CVE-2025 records published in February 2025
This page lists the 1,793 CVE-2025 records published in February 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 11 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 20811.6% of these records
- Listed in CISA KEV
- 110.6% of these records
- Reported exploited
- 50.3% of these records
- Detection signal
- 382.1% of these records
- Exploit code
- 402.2% of these records
- Actionable vendor fix
- 1,08460.5% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in February 2025 have had from about 20 months to about 21 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-27414 | MinIO SFTP authentication bypass due to improperly trusted SSH key | 4.6CNA v4.0 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-27413 | PwnDoc arbitrary file write to RCE | 6.5CNA v3.1 | 1.2% | 2025-02-28 | Fix |
| CVE-2025-27410 | PwnDoc arbitrary file write to RCE using path traversal in backup restore as admin | 6.5CNA v3.1 | 2.1% | 2025-02-28 | Exploit codeFix |
| CVE-2025-27408 | Manifest Uses a One-Way Hash without a Salt | 4.8CNA v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-27400 | OpenMage magento-lts magento vulnerable to stored XSS in theme config fields | 2.9CNA v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-26466 | OpenSSH: Denial of service in OpenSSH | 5.9NVD v3.1 | 40.7% | 2025-02-28 | Exploit codeFix |
| CVE-2025-26326 | A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered | 8.8CISA ADP v3.1 | 1.7% | 2025-02-28 | Exploit code |
| CVE-2025-26263 | GeoVision ASManager ASManagerService information disclosure | 5.1CISA ADP v3.1 | 1.4% | 2025-02-28 | Exploit code |
| CVE-2025-26047 | olajowon Loggrove SQL injection | 5.1CISA ADP v3.1 | 0.2% | 2025-02-28 | |
| CVE-2025-25916 | WuzhiCMS cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-02-28 | |
| CVE-2025-25729 | Bosscomm IF740 firmware update process information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25728 | Bosscomm IF740 firmware update API cleartext transmission of sensitive information | 6.5CISA ADP v3.1 | 0.2% | 2025-02-28 | |
| CVE-2025-25727 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext. | 6.2CISA ADP v3.1 | 0.2% | 2025-02-28 | |
| CVE-2025-25723 | gpac buffer overflow | 8.4CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25635 | TOTOLINK A3002R buffer overflow | 8.0CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25610 | TOTOLINK A3002R buffer overflow | 8.0CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25609 | TOTOLINK A3002R buffer overflow | 8.0CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25478 | sysPass external control of a file path | 6.5CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25477 | sysPass host header injection | 8.1CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25476 | sysPass stored cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25461 | Seeddms A stored cross-site scripting | 5.4CISA ADP v3.1 | 0.5% | 2025-02-28 | Exploit code |
| CVE-2025-25431 | TRENDnet Tew-929dru cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25430 | TRENDnet Tew-929dru cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25429 | TRENDnet Tew-929dru cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-25428 | TRENDnet Tew-929dru hard-coded password | 8.0CISA ADP v3.1 | 0.4% | 2025-02-28 | |
| CVE-2025-25379 | 07FLY-CMS cross-site request forgery | 9.6CISA ADP v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-24849 | Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure. | 7.5CNA v4.0 | 0.1% | 2025-02-28 | Fix |
| CVE-2025-24843 | Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored data. | 5.1CNA v4.0 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-24318 | Dario Health Dario application and server infrastructure session cookie vulnerability | 5.9CNA v4.0 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-24316 | Dario Health Dario application and server infrastructure information disclosure | 6.9CNA v4.0 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-23405 | Dario Health Blood Glucose Monitoring System Starter Kit Android application log injection | 6.9CNA v4.0 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-23225 | IBM MQ denial of service | 6.5CNA v3.1 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-22492 | Insecure storage of connection strings in FRS | 6.3CNA v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-22491 | Improper input validation in Foreseer Reporting Software (FRS) | 6.7CNA v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-22274 | HTML injection in CyberArk Endpoint Privilege Manager | 2.0CNA v4.0 | 0.5% | 2025-02-28 | Fix |
| CVE-2025-22273 | Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager | 9.3CNA v4.0 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-22272 | Self reflected XSS in CyberArk Endpoint Privilege Manager | 2.1CNA v4.0 | 0.5% | 2025-02-28 | Fix |
| CVE-2025-22271 | IP spoofing in CyberArk Endpoint Privilege Manager | 6.9CNA v4.0 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-22270 | Stored XSS in CyberArk Endpoint Privilege Manager | 7.3CNA v4.0 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-20060 | Dario Health Blood Glucose Monitoring System Android application information disclosure | 8.7CNA v4.0 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-20049 | Dario Health Dario application portal service cross-site scripting | 7.1CNA v4.0 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1795 | Python CPython mishandling of comma during folding and unicode-encoding of email headers | 2.3CNA v4.0 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-1776 | Cross-site scripting (XSS) vulnerability in Soteshop | 6.1CNA v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1757 | WordPress Portfolio Builder Portfolio Gallery plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-1749 | HTML injection vulnerability in OpenCart | 4.7v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1748 | HTML injection vulnerability in OpenCart | 4.7v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1747 | HTML injection vulnerability in OpenCart | 4.7v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1746 | Cross-site scripting vulnerability in OpenCart | 6.1v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-1744 | Out-of-bounds write in radare2 | 9.8v3.1 | 0.5% | 2025-02-28 | Fix |
| CVE-2025-1687 | Cardealer WordPress theme cross-site request forgery | 8.8CNA v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1682 | Cardealer WordPress theme privilege escalation | 8.8CNA v3.1 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-1681 | Cardealer WordPress theme unauthorized access | 5.4CNA v3.1 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-1662 | URL Media Uploader WordPress plugin server-side request forgery | 6.4v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1572 | KiviCare Clinic and Patient Management System (EHR) WordPress plugin SQL injection | 8.8v3.1 | 0.5% | 2025-02-28 | Fix |
| CVE-2025-1571 | Exclusive Addons for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1570 | wpWax Directorist password reset OTP privilege escalation | 9.8v3.1 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-1560 | WOW Entrance Effects (WEE!) WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-28 | |
| CVE-2025-1513 | Photos WordPress plugin stored cross-site scripting | 6.1NVD v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1511 | User Registration and Membership WordPress plugin reflected cross-site scripting | 6.1v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1506 | Wp Social Login and Register Social Counter WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-1505 | Advanced AJAX Product Filters WordPress plugin reflected cross-site scripting | 6.1v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1413 | Blackmagic Design DaVinci Resolve macOS installation permissions privilege escalation | 8.4CNA v4.0 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-1405 | Product Catalog Simple WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-1319 | Site Mailer WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-1300 | Open redirect in CodeChecker web server | 6.1CNA v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-0985 | IBM MQ information disclosure | 5.5CNA v3.1 | 0.3% | 2025-02-28 | Fix |
| CVE-2025-0975 | IBM MQ code execution | 8.8CNA v3.1 | 0.7% | 2025-02-28 | Fix |
| CVE-2025-0823 | IBM MQ path traversal | 6.5CNA v3.1 | 0.6% | 2025-02-28 | Fix |
| CVE-2025-0801 | RateMyAgent Official WordPress plugin cross-site request forgery to API Key update | 4.3v3.1 | 0.2% | 2025-02-28 | Fix |
| CVE-2025-0769 | PixelYourSite insecure deserialization | 6.3CNA v4.0 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-0764 | wpForo Forum WordPress plugin authenticated (Subscriber+) arbitrary file read in update | 6.5CNA v3.1 | 0.4% | 2025-02-28 | Fix |
| CVE-2025-0160 | IBM FlashSystem code execution | 8.1CNA v3.1 | 0.5% | 2025-02-28 | Fix |
| CVE-2025-0159 | IBM FlashSystem authentication bypass | 9.1CNA v3.1 | 0.9% | 2025-02-28 | Fix |
| CVE-2025-27399 | Mastodon's domain blocks and rationales ignore user approval when visibility set as users | 5.3CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-27157 | Mastodon's rate-limits are missing on `/auth/setup` | 5.3CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-27154 | Spotipy's cache file, containing spotify auth token, is created with overly broad permissions | 8.4CNA v4.0 | 0.6% | 2025-02-27 | Fix |
| CVE-2025-26325 | ShopXO unrestricted file upload | 9.8CISA ADP v3.1 | 0.5% | 2025-02-27 | |
| CVE-2025-26264 | GeoVision GV-ASWeb notification settings code injection | 8.8CISA ADP v3.1 | 23.0% | 2025-02-27 | Emerging ThreatsExploit code |
| CVE-2025-25761 | HkCms external control of a file path | 7.2CISA ADP v3.1 | 0.4% | 2025-02-27 | |
| CVE-2025-25760 | Sucms component admin_webgather.php server-side request forgery | 7.5CISA ADP v3.1 | 0.4% | 2025-02-27 | |
| CVE-2025-25759 | Sucms path traversal | 7.5CISA ADP v3.1 | 0.7% | 2025-02-27 | |
| CVE-2025-25730 | Motorola Droid Razr HD USB debugging improper access control | 4.6CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25570 | Vue Vben Admin hard-coded credentials | 9.8CISA ADP v3.1 | 2.1% | 2025-02-27 | Nuclei |
| CVE-2025-25334 | Suning Commerce Group Suning EMall iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25333 | IKEA CN iOS app information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-02-27 | |
