CVEs published December 30, 2025
425 CVEs were published on December 30, 2025: 27 critical, 97 high.
- Published
- 425
- Critical
- 27
- High
- 97
- Medium
- 107
- Low
- 8
- Unrated
- 186
- Now in CISA KEV
- 0
- Fix available
- 74
Most affected products
- Linux
- 244
- SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- 14
- Tenda M3
- 7
- Delta Electronics DVP-12SE11T
- 4
- Ksenia Security S.p.A. lares
- 4
- Edimax BR-6208AC
- 3
- JM-DATA ONU JF511-TV
- 3
- SohuTV CacheCloud
- 3
- Advance WP Query Search Filter
- 2
- BiggiDroid Simple PHP CMS
- 2
Critical 27
- CVE-2025-15114Ksenia Security lares Home Automation 1.6 PIN Exposure VulnerabilityKsenia Security S.p.A. lares
- CVE-2025-15113Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS UploadKsenia Security S.p.A. lares
- CVE-2025-15111Ksenia Security lares Home Automation 1.6 Default Credentials VulnerabilityKsenia Security S.p.A. lares
- CVE-2023-54327Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password ChangeTinycontrol LAN Controller
- CVE-2023-53983Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication BypassAteme Anevia Flamingo XL/XS · Ateme SoapLive +1
- CVE-2022-50803JM-DATA ONU JF511-TV 1.0.67 Default Credentials VulnerabilityJM-DATA ONU JF511-TV
- CVE-2022-50796SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgiSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50794SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via UsernameSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50696SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication BypassSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50691MiniDVBLinux 5.4 Remote Root Command Execution via commands.shMiniDVBLinux
- CVE-2025-68926RustFS has a gRPC Hardcoded Token Authentication Bypassrustfs
- CVE-2025-52835WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityConoHa by GMO WING WordPress Migrator
- CVE-2025-15255Tenda W6-S R7websSsecurityHandler httpd stack-based overflowTenda W6-S
- CVE-2023-54292RDMA/irdma: Fix data race on CQP request doneLinux
- CVE-2023-54280cifs: fix potential race when tree connecting ipcLinux
- CVE-2023-54269SUNRPC: double free xprt_ctxt while still in useLinux
- CVE-2023-54258cifs: fix potential oops in cifs_oplock_breakLinux
- CVE-2023-54257net: macb: fix a memory corruption in extended buffer descriptor modeLinux
- CVE-2023-54237net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()Linux
- CVE-2023-54223net/mlx5e: xsk: Fix invalid buffer access for legacy rqLinux
- CVE-2023-54203ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdrLinux
- CVE-2023-54184scsi: target: iscsit: Free cmds before session freeLinux
- CVE-2025-15359DVP-12SE11T - Out-of-bound memory write VulnerabilityDelta Electronics DVP-12SE11T
- CVE-2025-15102DVP-12SE11T - Password Protection BypassDelta Electronics DVP-12SE11T
- CVE-2025-69234Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.NAVER Whale browser
- CVE-2025-56332Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration
- CVE-2025-66848JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r43
High 97
- CVE-2025-59131WordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerabilityhoernerfranz WP-CalDav2ICS
- CVE-2024-58338Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute CommandAteme Flamingo XL
- CVE-2024-58337Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPIThe Akuvox Company Akuvox Smart Doorphone · The Akuvox Comp…
- CVE-2024-58336Akuvox Smart Intercom S539 Unauthenticated Video Stream DisclosureThe Akuvox Company Akuvox Smart Doorphone · The Akuvox Comp…
- CVE-2024-58315Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service PathTosibox Oy Tosibox Key Service
- CVE-2023-54163NLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer ParametersNLB Banka AD Skopje NLB mKlik Makedonija
- CVE-2022-50799Fetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of ServiceFetch Softworks Fetch FTP Client
- CVE-2022-50795SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50793SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.phpSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50792SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure VulnerabilitySOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50791SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.phpSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50789SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.phpSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50695SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50694SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username ParameterSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2025-62753WordPress MAS Videos plugin <= 1.3.4 - Local File Inclusion vulnerabilityMadrasThemes MAS Videos
