.md): ext4: silence the warning when evicting inode with dioread\_nolock (no CVSS, Linux)
- [CVE-2022-50729](https://cve.now/CVE-2022-50729.md): ksmbd: Fix resource leak in ksmbd\_session\_rpc\_open() (no CVSS, Linux)
- [CVE-2022-50728](https://cve.now/CVE-2022-50728.md): s390/lcs: Fix return type of lcs\_start\_xmit() (no CVSS, Linux)
- [CVE-2022-50727](https://cve.now/CVE-2022-50727.md): scsi: efct: Fix possible memleak in efct\_device\_init() (no CVSS, Linux)
- [CVE-2022-50726](https://cve.now/CVE-2022-50726.md): net/mlx5: Fix possible use-after-free in async command interface (CVSS 7.8, Linux)
- [CVE-2022-50725](https://cve.now/CVE-2022-50725.md): media: vidtv: Fix use-after-free in vidtv\_bridge\_dvb\_init() (no CVSS, Linux)
- [CVE-2022-50724](https://cve.now/CVE-2022-50724.md): regulator: core: fix resource leak in regulator\_register() (no CVSS, Linux)
- [CVE-2022-50723](https://cve.now/CVE-2022-50723.md): bnxt\_en: fix memory leak in bnxt\_nvm\_test() (no CVSS, Linux)
- [CVE-2022-50722](https://cve.now/CVE-2022-50722.md): media: ipu3-imgu: Fix NULL pointer dereference in active selection access (no CVSS, Linux)
- [CVE-2022-50721](https://cve.now/CVE-2022-50721.md): dmaengine: qcom-adm: fix wrong calling convention for prep\_slave\_sg (no CVSS, Linux)
- [CVE-2022-50720](https://cve.now/CVE-2022-50720.md): x86/apic: Don't disable x2APIC if locked (no CVSS, Linux)
- [CVE-2022-50719](https://cve.now/CVE-2022-50719.md): ALSA: line6: fix stack overflow in line6\_midi\_transmit (CVSS 7.8, Linux)
- [CVE-2022-50718](https://cve.now/CVE-2022-50718.md): drm/amdgpu: fix pci device refcount leak (no CVSS, Linux)
- [CVE-2022-50717](https://cve.now/CVE-2022-50717.md): nvmet-tcp: add bounds check on Transfer Tag (CVSS 9.8, Linux)
- [CVE-2022-50716](https://cve.now/CVE-2022-50716.md): wifi: ar5523: Fix use-after-free on ar5523\_cmd() timed out (no CVSS, Linux)
- [CVE-2022-50715](https://cve.now/CVE-2022-50715.md): md/raid1: stop mdx\_raid1 thread when raid1 array run failed (no CVSS, Linux)
- [CVE-2022-50714](https://cve.now/CVE-2022-50714.md): wifi: mt76: mt7921e: fix rmmod crash in driver reload test (no CVSS, Linux)
- [CVE-2022-50713](https://cve.now/CVE-2022-50713.md): clk: visconti: Fix memory leak in visconti\_register\_pll() (no CVSS, Linux)
- [CVE-2022-50712](https://cve.now/CVE-2022-50712.md): devlink: hold region lock when flushing snapshots (no CVSS, Linux)
- [CVE-2025-68749](https://cve.now/CVE-2025-68749.md): accel/ivpu: Fix race condition when unbinding BOs (CVSS 7.8, Linux)
- [CVE-2025-68748](https://cve.now/CVE-2025-68748.md): drm/panthor: Fix UAF race between device unplug and FW event processing (CVSS 7.8, Linux)
- [CVE-2025-68747](https://cve.now/CVE-2025-68747.md): drm/panthor: Fix UAF on kernel BO VA nodes (CVSS 7.8, Linux)
- [CVE-2025-68746](https://cve.now/CVE-2025-68746.md): spi: tegra210-quad: Fix timeout handling (CVSS 7.8, Linux)
- [CVE-2025-68745](https://cve.now/CVE-2025-68745.md): scsi: qla2xxx: Clear cmds after chip reset (CVSS 9.8, Linux)
- [CVE-2025-68744](https://cve.now/CVE-2025-68744.md): bpf: Free special fields when update \[lru\_,\]percpu\_hash maps (no CVSS, Linux)
