CVEs published January 14, 2026
180 CVEs were published on January 14, 2026: 11 critical, 49 high.
- Published
- 180
- Critical
- 11
- High
- 49
- Medium
- 85
- Low
- 3
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 63
Most affected products
- Linux
- 43
- Huawei HarmonyOS
- 13
- FreeRDP
- 9
- Bluspark Global BLUVOYIX
- 5
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- 5
- Insyde Software InsydeH2O tools
- 4
- Wireshark Foundation Wireshark
- 4
- Huawei HarmonyOS · Huawei EMUI
- 3
- Lenovo ThinkPlus FU100 · Lenovo ThinkPlus FU200 +2
- 3
- Typesetter
- 3
Critical 11
- CVE-2025-37184Unauthenticated Bypass Allows Multi-Factor Authentication CircumventionHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2025-71116libceph: make decode_pool() more resilient against corrupted osdmapsLinux
- CVE-2026-22240Plaintext Passwords Vulnerability in BLUVOYIXBluspark Global BLUVOYIX
- CVE-2026-22239Email Sending Vulnerability in BLUVOYIXBluspark Global BLUVOYIX
- CVE-2026-22238Administrator Account Creation Vulnerability in BLUVOYIXBluspark Global BLUVOYIX
- CVE-2026-22237Exposed Internal API Documentation Vulnerability in BLUVOYIXBluspark Global BLUVOYIX
- CVE-2026-22236Improper Authentication Vulnerability in BLUVOYIXBluspark Global BLUVOYIX
- CVE-2026-23550WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerabilityModular DS
- CVE-2025-14502News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusionvaghasia3 News and Blog Designer Bundle
- CVE-2025-14301Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversalwoosaai Integration Opvius AI for WooCommerce
- CVE-2025-70968FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().
High 49
- CVE-2025-12166Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameterscroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-0421A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Lenovo ThinkPad L13 Gen 6 BIOS · Lenovo ThinkPad L13 Gen… +2
- CVE-2025-13455A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authLenovo ThinkPlus FU100 · Lenovo ThinkPlus FU200 +2
- CVE-2026-0861Integer overflow in memalign leads to heap corruptionThe GNU C Library glibc
- CVE-2026-23512SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cppsumatrapdfreader sumatrapdf
- CVE-2025-11224Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-23498Shopware Improper Control of Generation of Code in Twig rendered viewsshopware · shopware/shopware +1
- CVE-2025-33206NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection.NVIDIA NSIGHT Graphics
- CVE-2026-23492Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848pimcore · pimcore/pimcore
- CVE-2026-23477Rocket.Chat Unauthorized Access to OAuth App DetailsRocketChat Rocket.Chat
- CVE-2026-22787html2pdf.js has a cross-site scripting vulnerabilityeKoopmans html2pdf.js · html2pdf.js
- CVE-2026-22708Cursor has a Terminal Tool Allowlist Bypass via Environment Variablescursor
- CVE-2025-37181Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2025-37183Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2025-37182Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2025-71136media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()Linux
- CVE-2025-71132smc91x: fix broken irq-context in PREEMPT_RTLinux
- CVE-2025-71131crypto: seqiv - Do not use req->iv after crypto_aead_encryptLinux
- CVE-2025-71130drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbufferLinux
- CVE-2025-71128erspan: Initialize options_len before referencing options.Linux
- CVE-2025-71127wifi: mac80211: Discard Beacon frames to non-broadcast addressLinux
- CVE-2025-71126mptcp: avoid deadlock on fallback while reinjectingLinux
- CVE-2025-71120SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verfLinux
- CVE-2025-71112net: hns3: add VLAN id validation before usingLinux
- CVE-2025-71109MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bitsLinux
- CVE-2025-9142Local privilege escalation in Harmony SASE Windows Agentcheckpoint Hramony SASE
- CVE-2025-14317User Enumeration in Crazy Bubble Tea mobile applicationEmaintenance Crazy Bubble Tea
- CVE-2025-14338Polkit authentication dis isabled by default in inputplumberhttps://github.com/ShadowBlip inputplumber
- CVE-2025-66005Lack of Authentication in the InputManager D-Bus interfacehttps://github.com/ShadowBlip inputplumber
- CVE-2025-0647In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to thArm Neoverse-N2 · Arm Neoverse-V3AE +9