- CVE-2025-15356Tenda AC20 PowerSaveSet sscanf buffer overflowTenda AC20
- CVE-2025-69256serverless MCP Server vulnerable to command injection in list-projects toolserverless
- CVE-2025-59129WordPress Appointify plugin <= 1.0.8 - SQL Injection vulnerabilityAppointify
- CVE-2025-15253Tenda M3 exeCommand stack-based overflowTenda M3
- CVE-2025-15252Tenda M3 setDhcpAP formSetRemoteDhcpForAp stack-based overflowTenda M3
- CVE-2023-54326misc: pci_endpoint_test: Free IRQs before removing the deviceLinux
- CVE-2023-54325crypto: qat - fix out-of-bounds readLinux
- CVE-2022-50885RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failedLinux
- CVE-2023-54318net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_addLinux
- CVE-2023-54317dm flakey: don't corrupt the zero pageLinux
- CVE-2023-54310scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race conditionLinux
- CVE-2023-54308ALSA: ymfpci: Create card with device-managed snd_devm_card_new()Linux
- CVE-2023-54306net: tls: avoid hanging tasks on the tx_lockLinux
- CVE-2023-54303bpf: Disable preemption in bpf_perf_event_outputLinux
- CVE-2023-54286wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtraceLinux
- CVE-2023-54285iomap: Fix possible overflow condition in iomap_write_delalloc_scanLinux
- CVE-2023-54284media: av7110: prevent underflow in write_ts_to_decoder()Linux
- CVE-2022-50880wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()Linux
- CVE-2023-54262net/mlx5e: Don't clone flow post action attributes second timeLinux
- CVE-2023-54254drm/ttm: Don't leak a resource on eviction errorLinux
- CVE-2023-54250ksmbd: avoid out of bounds access in decode_preauth_ctxt()Linux
- CVE-2022-50871wifi: ath11k: Fix qmi_msg_handler data structure initializationLinux
- CVE-2022-50869fs/ntfs3: Fix slab-out-of-bounds in r_pageLinux
- CVE-2022-50867drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usageLinux
- CVE-2022-50865tcp: fix a signed-integer-overflow bug in tcp_add_backlog()Linux
- CVE-2022-50861NFSD: Finish converting the NFSv2 GETACL result encoderLinux
- CVE-2022-50860apparmor: Fix memleak in alloc_ns()Linux
- CVE-2023-54243netfilter: ebtables: fix table blob use-after-freeLinux
- CVE-2023-54238mlx5: fix skb leak while fifo resync and pushLinux
- CVE-2023-54234scsi: mpi3mr: Fix missing mrioc->evtack_cmds initializationLinux
- CVE-2023-54227blk-mq: fix tags leak when shrink nr_hw_queuesLinux
- CVE-2023-54220serial: 8250: Fix oops for port->pm on uart_change_pm()Linux
- CVE-2023-54219Revert "IB/isert: Fix incorrect release of isert connection"Linux
- CVE-2023-54216net/mlx5e: TC, Fix using eswitch mapping in nic modeLinux
- CVE-2023-54214Bluetooth: L2CAP: Fix potential user-after-freeLinux
- CVE-2023-54210Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()Linux
- CVE-2023-54206net/sched: flower: fix filter idr initializationLinux
- CVE-2022-50841fs/ntfs3: Add overflow check for attribute sizeLinux
- CVE-2023-54202drm/i915: fix race condition UAF in i915_perf_add_config_ioctlLinux
- CVE-2023-54201RDMA/efa: Fix wrong resources deallocation orderLinux
- CVE-2023-54200netfilter: nf_tables: always release netdev hooks from notifierLinux
- CVE-2023-54198tty: fix out-of-bounds access in tty_driver_lookup_tty()Linux
- CVE-2023-54193net/sched: cls_api: remove block_cb from driver_list before freeingLinux
- CVE-2023-54187f2fs: fix potential corruption when moving a directoryLinux
- CVE-2023-54186usb: typec: altmodes/displayport: fix pin_assignment_showLinux
- CVE-2023-54182f2fs: fix to check readonly condition correctlyLinux
- CVE-2023-54173bpf: Disable preemption in bpf_event_outputLinux
- CVE-2023-54168RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()Linux
- CVE-2023-54166igc: Fix Kernel Panic during ndo_tx_timeout callbackLinux
- CVE-2023-54165zsmalloc: move LRU update from zs_map_object() to zs_malloc()Linux
- CVE-2023-54164Bluetooth: ISO: fix iso_conn related locking and validity issuesLinux
- CVE-2022-50822RDMA/restrack: Release MR restrack when deleteLinux
- CVE-2023-54162ksmbd: fix possible memory leak in smb2_lock()Linux
- CVE-2022-50785fsi: occ: Prevent use after freeLinux
- CVE-2025-14509Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tagsvillatheme Lucky Wheel for WooCommerce – Spin a Sale
- CVE-2025-69034WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerabilityMikado-Themes Lekker
- CVE-2025-68996WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Local File Inclusion vulnerabilityWebCodingPlace Responsive Posts Carousel Pro
- CVE-2025-68990WordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerabilityxenioushk BWL Pro Voting Manager
- CVE-2025-68987WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerabilityEdge-Themes Cinerama