| CVE-2025-25331 | Beitatong Technology LianJia iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25330 | Boohee Health iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25329 | Tencent MicroVision iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25326 | Merchants Union Consumer Finance Merchants Union Finance iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25325 | Yibin Fengguan Network Technology YuPao DirectHire iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25324 | Shandong Provincial Big Data Center AiShanDong iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-25323 | Qianjin Network Information Technology 51Job iOS app information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-24832 | Acronis Backup plugin for cPanel and WHM symlink following | 4.4CNA v3.0 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-23687 | Woo Store Mode WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-27 | |
| CVE-2025-22952 | Memos server-side request forgery (SSRF) | 9.8CISA ADP v3.1 | 2.9% | 2025-02-27 | NucleiFix |
| CVE-2025-22624 | bradvin FooGallery admin meta box handler reflected cross-site scripting | 5.1CNA v4.0 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-22280 | DefendWP Firewall WordPress plugin broken access control | 7.6CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21824 | Linux kernel host1x GPU driver vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21823 | Linux kernel batman-adv ELP metric worker vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21822 | Linux kernel vmclock PTP driver vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21821 | Linux kernel omap LCD framebuffer driver denial of service | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21820 | Linux kernel xilinx_uartps improper locking | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21819 | Linux kernel AMD display PSR1 lock manager denial of service | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21817 | Linux kernel block layer sysfs store deadlock | 5.5v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-21816 | Linux kernel hrtimer CPU hotplug migration vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21815 | Linux kernel memory compaction out-of-bounds read | 7.1v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21814 | Linux kernel PTP clock driver null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21813 | Linux kernel timer migration hierarchy off-by-one error | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21812 | Linux kernel ax25 use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21811 | Linux kernel nilfs2 dirty buffer handling use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21810 | Linux kernel driver core class iterator null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21809 | Linux kernel rxrpc peer hash table deadlock | 7.5CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21808 | Linux kernel XDP generic mode vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21807 | Linux kernel block layer sysfs limits deadlock | 5.5v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-21806 | In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21805 | Linux kernel RTRS RDMA transport vulnerability | 9.8CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-21804 | Linux kernel rcar PCIe endpoint driver null pointer dereference | 7.1CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21803 | Linux kernel LoongArch ACPI suspend handling vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21802 | Linux kernel hns3 Ethernet driver vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21801 | Linux kernel ravb Ethernet driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21800 | Linux kernel mlx5 HWS steering vulnerability | 7.8v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21799 | Linux kernel am65-cpsw Ethernet driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21798 | Linux kernel firewire KUnit test null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21797 | Linux kernel corsair-void HID driver use-after-free | 7.8v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21796 | Linux kernel NFSD ACL release use-after-free | 9.8CNA v3.1 | 0.7% | 2025-02-27 | Fix |
| CVE-2025-21795 | Linux kernel NFSD callback shutdown denial of service | 7.5CNA v3.1 | 0.7% | 2025-02-27 | Fix |
| CVE-2025-21794 | Linux kernel Thrustmaster HID driver out-of-bounds read | 7.1v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21793 | Linux kernel sn-f-ospi divide by zero | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21792 | Linux kernel AX.25 device binding reference count leak | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21791 | Linux kernel VRF l3mdev output path use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21790 | Linux kernel vxlan crash | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21789 | Linux kernel LoongArch checksum code out-of-bounds read | 7.3CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21788 | Linux kernel am65-cpsw XDP path memory leak | 7.5CNA v3.1 | 0.5% | 2025-02-27 | Fix |
| CVE-2025-21787 | Linux kernel team driver string option validation vulnerability | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21786 | Linux kernel workqueue rescuer thread use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21785 | Linux kernel arm64 cache information array out-of-bounds write | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21784 | Linux kernel PSP microcode loading vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21783 | Linux kernel gpiolib crash | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21782 | Linux kernel orangefs debug interface out-of-bounds read | 7.1v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21781 | Linux kernel batman-adv interface removal vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21780 | Linux kernel SMU power play table interface buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21779 | Linux kernel KVM Hyper-V SEND_IPI emulation null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21778 | Linux kernel ring buffer memory mapping vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21777 | Linux kernel ring buffer persistent metadata vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21776 | Linux kernel USB hub driver null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21775 | Linux kernel ctucanfd CAN driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21774 | Linux kernel rkcanfd CAN driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21773 | Linux kernel etas_es58x CAN driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21772 | Linux kernel Mac partition table parser out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21771 | Linux kernel sched_ext scheduler class vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21770 | Linux kernel IOMMU page fault queue memory leak | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21769 | Linux kernel vmclock PTP device driver vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21768 | Linux kernel IPv6 lightweight tunnel destination cache memory leak | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21767 | Linux kernel clocksource watchdog verification vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21766 | Linux kernel IPv4 route PMTU update vulnerability | 8.1CNA v3.1 | 0.6% | 2025-02-27 | Fix |
| CVE-2025-21765 | In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear. | 8.1CNA v3.1 | 0.6% | 2025-02-27 | Fix |
| CVE-2025-21764 | Linux kernel ndisc use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21763 | Linux kernel neighbour use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21762 | Linux kernel arp use-after-free | 8.1CNA v3.1 | 0.7% | 2025-02-27 | Fix |
| CVE-2025-21761 | Linux kernel openvswitch use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21760 | Linux kernel ndisc use-after-free | 8.1CNA v3.1 | 38.0% | 2025-02-27 | Emerging ThreatsFix |
| CVE-2025-21759 | Linux kernel IPv6 multicast use-after-free | 7.8CNA v3.1 | 7.8% | 2025-02-27 | Emerging ThreatsFix |
| CVE-2025-21758 | Linux kernel IPv6 multicast vulnerability | 7.8CNA v3.1 | 16.9% | 2025-02-27 | Emerging ThreatsFix |
| CVE-2025-21756 | Linux kernel vsock socket binding use-after-free | 7.8CNA v3.1 | 0.9% | 2025-02-27 | Reported exploitedExploit codeFix |
| CVE-2025-21754 | Linux kernel Btrfs ordered extent splitting reachable assertion | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21753 | Linux kernel Btrfs transaction abort handling use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21752 | Linux kernel Btrfs RAID stripe tree vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21751 | Linux kernel mlx5 hardware steering matcher use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21750 | Linux kernel brcmfmac Wi-Fi driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21749 | Linux kernel ROSE socket bind vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21748 | Linux kernel ksmbd IPC message allocation integer overflow | 9.8CNA v3.1 | 0.6% | 2025-02-27 | Fix |