- CVE-2026-0532External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini ConnectorElastic Kibana
- CVE-2025-14770Shipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parametertridenttechnolabs Shipping Rate By Cities
- CVE-2025-14613GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attributedaschmi GetContentFromURL
- CVE-2025-15266GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scriptingahmadgb GeekyBot — Generate AI Content Without Prompt, Chat…
- CVE-2025-15378AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scriptingajseidl AJS Footnotes
- CVE-2025-15283Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parametersjeroenpeters1986 Name Directory
- CVE-2025-14615DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injectiondashboardbuilder DASHBOARD BUILDER – WordPress plugin for C…
- CVE-2025-68968Double free vulnerability in the multi-mode input module.Huawei HarmonyOS
- CVE-2025-68960Multi-thread race condition vulnerability in the video framework module.Huawei HarmonyOS
- CVE-2025-68958Multi-thread race condition vulnerability in the card framework module.Huawei HarmonyOS
- CVE-2025-68957Multi-thread race condition vulnerability in the card framework module.Huawei HarmonyOS
- CVE-2025-68956Multi-thread race condition vulnerability in the card framework module.Huawei HarmonyOS
- CVE-2025-68955Multi-thread race condition vulnerability in the card framework module.Huawei HarmonyOS
- CVE-2025-12053egwindrvx64.sys is potentially vulnerable to a buffer overflowInsyde Software InsydeH2O tools
- CVE-2025-12052egwindrv.sys is potentially vulnerable to a buffer overflow.Insyde Software InsydeH2O tools
- CVE-2025-12051H2OFFT64.sys is potentially vulnerable to a buffer overflow.Insyde Software InsydeH2O tools
- CVE-2025-12050In H2OFFT32.sys is potentially vulnerable to a buffer overflow.Insyde Software InsydeH2O tools
- CVE-2025-70747Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function.
- CVE-2025-71021Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function.
Medium, low and unrated 120
- CVE-2026-0600Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository ConfigurationSonatype Nexus Repository
- CVE-2025-14058A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical accLenovo Tab M11 TB330FU TB330XU · Lenovo Tab K11 TB330FU +29
- CVE-2025-13454A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to senLenovo ThinkPlus FU100 · Lenovo ThinkPlus FU200 +2
- CVE-2025-13453A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the Lenovo ThinkPlus FU100 · Lenovo ThinkPlus FU200 +2
- CVE-2025-13154An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated locaLenovo Vantage
- CVE-2026-0601Nexus Repository 3 - Cross-Site ScriptingSonatype Nexus Repository
- CVE-2026-0961Out-of-bounds Write in WiresharkWireshark Foundation Wireshark
- CVE-2026-0962Out-of-bounds Write in WiresharkWireshark Foundation Wireshark
- CVE-2026-0960Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2026-0959Out-of-bounds Write in WiresharkWireshark Foundation Wireshark
- CVE-2026-22036Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionnodejs undici · undici
- CVE-2025-14557XSS in Drupal 7 Facebook Pixel ModuleDrupal Facebook Pixel
- CVE-2025-14556XSS in Drupal 7 Flag ModuleDrupal Flag
- CVE-2025-71166Typesetter CMS Reflected XSS via Move Message HandlingTypesetter
- CVE-2025-71165Typesetter CMS Reflected XSS via Status.phpTypesetter
- CVE-2025-71164Typesetter CMS Reflected XSS via Editing.phpTypesetter
- CVE-2026-23497Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pagesfrappe lms
- CVE-2026-22819Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.tsakinloluwami outray · outray
- CVE-2026-22859FreeRDP has a heap-buffer-overflow in urb_select_configurationFreeRDP
- CVE-2026-22858FreeRDP has a global-buffer-overflow in crypto_base64_decodeFreeRDP
- CVE-2026-22857FreeRDP has a heap-use-after-free in irp_thread_funcFreeRDP
- CVE-2026-22856FreeRDP has a heap-use-after-free in create_irp_threadFreeRDP
- CVE-2026-22855FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_callFreeRDP
- CVE-2026-22854FreeRDP has a heap-buffer-overflow in drive_process_irp_readFreeRDP
- CVE-2026-22853FreeRDP has a heap-buffer-overflow in ndr_read_uint8ArrayFreeRDP
- CVE-2026-22852FreeRDP has a heap-buffer-overflow in audin_process_formatsFreeRDP
- CVE-2026-22851FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)FreeRDP