- CVE-2025-68985WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerabilitythembay Aora
- CVE-2025-68984WordPress Puca theme <= 2.6.39 - Local File Inclusion vulnerabilitythembay Puca
- CVE-2025-68983WordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerabilitythembay Greenmart
- CVE-2025-15358DVP-12SE11T - Denial of Service VulnerabilityDelta Electronics DVP-12SE11T
- CVE-2025-15103DVP-12SE11T - Authentication Bypass via Partial Password DisclosureDelta Electronics DVP-12SE11T
- CVE-2025-15234Tenda M3 setInternetLanInfo formSetRemoteInternetLanInfo heap-based overflowTenda M3
- CVE-2025-15233Tenda M3 setAdInfoDetail formSetAdInfoDetails heap-based overflowTenda M3
- CVE-2025-15232Tenda M3 setAdPushInfo formSetAdPushInfo stack-based overflowTenda M3
- CVE-2025-15231Tenda M3 setVlanInfo formSetRemoteVlanInfo stack-based overflowTenda M3
- CVE-2025-15230Tenda M3 setVlanPolicyData formSetVlanPolicy heap-based overflowTenda M3
- CVE-2025-15218Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflowTenda AC10U
- CVE-2025-15217Tenda AC23 HTTP POST Request formSetPPTPUserList buffer overflowTenda AC23
- CVE-2025-15216Tenda AC23 SetIpMacBind fromSetIpMacBind stack-based overflowTenda AC23
- CVE-2025-15215Tenda AC10U HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflowTenda AC10U
- CVE-2025-69235Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.NAVER Whale browser
- CVE-2025-69217Coturn has unsafe nonce and relay port randomization due to weak random number generation.coturn
- CVE-2025-61557nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal.
- CVE-2025-65409A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputtin
- CVE-2025-65411A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecti
- CVE-2025-66723inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows atta
- CVE-2025-66824A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueCo
- CVE-2025-66834A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exp
- CVE-2025-66835TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the use
Medium, low and unrated 301
- CVE-2022-50802ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action ParameterETAP Lighting International NV ETAP Safety Manager
- CVE-2025-15112Ksenia Security lares Home Automation 1.6 URL Redirection VulnerabilityKsenia Security S.p.A. lares
- CVE-2022-50804JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) VulnerabilityJM-DATA ONU JF511-TV
- CVE-2022-50801JM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) VulnerabilityJM-DATA ONU JF511-TV
- CVE-2022-50800H3C SSL VPN n/a Username Enumeration via Login Script Credential VerificationHangzhou H3C Technologies H3C SSL VPN
- CVE-2022-50790SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream DisclosureSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50788SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log DirectorySOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50787SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site ScriptingSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2022-50692SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration VulnerabilitySOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2025-15360newbee-mall-plus Product Information Edit UploadController.java upload unrestricted uploadnewbee-mall-plus
- CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-27221ruby uri · uri
- CVE-2025-15357D-Link DI-7400G+ msp_info.htm command injectionD-Link DI-7400G+
- CVE-2025-14986ExecuteMultiOperation Namespace Policy BypassTemporal · go.temporal.io/server
- CVE-2025-14987Cross Namespace Commands Authorization BypassTemporal · go.temporal.io/server
- CVE-2025-15354itsourcecode Society Management System add_admin.php sql injectionitsourcecode Society Management System
- CVE-2025-69261WasmEdge integer wrap in MemoryInstance::getSpan()'s memory size checkWasmEdge
- CVE-2025-15353itsourcecode Society Management System edit_admin_query.php edit_admin_query sql injectionitsourcecode Society Management System
- CVE-2025-69210FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2025-69257theshit vulnerable to unsafe loading of user-owned Python rules when running as root.AsfhtgkDavid theshit · theshit
- CVE-2025-15264FeehiCMS TimThumb timthumb.php server-side request forgeryFeehiCMS
- CVE-2025-15263BiggiDroid Simple PHP CMS Admin Login login.php sql injectionBiggiDroid Simple PHP CMS
- CVE-2025-15262BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted uploadBiggiDroid Simple PHP CMS
- CVE-2025-15258Edimax BR-6208AC Web-based Configuration formALGSetup redirectEdimax BR-6208AC
- CVE-2025-15257Edimax BR-6208AC Web-based Configuration formRoute command injectionEdimax BR-6208AC
- CVE-2025-69204ImageMagick converting a malicious MVG file to SVG caused an integer overflow.ImageMagick