| CVE-2025-21747 | In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes takes up to 1 second for enabling the video signal, while the timeout is only 200 msec. This results in a kernel error message. Increase the tim | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21746 | Linux kernel Synaptics touchpad driver pass-through port race condition | 4.7v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-21745 | Linux kernel block cgroup class registration vulnerability | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21744 | Linux kernel brcmfmac Wi-Fi driver null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21743 | Linux kernel ipheth out-of-bounds read | 7.1v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21742 | Linux kernel ipheth out-of-bounds read | 7.1v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21741 | Linux kernel ipheth out-of-bounds read | 7.1v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21739 | Linux kernel UFS crypto profile initialization use-after-free | 7.8CISA ADP v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21738 | Linux kernel libata SFF ATA pass-through handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21737 | Linux kernel Ceph client MDS auth matching memory leak | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21736 | Linux kernel NILFS2 FIEMAP handling integer overflow | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21735 | Linux kernel NFC NCI HCI pipe creation out-of-bounds write | 8.8CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-21734 | Linux kernel fastrpc buffer copy out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21733 | Linux kernel osnoise tracer tracepoint handling vulnerability | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21732 | Linux kernel mlx5 RDMA ODP memory region race condition | 4.7v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-21731 | Linux kernel nbd use-after-free | 7.8CISA ADP v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21730 | Linux kernel rtw89 Wi-Fi driver WoWLAN resume vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21729 | Linux kernel rtw89 Wi-Fi driver hardware scan use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21728 | Linux kernel BPF signal delivery vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21727 | Linux kernel padata output reordering use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21726 | Linux kernel padata reorder work handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21725 | Linux kernel SMB client link speed handling vulnerability | 7.5CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-21724 | Linux kernel IOMMUFD IOVA bitmap out-of-bounds write | 7.8NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21723 | Linux kernel mpi3mr driver bsg queue setup null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21722 | Linux kernel NILFS2 buffer head handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21721 | Linux kernel NILFS2 directory rename handling reachable assertion | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21720 | Linux kernel XFRM packet offload path null pointer dereference | 7.5CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-21719 | Linux kernel ipmr crash | 7.1CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21718 | Linux kernel ROSE protocol timers race condition | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21717 | Linux kernel net/mlx5e kernel panic | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21716 | Linux kernel vxlan uninitialized resource use | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21715 | Linux kernel davicom use-after-free | 7.8CISA ADP v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21714 | Linux kernel mlx5 RDMA driver implicit ODP use-after-free | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21713 | Linux kernel pseries IOMMU TCE window handling null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21712 | Linux kernel md-bitmap statistics vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21711 | Linux kernel ROSE socket options integer overflow | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21710 | Linux kernel TCP window advertisement denial of service | 8.2CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-21709 | Linux kernel uprobe and dup_mmap handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21708 | Linux kernel rtl8150 USB Ethernet driver vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21707 | Linux kernel MPTCP suboption parsing vulnerability | 9.8CNA v3.1 | 0.5% | 2025-02-27 | Fix |
| CVE-2025-21706 | Linux kernel MPTCP path manager vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-21705 | Linux kernel MPTCP fastopen handling vulnerability | 5.5NVD v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-1756 | MongoDB Shell may be susceptible to local privilege escalation in Windows | 7.5CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-1755 | MongoDB Compass may be susceptible to local privilege escalation in Windows | 7.5CNA v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-1751 | ATISoluciones CIGES SQL injection | 9.8CNA v3.1 | 0.5% | 2025-02-27 | |
| CVE-2025-1745 | LinZhaoguan pb-cms Logout cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-02-27 | |
| CVE-2025-1743 | zyx0814 Pichome index.php path traversal | 6.9CNA v4.0 | 1.7% | 2025-02-27 | Nuclei |
| CVE-2025-1742 | pihome-shc PiHome home.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-02-27 | |
| CVE-2025-1741 | b1gMail Admin page users.php deserialization | 5.1CNA v4.0 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-1739 | Trivision Camera NC227WF activex_pal.asp authentication bypass | 7.1CNA v3.1 | 0.3% | 2025-02-27 | Exploit code |
| CVE-2025-1738 | Trivision Camera NC227WF information disclosure | 6.2CNA v3.1 | 0.2% | 2025-02-27 | Exploit code |
| CVE-2025-1717 | Login Me Now WordPress plugin authentication bypass | 8.1v3.1 | 0.6% | 2025-02-27 | Fix |
| CVE-2025-1693 | MongoDB Shell may be susceptible to control character injection via shell output | 3.9CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-1692 | MongoDB Shell may be susceptible to control character injection via pasting | 6.3CNA v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-1691 | MongoDB Shell may be susceptible to Control Character injection via autocomplete | 7.6CNA v3.1 | 0.4% | 2025-02-27 | Fix |
| CVE-2025-1690 | ThemeMakers Stripe Checkout WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-1689 | ThemeMakers PayPal Express Checkout WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-1686 | Pebble has arbitrary local file inclusion (LFI) vulnerability via `include` macro | 4.9v3.1 | 0.8% | 2025-02-27 | Fix |
| CVE-2025-1450 | Floating Chat Widget: Contact Chat Icons WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-27 | Fix |
| CVE-2025-1295 | Templines Elementor Helper Core WordPress plugin authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.5% | 2025-02-27 | Fix |
| CVE-2025-1282 | Car Dealer Automotive WordPress Theme Responsive arbitrary file deletion and read | 8.8CNA v3.1 | 1.1% | 2025-02-27 | Fix |
| CVE-2025-0914 | Velociraptor Shell Plugin Prevent_execve Bypass | 3.8CNA v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-0767 | WP Activity Log insecure deserialization | 9.8v3.1 | 0.5% | 2025-02-27 | Fix |
| CVE-2025-0759 | IBM EntireX race condition | 3.3CNA v3.1 | 0.1% | 2025-02-27 | Fix |
| CVE-2025-0469 | Forminator WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-02-27 | Fix |
| CVE-2025-26925 | Admin Menu Manager WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-26698 | J’s Communication RevoWorks Browser RevoWorks SCVX and incorrect resource transfer | 2.7CNA v3.0 | 0.2% | 2025-02-26 | |
| CVE-2025-25827 | emlog component sort.php server-side request forgery | 6.8CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25825 | emlog A cross-site scripting | 7.1CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25823 | emlog A cross-site scripting | 7.3CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25818 | emlog A cross-site scripting | 5.1CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25813 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25802 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25800 | Seacms path traversal | 5.3CISA ADP v3.1 | 0.5% | 2025-02-26 | |
| CVE-2025-25799 | Seacms files accessible to external parties | 6.0CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25797 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25796 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25794 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25793 | Seacms command injection | 5.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25792 | Seacms command injection | 4.4CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25791 | Yzncms plugin installation feature arbitrary file upload | 4.4CISA ADP v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-25790 | FoxCMS component \controller\LocalTemplate.php arbitrary file upload | 9.8CISA ADP v3.1 | 0.9% | 2025-02-26 | |
| CVE-2025-25789 | FoxCMS code injection | 9.8CISA ADP v3.1 | 1.3% | 2025-02-26 | |
| CVE-2025-25785 | jizhiCMS server-side request forgery | 9.1CISA ADP v3.1 | 0.4% | 2025-02-26 | |
| CVE-2025-25784 | jizhiCMS component \c\TemplateController.php arbitrary file upload | 9.8CISA ADP v3.1 | 0.9% | 2025-02-26 | |
| CVE-2025-25783 | emlog component admin\plugin.php arbitrary file upload | 9.8CISA ADP v3.1 | 0.7% | 2025-02-26 | |
| CVE-2025-25462 | PHPGurukul Land Record System SQL injection | 5.5CISA ADP v3.1 | 0.3% | 2025-02-26 | |
| CVE-2025-22881 | Heap-based buffer overflow in CNCSoft-G2 | 8.4CNA v4.0 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-22869 | Potential denial of service in golang.org/x/crypto | 7.5CISA ADP v3.1 | 0.9% | 2025-02-26 | Fix |
| CVE-2025-22868 | Unexpected memory consumption during token parsing in golang.org/x/oauth2 | 7.5CISA ADP v3.1 | 0.9% | 2025-02-26 | Fix |
| CVE-2025-20161 | Cisco NX-OS Software command injection | 5.1CNA v3.1 | 0.5% | 2025-02-26 | Fix |
| CVE-2025-20119 | Cisco Application Policy Infrastructure Controller Authenticated Local denial of service | 6.0CNA v3.1 | 0.1% | 2025-02-26 | Fix |
| CVE-2025-20118 | Cisco Application Policy Infrastructure Controller CLI information disclosure | 4.4CNA v3.1 | 0.2% | 2025-02-26 | Fix |
| CVE-2025-20117 | Cisco Application Policy Infrastructure Controller Authenticated command injection | 5.1CNA v3.1 | 0.2% | 2025-02-26 | Fix |
| CVE-2025-20116 | Cisco Application Policy Infrastructure Controller stored cross-site scripting | 4.8CNA v3.1 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-20111 | Cisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet denial of service | 7.4CNA v3.1 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-1726 | Esri ArcGIS Monitor SQL injection | 4.3CNA v3.1 | 0.4% | 2025-02-26 | Fix |
| CVE-2025-1716 | picklescan Security scanning bypass via pip main | 9.8NVD v3.1 | 1.7% | 2025-02-26 | Fix |
| CVE-2025-1634 | Io.quarkus:quarkus-resteasy: Memory leak in quarkus resteasy classic when client requests timeout | 7.5CNA v3.1 | 0.8% | 2025-02-26 | Fix |
| CVE-2025-1517 | Sina Extension for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.5% | 2025-02-26 | Fix |
| CVE-2025-1249 | Events Manager WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-1091 | Tenable Identity Exposure Broken Authorization Schema | 4.3CNA v3.1 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-0941 | MET ONE 3400+ potential credential exposure | 5.8CNA v3.1 | 0.2% | 2025-02-26 | |