- [CVE-2025-68743](https://cve.now/CVE-2025-68743.md): mshv: Fix create memory region overlap check (no CVSS, Linux)
- [CVE-2025-68742](https://cve.now/CVE-2025-68742.md): bpf: Fix invalid prog-\>stats access when update\_effective\_progs fails (no CVSS, Linux)
- [CVE-2025-68741](https://cve.now/CVE-2025-68741.md): scsi: qla2xxx: Fix improper freeing of purex item (CVSS 9.8, Linux)
- [CVE-2025-68740](https://cve.now/CVE-2025-68740.md): ima: Handle error code returned by ima\_filter\_rule\_match() (no CVSS, Linux)
- [CVE-2025-68739](https://cve.now/CVE-2025-68739.md): PM / devfreq: hisi: Fix potential UAF in OPP handling (no CVSS, Linux)
- [CVE-2025-68738](https://cve.now/CVE-2025-68738.md): wifi: mt76: mt7996: fix null pointer deref in mt7996\_conf\_tx() (no CVSS, Linux)
- [CVE-2025-68737](https://cve.now/CVE-2025-68737.md): arm64/pageattr: Propagate return value from \_\_change\_memory\_common (no CVSS, Linux)
- [CVE-2025-68736](https://cve.now/CVE-2025-68736.md): landlock: Fix handling of disconnected directories (CVSS 8.8, Linux)
- [CVE-2025-68735](https://cve.now/CVE-2025-68735.md): drm/panthor: Prevent potential UAF in group creation (CVSS 7.8, Linux)
- [CVE-2025-68734](https://cve.now/CVE-2025-68734.md): isdn: mISDN: hfcsusb: fix memory leak in hfcsusb\_probe() (no CVSS, Linux)
- [CVE-2023-54042](https://cve.now/CVE-2023-54042.md): powerpc/64s: Fix VAS mm use after free (CVSS 7.8, Linux)
- [CVE-2023-54041](https://cve.now/CVE-2023-54041.md): io\_uring: fix memory leak when removing provided buffers (no CVSS, Linux)
- [CVE-2023-54040](https://cve.now/CVE-2023-54040.md): ice: fix wrong fallback logic for FDIR (CVSS 8.8, Linux)
- [CVE-2023-54039](https://cve.now/CVE-2023-54039.md): can: j1939: j1939\_tp\_tx\_dat\_new(): fix out-of-bounds memory access (no CVSS, Linux)
- [CVE-2023-54038](https://cve.now/CVE-2023-54038.md): Bluetooth: hci\_conn: return ERR\_PTR instead of NULL when there is no link (no CVSS, Linux)
- [CVE-2023-54037](https://cve.now/CVE-2023-54037.md): ice: prevent NULL pointer deref during reload (no CVSS, Linux)
- [CVE-2023-54036](https://cve.now/CVE-2023-54036.md): wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU (no CVSS, Linux)
- [CVE-2023-54035](https://cve.now/CVE-2023-54035.md): netfilter: nf\_tables: fix underflow in chain reference counter (CVSS 7.8, Linux)
- [CVE-2023-54034](https://cve.now/CVE-2023-54034.md): iommufd: Make sure to zero vfio\_iommu\_type1\_info before copying to user (no CVSS, Linux)
- [CVE-2023-54033](https://cve.now/CVE-2023-54033.md): bpf: fix a memory leak in the LRU and LRU\_PERCPU hash maps (no CVSS, Linux)
- [CVE-2023-54032](https://cve.now/CVE-2023-54032.md): btrfs: fix race when deleting quota root from the dirty cow roots list (no CVSS, Linux)
- [CVE-2023-54031](https://cve.now/CVE-2023-54031.md): vdpa: Add queue index attr to vdpa\_nl\_policy for nlattr length check (no CVSS, Linux)
- [CVE-2023-54030](https://cve.now/CVE-2023-54030.md): io\_uring/net: don't overflow multishot recv (no CVSS, Linux)
- [CVE-2023-54028](https://cve.now/CVE-2023-54028.md): RDMA/rxe: Fix the error "trying to register non-static key in rxe\_cleanup\_task" (no CVSS, Linux)
- [CVE-2023-54027](https://cve.now/CVE-2023-54027.md): iio: core: Prevent invalid memory access when there is no parent (no CVSS, Linux)