- CVE-2025-68950Magick's failure to limit MVG mutual references forming a loopImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2025-66103WordPress WPCal.io plugin <= 0.9.5.9 - Cross Site Scripting (XSS) vulnerabilityrevmakx WPCal.io
- CVE-2025-15256Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injectionEdimax BR-6208AC
- CVE-2025-62128WordPress SiteLock Security plugin <= 5.0.1 - Broken Access Control vulnerabilitySiteLock Security – WP Hardening, Login Security & Malware…
- CVE-2025-62112WordPress Import into Easy Property Listings plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityMerv Barrett Import into Easy Property Listings
- CVE-2025-66094WordPress Yada Wiki plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilitydmccan Yada Wiki
- CVE-2025-68618Magick's failure to limit the depth of SVG file reads caused a DoS attack.ImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2025-62746WordPress Featured Video for WordPress – VideographyWP plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityCodeFlavors Featured Video for WordPress – VideographyWP
- CVE-2025-67746Composer vulnerable to ANSI sequence injectioncomposer · composer/composer
- CVE-2025-66080WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerabilityWP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…
- CVE-2025-64528Users are able to find users by name even when `enable_names` is offdiscourse
- CVE-2025-63027WordPress WBC907 Core plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilitywebcreations907 WBC907 Core
- CVE-2025-64190WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability8theme XStore Core
- CVE-2025-15254Tenda W6-S ATE Service ate TendaAte os command injectionTenda W6-S
- CVE-2025-15251beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity referencebeecue FastBee
- CVE-2025-1525008CMS Novel System Template mtpls.inc.php code injection08CMS Novel System
- CVE-2025-15249zhujunliang3 work_platform Content cross site scriptingzhujunliang3 work_platform
- CVE-2023-54324dm: fix a race condition in retrieve_depsLinux
- CVE-2023-54323cxl/pmem: Fix nvdimm registration racesLinux
- CVE-2022-50889dm integrity: Fix UAF in dm_integrity_dtr()Linux
- CVE-2022-50888remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()Linux
- CVE-2022-50887regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()Linux
- CVE-2023-54322arm64: set __exception_irq_entry with __irq_entry as a defaultLinux
- CVE-2023-54321driver core: fix potential null-ptr-deref in device_add()Linux
- CVE-2023-54320platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()Linux
- CVE-2023-54319pinctrl: at91-pio4: check return value of devm_kasprintf()Linux
- CVE-2022-50886mmc: toshsd: fix return value check of mmc_add_host()Linux
- CVE-2022-50884drm: Prevent drm_copy_field() to attempt copying a NULL pointerLinux
- CVE-2025-15248sunhailin12315 product-review 商品评价系统 Write a Review cross site scriptingsunhailin12315 product-review 商品评价系统
- CVE-2023-54316refscale: Fix uninitalized use of wait_queue_head_tLinux
- CVE-2023-54315powerpc/powernv/sriov: perform null check on iov before dereferencing iovLinux
- CVE-2023-54314media: af9005: Fix null-ptr-deref in af9005_i2c_xferLinux
- CVE-2023-54313ovl: fix null pointer dereference in ovl_get_acl_rcu()Linux
- CVE-2023-54312samples/bpf: Fix buffer overflow in tcp_baserttLinux
- CVE-2023-54311ext4: fix deadlock when converting an inline directory in nojournal modeLinux
- CVE-2023-54309tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creationLinux
- CVE-2023-54307ptp_qoriq: fix memory leak in probe()Linux
- CVE-2023-54305ext4: refuse to create ea block when umountedLinux
- CVE-2023-54304firmware: meson_sm: fix to avoid potential NULL pointer dereferenceLinux
- CVE-2023-54302RDMA/irdma: Fix data race on CQP completion statsLinux
- CVE-2023-54301serial: 8250_bcm7271: fix leak in `brcmuart_probe`Linux
- CVE-2023-54300wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rxLinux
- CVE-2023-54299usb: typec: bus: verify partner exists in typec_altmode_attentionLinux
- CVE-2023-54298thermal: intel: quark_dts: fix error pointer dereferenceLinux
- CVE-2023-54297btrfs: zoned: fix memory leak after finding block group with super blocksLinux
- CVE-2023-54296KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migrationLinux
- CVE-2023-54295mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_typeLinux
- CVE-2023-54294md/raid10: fix memleak of md threadLinux
- CVE-2023-54293bcache: fixup btree_cache_wait list damageLinux
- CVE-2023-54291vduse: fix NULL pointer dereferenceLinux
- CVE-2023-54289scsi: qedf: Fix NULL dereference in error handlingLinux
- CVE-2023-54288wifi: mac80211: fortify the spinlock against deadlock by interruptLinux