| CVE-2025-0889 | Privilege Management for Windows elevation of privilege | 7.2CNA v4.0 | 0.2% | 2025-02-26 | Fix |
| CVE-2025-0760 | Tenable Identity Exposure stored credential disclosure | 2.7CNA v3.1 | 0.2% | 2025-02-26 | Fix |
| CVE-2025-0731 | SMA: Sunny portal remote code execution | 6.5CNA v3.1 | 0.7% | 2025-02-26 | Fix |
| CVE-2025-0719 | IBM Cloud Pak for Data cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-02-26 | Fix |
| CVE-2025-0236 | Canon Generic PCL6 V4 Printer Driver out-of-bounds write | 5.3CNA v3.1 | 0.6% | 2025-02-26 | Fix |
| CVE-2025-0235 | Canon Generic PCL6 V4 Printer Driver out-of-bounds write | 5.3CNA v3.1 | 0.6% | 2025-02-26 | Fix |
| CVE-2025-0234 | Canon Generic PCL6 V4 Printer Driver out-of-bounds write | 5.3CNA v3.1 | 0.6% | 2025-02-26 | Fix |
| CVE-2025-27148 | Gradle vulnerable to local privilege escalation through system temporary directory | 8.8CNA v3.1 | 0.2% | 2025-02-25 | Fix |
| CVE-2025-27146 | Matrix IRC Bridge allows IRC command injection to own puppeted user | 2.7CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-27145 | copyparty renders unsanitized filenames as HTML when user uploads empty files | 3.6CNA v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-27142 | LocalSend file upload endpoint path traversal | 6.3CNA v4.0 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-27139 | Combodo iTop vulnerable to stored self cross-site scripting in preferences | 6.8CNA v3.1 | 0.2% | 2025-02-25 | Fix |
| CVE-2025-27135 | RAGFlow SQL injection | 8.9CNA v4.0 | 0.6% | 2025-02-25 | Fix |
| CVE-2025-27110 | owasp-modsecurity ModSecurity libmodsecurity3 has possible bypass of encoded HTML entities | 7.9CNA v4.0 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-27000 | Simple Photo Feed WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26995 | Market Exporter WordPress plugin broken access control | 5.4CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26993 | Visual Website Collaboration Atarim WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26991 | WPPizza WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26987 | Frontend Admin by DynamiApps WordPress plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26985 | Majestic Support WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-02-25 | Fix |
| CVE-2025-26983 | Recipe Card Blocks for Gutenberg and Elementor WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26981 | Web Accessibility By accessiBe WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26980 | Wired Impact Volunteer Management WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26979 | Funnel Builder by FunnelKit WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-02-25 | Fix |
| CVE-2025-26977 | FileBird WordPress plugin insecure direct object references (IDOR) | 7.2v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26975 | Strong Testimonials WordPress plugin broken access control | 5.3CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26974 | WP Multi Store Locator WordPress plugin SQL injection | 9.3CNA v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26971 | WordPress Poll Maker plugin SQL injection | 9.8v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26966 | PrivateContent WordPress plugin unauthenticated account takeover | 9.8CNA v3.1 | 0.6% | 2025-02-25 | |
| CVE-2025-26965 | Amelia WordPress plugin insecure direct object references (IDOR) | 5.3CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26964 | Eventin WordPress plugin local file inclusion | 8.8v3.1 | 0.7% | 2025-02-25 | Fix |
| CVE-2025-26963 | ClickWhale WordPress plugin cross-site request forgery (CSRF) to settings Change | 8.8v3.1 | 0.2% | 2025-02-25 | Fix |
| CVE-2025-26962 | Contact Form WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26960 | Small Package Quotes Unishippers Edition WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26957 | Affiliate Coupons WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-02-25 | Fix |
| CVE-2025-26952 | Business Card Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26949 | Team Section Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26948 | Pie Register Premium WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26947 | Services Section block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26946 | WP Yelp Review Slider WordPress plugin SQL injection | 7.6CNA v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26945 | Info Cards WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26943 | Easy Quotes WordPress plugin SQL injection | 9.3CNA v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26939 | Counters Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26938 | Countdown Timer block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26937 | Icon List Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26935 | WP Job Portal WordPress plugin local file inclusion | 8.8v3.1 | 0.7% | 2025-02-25 | Fix |
| CVE-2025-26932 | QuantumCloud ChatBot local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-02-25 | Fix |
| CVE-2025-26931 | Tribulant Gallery Voting WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-25 | Fix |
| CVE-2025-26928 | Order Limit for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26926 | Booknetic WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-25 | |
| CVE-2025-26915 | Wishlist WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26913 | AR for WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26912 | Easy Elementor Addons WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26911 | System Dashboard WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26907 | Estatik Mortgage Calculator WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-26905 | Estatik WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-02-25 | Fix |
| CVE-2025-26904 | WP Responsive Auto Fit Text WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26900 | Flexmls® IDX WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-02-25 | Fix |
| CVE-2025-26897 | List Related Attachments WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | |
| CVE-2025-26896 | PiwigoPress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26893 | Easy Charts WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26891 | Ibtana WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | |
| CVE-2025-26887 | EZ SQL Reports Shortcode Widget and DB Backup WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26884 | Greenshift WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26882 | Popup Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26881 | Sticky Content WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26878 | Autoship Cloud for WooCommerce Subscription Products WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26877 | Front End Users WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26876 | Search with Typesense WordPress plugin path traversal | 4.9v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26871 | Essential Blocks WordPress plugin broken access control | 8.8v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26868 | Fast Flow WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26753 | VideoWhisper Live Streaming Integration WordPress plugin arbitrary file download | 7.5CNA v3.1 | 0.6% | 2025-02-25 | Fix |
| CVE-2025-26752 | VideoWhisper Live Streaming Integration WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-26751 | Alphabetic Pagination WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-26601 | X.Org xwayland X.Org and use-after-free | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26600 | X.Org xwayland X.Org and use-after-free | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26599 | X.Org Xwayland compRedirectWindow function uninitialized pointer access | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26598 | Xorg: Xwayland: Out-of-bounds write in createpointerbarrierclient | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26597 | Xorg: Xwayland: Buffer overflow in xkbchangetypesofkey | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26596 | Xorg: Xwayland: Heap overflow in xkbwritekeysyms | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26595 | Xorg: Xwayland: Buffer overflow in xkbvmodmasktext | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-26594 | X.Org xwayland X.Org and use-after-free | 7.8NVD v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-25521 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25520 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25519 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25517 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25516 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25515 | Seacms SQL injection | 8.8CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-25514 | Seacms SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-02-25 | |
| CVE-2025-25192 | GLPI allows unauthorized access to debug mode | 6.5CNA v3.1 | 0.7% | 2025-02-25 | Fix |
| CVE-2025-23046 | GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin | 6.3CNA v4.0 | 0.5% | 2025-02-25 | Fix |
| CVE-2025-23024 | GLPI: Plugins are disabled accessing one page | 6.9CNA v4.0 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-22211 | Extension Webdesigner-profi.de SQL injection in JoomShopping component for Joomla | 3.4CISA ADP v3.1 | 0.4% | 2025-02-25 | |
| CVE-2025-22210 | Extension Hikashop.com SQL injection in Hikashop component for Joomla | 7.2CISA ADP v3.1 | 0.5% | 2025-02-25 | |
| CVE-2025-21627 | GLPI cross-site scripting | 6.5CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-21626 | GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint | 5.8CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-1676 | hzmanyun Education and Training System pdf2swf os command injection | 9.8v3.1 | 2.4% | 2025-02-25 | |
| CVE-2025-1675 | zephyrproject-rtos Zephyr out-of-bounds read in dns_copy_qname | 8.2CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-1674 | zephyrproject-rtos Zephyr out-of-bounds read when unpacking DNS answers | 8.2CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-1673 | zephyrproject-rtos Zephyr out-of-bounds read when calling crc16_ansi and strlen in dns_validate_msg | 8.2CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-1648 | Yawave WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 1.0% | 2025-02-25 | |
| CVE-2025-1646 | Lumsoft ERP ASPX File UploadAjaxAPI.ashx unrestricted upload | 6.9CNA v4.0 | 0.5% | 2025-02-25 | |