- [CVE-2023-54026](https://cve.now/CVE-2023-54026.md): opp: Fix use-after-free in lazy\_opp\_tables after probe deferral (CVSS 7.8, Linux)
- [CVE-2023-54025](https://cve.now/CVE-2023-54025.md): wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled (no CVSS, Linux)
- [CVE-2023-54024](https://cve.now/CVE-2023-54024.md): KVM: Destroy target device if coalesced MMIO unregistration fails (no CVSS, Linux)
- [CVE-2023-54023](https://cve.now/CVE-2023-54023.md): btrfs: fix race between balance and cancel/pause (no CVSS, Linux)
- [CVE-2023-54022](https://cve.now/CVE-2023-54022.md): ALSA: usb-audio: Fix potential memory leaks at error path for UMP open (no CVSS, Linux)
- [CVE-2023-54021](https://cve.now/CVE-2023-54021.md): ext4: set goal start correctly in ext4\_mb\_normalize\_request (no CVSS, Linux)
- [CVE-2023-54020](https://cve.now/CVE-2023-54020.md): dmaengine: sf-pdma: pdma\_desc memory leak fix (no CVSS, Linux)
- [CVE-2023-54019](https://cve.now/CVE-2023-54019.md): sched/psi: use kernfs polling functions for PSI trigger polling (CVSS 7.8, Linux)
- [CVE-2023-54018](https://cve.now/CVE-2023-54018.md): drm/msm/hdmi: Add missing check for alloc\_ordered\_workqueue (no CVSS, Linux)
- [CVE-2023-54017](https://cve.now/CVE-2023-54017.md): powerpc/pseries: fix possible memory leak in ibmebus\_bus\_init() (no CVSS, Linux)
- [CVE-2023-54016](https://cve.now/CVE-2023-54016.md): wifi: ath12k: Fix memory leak in rx\_desc and tx\_desc (no CVSS, Linux)
- [CVE-2023-54015](https://cve.now/CVE-2023-54015.md): net/mlx5: Devcom, fix error flow in mlx5\_devcom\_register\_device (no CVSS, Linux)
- [CVE-2023-54014](https://cve.now/CVE-2023-54014.md): scsi: qla2xxx: Check valid rport returned by fc\_bsg\_to\_rport() (no CVSS, Linux)
- [CVE-2023-54013](https://cve.now/CVE-2023-54013.md): interconnect: Fix locking for runpm vs reclaim (no CVSS, Linux)
- [CVE-2023-54012](https://cve.now/CVE-2023-54012.md): net: fix stack overflow when LRO is disabled for virtual interfaces (CVSS 7.8, Linux)
- [CVE-2023-54011](https://cve.now/CVE-2023-54011.md): scsi: mpi3mr: Fix an issue found by KASAN (no CVSS, Linux)
- [CVE-2023-54010](https://cve.now/CVE-2023-54010.md): ACPICA: ACPICA: check null return of ACPI\_ALLOCATE\_ZEROED in acpi\_db\_display\_objects (no CVSS, Linux)
- [CVE-2023-54009](https://cve.now/CVE-2023-54009.md): i2c: cadence: cdns\_i2c\_master\_xfer(): Fix runtime PM leak on error path (no CVSS, Linux)
- [CVE-2023-54008](https://cve.now/CVE-2023-54008.md): virtio\_vdpa: build affinity masks conditionally (no CVSS, Linux)
- [CVE-2023-54007](https://cve.now/CVE-2023-54007.md): vmci\_host: fix a race condition in vmci\_host\_poll() causing GPF (no CVSS, Linux)
- [CVE-2023-54006](https://cve.now/CVE-2023-54006.md): af\_unix: Fix data-race around unix\_tot\_inflight. (no CVSS, Linux)
- [CVE-2023-54005](https://cve.now/CVE-2023-54005.md): binder: fix memory leak in binder\_init() (no CVSS, Linux)
- [CVE-2023-54004](https://cve.now/CVE-2023-54004.md): udplite: Fix NULL pointer dereference in \_\_sk\_mem\_raise\_allocated(). (CVSS 7.5, Linux)
- [CVE-2023-54003](https://cve.now/CVE-2023-54003.md): RDMA/core: Fix GID entry ref leak when create\_ah fails (no CVSS, Linux)
