# CVEs published 2025-12-30

425 CVEs were published on December 30, 2025: 27 critical, 97 high. Days are UTC.

- [CVE-2025-59131](https://cve.now/CVE-2025-59131.md): WordPress WP-CalDav2ICS plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, hoernerfranz WP-CalDav2ICS)
- [CVE-2022-50802](https://cve.now/CVE-2022-50802.md): ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter (CVSS 5.1, ETAP Lighting International NV ETAP Safety Manager)
- [CVE-2025-15114](https://cve.now/CVE-2025-15114.md): Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability (CVSS 9.3, Ksenia Security S.p.A. lares)
- [CVE-2025-15113](https://cve.now/CVE-2025-15113.md): Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload (CVSS 9.3, Ksenia Security S.p.A. lares)
- [CVE-2025-15112](https://cve.now/CVE-2025-15112.md): Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability (CVSS 5.1, Ksenia Security S.p.A. lares)
- [CVE-2025-15111](https://cve.now/CVE-2025-15111.md): Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability (CVSS 9.3, Ksenia Security S.p.A. lares)
- [CVE-2024-58338](https://cve.now/CVE-2024-58338.md): Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command (CVSS 8.6, Ateme Flamingo XL)
- [CVE-2024-58337](https://cve.now/CVE-2024-58337.md): Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI (CVSS 8.7, The Akuvox Company Akuvox Smart Doorphone · The Akuvox Comp…)
- [CVE-2024-58336](https://cve.now/CVE-2024-58336.md): Akuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure (CVSS 8.7, The Akuvox Company Akuvox Smart Doorphone · The Akuvox Comp…)
- [CVE-2024-58315](https://cve.now/CVE-2024-58315.md): Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path (CVSS 8.5, Tosibox Oy Tosibox Key Service)
- [CVE-2023-54327](https://cve.now/CVE-2023-54327.md): Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change (CVSS 9.3, Tinycontrol LAN Controller)
- [CVE-2023-54163](https://cve.now/CVE-2023-54163.md): NLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer Parameters (CVSS 8.8, NLB Banka AD Skopje NLB mKlik Makedonija)
- [CVE-2023-53983](https://cve.now/CVE-2023-53983.md): Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass (CVSS 9.3, Ateme Anevia Flamingo XL/XS · Ateme SoapLive +1)
- [CVE-2022-50804](https://cve.now/CVE-2022-50804.md): JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) Vulnerability (CVSS 5.1, JM-DATA ONU JF511-TV)
- [CVE-2022-50803](https://cve.now/CVE-2022-50803.md): JM-DATA ONU JF511-TV 1.0.67 Default Credentials Vulnerability (CVSS 9.3, JM-DATA ONU JF511-TV)
- [CVE-2022-50801](https://cve.now/CVE-2022-50801.md): JM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability (CVSS 5.1, JM-DATA ONU JF511-TV)
- [CVE-2022-50800](https://cve.now/CVE-2022-50800.md): H3C SSL VPN n/a Username Enumeration via Login Script Credential Verification (CVSS 6.9, Hangzhou H3C Technologies H3C SSL VPN)
- [CVE-2022-50799](https://cve.now/CVE-2022-50799.md): Fetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service (CVSS 7.1, Fetch Softworks Fetch FTP Client)
- [CVE-2022-50796](https://cve.now/CVE-2022-50796.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Unauthenticated Remote Code Execution via upload.cgi (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50795](https://cve.now/CVE-2022-50795.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Conditional Command Injection via traceroute.php (CVSS 8.5, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50794](https://cve.now/CVE-2022-50794.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Unauthenticated Command Injection via Username (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50793](https://cve.now/CVE-2022-50793.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Authenticated Command Injection via www-data-handler.php (CVSS 8.7, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50792](https://cve.now/CVE-2022-50792.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Unauthenticated File Disclosure Vulnerability (CVSS 8.7, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50791](https://cve.now/CVE-2022-50791.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Conditional Command Injection via ping.php (CVSS 8.5, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50790](https://cve.now/CVE-2022-50790.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Unauthenticated Radio Stream Disclosure (CVSS 6.9, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50789](https://cve.now/CVE-2022-50789.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Conditional Command Injection via dns.php (CVSS 8.5, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50788](https://cve.now/CVE-2022-50788.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Information Disclosure via Log Directory (CVSS 6.9, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50787](https://cve.now/CVE-2022-50787.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Unauthenticated Stored Cross-Site Scripting (CVSS 5.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50696](https://cve.now/CVE-2022-50696.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Hardcoded Credentials Authentication Bypass (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50695](https://cve.now/CVE-2022-50695.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x ICMP Flood Attack via Network Commands (CVSS 8.7, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50694](https://cve.now/CVE-2022-50694.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x SQL Injection via Username Parameter (CVSS 8.8, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50692](https://cve.now/CVE-2022-50692.md): SOUND4 IMPACT/FIRST/PULSE/Eco \<=2.x Insufficient Session Expiration Vulnerability (CVSS 6.9, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2022-50691](https://cve.now/CVE-2022-50691.md): MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh (CVSS 9.3, MiniDVBLinux)
- [CVE-2025-62753](https://cve.now/CVE-2025-62753.md): WordPress MAS Videos plugin \<= 1.3.4 - Local File Inclusion vulnerability (CVSS 7.5, MadrasThemes MAS Videos)
- [CVE-2025-15360](https://cve.now/CVE-2025-15360.md): newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload (CVSS 5.1, newbee-mall-plus)
- [CVE-2025-61594](https://cve.now/CVE-2025-61594.md): URI Credential Leakage Bypass over CVE-2025-27221 (CVSS 2.1, ruby uri · uri)
- [CVE-2025-15357](https://cve.now/CVE-2025-15357.md): D-Link DI-7400G+ msp\_info.htm command injection (CVSS 5.3, D-Link DI-7400G+)
- [CVE-2025-15356](https://cve.now/CVE-2025-15356.md): Tenda AC20 PowerSaveSet sscanf buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-14986](https://cve.now/CVE-2025-14986.md): ExecuteMultiOperation Namespace Policy Bypass (CVSS 1.3, Temporal · go.temporal.io/server)
- [CVE-2025-14987](https://cve.now/CVE-2025-14987.md): Cross Namespace Commands Authorization Bypass (CVSS 5.3, Temporal · go.temporal.io/server)
- [CVE-2025-15354](https://cve.now/CVE-2025-15354.md): itsourcecode Society Management System add\_admin.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2025-69261](https://cve.now/CVE-2025-69261.md): WasmEdge integer wrap in MemoryInstance::getSpan()'s memory size check (CVSS 5.5, WasmEdge)
- [CVE-2025-15353](https://cve.now/CVE-2025-15353.md): itsourcecode Society Management System edit\_admin\_query.php edit\_admin\_query sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2025-69210](https://cve.now/CVE-2025-69210.md): FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload (CVSS 1.2, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2025-69257](https://cve.now/CVE-2025-69257.md): theshit vulnerable to unsafe loading of user-owned Python rules when running as root. (CVSS 6.7, AsfhtgkDavid theshit · theshit)