- CVE-2026-22779BlackSheep ClientSession is vulnerable to CRLF injectionNeoteroi BlackSheep · blacksheep
- CVE-2026-22694AliasVault is Missing Origin Validation in Android Passkey Credential Provideraliasvault
- CVE-2026-21889Weblate leaks information via screenshotsWeblateOrg weblate · weblate
- CVE-2025-37185Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration InterfaceHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2025-14242Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsingRed Hat Enterprise Linux
- CVE-2026-22211TinyOS <= 2.1.2 Global Buffer Overflow in printfUARTTinyOS
- CVE-2025-71144mptcp: ensure context reset on disconnect()Linux
- CVE-2025-71143clk: samsung: exynos-clkout: Assign .num before accessing .hwsLinux
- CVE-2025-71142cpuset: fix warning when disabling remote partitionLinux
- CVE-2025-71141drm/tilcdc: Fix removal actions in case of failed probeLinux
- CVE-2025-71140media: mediatek: vcodec: Use spinlock for context list protection lockLinux
- CVE-2025-71139kernel/kexec: fix IMA when allocation happens in CMA areaLinux
- CVE-2025-71138drm/msm/dpu: Add missing NULL pointer check for pingpong interfaceLinux
- CVE-2025-71137octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"Linux
- CVE-2025-71135md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()Linux
- CVE-2025-71134mm/page_alloc: change all pageblocks migrate type on coalescingLinux
- CVE-2025-71133RDMA/irdma: avoid invalid read in irdma_net_eventLinux
- CVE-2025-71129LoongArch: BPF: Sign extend kfunc call argumentsLinux
- CVE-2026-22820Outray cli is vulnerable to race conditions in tunnels creationakinloluwami outray · outray
- CVE-2025-71125tracing: Do not register unsupported perf eventsLinux
- CVE-2025-71124drm/msm/a6xx: move preempt_prepare_postamble after error checkLinux
- CVE-2025-71123ext4: fix string copying in parse_apply_sb_mount_options()Linux
- CVE-2025-71122iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVEDLinux
- CVE-2025-71121parisc: Do not reprogram affinitiy on ASP chipLinux
- CVE-2025-71119powerpc/kexec: Enable SMT before waking offline CPUsLinux
- CVE-2025-71118ACPICA: Avoid walking the Namespace if start_node is NULLLinux
- CVE-2025-71117block: Remove queue freezing from several sysfs store callbacksLinux
- CVE-2025-71115um: init cpu_tasks[] earlierLinux
- CVE-2025-71114via_wdt: fix critical boot hang due to unnamed resource allocationLinux
- CVE-2025-71113crypto: af_alg - zero initialize memory allocated via sock_kmallocLinux
- CVE-2025-71111hwmon: (w83791d) Convert macros to functions to avoid TOCTOULinux
- CVE-2025-71110mm/slub: reset KASAN tag in defer_free() before accessing freed memoryLinux
- CVE-2025-71108usb: typec: ucsi: Handle incorrect num_connectors capabilityLinux
- CVE-2025-71107f2fs: ensure node page reads complete before f2fs_put_super() finishesLinux
- CVE-2025-71106fs: PM: Fix reverse check in filesystems_freeze_callback()Linux
- CVE-2025-71105f2fs: use global inline_xattr_slab instead of per-sb slab cacheLinux
- CVE-2025-71104KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timerLinux
- CVE-2025-71103drm/msm: adreno: fix deferencing ifpc_reglist when not declaredLinux
- CVE-2025-71102scs: fix a wrong parameter in __scs_magicLinux
- CVE-2025-13175Insecure Password Storage in Y Soft SafeQ 6YSoft SafeQ
- CVE-2025-66169Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j componentApache Software Foundation Apache Camel Neo4j · org.apache.…
- CVE-2025-67859Polkit Authorization Check can be Bypassed in the TLP power daemonhttps://github.com/linrunner TLP
- CVE-2026-0529Improper Validation of Array Index in Packetbeat Leading to Overflow BuffersElastic Packetbeat
- CVE-2025-15475PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status ModificationPayHere Payment Gateway
- CVE-2025-15376Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgeryrndsand81 Stopwords for comments
- CVE-2025-14173Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletionperfitdev Perfit WooCommerce
- CVE-2025-14846SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Updatesocialchampio Auto Post to Social Media from Social Champ
- CVE-2025-15513Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulationfloattechnologies Float Payment Gateway
- CVE-2026-0741Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameterselectric-studio Electric Studio Download Counter