- [CVE-2023-54002](https://cve.now/CVE-2023-54002.md): btrfs: fix assertion of exclop condition when starting balance (no CVSS, Linux)
- [CVE-2023-54001](https://cve.now/CVE-2023-54001.md): staging: r8712: Fix memory leak in \_r8712\_init\_xmit\_priv() (no CVSS, Linux)
- [CVE-2023-54000](https://cve.now/CVE-2023-54000.md): net: hns3: fix deadlock issue when externel\_lb and reset are executed together (no CVSS, Linux)
- [CVE-2023-53999](https://cve.now/CVE-2023-53999.md): net/mlx5e: TC, Fix internal port memory leak (no CVSS, Linux)
- [CVE-2023-53998](https://cve.now/CVE-2023-53998.md): hwrng: virtio - Fix race on data\_avail and actual data (no CVSS, Linux)
- [CVE-2023-53997](https://cve.now/CVE-2023-53997.md): thermal: of: fix double-free on unregistration (CVSS 7.8, Linux)
- [CVE-2023-53996](https://cve.now/CVE-2023-53996.md): x86/sev: Make enc\_dec\_hypercall() accept a size instead of npages (CVSS 9.3, Linux)
- [CVE-2023-53995](https://cve.now/CVE-2023-53995.md): net: ipv4: fix one memleak in \_\_inet\_del\_ifa() (no CVSS, Linux)
- [CVE-2023-53994](https://cve.now/CVE-2023-53994.md): ionic: remove WARN\_ON to prevent panic\_on\_warn (no CVSS, Linux)
- [CVE-2023-53993](https://cve.now/CVE-2023-53993.md): PCI/DOE: Fix memory leak with CONFIG\_DEBUG\_OBJECTS=y (no CVSS, Linux)
- [CVE-2023-53992](https://cve.now/CVE-2023-53992.md): wifi: cfg80211: ocb: don't leave if not joined (no CVSS, Linux)
- [CVE-2023-53991](https://cve.now/CVE-2023-53991.md): drm/msm/dpu: Disallow unallocated resources to be returned (no CVSS, Linux)
- [CVE-2023-53990](https://cve.now/CVE-2023-53990.md): SMB3: Add missing locks to protect deferred close file list (CVSS 7.8, Linux)
- [CVE-2023-53989](https://cve.now/CVE-2023-53989.md): arm64: mm: fix VA-range sanity check (no CVSS, Linux)
- [CVE-2023-53988](https://cve.now/CVE-2023-53988.md): fs/ntfs3: Fix slab-out-of-bounds read in hdr\_delete\_de() (CVSS 7.8, Linux)
- [CVE-2023-53987](https://cve.now/CVE-2023-53987.md): ping: Fix potentail NULL deref for /proc/net/icmp. (no CVSS, Linux)
- [CVE-2023-53986](https://cve.now/CVE-2023-53986.md): mips: bmips: BCM6358: disable RAC flush for TP1 (CVSS 8.6, Linux)
- [CVE-2023-53867](https://cve.now/CVE-2023-53867.md): ceph: fix potential use-after-free bug when trimming caps (CVSS 9.8, Linux)
- [CVE-2022-50711](https://cve.now/CVE-2022-50711.md): net: ethernet: mtk\_eth\_soc: fix possible memory leak in mtk\_probe() (no CVSS, Linux)
- [CVE-2022-50710](https://cve.now/CVE-2022-50710.md): ice: set tx\_tstamps when creating new Tx rings via ethtool (no CVSS, Linux)
- [CVE-2022-50709](https://cve.now/CVE-2022-50709.md): wifi: ath9k: avoid uninit memory read in ath9k\_htc\_rx\_msg() (no CVSS, Linux)
- [CVE-2022-50708](https://cve.now/CVE-2022-50708.md): HSI: ssi\_protocol: fix potential resource leak in ssip\_pn\_open() (no CVSS, Linux)
- [CVE-2022-50707](https://cve.now/CVE-2022-50707.md): virtio-crypto: fix memory leak in virtio\_crypto\_alg\_skcipher\_close\_session() (no CVSS, Linux)
- [CVE-2022-50706](https://cve.now/CVE-2022-50706.md): net/ieee802154: don't warn zero-sized raw\_sendmsg() (no CVSS, Linux)