- CVE-2023-54287tty: serial: imx: disable Ageing Timer interrupt request irqLinux
- CVE-2023-54283bpf: Address KCSAN report on bpf_lru_listLinux
- CVE-2023-54282media: tuners: qt1010: replace BUG_ON with a regular errorLinux
- CVE-2023-54281btrfs: release path before inode lookup during the ino lookup ioctlLinux
- CVE-2022-50883bpf: Prevent decl_tag from being referenced in func_proto argLinux
- CVE-2022-50882media: uvcvideo: Fix memory leak in uvc_gpio_parseLinux
- CVE-2022-50881wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()Linux
- CVE-2022-50879objtool: Fix SEGFAULTLinux
- CVE-2022-50878gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()Linux
- CVE-2022-50877net: broadcom: bcm4908_enet: update TX stats after actual transmissionLinux
- CVE-2022-50876usb: musb: Fix musb_gadget.c rxstate overflow bugLinux
- CVE-2022-50875of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()Linux
- CVE-2022-50874RDMA/erdma: Fix refcount leak in erdma_mmapLinux
- CVE-2025-14426Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Updatewpchill Strong Testimonials
- CVE-2023-54279MIPS: fw: Allow firmware to pass a empty envLinux
- CVE-2023-54278s390/vmem: split pages when debug pagealloc is enabledLinux
- CVE-2023-54277fbdev: udlfb: Fix endpoint checkLinux
- CVE-2023-54276nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_netLinux
- CVE-2023-54275wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setupLinux
- CVE-2023-54274RDMA/srpt: Add a check for valid 'mad_agent' pointerLinux
- CVE-2023-54273xfrm: Fix leak of dev trackerLinux
- CVE-2023-54272fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()Linux
- CVE-2023-54271blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before initLinux
- CVE-2023-54270media: usb: siano: Fix use after free bugs caused by do_submit_urbLinux
- CVE-2023-54268debugobjects: Don't wake up kswapd from fill_pool()Linux
- CVE-2023-54267powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPTLinux
- CVE-2023-54266media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()Linux
- CVE-2023-54265ipv6: Fix an uninit variable access bug in __ip6_make_skb()Linux
- CVE-2023-54264fs/sysv: Null check to prevent null-ptr-deref bugLinux
- CVE-2023-54263drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DPLinux
- CVE-2023-54261drm/amdkfd: Add missing gfx11 MQD manager callbacksLinux
- CVE-2023-54260cifs: Fix lost destroy smbd connection when MR allocate failedLinux
- CVE-2023-54259soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflowLinux
- CVE-2023-54255sh: dma: Fix DMA channel offset calculationLinux
- CVE-2023-54253btrfs: set page extent mapped after read_folio in relocate_one_pageLinux
- CVE-2023-54252platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI stringsLinux
- CVE-2023-54251net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.Linux
- CVE-2023-54249bus: mhi: ep: Only send -ENOTCONN status if client driver is availableLinux
- CVE-2023-54248fs/ntfs3: Add check for kmemdupLinux
- CVE-2023-54247bpf: Silence a warning in btf_type_id_size()Linux
- CVE-2023-54246rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()Linux
- CVE-2023-54245ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-boundsLinux
- CVE-2023-54244ACPI: EC: Fix oops when removing custom query handlersLinux
- CVE-2022-50873vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_removeLinux
- CVE-2022-50872ARM: OMAP2+: Fix memory leak in realtime_counter_init()Linux
- CVE-2022-50870powerpc/rtas: avoid device tree lookups in rtas_os_term()Linux
- CVE-2022-50868hwrng: amd - Fix PCI device refcount leakLinux
- CVE-2022-50866ASoC: pxa: fix null-pointer dereference in filter()Linux
- CVE-2022-50864nilfs2: fix shift-out-of-bounds due to too large exponent of block sizeLinux
- CVE-2022-50863wifi: rtw89: free unused skb to prevent memory leakLinux
- CVE-2022-50862bpf: prevent decl_tag from being referenced in func_protoLinux
- CVE-2022-50859cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO messageLinux
- CVE-2022-50858mmc: alcor: fix return value check of mmc_add_host()Linux
- CVE-2022-50857rapidio: rio: fix possible name leak in rio_register_mport()Linux
- CVE-2022-50856cifs: Fix xid leak in cifs_ses_add_channel()Linux
- CVE-2022-50855bpf: prevent leak of lsm program after failed attachLinux
- CVE-2022-50854nfc: virtual_ncidev: Fix memory leak in virtual_nci_send()Linux
- CVE-2022-50853NFSv4: Fix a credential leak in _nfs4_discover_trunking()Linux
- CVE-2022-50852wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()Linux
- CVE-2022-50851vhost_vdpa: fix the crash in unmap a large memoryLinux
- CVE-2022-50850scsi: ipr: Fix WARNING in ipr_init()Linux
- CVE-2022-50849pstore: Avoid kcore oops by vmap()ing with VM_IOREMAPLinux
- CVE-2022-50848drivers: dio: fix possible memory leak in dio_init()Linux