- [CVE-2025-69256](https://cve.now/CVE-2025-69256.md): serverless MCP Server vulnerable to command injection in list-projects tool (CVSS 7.5, serverless)
- [CVE-2025-15264](https://cve.now/CVE-2025-15264.md): FeehiCMS TimThumb timthumb.php server-side request forgery (CVSS 6.9, FeehiCMS)
- [CVE-2025-15263](https://cve.now/CVE-2025-15263.md): BiggiDroid Simple PHP CMS Admin Login login.php sql injection (CVSS 6.9, BiggiDroid Simple PHP CMS)
- [CVE-2025-15262](https://cve.now/CVE-2025-15262.md): BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted upload (CVSS 5.1, BiggiDroid Simple PHP CMS)
- [CVE-2025-15258](https://cve.now/CVE-2025-15258.md): Edimax BR-6208AC Web-based Configuration formALGSetup redirect (CVSS 5.1, Edimax BR-6208AC)
- [CVE-2025-15257](https://cve.now/CVE-2025-15257.md): Edimax BR-6208AC Web-based Configuration formRoute command injection (CVSS 6.9, Edimax BR-6208AC)
- [CVE-2025-68926](https://cve.now/CVE-2025-68926.md): RustFS has a gRPC Hardcoded Token Authentication Bypass (CVSS 9.8, rustfs)
- [CVE-2025-69204](https://cve.now/CVE-2025-69204.md): ImageMagick converting a malicious MVG file to SVG caused an integer overflow. (CVSS 5.3, ImageMagick)
- [CVE-2025-59129](https://cve.now/CVE-2025-59129.md): WordPress Appointify plugin \<= 1.0.8 - SQL Injection vulnerability (CVSS 7.6, Appointify)
- [CVE-2025-68950](https://cve.now/CVE-2025-68950.md): Magick's failure to limit MVG mutual references forming a loop (CVSS 4.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2025-52835](https://cve.now/CVE-2025-52835.md): WordPress WING WordPress Migrator plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 9.6, ConoHa by GMO WING WordPress Migrator)
- [CVE-2025-66103](https://cve.now/CVE-2025-66103.md): WordPress WPCal.io plugin \<= 0.9.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, revmakx WPCal.io)
- [CVE-2025-15256](https://cve.now/CVE-2025-15256.md): Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection (CVSS 6.9, Edimax BR-6208AC)
- [CVE-2025-62128](https://cve.now/CVE-2025-62128.md): WordPress SiteLock Security plugin \<= 5.0.1 - Broken Access Control vulnerability (CVSS 4.3, SiteLock Security – WP Hardening, Login Security & Malware…)
- [CVE-2025-62112](https://cve.now/CVE-2025-62112.md): WordPress Import into Easy Property Listings plugin \<= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Merv Barrett Import into Easy Property Listings)
- [CVE-2025-66094](https://cve.now/CVE-2025-66094.md): WordPress Yada Wiki plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dmccan Yada Wiki)
- [CVE-2025-68618](https://cve.now/CVE-2025-68618.md): Magick's failure to limit the depth of SVG file reads caused a DoS attack. (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2025-62746](https://cve.now/CVE-2025-62746.md): WordPress Featured Video for WordPress – VideographyWP plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodeFlavors Featured Video for WordPress – VideographyWP)
- [CVE-2025-67746](https://cve.now/CVE-2025-67746.md): Composer vulnerable to ANSI sequence injection (CVSS 1.3, composer · composer/composer)
- [CVE-2025-66080](https://cve.now/CVE-2025-66080.md): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin \<= 4.0.3 - Broken Access Control vulnerability (CVSS 5.3, WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…)
- [CVE-2025-64528](https://cve.now/CVE-2025-64528.md): Users are able to find users by name even when \`enable\_names\` is off (CVSS 6.3, discourse)
- [CVE-2025-63027](https://cve.now/CVE-2025-63027.md): WordPress WBC907 Core plugin \<= 3.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webcreations907 WBC907 Core)
- [CVE-2025-15255](https://cve.now/CVE-2025-15255.md): Tenda W6-S R7websSsecurityHandler httpd stack-based overflow (CVSS 9.3, Tenda W6-S)
- [CVE-2025-64190](https://cve.now/CVE-2025-64190.md): WordPress XStore Core plugin \< 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 8theme XStore Core)
- [CVE-2025-15254](https://cve.now/CVE-2025-15254.md): Tenda W6-S ATE Service ate TendaAte os command injection (CVSS 5.3, Tenda W6-S)
- [CVE-2025-15253](https://cve.now/CVE-2025-15253.md): Tenda M3 exeCommand stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15252](https://cve.now/CVE-2025-15252.md): Tenda M3 setDhcpAP formSetRemoteDhcpForAp stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15251](https://cve.now/CVE-2025-15251.md): beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference (CVSS 6.3, beecue FastBee)
- [CVE-2025-15250](https://cve.now/CVE-2025-15250.md): 08CMS Novel System Template mtpls.inc.php code injection (CVSS 5.1, 08CMS Novel System)
- [CVE-2025-15249](https://cve.now/CVE-2025-15249.md): zhujunliang3 work\_platform Content cross site scripting (CVSS 5.1, zhujunliang3 work\_platform)
- [CVE-2023-54326](https://cve.now/CVE-2023-54326.md): misc: pci\_endpoint\_test: Free IRQs before removing the device (CVSS 7.8, Linux)
- [CVE-2023-54325](https://cve.now/CVE-2023-54325.md): crypto: qat - fix out-of-bounds read (CVSS 7.1, Linux)
- [CVE-2023-54324](https://cve.now/CVE-2023-54324.md): dm: fix a race condition in retrieve\_deps (no CVSS, Linux)
- [CVE-2023-54323](https://cve.now/CVE-2023-54323.md): cxl/pmem: Fix nvdimm registration races (no CVSS, Linux)
- [CVE-2022-50889](https://cve.now/CVE-2022-50889.md): dm integrity: Fix UAF in dm\_integrity\_dtr() (no CVSS, Linux)
- [CVE-2022-50888](https://cve.now/CVE-2022-50888.md): remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5\_wcss\_init\_mmio() (no CVSS, Linux)
- [CVE-2022-50887](https://cve.now/CVE-2022-50887.md): regulator: core: fix unbalanced of node refcount in regulator\_dev\_lookup() (no CVSS, Linux)
- [CVE-2023-54322](https://cve.now/CVE-2023-54322.md): arm64: set \_\_exception\_irq\_entry with \_\_irq\_entry as a default (no CVSS, Linux)
- [CVE-2023-54321](https://cve.now/CVE-2023-54321.md): driver core: fix potential null-ptr-deref in device\_add() (no CVSS, Linux)
- [CVE-2023-54320](https://cve.now/CVE-2023-54320.md): platform/x86/amd: pmc: Fix memory leak in amd\_pmc\_stb\_debugfs\_open\_v2() (no CVSS, Linux)
- [CVE-2023-54319](https://cve.now/CVE-2023-54319.md): pinctrl: at91-pio4: check return value of devm\_kasprintf() (no CVSS, Linux)
- [CVE-2022-50886](https://cve.now/CVE-2022-50886.md): mmc: toshsd: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50885](https://cve.now/CVE-2022-50885.md): RDMA/rxe: Fix NULL-ptr-deref in rxe\_qp\_do\_cleanup() when socket create failed (CVSS 7.5, Linux)
- [CVE-2022-50884](https://cve.now/CVE-2022-50884.md): drm: Prevent drm\_copy\_field() to attempt copying a NULL pointer (no CVSS, Linux)
- [CVE-2025-15248](https://cve.now/CVE-2025-15248.md): sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting (CVSS 5.1, sunhailin12315 product-review 商品评价系统)
- [CVE-2023-54318](https://cve.now/CVE-2023-54318.md): net/smc: use smc\_lgr\_list.lock to protect smc\_lgr\_list.list iterate in smcr\_port\_add (CVSS 8.8, Linux)
- [CVE-2023-54317](https://cve.now/CVE-2023-54317.md): dm flakey: don't corrupt the zero page (CVSS 7.8, Linux)
- [CVE-2023-54316](https://cve.now/CVE-2023-54316.md): refscale: Fix uninitalized use of wait\_queue\_head\_t (no CVSS, Linux)
- [CVE-2023-54315](https://cve.now/CVE-2023-54315.md): powerpc/powernv/sriov: perform null check on iov before dereferencing iov (no CVSS, Linux)
- [CVE-2023-54314](https://cve.now/CVE-2023-54314.md): media: af9005: Fix null-ptr-deref in af9005\_i2c\_xfer (no CVSS, Linux)
- [CVE-2023-54313](https://cve.now/CVE-2023-54313.md): ovl: fix null pointer dereference in ovl\_get\_acl\_rcu() (no CVSS, Linux)