- [CVE-2022-50705](https://cve.now/CVE-2022-50705.md): io\_uring/rw: defer fsnotify calls to task context (no CVSS, Linux)
- [CVE-2022-50704](https://cve.now/CVE-2022-50704.md): USB: gadget: Fix use-after-free during usb config switch (no CVSS, Linux)
- [CVE-2022-50703](https://cve.now/CVE-2022-50703.md): soc: qcom: smsm: Fix refcount leak bugs in qcom\_smsm\_probe() (no CVSS, Linux)
- [CVE-2022-50702](https://cve.now/CVE-2022-50702.md): vdpa\_sim: fix possible memory leak in vdpasim\_net\_init() and vdpasim\_blk\_init() (no CVSS, Linux)
- [CVE-2022-50701](https://cve.now/CVE-2022-50701.md): wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host (CVSS 7.1, Linux)
- [CVE-2022-50700](https://cve.now/CVE-2022-50700.md): wifi: ath10k: Delay the unmapping of the buffer (CVSS 7.5, Linux)
- [CVE-2022-50699](https://cve.now/CVE-2022-50699.md): selinux: enable use of both GFP\_KERNEL and GFP\_ATOMIC in convert\_context() (no CVSS, Linux)
- [CVE-2022-50698](https://cve.now/CVE-2022-50698.md): ASoC: da7219: Fix an error handling path in da7219\_register\_dai\_clks() (no CVSS, Linux)
- [CVE-2022-50697](https://cve.now/CVE-2022-50697.md): mrp: introduce active flags to prevent UAF when applicant uninit (CVSS 7.8, Linux)
- [CVE-2025-68733](https://cve.now/CVE-2025-68733.md): smack: fix bug: unprivileged task can create labels (no CVSS, Linux)
- [CVE-2025-68732](https://cve.now/CVE-2025-68732.md): gpu: host1x: Fix race in syncpt alloc/free (no CVSS, Linux)
- [CVE-2025-68731](https://cve.now/CVE-2025-68731.md): accel/amdxdna: Fix an integer overflow in aie2\_query\_ctx\_status\_array() (no CVSS, Linux)
- [CVE-2025-68730](https://cve.now/CVE-2025-68730.md): accel/ivpu: Fix page fault in ivpu\_bo\_unbind\_all\_bos\_from\_context() (CVSS 7.8, Linux)
- [CVE-2025-68729](https://cve.now/CVE-2025-68729.md): wifi: ath12k: Fix MSDU buffer types handling in RX error path (no CVSS, Linux)
- [CVE-2025-68728](https://cve.now/CVE-2025-68728.md): ntfs3: fix uninit memory after failed mi\_read in mi\_format\_new (no CVSS, Linux)
- [CVE-2025-68727](https://cve.now/CVE-2025-68727.md): ntfs3: Fix uninit buffer allocated by \_\_getname() (no CVSS, Linux)
- [CVE-2025-68726](https://cve.now/CVE-2025-68726.md): crypto: aead - Fix reqsize handling (CVSS 9.8, Linux)
- [CVE-2025-68725](https://cve.now/CVE-2025-68725.md): bpf: Do not let BPF test infra emit invalid GSO types to stack (no CVSS, Linux)
- [CVE-2025-68724](https://cve.now/CVE-2025-68724.md): crypto: asymmetric\_keys - prevent overflow in asymmetric\_key\_generate\_id (CVSS 7.8, Linux)
- [CVE-2025-68380](https://cve.now/CVE-2025-68380.md): wifi: ath11k: fix peer HE MCS assignment (no CVSS, Linux)
- [CVE-2025-68379](https://cve.now/CVE-2025-68379.md): RDMA/rxe: Fix null deref on srq-\>rq.queue after resize failure (CVSS 7.8, Linux)
- [CVE-2025-68378](https://cve.now/CVE-2025-68378.md): bpf: Fix stackmap overflow check in \_\_bpf\_get\_stackid() (no CVSS, Linux)
- [CVE-2025-68377](https://cve.now/CVE-2025-68377.md): ns: initialize ns\_list\_node for initial namespaces (no CVSS, Linux)
- [CVE-2025-68376](https://cve.now/CVE-2025-68376.md): coresight: ETR: Fix ETR buffer use-after-free issue (no CVSS, Linux)