- CVE-2023-54242block, bfq: Fix division by zero error on zero wsumLinux
- CVE-2023-54241MIPS: KVM: Fix NULL pointer dereferenceLinux
- CVE-2023-54240net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()Linux
- CVE-2023-54239iommufd: Check for uptr overflowLinux
- CVE-2023-54236net/net_failover: fix txq exceeding warningLinux
- CVE-2023-54235PCI/DOE: Fix destroy_work_on_stack() raceLinux
- CVE-2023-54233ASoC: SOF: avoid a NULL dereference with unsupported widgetsLinux
- CVE-2023-54232m68k: Only force 030 bus error if PC not in exception tableLinux
- CVE-2023-54231net: libwx: fix memory leak in wx_setup_rx_resourcesLinux
- CVE-2023-54230amba: bus: fix refcount leakLinux
- CVE-2023-54229wifi: ath11k: fix registration of 6Ghz-only phy without the full channel rangeLinux
- CVE-2023-54228regulator: raa215300: Fix resource leak in case of errorLinux
- CVE-2023-54226af_unix: Fix data races around sk->sk_shutdown.Linux
- CVE-2023-54225net: ipa: only reset hashed tables when supportedLinux
- CVE-2023-54224btrfs: fix lockdep splat and potential deadlock after failure running delayed itemsLinux
- CVE-2023-54222hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()Linux
- CVE-2023-54221clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probeLinux
- CVE-2023-54218net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().Linux
- CVE-2023-54217Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"Linux
- CVE-2023-54215virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()Linux
- CVE-2023-54213USB: sisusbvga: Add endpoint checksLinux
- CVE-2023-54211tracing: Fix warning in trace_buffered_event_disable()Linux
- CVE-2023-54209block: fix blktrace debugfs entries leakageLinux
- CVE-2023-54208media: ov5675: Fix memleak in ov5675_init_controls()Linux
- CVE-2023-54207HID: uclogic: Correct devm device reference for hidinput input_dev nameLinux
- CVE-2023-54205pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domainLinux
- CVE-2023-54204mmc: sunplus: fix return value check of mmc_add_host()Linux
- CVE-2022-50847drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probeLinux
- CVE-2022-50846mmc: via-sdmmc: fix return value check of mmc_add_host()Linux
- CVE-2022-50845ext4: fix inode leak in ext4_xattr_inode_create() on an error pathLinux
- CVE-2022-50844drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callbackLinux
- CVE-2022-50843dm clone: Fix UAF in clone_dtr()Linux
- CVE-2022-50842drm/virtio: Check whether transferred 2D BO is shmemLinux
- CVE-2022-50840scsi: snic: Fix possible UAF in snic_tgt_create()Linux
- CVE-2022-50839jbd2: fix potential buffer head reference count leakLinux
- CVE-2022-50838net: stream: purge sk_error_queue in sk_stream_kill_queues()Linux
- CVE-2022-50837net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error pathLinux
- CVE-2022-50836remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()Linux
- CVE-2022-50835jbd2: add miss release buffer head in fc_do_one_pass()Linux
- CVE-2022-50834nfc: Fix potential resource leaksLinux
- CVE-2022-50833Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer worksLinux
- CVE-2022-50832wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()Linux
- CVE-2022-50830auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()Linux
- CVE-2022-50829wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()Linux
- CVE-2022-50828clk: zynqmp: Fix stack-out-of-bounds in strncpy`Linux
- CVE-2023-54199drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()Linux
- CVE-2023-54197Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"Linux
- CVE-2023-54196fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'Linux
- CVE-2023-54195rxrpc: Fix timeout of a call that hasn't yet been granted a channelLinux
- CVE-2023-54194exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfreeLinux
- CVE-2023-54192f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_blockLinux
- CVE-2023-54191wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exitLinux
- CVE-2023-54190leds: led-core: Fix refcount leak in of_led_get()Linux
- CVE-2023-54189pstore/ram: Add check for kstrdupLinux
- CVE-2023-54188dmaengine: apple-admac: Fix 'current_tx' not getting freedLinux
- CVE-2023-54185btrfs: remove BUG_ON()'s in add_new_free_space()Linux
- CVE-2023-54183media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()Linux
- CVE-2023-54181bpf: Fix issue in verifying allow_ptr_leaksLinux
- CVE-2023-54180btrfs: handle case when repair happens with dev-replaceLinux
- CVE-2023-54179scsi: qla2xxx: Array index may go out of boundLinux
- CVE-2023-54178of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()Linux
- CVE-2023-54177quota: fix warning in dqgrab()Linux
- CVE-2023-54176mptcp: stricter state check in mptcp_workerLinux