- [CVE-2023-54312](https://cve.now/CVE-2023-54312.md): samples/bpf: Fix buffer overflow in tcp\_basertt (no CVSS, Linux)
- [CVE-2023-54311](https://cve.now/CVE-2023-54311.md): ext4: fix deadlock when converting an inline directory in nojournal mode (no CVSS, Linux)
- [CVE-2023-54310](https://cve.now/CVE-2023-54310.md): scsi: message: mptlan: Fix use after free bug in mptlan\_remove() due to race condition (CVSS 7.8, Linux)
- [CVE-2023-54309](https://cve.now/CVE-2023-54309.md): tpm: tpm\_vtpm\_proxy: fix a race condition in /dev/vtpmx creation (no CVSS, Linux)
- [CVE-2023-54308](https://cve.now/CVE-2023-54308.md): ALSA: ymfpci: Create card with device-managed snd\_devm\_card\_new() (CVSS 7.8, Linux)
- [CVE-2023-54307](https://cve.now/CVE-2023-54307.md): ptp\_qoriq: fix memory leak in probe() (no CVSS, Linux)
- [CVE-2023-54306](https://cve.now/CVE-2023-54306.md): net: tls: avoid hanging tasks on the tx\_lock (CVSS 7.5, Linux)
- [CVE-2023-54305](https://cve.now/CVE-2023-54305.md): ext4: refuse to create ea block when umounted (no CVSS, Linux)
- [CVE-2023-54304](https://cve.now/CVE-2023-54304.md): firmware: meson\_sm: fix to avoid potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-54303](https://cve.now/CVE-2023-54303.md): bpf: Disable preemption in bpf\_perf\_event\_output (CVSS 7.8, Linux)
- [CVE-2023-54302](https://cve.now/CVE-2023-54302.md): RDMA/irdma: Fix data race on CQP completion stats (no CVSS, Linux)
- [CVE-2023-54301](https://cve.now/CVE-2023-54301.md): serial: 8250\_bcm7271: fix leak in \`brcmuart\_probe\` (no CVSS, Linux)
- [CVE-2023-54300](https://cve.now/CVE-2023-54300.md): wifi: ath9k: avoid referencing uninit memory in ath9k\_wmi\_ctrl\_rx (no CVSS, Linux)
- [CVE-2023-54299](https://cve.now/CVE-2023-54299.md): usb: typec: bus: verify partner exists in typec\_altmode\_attention (no CVSS, Linux)
- [CVE-2023-54298](https://cve.now/CVE-2023-54298.md): thermal: intel: quark\_dts: fix error pointer dereference (no CVSS, Linux)
- [CVE-2023-54297](https://cve.now/CVE-2023-54297.md): btrfs: zoned: fix memory leak after finding block group with super blocks (no CVSS, Linux)
- [CVE-2023-54296](https://cve.now/CVE-2023-54296.md): KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (no CVSS, Linux)
- [CVE-2023-54295](https://cve.now/CVE-2023-54295.md): mtd: spi-nor: Fix shift-out-of-bounds in spi\_nor\_set\_erase\_type (no CVSS, Linux)
- [CVE-2023-54294](https://cve.now/CVE-2023-54294.md): md/raid10: fix memleak of md thread (no CVSS, Linux)
- [CVE-2023-54293](https://cve.now/CVE-2023-54293.md): bcache: fixup btree\_cache\_wait list damage (no CVSS, Linux)
- [CVE-2023-54292](https://cve.now/CVE-2023-54292.md): RDMA/irdma: Fix data race on CQP request done (CVSS 9.8, Linux)
- [CVE-2023-54291](https://cve.now/CVE-2023-54291.md): vduse: fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-54289](https://cve.now/CVE-2023-54289.md): scsi: qedf: Fix NULL dereference in error handling (no CVSS, Linux)
- [CVE-2023-54288](https://cve.now/CVE-2023-54288.md): wifi: mac80211: fortify the spinlock against deadlock by interrupt (no CVSS, Linux)
- [CVE-2023-54287](https://cve.now/CVE-2023-54287.md): tty: serial: imx: disable Ageing Timer interrupt request irq (no CVSS, Linux)
- [CVE-2023-54286](https://cve.now/CVE-2023-54286.md): wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (CVSS 7.6, Linux)
- [CVE-2023-54285](https://cve.now/CVE-2023-54285.md): iomap: Fix possible overflow condition in iomap\_write\_delalloc\_scan (CVSS 7.1, Linux)
- [CVE-2023-54284](https://cve.now/CVE-2023-54284.md): media: av7110: prevent underflow in write\_ts\_to\_decoder() (CVSS 7.1, Linux)
- [CVE-2023-54283](https://cve.now/CVE-2023-54283.md): bpf: Address KCSAN report on bpf\_lru\_list (no CVSS, Linux)
- [CVE-2023-54282](https://cve.now/CVE-2023-54282.md): media: tuners: qt1010: replace BUG\_ON with a regular error (no CVSS, Linux)
- [CVE-2023-54281](https://cve.now/CVE-2023-54281.md): btrfs: release path before inode lookup during the ino lookup ioctl (no CVSS, Linux)
- [CVE-2023-54280](https://cve.now/CVE-2023-54280.md): cifs: fix potential race when tree connecting ipc (CVSS 9.8, Linux)
- [CVE-2022-50883](https://cve.now/CVE-2022-50883.md): bpf: Prevent decl\_tag from being referenced in func\_proto arg (no CVSS, Linux)
- [CVE-2022-50882](https://cve.now/CVE-2022-50882.md): media: uvcvideo: Fix memory leak in uvc\_gpio\_parse (no CVSS, Linux)
- [CVE-2022-50881](https://cve.now/CVE-2022-50881.md): wifi: ath9k: Fix use-after-free in ath9k\_hif\_usb\_disconnect() (no CVSS, Linux)
- [CVE-2022-50880](https://cve.now/CVE-2022-50880.md): wifi: ath10k: add peer map clean up for peer delete in ath10k\_sta\_state() (CVSS 8.8, Linux)
- [CVE-2022-50879](https://cve.now/CVE-2022-50879.md): objtool: Fix SEGFAULT (no CVSS, Linux)
- [CVE-2022-50878](https://cve.now/CVE-2022-50878.md): gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611\_connector\_init() (no CVSS, Linux)
- [CVE-2022-50877](https://cve.now/CVE-2022-50877.md): net: broadcom: bcm4908\_enet: update TX stats after actual transmission (no CVSS, Linux)
- [CVE-2022-50876](https://cve.now/CVE-2022-50876.md): usb: musb: Fix musb\_gadget.c rxstate overflow bug (no CVSS, Linux)
- [CVE-2022-50875](https://cve.now/CVE-2022-50875.md): of: overlay: fix null pointer dereferencing in find\_dup\_cset\_node\_entry() and find\_dup\_cset\_prop() (no CVSS, Linux)
- [CVE-2022-50874](https://cve.now/CVE-2022-50874.md): RDMA/erdma: Fix refcount leak in erdma\_mmap (no CVSS, Linux)
- [CVE-2025-14426](https://cve.now/CVE-2025-14426.md): Strong Testimonials \<= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update (CVSS 4.3, wpchill Strong Testimonials)
- [CVE-2023-54279](https://cve.now/CVE-2023-54279.md): MIPS: fw: Allow firmware to pass a empty env (no CVSS, Linux)
- [CVE-2023-54278](https://cve.now/CVE-2023-54278.md): s390/vmem: split pages when debug pagealloc is enabled (no CVSS, Linux)
- [CVE-2023-54277](https://cve.now/CVE-2023-54277.md): fbdev: udlfb: Fix endpoint check (no CVSS, Linux)
- [CVE-2023-54276](https://cve.now/CVE-2023-54276.md): nfsd: move init of percpu reply\_cache\_stats counters back to nfsd\_init\_net (no CVSS, Linux)
- [CVE-2023-54275](https://cve.now/CVE-2023-54275.md): wifi: ath11k: Fix memory leak in ath11k\_peer\_rx\_frag\_setup (no CVSS, Linux)
- [CVE-2023-54274](https://cve.now/CVE-2023-54274.md): RDMA/srpt: Add a check for valid 'mad\_agent' pointer (no CVSS, Linux)
- [CVE-2023-54273](https://cve.now/CVE-2023-54273.md): xfrm: Fix leak of dev tracker (no CVSS, Linux)
- [CVE-2023-54272](https://cve.now/CVE-2023-54272.md): fs/ntfs3: Fix a possible null-pointer dereference in ni\_clear() (no CVSS, Linux)
- [CVE-2023-54271](https://cve.now/CVE-2023-54271.md): blk-cgroup: Fix NULL deref caused by blkg\_policy\_data being installed before init (no CVSS, Linux)
- [CVE-2023-54270](https://cve.now/CVE-2023-54270.md): media: usb: siano: Fix use after free bugs caused by do\_submit\_urb (no CVSS, Linux)
- [CVE-2023-54269](https://cve.now/CVE-2023-54269.md): SUNRPC: double free xprt\_ctxt while still in use (CVSS 9.8, Linux)
- [CVE-2023-54268](https://cve.now/CVE-2023-54268.md): debugobjects: Don't wake up kswapd from fill\_pool() (no CVSS, Linux)
- [CVE-2023-54267](https://cve.now/CVE-2023-54267.md): powerpc/pseries: Rework lppaca\_shared\_proc() to avoid DEBUG\_PREEMPT (no CVSS, Linux)
- [CVE-2023-54266](https://cve.now/CVE-2023-54266.md): media: dvb-usb: m920x: Fix a potential memory leak in m920x\_i2c\_xfer() (no CVSS, Linux)
- [CVE-2023-54265](https://cve.now/CVE-2023-54265.md): ipv6: Fix an uninit variable access bug in \_\_ip6\_make\_skb() (no CVSS, Linux)
- [CVE-2023-54264](https://cve.now/CVE-2023-54264.md): fs/sysv: Null check to prevent null-ptr-deref bug (no CVSS, Linux)