- [CVE-2025-68375](https://cve.now/CVE-2025-68375.md): perf/x86: Fix NULL event access and potential PEBS record loss (no CVSS, Linux)
- [CVE-2025-68374](https://cve.now/CVE-2025-68374.md): md: fix rcu protection in md\_wakeup\_thread (no CVSS, Linux)
- [CVE-2025-68373](https://cve.now/CVE-2025-68373.md): md: avoid repeated calls to del\_gendisk (no CVSS, Linux)
- [CVE-2025-68372](https://cve.now/CVE-2025-68372.md): nbd: defer config put in recv\_work (no CVSS, Linux)
- [CVE-2025-68371](https://cve.now/CVE-2025-68371.md): scsi: smartpqi: Fix device resources accessed after device removal (no CVSS, Linux)
- [CVE-2025-68370](https://cve.now/CVE-2025-68370.md): coresight: tmc: add the handle of the event to the path (CVSS 7.8, Linux)
- [CVE-2025-68369](https://cve.now/CVE-2025-68369.md): ntfs3: init run lock for extend inode (CVSS 7.5, Linux)
- [CVE-2025-68368](https://cve.now/CVE-2025-68368.md): md: init bioset in mddev\_init (no CVSS, Linux)
- [CVE-2025-68367](https://cve.now/CVE-2025-68367.md): macintosh/mac\_hid: fix race condition in mac\_hid\_toggle\_emumouse (no CVSS, Linux)
- [CVE-2025-68366](https://cve.now/CVE-2025-68366.md): nbd: defer config unlock in nbd\_genl\_connect (no CVSS, Linux)
- [CVE-2025-68365](https://cve.now/CVE-2025-68365.md): fs/ntfs3: Initialize allocated memory before use (CVSS 8.2, Linux)
- [CVE-2025-68364](https://cve.now/CVE-2025-68364.md): ocfs2: relax BUG() to ocfs2\_error() in \_\_ocfs2\_move\_extent() (no CVSS, Linux)
- [CVE-2025-68363](https://cve.now/CVE-2025-68363.md): bpf: Check skb-\>transport\_header is set in bpf\_skb\_check\_mtu (no CVSS, Linux)
- [CVE-2025-68362](https://cve.now/CVE-2025-68362.md): wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187\_rx\_cb() (no CVSS, Linux)
- [CVE-2025-68361](https://cve.now/CVE-2025-68361.md): erofs: limit the level of fs stacking for file-backed mounts (no CVSS, Linux)
- [CVE-2025-68360](https://cve.now/CVE-2025-68360.md): wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (CVSS 8.2, Linux)
- [CVE-2025-68359](https://cve.now/CVE-2025-68359.md): btrfs: fix double free of qgroup record after failure to add delayed ref head (CVSS 9.8, Linux)
- [CVE-2025-68358](https://cve.now/CVE-2025-68358.md): btrfs: fix racy bitfield write in btrfs\_clear\_space\_info\_full() (no CVSS, Linux)
- [CVE-2025-68357](https://cve.now/CVE-2025-68357.md): iomap: allocate s\_dio\_done\_wq for async reads as well (no CVSS, Linux)
- [CVE-2025-68356](https://cve.now/CVE-2025-68356.md): gfs2: Prevent recursive memory reclaim (no CVSS, Linux)
- [CVE-2025-68355](https://cve.now/CVE-2025-68355.md): bpf: Fix exclusive map memory leak (no CVSS, Linux)
- [CVE-2025-68354](https://cve.now/CVE-2025-68354.md): regulator: core: Protect regulator\_supply\_alias\_list with regulator\_list\_mutex (no CVSS, Linux)
- [CVE-2025-68353](https://cve.now/CVE-2025-68353.md): net: vxlan: prevent NULL deref in vxlan\_xmit\_one (no CVSS, Linux)
- [CVE-2025-68352](https://cve.now/CVE-2025-68352.md): spi: ch341: fix out-of-bounds memory access in ch341\_transfer\_one (CVSS 7.8, Linux)
- [CVE-2025-68351](https://cve.now/CVE-2025-68351.md): exfat: fix refcount leak in exfat\_find (no CVSS, Linux)
- [CVE-2025-68350](https://cve.now/CVE-2025-68350.md): exfat: fix divide-by-zero in exfat\_allocate\_bitmap (no CVSS, Linux)