| CVE-2025-1645 | Benner Connecta EditarLogado resource injection | 5.3CNA v4.0 | 0.4% | 2025-02-25 | |
| CVE-2025-1644 | Benner ModernaNet SG_Gravar cross-site request forgery | 6.5v3.1 | 0.4% | 2025-02-25 | |
| CVE-2025-1643 | Benner ModernaNet SG_AlterarSenha cross-site request forgery | 8.8v3.1 | 0.4% | 2025-02-25 | |
| CVE-2025-1642 | Benner ModernaNet GetImageMedico resource injection | 7.5v3.1 | 0.7% | 2025-02-25 | |
| CVE-2025-1641 | Benner ModernaNet GetHorariosDoDia SQL injection | 9.8v3.1 | 0.6% | 2025-02-25 | |
| CVE-2025-1640 | Benner ModernaNet JS_CarregaCombo SQL injection | 9.8v3.1 | 0.6% | 2025-02-25 | |
| CVE-2025-1262 | Advanced Google reCaptcha WordPress plugin Built-in Math CAPTCHA bypass | 5.3CNA v3.1 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-1204 | Contec Health CMS8000 Patient Monitor hidden functionality | 7.7CNA v4.0 | 0.5% | 2025-02-25 | |
| CVE-2025-1128 | Everest Forms WordPress plugin unauthenticated arbitrary file upload, read, and deletion | 9.8CNA v3.1 | 42.4% | 2025-02-25 | Fix |
| CVE-2025-1068 | There is a code injection vulnerability in Esri ArcGIS AllSource | 7.3CNA v3.1 | 0.2% | 2025-02-25 | Fix |
| CVE-2025-1067 | There is a code injection vulnerability in ArcGIS Pro | 7.3CNA v3.1 | 0.2% | 2025-02-25 | Fix |
| CVE-2025-1063 | Classified Listing WordPress plugin information disclosure | 5.3CNA v3.1 | 0.4% | 2025-02-25 | Fix |
| CVE-2025-0514 | The Document Foundation LibreOffice improper input validation | 7.2CNA v4.0 | 0.3% | 2025-02-25 | Fix |
| CVE-2025-27364 | Caldera OS command injection | 10.0CNA v3.1 | 25.9% | 2025-02-24 | Emerging ThreatsKCV |
| CVE-2025-27357 | Önceki Yazı Link WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27356 | Sticky Header On Scroll WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27355 | Woocommerce Loi Hamon WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-24 | |
| CVE-2025-27353 | Namaste! LMS WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27352 | 无觅相关文章插件 WordPress plugin CSRF to cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27351 | Local Search SEO Contact Page WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27349 | Get Posts WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27348 | WP Social SEO Booster WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27347 | Direct Checkout Button for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27344 | Phee's LinkPreview WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27342 | WooCommerce Recargo de Equivalencia WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27341 | Reactive Mortgage Calculator WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27340 | F12-Profiler WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.2% | 2025-02-24 | Fix |
| CVE-2025-27339 | Minimum Password Strength WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27336 | Just Variables WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27335 | Auto Tag Links WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27332 | Smart Maintenance and Countdown WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-24 | |
| CVE-2025-27331 | WooCommerce Display Products by Tags WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27330 | PlayerJS WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | Fix |
| CVE-2025-27329 | EZ InLinkz linkup WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27328 | WP-PostRatings Cheater WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27327 | Live Streaming Video Player by SRS Player WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27325 | Video.js HLS Player WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27323 | WP About Author WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-24 | Fix |
| CVE-2025-27321 | Blightly Explorer WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-24 | |
| CVE-2025-27320 | Profile Widget Ninja WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27318 | Simple Google Sitemap WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27317 | RAYS Grid WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27316 | JPG, PNG Compression and Optimization WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27315 | All-In-One Cufon WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27312 | WP Sitemap WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2025-02-24 | |
| CVE-2025-27311 | Bulk Content Creator WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27307 | Quotes llama WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-27306 | Pathomation WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27305 | Table of Contents Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27304 | Contact Form 7 Star Rating with font Awesome WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27303 | Contact Form 7 Star Rating WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27301 | NHR Options Table Manager WordPress plugin deserialization of untrusted data | 7.2CNA v3.1 | 0.7% | 2025-02-24 | Fix |
| CVE-2025-27300 | ADFO WordPress plugin deserialization of untrusted data | 7.2CNA v3.1 | 0.7% | 2025-02-24 | |
| CVE-2025-27298 | WP Video Posts WordPress plugin CSRF to remote code execution (RCE) | 8.3CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27297 | Bravo Search and Replace WordPress plugin SQL injection | 7.6CNA v3.1 | 0.5% | 2025-02-24 | |
| CVE-2025-27296 | Auto Ad Inserter WordPress plugin revenueflex missing authorization | 7.2CNA v3.1 | 0.5% | 2025-02-24 | Fix |
| CVE-2025-27294 | WP-Asambleas WordPress plugin arbitrary shortcode execution vulnerability | 4.8CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27290 | Select Erima Zarinpal Donate WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27280 | Archive Page WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-27277 | tiefpunkt Add Linked Images To Gallery cross-site request forgery | 7.1CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27276 | Photo Gallery ( Responsive ) WordPress plugin CSRF to privilege escalation | 8.8CNA v3.1 | 0.2% | 2025-02-24 | |
| CVE-2025-27272 | VG PostCarousel WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-02-24 | |
| CVE-2025-27266 | Hover Image Button WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27265 | Google Maps for WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-02-24 | |
| CVE-2025-27144 | go-jose go JOSE's Parsing vulnerable to denial of service | 6.6CNA v4.0 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-27143 | better-auth beter Auth has an open redirect via Scheme-Less Callback parameter | 6.9CNA v4.0 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-27141 | Metabase Enterprise Edition allows cached questions to leak data to impersonated users | 4.8CNA v4.0 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-27140 | WeGIA vulnerable to OS command injection at endpoint importar_dump.php parameter import (RCE) | 10.0CNA v4.0 | 2.9% | 2025-02-24 | Fix |
| CVE-2025-27137 | Dependency-Track vulnerable to local file inclusion via custom notification templates | 4.4CNA v3.1 | 0.2% | 2025-02-24 | Fix |
| CVE-2025-27133 | WeGIA has SQL injection endpoint at dao/pet/adicionar_tipo_exame.php parameter tipo_exame | 9.4CNA v4.0 | 0.6% | 2025-02-24 | Fix |
| CVE-2025-27112 | Navidrome has authentication bypass in Subsonic API with non-existent username | 6.9CNA v4.0 | 1.0% | 2025-02-24 | NucleiFix |
| CVE-2025-26883 | Animated Text Block WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-26803 | Phusion Passenger denial of service | 7.5v3.1 | 0.6% | 2025-02-24 | Fix |
| CVE-2025-26533 | moodle SQL injection risk in course search module list filter | 9.8NVD v3.1 | 0.6% | 2025-02-24 | Fix |
| CVE-2025-26532 | moodle teachers can evade trusttext config when restoring glossary entries | 4.3NVD v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-26531 | moodle IDOR in badges allows disabling of arbitrary badges | 5.3NVD v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-26530 | moodle reflected XSS via question bank filter | 6.1NVD v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-26529 | moodle stored XSS risk in admin live log | 6.1NVD v3.1 | 0.5% | 2025-02-24 | Exploit codeFix |
| CVE-2025-26528 | moodle stored XSS in ddimageortext question type | 6.1NVD v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-26527 | moodle non-searchable tags can still be discovered on the tag search page and in the tags block | 5.3CNA v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-26526 | moodle feedback response viewing and deletions did not respect Separate Groups mode | 6.5CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-26525 | moodle arbitrary file read risk through pdfTeX | 8.6CNA v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-26201 | GreaterWMS staff route authentication bypass | 9.1CISA ADP v3.1 | 0.6% | 2025-02-24 | |
| CVE-2025-26200 | SLIMS Senayan Library Management System SQL injection | 7.2CISA ADP v3.1 | 0.5% | 2025-02-24 | |
| CVE-2025-25513 | Seacms SQL injection | 9.8v3.1 | 0.5% | 2025-02-24 | |
| CVE-2025-25460 | FlatPress cross-site scripting | 4.8CISA ADP v3.1 | 0.5% | 2025-02-24 | Exploit code |
| CVE-2025-25279 | Arbitrary file read in Mattermost Boards via import and export board archive | 9.9CNA v3.1 | 24.2% | 2025-02-24 | Fix |
| CVE-2025-24526 | Mattermost channel export permitted on archived channel when viewing archived channels is disabled | 4.3CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-24490 | SQL injection in Mattermost Boards via board category ID reordering | 9.6CNA v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-23017 | workos Hosted AuthKit authentication bypass | 6.0CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-22974 | Seacms SQL injection | 9.8CISA ADP v3.1 | 0.8% | 2025-02-24 | |
| CVE-2025-22495 | Eaton Network M2 OS command injection | 8.4CNA v3.1 | 0.4% | 2025-02-24 | Fix |
| CVE-2025-20051 | Arbitrary file read via block duplication in Mattermost Boards | 9.9CNA v3.1 | 0.6% | 2025-02-24 | Fix |
| CVE-2025-1632 | libarchive bsdunzip.c list null pointer dereference | 5.5v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-1629 | Excitel Broadband Private my Excitel App One-Time Password excessive authentication | 5.1CNA v4.0 | 0.2% | 2025-02-24 | |
| CVE-2025-1618 | VTiger CRM index.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-02-24 | |
| CVE-2025-1617 | Netis WF2780 Wireless 2.4G menu cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-02-24 | |