- [CVE-2023-54263](https://cve.now/CVE-2023-54263.md): drm/nouveau/kms/nv50-: init hpd\_irq\_lock for PIOR DP (no CVSS, Linux)
- [CVE-2023-54262](https://cve.now/CVE-2023-54262.md): net/mlx5e: Don't clone flow post action attributes second time (CVSS 8.8, Linux)
- [CVE-2023-54261](https://cve.now/CVE-2023-54261.md): drm/amdkfd: Add missing gfx11 MQD manager callbacks (no CVSS, Linux)
- [CVE-2023-54260](https://cve.now/CVE-2023-54260.md): cifs: Fix lost destroy smbd connection when MR allocate failed (no CVSS, Linux)
- [CVE-2023-54259](https://cve.now/CVE-2023-54259.md): soundwire: bus: Fix unbalanced pm\_runtime\_put() causing usage count underflow (no CVSS, Linux)
- [CVE-2023-54258](https://cve.now/CVE-2023-54258.md): cifs: fix potential oops in cifs\_oplock\_break (CVSS 9.8, Linux)
- [CVE-2023-54257](https://cve.now/CVE-2023-54257.md): net: macb: fix a memory corruption in extended buffer descriptor mode (CVSS 9.8, Linux)
- [CVE-2023-54255](https://cve.now/CVE-2023-54255.md): sh: dma: Fix DMA channel offset calculation (no CVSS, Linux)
- [CVE-2023-54254](https://cve.now/CVE-2023-54254.md): drm/ttm: Don't leak a resource on eviction error (CVSS 7.8, Linux)
- [CVE-2023-54253](https://cve.now/CVE-2023-54253.md): btrfs: set page extent mapped after read\_folio in relocate\_one\_page (no CVSS, Linux)
- [CVE-2023-54252](https://cve.now/CVE-2023-54252.md): platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings (no CVSS, Linux)
- [CVE-2023-54251](https://cve.now/CVE-2023-54251.md): net/sched: taprio: Limit TCA\_TAPRIO\_ATTR\_SCHED\_CYCLE\_TIME to INT\_MAX. (no CVSS, Linux)
- [CVE-2023-54250](https://cve.now/CVE-2023-54250.md): ksmbd: avoid out of bounds access in decode\_preauth\_ctxt() (CVSS 8.2, Linux)
- [CVE-2023-54249](https://cve.now/CVE-2023-54249.md): bus: mhi: ep: Only send -ENOTCONN status if client driver is available (no CVSS, Linux)
- [CVE-2023-54248](https://cve.now/CVE-2023-54248.md): fs/ntfs3: Add check for kmemdup (no CVSS, Linux)
- [CVE-2023-54247](https://cve.now/CVE-2023-54247.md): bpf: Silence a warning in btf\_type\_id\_size() (no CVSS, Linux)
- [CVE-2023-54246](https://cve.now/CVE-2023-54246.md): rcuscale: Move rcu\_scale\_writer() schedule\_timeout\_uninterruptible() to \_idle() (no CVSS, Linux)
- [CVE-2023-54245](https://cve.now/CVE-2023-54245.md): ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds (no CVSS, Linux)
- [CVE-2023-54244](https://cve.now/CVE-2023-54244.md): ACPI: EC: Fix oops when removing custom query handlers (no CVSS, Linux)
- [CVE-2022-50873](https://cve.now/CVE-2022-50873.md): vdpa/vp\_vdpa: fix kfree a wrong pointer in vp\_vdpa\_remove (no CVSS, Linux)
- [CVE-2022-50872](https://cve.now/CVE-2022-50872.md): ARM: OMAP2+: Fix memory leak in realtime\_counter\_init() (no CVSS, Linux)
- [CVE-2022-50871](https://cve.now/CVE-2022-50871.md): wifi: ath11k: Fix qmi\_msg\_handler data structure initialization (CVSS 7.8, Linux)
- [CVE-2022-50870](https://cve.now/CVE-2022-50870.md): powerpc/rtas: avoid device tree lookups in rtas\_os\_term() (no CVSS, Linux)
- [CVE-2022-50869](https://cve.now/CVE-2022-50869.md): fs/ntfs3: Fix slab-out-of-bounds in r\_page (CVSS 7.8, Linux)
- [CVE-2022-50868](https://cve.now/CVE-2022-50868.md): hwrng: amd - Fix PCI device refcount leak (no CVSS, Linux)
- [CVE-2022-50867](https://cve.now/CVE-2022-50867.md): drm/msm/a6xx: Fix kvzalloc vs state\_kcalloc usage (CVSS 7.8, Linux)
- [CVE-2022-50866](https://cve.now/CVE-2022-50866.md): ASoC: pxa: fix null-pointer dereference in filter() (no CVSS, Linux)
- [CVE-2022-50865](https://cve.now/CVE-2022-50865.md): tcp: fix a signed-integer-overflow bug in tcp\_add\_backlog() (CVSS 7.5, Linux)
- [CVE-2022-50864](https://cve.now/CVE-2022-50864.md): nilfs2: fix shift-out-of-bounds due to too large exponent of block size (no CVSS, Linux)
- [CVE-2022-50863](https://cve.now/CVE-2022-50863.md): wifi: rtw89: free unused skb to prevent memory leak (no CVSS, Linux)
- [CVE-2022-50862](https://cve.now/CVE-2022-50862.md): bpf: prevent decl\_tag from being referenced in func\_proto (no CVSS, Linux)
- [CVE-2022-50861](https://cve.now/CVE-2022-50861.md): NFSD: Finish converting the NFSv2 GETACL result encoder (CVSS 7.5, Linux)
- [CVE-2022-50860](https://cve.now/CVE-2022-50860.md): apparmor: Fix memleak in alloc\_ns() (CVSS 7.8, Linux)
- [CVE-2022-50859](https://cve.now/CVE-2022-50859.md): cifs: Fix the error length of VALIDATE\_NEGOTIATE\_INFO message (no CVSS, Linux)
- [CVE-2022-50858](https://cve.now/CVE-2022-50858.md): mmc: alcor: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50857](https://cve.now/CVE-2022-50857.md): rapidio: rio: fix possible name leak in rio\_register\_mport() (no CVSS, Linux)
- [CVE-2022-50856](https://cve.now/CVE-2022-50856.md): cifs: Fix xid leak in cifs\_ses\_add\_channel() (no CVSS, Linux)
- [CVE-2022-50855](https://cve.now/CVE-2022-50855.md): bpf: prevent leak of lsm program after failed attach (no CVSS, Linux)
- [CVE-2022-50854](https://cve.now/CVE-2022-50854.md): nfc: virtual\_ncidev: Fix memory leak in virtual\_nci\_send() (no CVSS, Linux)
- [CVE-2022-50853](https://cve.now/CVE-2022-50853.md): NFSv4: Fix a credential leak in \_nfs4\_discover\_trunking() (no CVSS, Linux)
- [CVE-2022-50852](https://cve.now/CVE-2022-50852.md): wifi: mt76: mt7921: fix use after free in mt7921\_acpi\_read() (no CVSS, Linux)
- [CVE-2022-50851](https://cve.now/CVE-2022-50851.md): vhost\_vdpa: fix the crash in unmap a large memory (no CVSS, Linux)
- [CVE-2022-50850](https://cve.now/CVE-2022-50850.md): scsi: ipr: Fix WARNING in ipr\_init() (no CVSS, Linux)
- [CVE-2022-50849](https://cve.now/CVE-2022-50849.md): pstore: Avoid kcore oops by vmap()ing with VM\_IOREMAP (no CVSS, Linux)
- [CVE-2022-50848](https://cve.now/CVE-2022-50848.md): drivers: dio: fix possible memory leak in dio\_init() (no CVSS, Linux)
- [CVE-2023-54243](https://cve.now/CVE-2023-54243.md): netfilter: ebtables: fix table blob use-after-free (CVSS 7.8, Linux)
- [CVE-2023-54242](https://cve.now/CVE-2023-54242.md): block, bfq: Fix division by zero error on zero wsum (no CVSS, Linux)
- [CVE-2023-54241](https://cve.now/CVE-2023-54241.md): MIPS: KVM: Fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-54240](https://cve.now/CVE-2023-54240.md): net: ethernet: mtk\_eth\_soc: fix possible NULL pointer dereference in mtk\_hwlro\_get\_fdir\_all() (no CVSS, Linux)
- [CVE-2023-54239](https://cve.now/CVE-2023-54239.md): iommufd: Check for uptr overflow (no CVSS, Linux)
- [CVE-2023-54238](https://cve.now/CVE-2023-54238.md): mlx5: fix skb leak while fifo resync and push (CVSS 7.8, Linux)
- [CVE-2023-54237](https://cve.now/CVE-2023-54237.md): net/smc: fix potential panic dues to unprotected smc\_llc\_srv\_add\_link() (CVSS 9.8, Linux)
- [CVE-2023-54236](https://cve.now/CVE-2023-54236.md): net/net\_failover: fix txq exceeding warning (no CVSS, Linux)
- [CVE-2023-54235](https://cve.now/CVE-2023-54235.md): PCI/DOE: Fix destroy\_work\_on\_stack() race (no CVSS, Linux)
- [CVE-2023-54234](https://cve.now/CVE-2023-54234.md): scsi: mpi3mr: Fix missing mrioc-\>evtack\_cmds initialization (CVSS 7.8, Linux)
- [CVE-2023-54233](https://cve.now/CVE-2023-54233.md): ASoC: SOF: avoid a NULL dereference with unsupported widgets (no CVSS, Linux)
- [CVE-2023-54232](https://cve.now/CVE-2023-54232.md): m68k: Only force 030 bus error if PC not in exception table (no CVSS, Linux)
- [CVE-2023-54231](https://cve.now/CVE-2023-54231.md): net: libwx: fix memory leak in wx\_setup\_rx\_resources (no CVSS, Linux)
- [CVE-2023-54230](https://cve.now/CVE-2023-54230.md): amba: bus: fix refcount leak (no CVSS, Linux)
- [CVE-2023-54229](https://cve.now/CVE-2023-54229.md): wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (no CVSS, Linux)