- CVE-2023-54175i2c: xiic: xiic_xfer(): Fix runtime PM leak on error pathLinux
- CVE-2023-54174vfio: Fix NULL pointer dereference caused by uninitialized group->iommufdLinux
- CVE-2023-54172x86/hyperv: Disable IBT when hypercall page lacks ENDBR instructionLinux
- CVE-2023-54171tracing: Fix memory leak of iter->temp when reading trace_pipeLinux
- CVE-2023-54170keys: Fix linking a duplicate key to a keyring's assoc_arrayLinux
- CVE-2023-54169net/mlx5e: fix memory leak in mlx5e_ptp_openLinux
- CVE-2023-54167m68k: mm: Move initrd phys_to_virt handling after paging_init()Linux
- CVE-2022-50827scsi: lpfc: Fix memory leak in lpfc_create_port()Linux
- CVE-2022-50826ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()Linux
- CVE-2022-50825usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe()Linux
- CVE-2022-50824tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leakLinux
- CVE-2022-50823clk: tegra: Fix refcount leak in tegra114_clock_initLinux
- CVE-2022-50821SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() failsLinux
- CVE-2022-50820perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()Linux
- CVE-2022-50819udmabuf: Set ubuf->sg = NULL if the creation of sg table failsLinux
- CVE-2022-50818scsi: pm8001: Fix running_req for internal abort commandsLinux
- CVE-2022-50817net: hsr: avoid possible NULL deref in skb_clone()Linux
- CVE-2022-50816ipv6: ensure sane device mtu in tunnelsLinux
- CVE-2022-50815ext2: Add sanity checks for group and filesystem sizeLinux
- CVE-2022-50814crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nrLinux
- CVE-2022-50813drivers: mcb: fix resource leak in mcb_probe()Linux
- CVE-2022-50812security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6Linux
- CVE-2022-50811erofs: fix missing unmap if z_erofs_get_extent_compressedlen() failsLinux
- CVE-2022-50810rapidio: devices: fix missing put_device in mport_cdev_openLinux
- CVE-2022-50809xhci: dbc: Fix memory leak in xhci_alloc_dbc()Linux
- CVE-2022-50786media: s5p-mfc: Clear workbit to handle error conditionLinux
- CVE-2022-50784wifi: iwlwifi: mei: fix potential NULL-ptr deref after cloneLinux
- CVE-2025-15247gmg137 snap7-rs client.rs download heap-based overflowgmg137 snap7-rs
- CVE-2025-15246aizuda snail-job API FurySerializer.deserialize deserializationaizuda snail-job
- CVE-2025-15245D-Link DCS-850L Firmware Update Service uploadfirmware path traversalD-Link DCS-850L
- CVE-2025-69093WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerabilitywpdesk ShopMagic
- CVE-2025-69092WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2025-69091WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerabilityKraft Plugins Demo Importer Plus
- CVE-2025-69089WordPress Auto Listings plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityautolistings Auto Listings
- CVE-2025-69088WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerabilityVidish Combo Offers WooCommerce
- CVE-2025-69033WordPress Blog Filter plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerabilityA WP Life Blog Filter
- CVE-2025-69032WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes FiveStar
- CVE-2025-69031WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerabilitySkywarrior Arcane
- CVE-2025-69030WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Backpack Traveler
- CVE-2025-69029WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerabilitySelect-Themes Struktur
- CVE-2025-69028WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerabilityBoldGrid weForms
- CVE-2025-69027WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerabilitytychesoftwares Product Delivery Date for WooCommerce – Lite
- CVE-2025-69026WordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerabilityRoxnor PopupKit
- CVE-2025-69025WordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerabilityAethonic Poptics
- CVE-2025-69024WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerabilitybizswoop BizPrint
- CVE-2025-69023WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerabilityMarketing Fire Discussion Board
- CVE-2025-69022WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerabilityWeblizar - WordPress Themes & Plugin HR Management Lite
- CVE-2025-69021WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityAys Pro Popup box
- CVE-2025-69020WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerabilityTribulant Software Newsletters
- CVE-2025-69019WordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityFlippingBook
- CVE-2025-69018WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerabilityShamalli Web Directory Free
- CVE-2025-69017WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerabilityMagnigenie RestroPress
- CVE-2025-69016WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerabilityAverta Shortcodes and extra features for Phlox theme