- [CVE-2025-68349](https://cve.now/CVE-2025-68349.md): NFSv4/pNFS: Clear NFS\_INO\_LAYOUTCOMMIT in pnfs\_mark\_layout\_stateid\_invalid (CVSS 7.5, Linux)
- [CVE-2025-68348](https://cve.now/CVE-2025-68348.md): block: fix memory leak in \_\_blkdev\_issue\_zero\_pages (no CVSS, Linux)
- [CVE-2025-68347](https://cve.now/CVE-2025-68347.md): ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVSS 7.8, Linux)
- [CVE-2025-68346](https://cve.now/CVE-2025-68346.md): ALSA: dice: fix buffer overflow in detect\_stream\_formats() (no CVSS, Linux)
- [CVE-2025-68345](https://cve.now/CVE-2025-68345.md): ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41\_hda\_read\_acpi() (no CVSS, Linux)
- [CVE-2025-68344](https://cve.now/CVE-2025-68344.md): ALSA: wavefront: Fix integer overflow in sample size validation (no CVSS, Linux)
- [CVE-2025-64641](https://cve.now/CVE-2025-64641.md): Mattermost Jira plugin crafted action leaks Jira issue details (CVSS 4.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-13767](https://cve.now/CVE-2025-13767.md): Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-57840](https://cve.now/CVE-2025-57840.md): Privilege Bypass in ADB (CVSS 2.2, Honor Magic OS)
- [CVE-2025-13407](https://cve.now/CVE-2025-13407.md): GravityForms \< 2.9.23.1 - Unauthenticated Arbitrary File Upload (CVSS 6.8, Gravity Forms)
- [CVE-2025-66444](https://cve.now/CVE-2025-66444.md): Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (CVSS 8.2, Hitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…)
- [CVE-2025-66445](https://cve.now/CVE-2025-66445.md): Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (CVSS 7.1, Hitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…)
- [CVE-2025-13773](https://cve.now/CVE-2025-13773.md): Print Invoice & Delivery Notes for WooCommerce \<= 5.8.0 - Unauthenticated Remote Code Execution (CVSS 9.8, tychesoftwares Print Invoice & Delivery Notes for WooCommer…)
- [CVE-2025-15053](https://cve.now/CVE-2025-15053.md): code-projects Student Information System searchresults.php sql injection (CVSS 6.9, code-projects Student Information System)
- [CVE-2025-15052](https://cve.now/CVE-2025-15052.md): code-projects Student Information System profile.php cross site scripting (CVSS 5.1, code-projects Student Information System)
- [CVE-2025-15050](https://cve.now/CVE-2025-15050.md): code-projects Student File Management System save\_file.php unrestricted upload (CVSS 5.3, code-projects Student File Management System)
- [CVE-2024-35322](https://cve.now/CVE-2024-35322.md): MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. (CVSS 6.1)
- [CVE-2024-39037](https://cve.now/CVE-2024-39037.md): MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter. (CVSS 6.5)
- [CVE-2024-40317](https://cve.now/CVE-2024-40317.md): A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a us (CVSS 6.1)
- [CVE-2024-58335](https://cve.now/CVE-2024-58335.md): OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualiz (CVSS 5.0, jcthiele OpenXRechnungToolbox)
- [CVE-2025-60935](https://cve.now/CVE-2025-60935.md): An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a cr (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.