- [CVE-2023-54228](https://cve.now/CVE-2023-54228.md): regulator: raa215300: Fix resource leak in case of error (no CVSS, Linux)
- [CVE-2023-54227](https://cve.now/CVE-2023-54227.md): blk-mq: fix tags leak when shrink nr\_hw\_queues (CVSS 7.5, Linux)
- [CVE-2023-54226](https://cve.now/CVE-2023-54226.md): af\_unix: Fix data races around sk-\>sk\_shutdown. (no CVSS, Linux)
- [CVE-2023-54225](https://cve.now/CVE-2023-54225.md): net: ipa: only reset hashed tables when supported (no CVSS, Linux)
- [CVE-2023-54224](https://cve.now/CVE-2023-54224.md): btrfs: fix lockdep splat and potential deadlock after failure running delayed items (no CVSS, Linux)
- [CVE-2023-54223](https://cve.now/CVE-2023-54223.md): net/mlx5e: xsk: Fix invalid buffer access for legacy rq (CVSS 9.8, Linux)
- [CVE-2023-54222](https://cve.now/CVE-2023-54222.md): hte: tegra-194: Fix off by one in tegra\_hte\_map\_to\_line\_id() (no CVSS, Linux)
- [CVE-2023-54221](https://cve.now/CVE-2023-54221.md): clk: imx93: fix memory leak and missing unwind goto in imx93\_clocks\_probe (no CVSS, Linux)
- [CVE-2023-54220](https://cve.now/CVE-2023-54220.md): serial: 8250: Fix oops for port-\>pm on uart\_change\_pm() (CVSS 7.8, Linux)
- [CVE-2023-54219](https://cve.now/CVE-2023-54219.md): Revert "IB/isert: Fix incorrect release of isert connection" (CVSS 7.5, Linux)
- [CVE-2023-54218](https://cve.now/CVE-2023-54218.md): net: Fix load-tearing on sk-\>sk\_stamp in sock\_recv\_cmsgs(). (no CVSS, Linux)
- [CVE-2023-54217](https://cve.now/CVE-2023-54217.md): Revert "drm/msm: Add missing check and destroy for alloc\_ordered\_workqueue" (no CVSS, Linux)
- [CVE-2023-54216](https://cve.now/CVE-2023-54216.md): net/mlx5e: TC, Fix using eswitch mapping in nic mode (CVSS 7.8, Linux)
- [CVE-2023-54215](https://cve.now/CVE-2023-54215.md): virtio-vdpa: Fix cpumask memory leak in virtio\_vdpa\_find\_vqs() (no CVSS, Linux)
- [CVE-2023-54214](https://cve.now/CVE-2023-54214.md): Bluetooth: L2CAP: Fix potential user-after-free (CVSS 8.8, Linux)
- [CVE-2023-54213](https://cve.now/CVE-2023-54213.md): USB: sisusbvga: Add endpoint checks (no CVSS, Linux)
- [CVE-2023-54211](https://cve.now/CVE-2023-54211.md): tracing: Fix warning in trace\_buffered\_event\_disable() (no CVSS, Linux)
- [CVE-2023-54210](https://cve.now/CVE-2023-54210.md): Bluetooth: hci\_sync: Avoid use-after-free in dbg for hci\_remove\_adv\_monitor() (CVSS 7.8, Linux)
- [CVE-2023-54209](https://cve.now/CVE-2023-54209.md): block: fix blktrace debugfs entries leakage (no CVSS, Linux)
- [CVE-2023-54208](https://cve.now/CVE-2023-54208.md): media: ov5675: Fix memleak in ov5675\_init\_controls() (no CVSS, Linux)
- [CVE-2023-54207](https://cve.now/CVE-2023-54207.md): HID: uclogic: Correct devm device reference for hidinput input\_dev name (no CVSS, Linux)
- [CVE-2023-54206](https://cve.now/CVE-2023-54206.md): net/sched: flower: fix filter idr initialization (CVSS 7.8, Linux)
- [CVE-2023-54205](https://cve.now/CVE-2023-54205.md): pinctrl: stm32: Fix refcount leak in stm32\_pctrl\_get\_irq\_domain (no CVSS, Linux)
- [CVE-2023-54204](https://cve.now/CVE-2023-54204.md): mmc: sunplus: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50847](https://cve.now/CVE-2022-50847.md): drm/bridge: it6505: Initialize AUX channel in it6505\_i2c\_probe (no CVSS, Linux)
- [CVE-2022-50846](https://cve.now/CVE-2022-50846.md): mmc: via-sdmmc: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50845](https://cve.now/CVE-2022-50845.md): ext4: fix inode leak in ext4\_xattr\_inode\_create() on an error path (no CVSS, Linux)
- [CVE-2022-50844](https://cve.now/CVE-2022-50844.md): drm/amdgpu: Fix type of second parameter in odn\_edit\_dpm\_table() callback (no CVSS, Linux)
- [CVE-2022-50843](https://cve.now/CVE-2022-50843.md): dm clone: Fix UAF in clone\_dtr() (no CVSS, Linux)
- [CVE-2022-50842](https://cve.now/CVE-2022-50842.md): drm/virtio: Check whether transferred 2D BO is shmem (no CVSS, Linux)
- [CVE-2022-50841](https://cve.now/CVE-2022-50841.md): fs/ntfs3: Add overflow check for attribute size (CVSS 7.8, Linux)
- [CVE-2022-50840](https://cve.now/CVE-2022-50840.md): scsi: snic: Fix possible UAF in snic\_tgt\_create() (no CVSS, Linux)
- [CVE-2022-50839](https://cve.now/CVE-2022-50839.md): jbd2: fix potential buffer head reference count leak (no CVSS, Linux)
- [CVE-2022-50838](https://cve.now/CVE-2022-50838.md): net: stream: purge sk\_error\_queue in sk\_stream\_kill\_queues() (no CVSS, Linux)
- [CVE-2022-50837](https://cve.now/CVE-2022-50837.md): net: dsa: tag\_8021q: avoid leaking ctx on dsa\_tag\_8021q\_register() error path (no CVSS, Linux)
- [CVE-2022-50836](https://cve.now/CVE-2022-50836.md): remoteproc: sysmon: fix memory leak in qcom\_add\_sysmon\_subdev() (no CVSS, Linux)
- [CVE-2022-50835](https://cve.now/CVE-2022-50835.md): jbd2: add miss release buffer head in fc\_do\_one\_pass() (no CVSS, Linux)
- [CVE-2022-50834](https://cve.now/CVE-2022-50834.md): nfc: Fix potential resource leaks (no CVSS, Linux)
- [CVE-2022-50833](https://cve.now/CVE-2022-50833.md): Bluetooth: use hdev-\>workqueue when queuing hdev-\>{cmd,ncmd}\_timer works (no CVSS, Linux)
- [CVE-2022-50832](https://cve.now/CVE-2022-50832.md): wifi: wilc1000: fix potential memory leak in wilc\_mac\_xmit() (no CVSS, Linux)
- [CVE-2022-50830](https://cve.now/CVE-2022-50830.md): auxdisplay: hd44780: Fix potential memory leak in hd44780\_remove() (no CVSS, Linux)
- [CVE-2022-50829](https://cve.now/CVE-2022-50829.md): wifi: ath9k: hif\_usb: Fix use-after-free in ath9k\_hif\_usb\_reg\_in\_cb() (no CVSS, Linux)
- [CVE-2022-50828](https://cve.now/CVE-2022-50828.md): clk: zynqmp: Fix stack-out-of-bounds in strncpy\` (no CVSS, Linux)
- [CVE-2023-54203](https://cve.now/CVE-2023-54203.md): ksmbd: fix slab-out-of-bounds in init\_smb2\_rsp\_hdr (CVSS 9.1, Linux)
- [CVE-2023-54202](https://cve.now/CVE-2023-54202.md): drm/i915: fix race condition UAF in i915\_perf\_add\_config\_ioctl (CVSS 7.8, Linux)
- [CVE-2023-54201](https://cve.now/CVE-2023-54201.md): RDMA/efa: Fix wrong resources deallocation order (CVSS 7.8, Linux)
- [CVE-2023-54200](https://cve.now/CVE-2023-54200.md): netfilter: nf\_tables: always release netdev hooks from notifier (CVSS 7.8, Linux)
- [CVE-2023-54199](https://cve.now/CVE-2023-54199.md): drm/msm/adreno: Fix null ptr access in adreno\_gpu\_cleanup() (no CVSS, Linux)
- [CVE-2023-54198](https://cve.now/CVE-2023-54198.md): tty: fix out-of-bounds access in tty\_driver\_lookup\_tty() (CVSS 7.8, Linux)
- [CVE-2023-54197](https://cve.now/CVE-2023-54197.md): Revert "Bluetooth: btsdio: fix use after free bug in btsdio\_remove due to unfinished work" (no CVSS, Linux)
- [CVE-2023-54196](https://cve.now/CVE-2023-54196.md): fs/ntfs3: Fix NULL pointer dereference in 'ni\_write\_inode' (no CVSS, Linux)
- [CVE-2023-54195](https://cve.now/CVE-2023-54195.md): rxrpc: Fix timeout of a call that hasn't yet been granted a channel (no CVSS, Linux)
- [CVE-2023-54194](https://cve.now/CVE-2023-54194.md): exfat: use kvmalloc\_array/kvfree instead of kmalloc\_array/kfree (no CVSS, Linux)
- [CVE-2023-54193](https://cve.now/CVE-2023-54193.md): net/sched: cls\_api: remove block\_cb from driver\_list before freeing (CVSS 7.8, Linux)
- [CVE-2023-54192](https://cve.now/CVE-2023-54192.md): f2fs: fix null pointer panic in tracepoint in \_\_replace\_atomic\_write\_block (no CVSS, Linux)
- [CVE-2023-54191](https://cve.now/CVE-2023-54191.md): wifi: mt76: mt7996: fix memory leak in mt7996\_mcu\_exit (no CVSS, Linux)
- [CVE-2023-54190](https://cve.now/CVE-2023-54190.md): leds: led-core: Fix refcount leak in of\_led\_get() (no CVSS, Linux)
- [CVE-2023-54189](https://cve.now/CVE-2023-54189.md): pstore/ram: Add check for kstrdup (no CVSS, Linux)