- CVE-2025-69015WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityAutomattic Crowdsignal Forms
- CVE-2025-69014WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerabilityYouzify
- CVE-2025-69013WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerabilityjetmonsters Stratum
- CVE-2025-69012WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerabilityStephen Harris Event Organiser
- CVE-2025-69010WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerabilityThemebeez Toolkit
- CVE-2025-69009WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerabilitykamleshyadav Medicalequipment
- CVE-2025-69008WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityInboxify Sign Up Form
- CVE-2025-69007WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerabilityOTWthemes Popping Sidebars and Widgets Light
- CVE-2025-69006WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityAtte Moisio AM Events
- CVE-2025-68998WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerabilityHeateor Support Heateor Social Login
- CVE-2025-68997WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerabilityAdvancedCoding wpDiscuz
- CVE-2025-68995WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerabilityPremio My Sticky Elements
- CVE-2025-68994WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerabilityXforWooCommerce Product Loops for WooCommerce
- CVE-2025-68993WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerabilityXforWooCommerce Share, Print and PDF Products for WooCommer…
- CVE-2025-68992WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityxenioushk BWL Knowledge Base Manager
- CVE-2025-68991WordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilityxenioushk BWL Pro Voting Manager
- CVE-2025-68989WordPress Contact Form 7 Extension For Mailchimp plugin <= 0.9.68 - Sensitive Data Exposure vulnerabilityRenzo Johnson contact-form-7-mailchimp-extension
- CVE-2025-68988WordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityo2oe E-Invoice App Malaysia
- CVE-2025-68982WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerabilityDesignThemes LMS Addon
- CVE-2025-68981WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerabilitydesignthemes HomeFix Elementor Portfolio
- CVE-2025-68980WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerabilitydesignthemes WeDesignTech Portfolio
- CVE-2025-68979WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerabilitySimpleCalendar Google Calendar Events
- CVE-2025-68978WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityDesignThemes Core
- CVE-2025-68977WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityDesignThemes Portfolio Addon
- CVE-2025-68976WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerabilityEagle-Themes Eagle Booking
- CVE-2025-68975WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerabilityEagle-Themes Eagle Booking
- CVE-2025-68974WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2025-15244PHPEMS Purchase Request race conditionPHPEMS
- CVE-2025-15243code-projects Simple Stock System login.php sql injectioncode-projects Simple Stock System
- CVE-2025-15242PHPEMS Coupon race conditionPHPEMS
- CVE-2025-15241CloudPanel Community Edition HTTP Header users redirectCloudPanel Community Edition
- CVE-2025-15355NetVision Information｜ISOinsight - Reflected Cross-site ScriptingNetVision Information ISOinsight
- CVE-2025-15229Tenda CH22 DhcpListClient fromDhcpListClient denial of serviceTenda CH22
- CVE-2025-14313Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajaxAdvance WP Query Search Filter
- CVE-2025-14312Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counterAdvance WP Query Search Filter
- CVE-2025-15222Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserializationDromara Sa-Token
- CVE-2025-15221SohuTV CacheCloud AppDataMigrateController.java index cross site scriptingSohuTV CacheCloud
- CVE-2025-15220SohuTV CacheCloud LoginController.java init cross site scriptingSohuTV CacheCloud
- CVE-2025-15219SohuTV CacheCloud MachineManageController.java doPodList cross site scriptingSohuTV CacheCloud
- CVE-2025-15214Campcodes Park Ticketing System admin_class.php save_pricing cross site scriptingCampcodes Park Ticketing System
- CVE-2025-15213code-projects Student File Management System File Download download.php improper authorizationcode-projects Student File Management System
- CVE-2025-15212code-projects Refugee Food Management System regfood.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15211code-projects Refugee Food Management System refugee.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-65925An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.
- CVE-2025-66823An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HT