- CVE-2025-15512Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulationaplazopayment Aplazo Payment Gateway
- CVE-2026-0813Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Pageprasannasp Short Link
- CVE-2026-0734WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameterdfieldfl WP Allowed Hosts
- CVE-2026-0812LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Pageguillaumev LinkedIn SC
- CVE-2026-0739WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameterswebbu WMF Mobile Redirector
- CVE-2025-68492Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability.Chainlit
- CVE-2025-15486Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingkunzemarketing Kunze Law
- CVE-2025-14854WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modificationnofearinc WP-CRM System – Manage Clients and Projects
- CVE-2025-12178SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeaankit SpiceForms Form Builder
- CVE-2025-15021Gotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsgothamdev Gotham Block Extra Light
- CVE-2025-15020Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcodegothamdev Gotham Block Extra Light
- CVE-2025-14464PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentialskiwicommerce PDF Resume Parser
- CVE-2025-13627Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' SettingMakesweat
- CVE-2025-14880Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modificationnetcashpaynow Netcash WooCommerce Payment Gateway
- CVE-2025-14482Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updatecrushpics Crush.pics Image Optimizer – Image Compression an…
- CVE-2026-0635Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'techknowprime Responsive Accordion Slider
- CVE-2026-0678Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameterlogiceverest Shipping Rates by City for WooCommerce
- CVE-2026-0694SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleSearchWiz
- CVE-2025-14379Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scriptingadoncreatives Testimonials Creator
- CVE-2025-15377Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgeryabage Sosh Share Buttons
- CVE-2026-0680Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settingsvk011 Real Post Slider Lite
- CVE-2025-14725Internal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settingssablab Internal Link Builder
- CVE-2026-0717LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information ExposureLottieFiles
- CVE-2025-14389WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Updateobridgeacademy WPBlogSyn
- CVE-2026-0594List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphamallsop List Site Contributors
- CVE-2026-22718Command injection vulnerabilitySpring CLI VSCode Extension
- CVE-2025-68959Permission verification bypass vulnerability in the media library module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-68970Permission verification bypass vulnerability in the media library module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-68963Man-in-the-middle attack vulnerability in the Clone module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-68967Vulnerability of improper permission control in the print module.Huawei HarmonyOS
- CVE-2025-68966Permission control vulnerability in the Notepad module.Huawei HarmonyOS
- CVE-2025-68965Permission control vulnerability in the Notepad module.Huawei HarmonyOS
- CVE-2025-68964Data verification vulnerability in the HiView module.Huawei HarmonyOS
- CVE-2025-68969Multi-thread race condition vulnerability in the thermal management module.Huawei HarmonyOS
- CVE-2025-68962Multi-thread race condition vulnerability in the camera framework module.Huawei HarmonyOS
- CVE-2025-68961Multi-thread race condition vulnerability in the camera framework module.Huawei HarmonyOS
- CVE-2025-56226Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.
- CVE-2025-63644A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.ph7software/ph7builder
- CVE-2025-65396A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hi
- CVE-2025-65397An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows a
- CVE-2025-67399An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the U
- CVE-2025-67833Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter.
- CVE-2025-67834Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter.
- CVE-2025-67835Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated attacker via the Notification Contacts func