- [CVE-2023-54188](https://cve.now/CVE-2023-54188.md): dmaengine: apple-admac: Fix 'current\_tx' not getting freed (no CVSS, Linux)
- [CVE-2023-54187](https://cve.now/CVE-2023-54187.md): f2fs: fix potential corruption when moving a directory (CVSS 7.8, Linux)
- [CVE-2023-54186](https://cve.now/CVE-2023-54186.md): usb: typec: altmodes/displayport: fix pin\_assignment\_show (CVSS 7.8, Linux)
- [CVE-2023-54185](https://cve.now/CVE-2023-54185.md): btrfs: remove BUG\_ON()'s in add\_new\_free\_space() (no CVSS, Linux)
- [CVE-2023-54184](https://cve.now/CVE-2023-54184.md): scsi: target: iscsit: Free cmds before session free (CVSS 9.8, Linux)
- [CVE-2023-54183](https://cve.now/CVE-2023-54183.md): media: v4l2-core: Fix a potential resource leak in v4l2\_fwnode\_parse\_link() (no CVSS, Linux)
- [CVE-2023-54182](https://cve.now/CVE-2023-54182.md): f2fs: fix to check readonly condition correctly (CVSS 7.1, Linux)
- [CVE-2023-54181](https://cve.now/CVE-2023-54181.md): bpf: Fix issue in verifying allow\_ptr\_leaks (no CVSS, Linux)
- [CVE-2023-54180](https://cve.now/CVE-2023-54180.md): btrfs: handle case when repair happens with dev-replace (no CVSS, Linux)
- [CVE-2023-54179](https://cve.now/CVE-2023-54179.md): scsi: qla2xxx: Array index may go out of bound (no CVSS, Linux)
- [CVE-2023-54178](https://cve.now/CVE-2023-54178.md): of: unittest: fix null pointer dereferencing in of\_unittest\_find\_node\_by\_name() (no CVSS, Linux)
- [CVE-2023-54177](https://cve.now/CVE-2023-54177.md): quota: fix warning in dqgrab() (no CVSS, Linux)
- [CVE-2023-54176](https://cve.now/CVE-2023-54176.md): mptcp: stricter state check in mptcp\_worker (no CVSS, Linux)
- [CVE-2023-54175](https://cve.now/CVE-2023-54175.md): i2c: xiic: xiic\_xfer(): Fix runtime PM leak on error path (no CVSS, Linux)
- [CVE-2023-54174](https://cve.now/CVE-2023-54174.md): vfio: Fix NULL pointer dereference caused by uninitialized group-\>iommufd (no CVSS, Linux)
- [CVE-2023-54173](https://cve.now/CVE-2023-54173.md): bpf: Disable preemption in bpf\_event\_output (CVSS 7.8, Linux)
- [CVE-2023-54172](https://cve.now/CVE-2023-54172.md): x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction (no CVSS, Linux)
- [CVE-2023-54171](https://cve.now/CVE-2023-54171.md): tracing: Fix memory leak of iter-\>temp when reading trace\_pipe (no CVSS, Linux)
- [CVE-2023-54170](https://cve.now/CVE-2023-54170.md): keys: Fix linking a duplicate key to a keyring's assoc\_array (no CVSS, Linux)
- [CVE-2023-54169](https://cve.now/CVE-2023-54169.md): net/mlx5e: fix memory leak in mlx5e\_ptp\_open (no CVSS, Linux)
- [CVE-2023-54168](https://cve.now/CVE-2023-54168.md): RDMA/mlx4: Prevent shift wrapping in set\_user\_sq\_size() (CVSS 7.8, Linux)
- [CVE-2023-54167](https://cve.now/CVE-2023-54167.md): m68k: mm: Move initrd phys\_to\_virt handling after paging\_init() (no CVSS, Linux)
- [CVE-2023-54166](https://cve.now/CVE-2023-54166.md): igc: Fix Kernel Panic during ndo\_tx\_timeout callback (CVSS 7.8, Linux)
- [CVE-2023-54165](https://cve.now/CVE-2023-54165.md): zsmalloc: move LRU update from zs\_map\_object() to zs\_malloc() (CVSS 7.8, Linux)
- [CVE-2023-54164](https://cve.now/CVE-2023-54164.md): Bluetooth: ISO: fix iso\_conn related locking and validity issues (CVSS 8.0, Linux)
- [CVE-2022-50827](https://cve.now/CVE-2022-50827.md): scsi: lpfc: Fix memory leak in lpfc\_create\_port() (no CVSS, Linux)
- [CVE-2022-50826](https://cve.now/CVE-2022-50826.md): ipu3-imgu: Fix NULL pointer dereference in imgu\_subdev\_set\_selection() (no CVSS, Linux)
- [CVE-2022-50825](https://cve.now/CVE-2022-50825.md): usb: typec: wusb3801: fix fwnode refcount leak in wusb3801\_probe() (no CVSS, Linux)
- [CVE-2022-50824](https://cve.now/CVE-2022-50824.md): tpm: tpm\_tis: Add the missed acpi\_put\_table() to fix memory leak (no CVSS, Linux)
- [CVE-2022-50823](https://cve.now/CVE-2022-50823.md): clk: tegra: Fix refcount leak in tegra114\_clock\_init (no CVSS, Linux)
- [CVE-2022-50822](https://cve.now/CVE-2022-50822.md): RDMA/restrack: Release MR restrack when delete (CVSS 7.8, Linux)
- [CVE-2022-50821](https://cve.now/CVE-2022-50821.md): SUNRPC: Don't leak netobj memory when gss\_read\_proxy\_verf() fails (no CVSS, Linux)
- [CVE-2022-50820](https://cve.now/CVE-2022-50820.md): perf/arm\_dmc620: Fix hotplug callback leak in dmc620\_pmu\_init() (no CVSS, Linux)
- [CVE-2022-50819](https://cve.now/CVE-2022-50819.md): udmabuf: Set ubuf-\>sg = NULL if the creation of sg table fails (no CVSS, Linux)
- [CVE-2022-50818](https://cve.now/CVE-2022-50818.md): scsi: pm8001: Fix running\_req for internal abort commands (no CVSS, Linux)
- [CVE-2022-50817](https://cve.now/CVE-2022-50817.md): net: hsr: avoid possible NULL deref in skb\_clone() (no CVSS, Linux)
- [CVE-2022-50816](https://cve.now/CVE-2022-50816.md): ipv6: ensure sane device mtu in tunnels (no CVSS, Linux)
- [CVE-2022-50815](https://cve.now/CVE-2022-50815.md): ext2: Add sanity checks for group and filesystem size (no CVSS, Linux)
- [CVE-2022-50814](https://cve.now/CVE-2022-50814.md): crypto: hisilicon/zip - fix mismatch in get/set sgl\_sge\_nr (no CVSS, Linux)
- [CVE-2022-50813](https://cve.now/CVE-2022-50813.md): drivers: mcb: fix resource leak in mcb\_probe() (no CVSS, Linux)
- [CVE-2022-50812](https://cve.now/CVE-2022-50812.md): security: Restrict CONFIG\_ZERO\_CALL\_USED\_REGS to gcc or clang \> 15.0.6 (no CVSS, Linux)
- [CVE-2022-50811](https://cve.now/CVE-2022-50811.md): erofs: fix missing unmap if z\_erofs\_get\_extent\_compressedlen() fails (no CVSS, Linux)
- [CVE-2022-50810](https://cve.now/CVE-2022-50810.md): rapidio: devices: fix missing put\_device in mport\_cdev\_open (no CVSS, Linux)
- [CVE-2022-50809](https://cve.now/CVE-2022-50809.md): xhci: dbc: Fix memory leak in xhci\_alloc\_dbc() (no CVSS, Linux)
- [CVE-2023-54162](https://cve.now/CVE-2023-54162.md): ksmbd: fix possible memory leak in smb2\_lock() (CVSS 8.8, Linux)
- [CVE-2022-50786](https://cve.now/CVE-2022-50786.md): media: s5p-mfc: Clear workbit to handle error condition (no CVSS, Linux)
- [CVE-2022-50785](https://cve.now/CVE-2022-50785.md): fsi: occ: Prevent use after free (CVSS 7.8, Linux)
- [CVE-2022-50784](https://cve.now/CVE-2022-50784.md): wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone (no CVSS, Linux)
- [CVE-2025-15247](https://cve.now/CVE-2025-15247.md): gmg137 snap7-rs client.rs download heap-based overflow (CVSS 6.9, gmg137 snap7-rs)
- [CVE-2025-15246](https://cve.now/CVE-2025-15246.md): aizuda snail-job API FurySerializer.deserialize deserialization (CVSS 5.3, aizuda snail-job)
- [CVE-2025-14509](https://cve.now/CVE-2025-14509.md): Lucky Wheel for WooCommerce – Spin a Sale \<= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags (CVSS 7.2, villatheme Lucky Wheel for WooCommerce – Spin a Sale)
- [CVE-2025-15245](https://cve.now/CVE-2025-15245.md): D-Link DCS-850L Firmware Update Service uploadfirmware path traversal (CVSS 5.1, D-Link DCS-850L)
- [CVE-2025-69093](https://cve.now/CVE-2025-69093.md): WordPress ShopMagic plugin \<= 4.7.2 - Broken Access Control vulnerability (CVSS 5.3, wpdesk ShopMagic)
- [CVE-2025-69092](https://cve.now/CVE-2025-69092.md): WordPress Essential Addons for Elementor plugin \<= 6.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Addons for Elementor)
- [CVE-2025-69091](https://cve.now/CVE-2025-69091.md): WordPress Demo Importer Plus plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 4.3, Kraft Plugins Demo Importer Plus)
- [CVE-2025-69089](https://cve.now/CVE-2025-69089.md): WordPress Auto Listings plugin \<= 2.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, autolistings Auto Listings)
- [CVE-2025-69088](https://cve.now/CVE-2025-69088.md): WordPress Combo Offers WooCommerce plugin \<= 4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vidish Combo Offers WooCommerce)