| CVE-2025-1616 | FiberHome An5506-01a ONU GPON Diagnosis os command injection | 9.8v3.1 | 7.7% | 2025-02-24 | |
| CVE-2025-1615 | FiberHome AN5506-01A ONU GPON NAT Submenu cross-site scripting | 4.8v3.1 | 0.6% | 2025-02-24 | |
| CVE-2025-1614 | FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross-site scripting | 4.8v3.1 | 0.8% | 2025-02-24 | |
| CVE-2025-1613 | FiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross-site scripting | 4.8v3.1 | 0.8% | 2025-02-24 | |
| CVE-2025-1612 | Edimax BR-6288ACL wireless5g_basic.asp cross-site scripting | 6.1v3.1 | 0.4% | 2025-02-24 | |
| CVE-2025-1611 | ShopXO Template ThemeAdminService.php injection | 5.1CNA v4.0 | 0.6% | 2025-02-24 | |
| CVE-2025-1610 | LB-LINK AC1900 Router set_blacklist websGetVar os command injection | 9.8v3.1 | 13.2% | 2025-02-24 | |
| CVE-2025-1609 | LB-LINK AC1900 Router set_cmd websGetVar os command injection | 9.8v3.1 | 10.2% | 2025-02-24 | |
| CVE-2025-1608 | LB-LINK AC1900 Router set_manpwd websGetVar os command injection | 9.8v3.1 | 10.2% | 2025-02-24 | |
| CVE-2025-1607 | SourceCodester Best Employee Management System salary_slip.php authorization | 5.3CNA v4.0 | 0.6% | 2025-02-24 | |
| CVE-2025-1606 | SourceCodester Best Employee Management System backups.php information disclosure | 7.5v3.1 | 0.7% | 2025-02-24 | |
| CVE-2025-1599 | SourceCodester Best Church Management Software profile_crud.php path traversal | 9.1v3.1 | 1.1% | 2025-02-24 | |
| CVE-2025-1598 | SourceCodester Best Church Management Software asset_crud.php unrestricted upload | 9.8v3.1 | 0.7% | 2025-02-24 | |
| CVE-2025-1488 | WPO365 MICROSOFT 365 GRAPH MAILER WordPress plugin open redirect via redirect_to parameter | 6.1v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-1412 | Mattermost Session Persistence after User-to-Bot Conversion | 3.1CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-0690 | Red Hat Enterprise Linux 9 grub2: Read: Integer overflow may lead to out-of-bounds write | 6.1CNA v3.1 | 0.7% | 2025-02-24 | Fix |
| CVE-2025-0545 | XSS in Tekrom Technology's T-Soft E-Commerce | 4.7CNA v3.1 | 0.3% | 2025-02-24 | Fix |
| CVE-2025-22635 | Eventer - WordPress Event and Booking Manager plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.2% | 2025-02-23 | Fix |
| CVE-2025-22633 | Give Divi Donation Modules WordPress plugin sensitive data exposure | 5.8CNA v3.1 | 0.3% | 2025-02-23 | Fix |
| CVE-2025-22632 | WooCommerce Pricing Product Pricing WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-23 | Fix |
| CVE-2025-22631 | Marketing Automation WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-23 | Fix |
| CVE-2025-1597 | SourceCodester Best Church Management Software redirect.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1596 | SourceCodester Best Church Management Software fpassword.php SQL injection | 9.8v3.1 | 0.6% | 2025-02-23 | Fix |
| CVE-2025-1595 | Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure | 6.9CNA v4.0 | 1.1% | 2025-02-23 | Nuclei |
| CVE-2025-1594 | FFmpeg AAC Encoder aacenc_tns.c ff_aac_search_for_tns stack-based overflow | 8.8v3.1 | 0.6% | 2025-02-23 | Fix |
| CVE-2025-1593 | SourceCodester Best Employee Management System Profile Picture unrestricted upload | 9.8v3.1 | 0.5% | 2025-02-23 | |
| CVE-2025-1592 | SourceCodester Best Employee Management System Add Role Page Role.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1591 | SourceCodester Employee Management System Department page department.php cross-site scripting | 6.1v3.1 | 0.3% | 2025-02-23 | |
| CVE-2025-1590 | SourceCodester E-Learning System List of Lessons page index.php unrestricted upload | 7.2v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1589 | SourceCodester E-Learning System User Registration register.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-02-23 | |
| CVE-2025-1588 | PHPGurukul Online Nurse Hiring System manage-nurse.php path traversal | 9.1v3.1 | 0.8% | 2025-02-23 | |
| CVE-2025-1587 | SourceCodester Telecom Billing Management System Add New Record main.cpp addrecords buffer overflow | 7.8v3.1 | 0.3% | 2025-02-23 | |
| CVE-2025-1586 | code-projects Blood Bank System A-.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-02-23 | |
| CVE-2025-1585 | otale header.html OptionsService cross-site scripting | 5.4v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1584 | opensolon Solon StaticMappings.java path traversal | 5.3CNA v4.0 | 0.6% | 2025-02-23 | Fix |
| CVE-2025-1583 | PHPGurukul Online Nurse Hiring System search-report-details.php SQL injection | 9.8v3.1 | 0.6% | 2025-02-23 | |
| CVE-2025-1582 | PHPGurukul Online Nurse Hiring System all-request.php SQL injection | 9.8v3.1 | 0.6% | 2025-02-23 | |
| CVE-2025-1581 | PHPGurukul Online Nurse Hiring System book-nurse.php SQL injection | 9.8v3.1 | 0.5% | 2025-02-23 | |
| CVE-2025-1580 | PHPGurukul Nipah Virus Testing Management System search-report-result.php SQL injection | 9.8v3.1 | 0.5% | 2025-02-23 | |
| CVE-2025-1579 | code-projects Blood Bank System user.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1578 | PHPGurukul/Campcodes Online Shopping Portal search-result.php SQL injection | 7.5v3.1 | 0.4% | 2025-02-23 | |
| CVE-2025-1577 | code-projects Blood Bank System prostatus.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-23 | |
| CVE-2025-1576 | code-projects Real Estate Property Management System ajax_state.php SQL injection | 9.8v3.1 | 0.6% | 2025-02-23 | |
| CVE-2025-1575 | Harpia DiagSystem atualatendimento_jpeg.php resource injection | 5.3CNA v4.0 | 0.5% | 2025-02-23 | |
| CVE-2025-1467 | tarteaucitronjs tarteaucitron cross-site scripting (XSS) | 5.1CNA v4.0 | 0.3% | 2025-02-23 | Fix |
| CVE-2025-27012 | A1POST.BG Shipping for Woo WordPress plugin CSRF to privilege escalation | 8.8CNA v3.1 | 0.2% | 2025-02-22 | Fix |
| CVE-2025-26973 | Social Warfare WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-22 | Fix |
| CVE-2025-26776 | Chaty Pro WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.6% | 2025-02-22 | Fix |
| CVE-2025-26774 | Responsive Modal Builder for High Conversion Easy Popups WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-22 | Fix |
| CVE-2025-26764 | Distance Based Shipping Calculator WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.3% | 2025-02-22 | Fix |
| CVE-2025-26763 | Responsive Slider by MetaSlider WordPress plugin deserialization of untrusted data | 9.8CNA v3.1 | 0.7% | 2025-02-22 | Fix |
| CVE-2025-26760 | Calculator Builder WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-02-22 | Fix |
| CVE-2025-26757 | FULL Cliente WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-02-22 | Fix |
| CVE-2025-26756 | Magic the Gathering Card Tooltips WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-22 | Fix |
| CVE-2025-26750 | Vitepos WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-02-22 | Fix |
| CVE-2025-21704 | Linux kernel CDC-ACM USB driver out-of-bounds write | 7.8NVD v3.1 | 0.4% | 2025-02-22 | Fix |
| CVE-2025-1557 | OFCMS cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-02-22 | |
| CVE-2025-1556 | westboy CicadasCMS Template Management system deserialization | 9.8v3.1 | 0.7% | 2025-02-22 | |
| CVE-2025-1553 | pankajindevops scale project cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-02-22 | |
| CVE-2025-1510 | Custom Post Type Date Archives do_shortcode action code injection | 9.8v3.1 | 0.6% | 2025-02-22 | |
| CVE-2025-1509 | Show Me The Cookies WordPress plugin unauthenticated arbitrary shortcode execution | 9.8v3.1 | 0.6% | 2025-02-22 | |
| CVE-2025-1361 | IP2Location Country Blocker WordPress plugin information disclosure | 5.3NVD v3.1 | 1.3% | 2025-02-22 | NucleiFix |
| CVE-2025-0957 | Vulnerability: SMTP for Amazon SES WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.5% | 2025-02-22 | Fix |
| CVE-2025-0953 | SMTP for Sendinblue YaySMTP WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-22 | Fix |
| CVE-2025-0918 | SMTP for SendGrid YaySMTP WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-22 | Fix |
| CVE-2025-27109 | solidjs solid lack of Escaping of HTML in JSX Fragments allows for cross-site scripting in solid-js | 7.3CNA v3.1 | 0.3% | 2025-02-21 | Fix |
| CVE-2025-27108 | Cross-site scripting vulnerability due to improper use of string.replace in dom-expressions | 7.3CNA v3.1 | 0.3% | 2025-02-21 | Fix |
| CVE-2025-27106 | Code injection in binance-trading-bot | 7.7CNA v4.0 | 2.0% | 2025-02-21 | Fix |
| CVE-2025-27105 | AugAssign evaluation order causing OOB write within the object in Vyper | 2.3CNA v4.0 | 0.6% | 2025-02-21 | Fix |
| CVE-2025-27104 | Double eval in for List Iter in Vyper | 2.3CNA v4.0 | 0.4% | 2025-02-21 | Fix |
| CVE-2025-27100 | An authenticated user can crash lakeFS by exhausting server memory | 6.5CNA v3.1 | 0.4% | 2025-02-21 | Fix |
| CVE-2025-26794 | Exim SQLite hints and ETRN serialization SQL injection | 9.8NVD v3.1 | 77.5% | 2025-02-21 | Emerging ThreatsExploit codeFix |
| CVE-2025-26622 | Sqrt doesn't define rounding behavior in Vyper | 2.3CNA v4.0 | 0.3% | 2025-02-21 | Fix |
| CVE-2025-26014 | olajowon Loggrove remote code execution | 9.8CISA ADP v3.1 | 1.1% | 2025-02-21 | Exploit code |
| CVE-2025-26013 | olajowon Loggrove sensitive information in source code | 8.2CISA ADP v3.1 | 0.4% | 2025-02-21 | |
| CVE-2025-25878 | Angeljudesuarez Simple ChatBox SQL injection | 3.8CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25877 | Angeljudesuarez Simple ChatBox SQL injection | 3.8CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25876 | Angeljudesuarez Simple ChatBox SQL injection | 7.2CISA ADP v3.1 | 0.5% | 2025-02-21 | |
| CVE-2025-25875 | Angeljudesuarez Simple ChatBox SQL injection | 6.4CISA ADP v3.1 | 0.4% | 2025-02-21 | |
| CVE-2025-25772 | Ujcms Jspxcms component /back/UserController.java cross-site request forgery | 5.1CISA ADP v3.1 | 0.2% | 2025-02-21 | |
| CVE-2025-25770 | wangmarket cross-site request forgery | 6.8CISA ADP v3.1 | 0.2% | 2025-02-21 | |
| CVE-2025-25769 | wangmarket cross-site request forgery | 8.0CISA ADP v3.1 | 0.2% | 2025-02-21 | |
| CVE-2025-25768 | MRCMS command injection | 5.4CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25767 | MRCMS component /controller/UserController.java privilege escalation | 4.8CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25766 | MRCMS component /file/savefile.do arbitrary file upload | 4.8CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25765 | MRCMS arbitrary file write | 4.0CISA ADP v3.1 | 0.2% | 2025-02-21 | |