- [CVE-2025-69034](https://cve.now/CVE-2025-69034.md): WordPress Lekker theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Lekker)
- [CVE-2025-69033](https://cve.now/CVE-2025-69033.md): WordPress Blog Filter plugin \<= 1.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, A WP Life Blog Filter)
- [CVE-2025-69032](https://cve.now/CVE-2025-69032.md): WordPress FiveStar theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes FiveStar)
- [CVE-2025-69031](https://cve.now/CVE-2025-69031.md): WordPress Arcane theme \<= 3.6.6 - Broken Access Control vulnerability (CVSS 5.3, Skywarrior Arcane)
- [CVE-2025-69030](https://cve.now/CVE-2025-69030.md): WordPress Backpack Traveler theme \<= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Backpack Traveler)
- [CVE-2025-69029](https://cve.now/CVE-2025-69029.md): WordPress Struktur theme \<= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Select-Themes Struktur)
- [CVE-2025-69028](https://cve.now/CVE-2025-69028.md): WordPress weForms plugin \<= 1.6.25 - Broken Access Control vulnerability (CVSS 5.3, BoldGrid weForms)
- [CVE-2025-69027](https://cve.now/CVE-2025-69027.md): WordPress Product Delivery Date for WooCommerce – Lite plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 5.3, tychesoftwares Product Delivery Date for WooCommerce – Lite)
- [CVE-2025-69026](https://cve.now/CVE-2025-69026.md): WordPress PopupKit plugin \<= 2.1.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, Roxnor PopupKit)
- [CVE-2025-69025](https://cve.now/CVE-2025-69025.md): WordPress Poptics plugin \<= 1.0.20 - Sensitive Data Exposure vulnerability (CVSS 4.3, Aethonic Poptics)
- [CVE-2025-69024](https://cve.now/CVE-2025-69024.md): WordPress BizPrint plugin \<= 4.6.7 - Broken Access Control vulnerability (CVSS 6.5, bizswoop BizPrint)
- [CVE-2025-69023](https://cve.now/CVE-2025-69023.md): WordPress Discussion Board plugin \<= 2.5.7 - Broken Access Control vulnerability (CVSS 4.3, Marketing Fire Discussion Board)
- [CVE-2025-69022](https://cve.now/CVE-2025-69022.md): WordPress HR Management Lite plugin \<= 3.6 - Broken Access Control vulnerability (CVSS 5.4, Weblizar - WordPress Themes & Plugin HR Management Lite)
- [CVE-2025-69021](https://cve.now/CVE-2025-69021.md): WordPress Popup box plugin \<= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Ays Pro Popup box)
- [CVE-2025-69020](https://cve.now/CVE-2025-69020.md): WordPress Newsletters plugin \<= 4.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tribulant Software Newsletters)
- [CVE-2025-69019](https://cve.now/CVE-2025-69019.md): WordPress FlippingBook plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FlippingBook)
- [CVE-2025-69018](https://cve.now/CVE-2025-69018.md): WordPress Web Directory Free plugin \<= 1.7.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Shamalli Web Directory Free)
- [CVE-2025-69017](https://cve.now/CVE-2025-69017.md): WordPress RestroPress plugin \<= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Magnigenie RestroPress)
- [CVE-2025-69016](https://cve.now/CVE-2025-69016.md): WordPress Shortcodes and extra features for Phlox theme plugin \<= 2.17.22 - Broken Access Control vulnerability (CVSS 4.3, Averta Shortcodes and extra features for Phlox theme)
- [CVE-2025-69015](https://cve.now/CVE-2025-69015.md): WordPress Crowdsignal Forms plugin \<= 1.7.2 - Broken Access Control vulnerability (CVSS 3.8, Automattic Crowdsignal Forms)
- [CVE-2025-69014](https://cve.now/CVE-2025-69014.md): WordPress Youzify plugin \<= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Youzify)
- [CVE-2025-69013](https://cve.now/CVE-2025-69013.md): WordPress Stratum plugin \<= 1.6.1 - Broken Access Control vulnerability (CVSS 4.3, jetmonsters Stratum)
- [CVE-2025-69012](https://cve.now/CVE-2025-69012.md): WordPress Event Organiser plugin \<= 3.12.8 - Broken Access Control vulnerability (CVSS 4.3, Stephen Harris Event Organiser)
- [CVE-2025-69010](https://cve.now/CVE-2025-69010.md): WordPress Themebeez Toolkit plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 5.3, Themebeez Toolkit)
- [CVE-2025-69009](https://cve.now/CVE-2025-69009.md): WordPress Medicalequipment theme \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3, kamleshyadav Medicalequipment)
- [CVE-2025-69008](https://cve.now/CVE-2025-69008.md): WordPress Inboxify Sign Up Form plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Inboxify Sign Up Form)
- [CVE-2025-69007](https://cve.now/CVE-2025-69007.md): WordPress Popping Sidebars and Widgets Light plugin \<= 1.27 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, OTWthemes Popping Sidebars and Widgets Light)
- [CVE-2025-69006](https://cve.now/CVE-2025-69006.md): WordPress AM Events plugin \<= 1.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Atte Moisio AM Events)
- [CVE-2025-68998](https://cve.now/CVE-2025-68998.md): WordPress Heateor Social Login plugin \<= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Heateor Support Heateor Social Login)
- [CVE-2025-68997](https://cve.now/CVE-2025-68997.md): WordPress wpDiscuz plugin \<= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, AdvancedCoding wpDiscuz)
- [CVE-2025-68996](https://cve.now/CVE-2025-68996.md): WordPress Responsive Posts Carousel Pro plugin \<= 15.1 - Local File Inclusion vulnerability (CVSS 7.5, WebCodingPlace Responsive Posts Carousel Pro)
- [CVE-2025-68995](https://cve.now/CVE-2025-68995.md): WordPress My Sticky Elements plugin \<= 2.3.3 - Broken Access Control vulnerability (CVSS 4.3, Premio My Sticky Elements)
- [CVE-2025-68994](https://cve.now/CVE-2025-68994.md): WordPress Product Loops for WooCommerce plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 5.3, XforWooCommerce Product Loops for WooCommerce)
- [CVE-2025-68993](https://cve.now/CVE-2025-68993.md): WordPress Share, Print and PDF Products for WooCommerce plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 5.3, XforWooCommerce Share, Print and PDF Products for WooCommer…)
- [CVE-2025-68992](https://cve.now/CVE-2025-68992.md): WordPress BWL Knowledge Base Manager plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, xenioushk BWL Knowledge Base Manager)
- [CVE-2025-68991](https://cve.now/CVE-2025-68991.md): WordPress BWL Pro Voting Manager plugin \<= 1.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, xenioushk BWL Pro Voting Manager)
- [CVE-2025-68990](https://cve.now/CVE-2025-68990.md): WordPress BWL Pro Voting Manager plugin \<= 1.4.9 - SQL Injection vulnerability (CVSS 8.5, xenioushk BWL Pro Voting Manager)
- [CVE-2025-68989](https://cve.now/CVE-2025-68989.md): WordPress Contact Form 7 Extension For Mailchimp plugin \<= 0.9.68 - Sensitive Data Exposure vulnerability (CVSS 4.3, Renzo Johnson contact-form-7-mailchimp-extension)
- [CVE-2025-68988](https://cve.now/CVE-2025-68988.md): WordPress E-Invoice App Malaysia plugin \<= 1.3.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, o2oe E-Invoice App Malaysia)
- [CVE-2025-68987](https://cve.now/CVE-2025-68987.md): WordPress Cinerama theme \<= 2.9 - Local File Inclusion vulnerability (CVSS 7.5, Edge-Themes Cinerama)
- [CVE-2025-68985](https://cve.now/CVE-2025-68985.md): WordPress Aora theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 7.5, thembay Aora)
- [CVE-2025-68984](https://cve.now/CVE-2025-68984.md): WordPress Puca theme \<= 2.6.39 - Local File Inclusion vulnerability (CVSS 7.5, thembay Puca)
- [CVE-2025-68983](https://cve.now/CVE-2025-68983.md): WordPress Greenmart theme \<= 4.2.11 - Local File Inclusion vulnerability (CVSS 7.5, thembay Greenmart)
- [CVE-2025-68982](https://cve.now/CVE-2025-68982.md): WordPress DesignThemes LMS Addon plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 5.3, DesignThemes LMS Addon)