| CVE-2025-25605 | TOTOLINK X5000R command injection | 6.5CISA ADP v3.1 | 0.8% | 2025-02-21 | |
| CVE-2025-25604 | TOTOLINK X5000R command injection | 6.5CISA ADP v3.1 | 0.8% | 2025-02-21 | |
| CVE-2025-25510 | Tenda AC8 buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25507 | Tenda AC6 There is a remote code execution | 6.5CISA ADP v3.1 | 0.5% | 2025-02-21 | |
| CVE-2025-25505 | Tenda AC6 buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-25282 | Potential insecure direct object reference (IDOR) vulnerability in ragflow | 8.1CNA v3.0 | 0.5% | 2025-02-21 | |
| CVE-2025-1555 | hzmanyun Education and Training System saveImage unrestricted upload | 9.8v3.1 | 0.7% | 2025-02-21 | |
| CVE-2025-1548 | iteachyou Dreamer CMS edit cross-site scripting | 4.6v3.1 | 0.3% | 2025-02-21 | |
| CVE-2025-1546 | BDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injection | 6.9CNA v4.0 | 2.7% | 2025-02-21 | |
| CVE-2025-1544 | dingfanzu CMS loadShopInfo.php SQL injection | 5.3CNA v4.0 | 0.3% | 2025-02-21 | |
| CVE-2025-1543 | iteachyou Dreamer CMS ueditor- path traversal | 5.3CNA v4.0 | 0.8% | 2025-02-21 | |
| CVE-2025-1539 | D-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflow | 9.8v3.1 | 1.6% | 2025-02-21 | |
| CVE-2025-1538 | D-Link DAP-1320 API set_ws_action heap-based overflow | 8.7CNA v4.0 | 1.5% | 2025-02-21 | |
| CVE-2025-1537 | Harpia DiagSystem atualatendimento_jpeg.php SQL injection | 5.3CNA v4.0 | 0.4% | 2025-02-21 | |
| CVE-2025-1536 | Raisecom Multi-Service Intelligent Gateway vpn_template_style.php OS command injection | 6.9CNA v4.0 | 3.2% | 2025-02-21 | |
| CVE-2025-1535 | Baiyi Cloud Asset Management System admin.ticket.close.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-02-21 | |
| CVE-2025-1489 | WP-Appbox WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-21 | Exploit codeFix |
| CVE-2025-1471 | Eclipse Omr: Buffer overflow | 7.1CNA v4.0 | 0.2% | 2025-02-21 | Fix |
| CVE-2025-1470 | Eclipse Omr: Null pointer dereference | 5.1CNA v4.0 | 0.2% | 2025-02-21 | |
| CVE-2025-1410 | Events Calendar Made Simple Pie Calendar WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-21 | Fix |
| CVE-2025-1407 | AMO Team Showcase WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-02-21 | |
| CVE-2025-1406 | Newpost Catch WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-21 | Fix |
| CVE-2025-1403 | IBM Qiskit SDK denial of service | 8.6CNA v3.1 | 0.7% | 2025-02-21 | Fix |
| CVE-2025-1402 | stellarwp Event Tickets and Registration ticket deletion handler missing authorization | 5.3CNA v3.1 | 0.4% | 2025-02-21 | Fix |
| CVE-2025-1001 | Medixant RadiAnt DICOM Viewer improper certificate validation | 5.7CNA v4.0 | 0.1% | 2025-02-21 | Fix |
| CVE-2025-0838 | Heap buffer overflow in Abseil | 5.9CNA v4.0 | 0.6% | 2025-02-21 | Fix |
| CVE-2025-0728 | Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow | 5.3CNA v4.0 | 0.8% | 2025-02-21 | Fix |
| CVE-2025-0727 | Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow | 5.3CNA v4.0 | 0.8% | 2025-02-21 | Fix |
| CVE-2025-0726 | Eclipse ThreadX NetX Duo HTTP server denial of service | 7.1CNA v4.0 | 0.8% | 2025-02-21 | Fix |
| CVE-2025-27218 | Sitecore Experience Manager and Experience Platform insecure deserialization | 5.3CISA ADP v3.1 | 65.0% | 2025-02-20 | NucleiMetasploitEmerging ThreatsExploit code |
| CVE-2025-27098 | The Guild GraphQL Mesh static file handler path traversal | 5.8CNA v3.1 | 0.4% | 2025-02-20 | Fix |
| CVE-2025-27097 | The Guild GraphQL Mesh query document cache vulnerability | 5.1CNA v4.0 | 0.4% | 2025-02-20 | Fix |
| CVE-2025-27096 | SQL injection endpoint html/personalizacao_upload.php parameter id_campo in WeGIA | 9.4CNA v4.0 | 0.6% | 2025-02-20 | Fix |
| CVE-2025-27091 | Cisco OpenH264 Decoding functions heap overflow | 8.6CNA v4.0 | 0.7% | 2025-02-20 | Fix |
| CVE-2025-27088 | Reflected cross-site scripting (XSS) in template implementation in oxyno-zeta/s3-proxy | 8.4CNA v4.0 | 0.5% | 2025-02-20 | Fix |
| CVE-2025-26856 | I-O DATA DEVICE UD-LT2 OS command improper neutralization | 7.2CNA v3.0 | 1.1% | 2025-02-20 | |
| CVE-2025-26618 | SSH SFTP packet size not verified properly in Erlang OTP | 7.0CNA v4.0 | 0.5% | 2025-02-20 | Fix |
| CVE-2025-26311 | Libming clip actions parsing functions memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26310 | Libming denial of service | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26309 | Libming parseSWF_DEFINESCENEANDFRAMEDATA function memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26308 | Libming parseSWF_FILTERLIST function in util/parser.c memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26307 | Libming parseSWF_IMPORTASSETS2 function memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26306 | Libming readSizedString function in util/read.c memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26305 | Libming parseSWF_SOUNDINFO function in util/parser.c memory leak | 8.2CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-26304 | Libming parseSWF_EXPORTASSETS function memory leak | 8.2CISA ADP v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-25973 | Yandaozi Ppress "related recommendations" feature stored cross-site scripting | 6.5CISA ADP v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25968 | Ddsn CM3 Acora Content Management System improper access control | 6.0CISA ADP v3.1 | 1.0% | 2025-02-20 | |
| CVE-2025-25960 | Phpcms cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-02-20 | |
| CVE-2025-25958 | Phpcms cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-02-20 | |
| CVE-2025-25957 | XunRuiCMS cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-02-20 | |
| CVE-2025-25679 | Tenda i12 stack-based buffer overflow | 8.0CISA ADP v3.1 | 0.3% | 2025-02-20 | |
| CVE-2025-25678 | Tenda i12 buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25676 | Tenda i12 buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25675 | Tenda AC10 command injection | 9.8v3.1 | 1.3% | 2025-02-20 | |
| CVE-2025-25674 | Tenda AC10 buffer overflow | 9.8v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-25668 | Tenda AC8 buffer overflow | 9.8v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25667 | Tenda AC8 buffer overflow | 9.8v3.1 | 0.6% | 2025-02-20 | |
| CVE-2025-25664 | Tenda AC8 buffer overflow | 9.8v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25663 | Tenda AC8 buffer overflow | 9.8v3.1 | 0.5% | 2025-02-20 | Emerging Threats |
| CVE-2025-25662 | Tenda O4 buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-25299 | ckeditor5 cross-site scripting (XSS) in the real-time collaboration package | 2.3CNA v4.0 | 0.6% | 2025-02-20 | Fix |
| CVE-2025-24947 | litespeedtech LSQUIC algorithmic complexity | 5.3CNA v3.1 | 0.7% | 2025-02-20 | Fix |
| CVE-2025-24946 | privateoctopus picoquic algorithmic complexity | 5.3CNA v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-24893 | XWiki Platform eval injection | 9.8CNA v3.1 | 99.9% | 2025-02-20 | KEVNucleiMetasploitExploit codeFix |
| CVE-2025-23020 | ptrd Kwik algorithmic complexity | 5.3CNA v3.1 | 0.6% | 2025-02-20 | Fix |
| CVE-2025-22973 | QiboSoft QiboCMS X1 information disclosure | 7.5CISA ADP v3.1 | 0.5% | 2025-02-20 | |
| CVE-2025-21106 | Dell RecoverPoint for VMs incorrect default permissions | 5.5CNA v3.1 | 0.1% | 2025-02-20 | Fix |
| CVE-2025-21105 | Dell RecoverPoint for VMs command execution | 6.6CNA v3.1 | 0.2% | 2025-02-20 | Fix |
| CVE-2025-20059 | PingAM Java Policy Agent path traversal | 9.2CNA v4.0 | 1.0% | 2025-02-20 | |
| CVE-2025-1492 | Uncontrolled recursion in Wireshark | 7.8CNA v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-1483 | LTL Freight Quotes WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-1328 | Typed JS: A typewriter style animation WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-20 | |
| CVE-2025-1293 | HashiCorp Hermes improperly Validates AWS ALB JWTs, which may lead to authentication bypass | 8.2CNA v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-1265 | Elseta Vinci Protocol Analyzer OS command injection | 9.4CNA v4.0 | 1.4% | 2025-02-20 | Fix |
| CVE-2025-1223 | Citrix Secure Access Client uncontrolled search path | 5.8CNA v4.0 | 0.2% | 2025-02-20 | Fix |
| CVE-2025-1222 | Citrix Secure Access Client privilege escalation | 5.8CNA v4.0 | 0.2% | 2025-02-20 | Fix |
| CVE-2025-1064 | Login/Signup Popup ( Inline Form + Woocommerce ) WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-1043 | Embed Any Document WordPress plugin server-side request forgery | 6.4CNA v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-1039 | Lenix Elementor Leads addon WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-20 | Fix |
| CVE-2025-0897 | Modal Window WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-20 | Fix |
| CVE-2025-0868 | Remote code execution in DocsGPT | 9.3CNA v4.0 | 17.1% | 2025-02-20 | NucleiEmerging ThreatsExploit code |
| CVE-2025-0866 | Legoeso PDF Manager WordPress plugin authenticated (Author+) SQL injection via checkedVals parameter | 6.5CNA v3.1 | 0.4% | 2025-02-20 | |
| CVE-2025-0352 | Rapid Response Monitoring My Security Account App authorization bypass through user-controlled key | 8.7CNA v4.0 | 0.4% | 2025-02-20 | Fix |
| CVE-2025-0161 | IBM Security Verify Access Appliance code injection | 7.8CNA v3.1 | 0.2% | 2025-02-20 | Fix |
| CVE-2025-0112 | Cortex XDR Agent: Local Windows User can Disable the Agent | 6.8CNA v4.0 | 0.2% | 2025-02-20 | Fix |
| CVE-2025-27092 | Path traversal vulnerability in GHOSTS Photo Retrieval endpoint | 8.7CNA v4.0 | 0.6% | 2025-02-19 | Fix |
| CVE-2025-27090 | Server-side request forgery (SSRF) in sliver teamserver | 6.9CNA v4.0 | 0.6% | 2025-02-19 | Fix |
| CVE-2025-27089 | Overlapping policies allow update to non-allowed fields in directus | 5.4CNA v3.1 | 0.2% | 2025-02-19 | Fix |
| CVE-2025-25947 | Axiosys Bento4 improper initialization | 5.5CISA ADP v3.1 | 0.2% | 2025-02-19 | |
| CVE-2025-25946 | Axiosys Bento4 memory leak | 5.5CISA ADP v3.1 | 0.2% | 2025-02-19 | |
| CVE-2025-25945 | Axiosys Bento4 information disclosure | 6.5CISA ADP v3.1 | 0.4% | 2025-02-19 | |
| CVE-2025-25944 | Axiosys Bento4 buffer overflow | 7.3CISA ADP v3.1 | 0.2% | 2025-02-19 | |
| CVE-2025-25943 | Axiosys Bento4 buffer overflow | 7.8CISA ADP v3.1 | 0.2% | 2025-02-19 | |
| CVE-2025-25942 | Axiosys Bento4 information disclosure | 6.5CISA ADP v3.1 | 0.4% | 2025-02-19 | |
| CVE-2025-25196 | OpenFGA authorization bypass | 5.8CNA v4.0 | 0.4% | 2025-02-19 | Fix |