- [CVE-2025-68981](https://cve.now/CVE-2025-68981.md): WordPress HomeFix Elementor Portfolio plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.3, designthemes HomeFix Elementor Portfolio)
- [CVE-2025-68980](https://cve.now/CVE-2025-68980.md): WordPress WeDesignTech Portfolio plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.3, designthemes WeDesignTech Portfolio)
- [CVE-2025-68979](https://cve.now/CVE-2025-68979.md): WordPress Google Calendar Events plugin \<= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, SimpleCalendar Google Calendar Events)
- [CVE-2025-68978](https://cve.now/CVE-2025-68978.md): WordPress DesignThemes Core plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DesignThemes Core)
- [CVE-2025-68977](https://cve.now/CVE-2025-68977.md): WordPress DesignThemes Portfolio Addon plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DesignThemes Portfolio Addon)
- [CVE-2025-68976](https://cve.now/CVE-2025-68976.md): WordPress Eagle Booking plugin \<= 1.3.4.3 - Settings Change vulnerability (CVSS 5.4, Eagle-Themes Eagle Booking)
- [CVE-2025-68975](https://cve.now/CVE-2025-68975.md): WordPress Eagle Booking plugin \<= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Eagle-Themes Eagle Booking)
- [CVE-2025-68974](https://cve.now/CVE-2025-68974.md): WordPress WordPress Social Login and Register plugin \<= 7.7.0 - Local File Inclusion vulnerability (CVSS 6.6, miniOrange WordPress Social Login and Register)
- [CVE-2025-15244](https://cve.now/CVE-2025-15244.md): PHPEMS Purchase Request race condition (CVSS 6.3, PHPEMS)
- [CVE-2025-15243](https://cve.now/CVE-2025-15243.md): code-projects Simple Stock System login.php sql injection (CVSS 6.9, code-projects Simple Stock System)
- [CVE-2025-15242](https://cve.now/CVE-2025-15242.md): PHPEMS Coupon race condition (CVSS 2.3, PHPEMS)
- [CVE-2025-15359](https://cve.now/CVE-2025-15359.md): DVP-12SE11T - Out-of-bound memory write Vulnerability (CVSS 9.1, Delta Electronics DVP-12SE11T)
- [CVE-2025-15358](https://cve.now/CVE-2025-15358.md): DVP-12SE11T - Denial of Service Vulnerability (CVSS 7.5, Delta Electronics DVP-12SE11T)
- [CVE-2025-15241](https://cve.now/CVE-2025-15241.md): CloudPanel Community Edition HTTP Header users redirect (CVSS 5.1, CloudPanel Community Edition)
- [CVE-2025-15103](https://cve.now/CVE-2025-15103.md): DVP-12SE11T - Authentication Bypass via Partial Password Disclosure (CVSS 8.1, Delta Electronics DVP-12SE11T)
- [CVE-2025-15102](https://cve.now/CVE-2025-15102.md): DVP-12SE11T - Password Protection Bypass (CVSS 9.1, Delta Electronics DVP-12SE11T)
- [CVE-2025-15234](https://cve.now/CVE-2025-15234.md): Tenda M3 setInternetLanInfo formSetRemoteInternetLanInfo heap-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15233](https://cve.now/CVE-2025-15233.md): Tenda M3 setAdInfoDetail formSetAdInfoDetails heap-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15355](https://cve.now/CVE-2025-15355.md): NetVision Information｜ISOinsight - Reflected Cross-site Scripting (CVSS 5.1, NetVision Information ISOinsight)
- [CVE-2025-15232](https://cve.now/CVE-2025-15232.md): Tenda M3 setAdPushInfo formSetAdPushInfo stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15231](https://cve.now/CVE-2025-15231.md): Tenda M3 setVlanInfo formSetRemoteVlanInfo stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15230](https://cve.now/CVE-2025-15230.md): Tenda M3 setVlanPolicyData formSetVlanPolicy heap-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-15229](https://cve.now/CVE-2025-15229.md): Tenda CH22 DhcpListClient fromDhcpListClient denial of service (CVSS 6.9, Tenda CH22)
- [CVE-2025-14313](https://cve.now/CVE-2025-14313.md): Advance WP Query Search Filter \<= 1.0.10 - Reflected XSS via taxo\_ajax (CVSS 6.1, Advance WP Query Search Filter)
- [CVE-2025-14312](https://cve.now/CVE-2025-14312.md): Advance WP Query Search Filter \<= 1.0.10 - Reflected XSS via counter (CVSS 6.1, Advance WP Query Search Filter)
- [CVE-2025-15222](https://cve.now/CVE-2025-15222.md): Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization (CVSS 2.3, Dromara Sa-Token)
- [CVE-2025-15221](https://cve.now/CVE-2025-15221.md): SohuTV CacheCloud AppDataMigrateController.java index cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15220](https://cve.now/CVE-2025-15220.md): SohuTV CacheCloud LoginController.java init cross site scripting (CVSS 5.3, SohuTV CacheCloud)
- [CVE-2025-15219](https://cve.now/CVE-2025-15219.md): SohuTV CacheCloud MachineManageController.java doPodList cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15218](https://cve.now/CVE-2025-15218.md): Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC10U)
- [CVE-2025-15217](https://cve.now/CVE-2025-15217.md): Tenda AC23 HTTP POST Request formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-15216](https://cve.now/CVE-2025-15216.md): Tenda AC23 SetIpMacBind fromSetIpMacBind stack-based overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-15215](https://cve.now/CVE-2025-15215.md): Tenda AC10U HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC10U)
- [CVE-2025-15214](https://cve.now/CVE-2025-15214.md): Campcodes Park Ticketing System admin\_class.php save\_pricing cross site scripting (CVSS 4.8, Campcodes Park Ticketing System)
- [CVE-2025-69235](https://cve.now/CVE-2025-69235.md): Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. (CVSS 7.5, NAVER Whale browser)
- [CVE-2025-69234](https://cve.now/CVE-2025-69234.md): Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment. (CVSS 9.1, NAVER Whale browser)
- [CVE-2025-15213](https://cve.now/CVE-2025-15213.md): code-projects Student File Management System File Download download.php improper authorization (CVSS 5.3, code-projects Student File Management System)
- [CVE-2025-69217](https://cve.now/CVE-2025-69217.md): Coturn has unsafe nonce and relay port randomization due to weak random number generation. (CVSS 7.7, coturn)
- [CVE-2025-15212](https://cve.now/CVE-2025-15212.md): code-projects Refugee Food Management System regfood.php sql injection (CVSS 5.3, code-projects Refugee Food Management System)
- [CVE-2025-15211](https://cve.now/CVE-2025-15211.md): code-projects Refugee Food Management System refugee.php sql injection (CVSS 5.3, code-projects Refugee Food Management System)
- [CVE-2025-56332](https://cve.now/CVE-2025-56332.md): Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration (CVSS 9.1)
- [CVE-2025-61557](https://cve.now/CVE-2025-61557.md): nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal. (CVSS 7.5)
- [CVE-2025-65409](https://cve.now/CVE-2025-65409.md): A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputtin (CVSS 7.5)
- [CVE-2025-65411](https://cve.now/CVE-2025-65411.md): A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecti (CVSS 7.5)
- [CVE-2025-65925](https://cve.now/CVE-2025-65925.md): An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. (CVSS 6.5)
- [CVE-2025-66723](https://cve.now/CVE-2025-66723.md): inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows atta (CVSS 7.5)
- [CVE-2025-66823](https://cve.now/CVE-2025-66823.md): An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HT (CVSS 3.5)
- [CVE-2025-66824](https://cve.now/CVE-2025-66824.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueCo (CVSS 7.3)
- [CVE-2025-66834](https://cve.now/CVE-2025-66834.md): A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exp (CVSS 7.3)
- [CVE-2025-66835](https://cve.now/CVE-2025-66835.md): TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the use (CVSS 7.1)
- [CVE-2025-66848](https://cve.now/CVE-2025-66848.md): JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r43 (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.