| CVE-2025-25054 | Six Apart Movable Type (8.4.x series) user information edit page reflected cross-site scripting | 6.1CNA v3.0 | 0.3% | 2025-02-19 | |
| CVE-2025-24989 | Microsoft Power Pages improper access control | 8.2CNA v3.1 | 1.6% | 2025-02-19 | KEVFix |
| CVE-2025-24965 | Krun_config.json symlink attack creates or overwrites file on the host in crun | 8.5CNA v4.0 | 0.6% | 2025-02-19 | Fix |
| CVE-2025-24841 | Six Apart Movable Type (8.4.x series) Movable Type contains a stored cross-site scripting | 5.4CNA v3.0 | 0.2% | 2025-02-19 | |
| CVE-2025-24806 | Regulation applies separately to Username-based logins to Email-based logins in authelia | 2.3CNA v4.0 | 0.4% | 2025-02-19 | Fix |
| CVE-2025-22888 | Six Apart Movable Type (8.4.x series) Movable Type contains a stored cross-site scripting | 5.4CNA v3.0 | 0.2% | 2025-02-19 | |
| CVE-2025-22622 | Age Verification reflected cross-site scripting (XSS) | 4.3CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-21355 | Microsoft Bing remote code execution | 8.6CNA v3.1 | 1.7% | 2025-02-19 | Fix |
| CVE-2025-20211 | Cisco BroadWorks Application Delivery Platform software cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-20158 | Cisco Video Phone 8875 and Desk Phone 9800 Series information disclosure | 4.4CNA v3.1 | 0.2% | 2025-02-19 | Fix |
| CVE-2025-20153 | Cisco ESA mail Bypass | 5.8CNA v3.1 | 0.4% | 2025-02-19 | Fix |
| CVE-2025-1465 | Lmxcms Maintenance db.inc.php code injection | 6.6v3.1 | 0.5% | 2025-02-19 | |
| CVE-2025-1464 | Baiyi Cloud Asset Management System admin.house.collect.php SQL injection | 6.9CNA v4.0 | 0.5% | 2025-02-19 | |
| CVE-2025-1448 | Synway SMG Gateway Management Software 9-12ping.php command injection | 6.9CNA v4.0 | 2.7% | 2025-02-19 | |
| CVE-2025-1447 | kasuganosoras Pigeon index.php server-side request forgery | 5.3CNA v4.0 | 0.4% | 2025-02-19 | Fix |
| CVE-2025-1441 | Royal Elementor Addons and Templates WordPress plugin cross-site request forgery | 8.8v3.1 | 0.2% | 2025-02-19 | Fix |
| CVE-2025-1426 | Google Chrome GPU heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.6% | 2025-02-19 | Fix |
| CVE-2025-1135 | SQL injection in ChurchCRM CurrentFundraiser parameter via BatchWinnerEntry.php | 7.2NVD v3.1 | 0.8% | 2025-02-19 | |
| CVE-2025-1134 | SQL injection in ChurchCRM CurrentFundraiser parameter via DonatedItemEditor.php | 7.2NVD v3.1 | 0.8% | 2025-02-19 | |
| CVE-2025-1133 | SQL injection in ChurchCRM EID parameter via EditEventAttendees.php | 7.2NVD v3.1 | 0.6% | 2025-02-19 | |
| CVE-2025-1132 | SQL injection in ChurchCRM EN_tyid parameter via EditEventAttendees.php | 8.8NVD v3.1 | 0.6% | 2025-02-19 | |
| CVE-2025-1118 | GRUB2 dump command information disclosure | 4.4CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-1075 | Checkmk LDAP credentials logged to Apache error log | 5.6CNA v4.0 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-1065 | Visualizer: Tables and Charts Manager for WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-1024 | ChurchCRM improper authentication | 4.8NVD v3.1 | 0.3% | 2025-02-19 | |
| CVE-2025-1007 | Eclipse Foundation OpenVSX namespace details API improper authorization | 6.9CNA v4.0 | 0.5% | 2025-02-19 | |
| CVE-2025-1006 | Google Chrome Network use-after-free | 8.8CISA ADP v3.1 | 0.5% | 2025-02-19 | Fix |
| CVE-2025-0999 | Google Chrome V8 heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.6% | 2025-02-19 | Fix |
| CVE-2025-0968 | ElementsKit Elementor addons WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.5% | 2025-02-19 | Fix |
| CVE-2025-0916 | YaySMTP - unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-19 | Fix |
| CVE-2025-0893 | Symantec Diagnostic Tool improper privilege management | 7.8CNA v3.1 | 0.2% | 2025-02-19 | Fix |
| CVE-2025-0865 | WP Media Category Management - cross-site request forgery to Settings Update | 6.5CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-0677 | GRUB2 UFS module out-of-bounds write | 6.4CNA v3.1 | 0.3% | 2025-02-19 | Fix |
| CVE-2025-0633 | iniparser heap overflow in iniparser.c | 5.1CNA v4.0 | 0.2% | 2025-02-19 | Fix |
| CVE-2025-0624 | GRUB2 network boot configuration search out-of-bounds write | 7.6CNA v3.1 | 1.4% | 2025-02-19 | Fix |
| CVE-2025-27113 | libxml2 null pointer dereference | 7.5v3.1 | 1.0% | 2025-02-18 | Fix |
| CVE-2025-27016 | Drivr Lite Google Drive WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-18 | |
| CVE-2025-27013 | MediCenter WordPress theme sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-26624 | Local privilege escalation in Rufus and previous versions | 6.8CNA v4.0 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-26623 | Exiv2 allows use-after-free | 5.3CNA v4.0 | 0.9% | 2025-02-18 | Fix |
| CVE-2025-26620 | DuendeSoftware foss time-of-check time-of-use race condition | 6.3CNA v4.0 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-26617 | SQL injection endpoint historico_paciente.php parameter id_fichamedica in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26616 | Path traversal endpoint exportar_dump.php parameter file in WeGIA | 10.0CNA v4.0 | 0.7% | 2025-02-18 | Fix |
| CVE-2025-26615 | Path traversal endpoint examples.php parameter src in WeGIA | 10.0CNA v3.1 | 0.8% | 2025-02-18 | Fix |
| CVE-2025-26614 | SQL injection endpoint deletar_documento.php parameter id_cargo in WeGIA | 9.4CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26613 | OS command injection endpoint gerenciar_backup.php parameter file (RCE) in WeGIA | 10.0CNA v4.0 | 2.5% | 2025-02-18 | Fix |
| CVE-2025-26612 | SQL injection endpoint adicionar_almoxarife.php parameter id_almoxarifado, id_funcionario in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26611 | SQL injection endpoint remover_produto.php parameter id_produto in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26610 | SQL injection endpoint restaurar_produto_desocultar.php parameter id_produto in WeGIA | 9.4CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26609 | SQL injection endpoint familiar_docfamiliar.php parameter id_dependente, id_doc in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26608 | SQL injection endpoint dependente_docdependente.php parameter id_dependente, id_doc in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26607 | SQL injection endpoint documento_excluir.php parameter id_funcionario in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26606 | SQL injection endpoint informacao_adicional.php parameter id_descricao in WeGIA | 10.0CNA v4.0 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-26605 | SQL injection endpoint deletar_cargo.php parameter id_cargo in WeGIA | 9.4CNA v4.0 | 0.5% | 2025-02-18 | Fix |
| CVE-2025-26604 | Discord-Agora Kernel code execution | 8.3CNA v3.1 | 0.4% | 2025-02-18 | |
| CVE-2025-26603 | Heap-use-after-free in function str_to_reg in Vim/Vim | 4.2CNA v3.1 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-26465 | OpenSSH: Machine-in-the-middle attack if verifyhostkeydns is enabled | 6.8NVD v3.1 | 7.7% | 2025-02-18 | Fix |
| CVE-2025-26058 | Webkul QloApps sensitive query strings | 4.2CISA ADP v3.1 | 0.2% | 2025-02-18 | |
| CVE-2025-25896 | D-Link DSL-3782 stack-based buffer overflow | 5.7CISA ADP v3.1 | 0.5% | 2025-02-18 | Emerging Threats |
| CVE-2025-25895 | D-Link DSL-3782 OS command injection | 8.0CISA ADP v3.1 | 1.0% | 2025-02-18 | |
| CVE-2025-25894 | D-Link DSL-3782 OS command injection | 8.0CISA ADP v3.1 | 1.0% | 2025-02-18 | |
| CVE-2025-25893 | D-Link DSL-3782 OS command injection | 8.0CISA ADP v3.1 | 1.0% | 2025-02-18 | |
| CVE-2025-25892 | D-Link DSL-3782 stack-based buffer overflow | 5.7CISA ADP v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-25891 | D-Link DSL-3782 stack-based buffer overflow | 5.7CISA ADP v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-25475 | OFFIS DCMTK component /libsrc/dcrleccd.cc null pointer dereference | 7.5CISA ADP v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-25474 | OFFIS DCMTK buffer overflow | 6.5CISA ADP v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-25473 | FFmpeg memory allocator memory leak | 5.3CISA ADP v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-25472 | OFFIS DCMTK A buffer overflow | 5.3CISA ADP v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-25471 | FFmpeg MOV demuxer null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-25469 | FFmpeg libavutil/iamf.c memory leak | 6.5CISA ADP v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-25468 | FFmpeg libavutil/mem.c memory leak | 6.5CISA ADP v3.1 | 0.4% | 2025-02-18 | |
| CVE-2025-25467 | libx264 AAC decoder vulnerability | 9.8CISA ADP v3.1 | 0.7% | 2025-02-18 | |
| CVE-2025-25305 | SSL validation for outgoing requests in Home Assistant Core and used libs not correct | 7.0CNA v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-25300 | smartbanner.js rel noopener XSS | 1.3CNA v4.0 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-25284 | Path traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS Implementation | 8.7CNA v4.0 | 0.6% | 2025-02-18 | |
| CVE-2025-25224 | LuxSoft The LuxCal Web Calendar missing authentication | 7.5v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-25223 | LuxSoft The LuxCal Web Calendar path traversal | 5.3v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-25222 | LuxSoft The LuxCal Web Calendar SQL injection | 9.8v3.1 | 0.5% | 2025-02-18 | Fix |
| CVE-2025-25221 | LuxSoft The LuxCal Web Calendar SQL injection | 9.8v3.1 | 0.5% | 2025-02-18 | Fix |
| CVE-2025-25055 | JIP InfoBridge FileMegane authentication bypass by spoofing | 5.3CNA v3.0 | 0.4% | 2025-02-18 | |
| CVE-2025-24928 | libxml2 stack-based buffer overflow | 7.7v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-24895 | italia cie-aspnetcore SAML Response signature verification Bypass in CIE.AspNetCore.Authentication | 9.1CNA v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-24894 | italia spid-aspnetcore SAML Response signature verification Bypass in SPID.AspNetCore.Authentication | 9.1CNA v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-22921 | FFmpeg null pointer dereference | 6.5CISA ADP v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-22920 | FFmpeg A heap-based buffer overflow | 5.3CISA ADP v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-22919 | FFmpeg git-master commit N-113007-g8d24a28d06 reachable assertion | 6.5CISA ADP v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-22663 | Paid Videochat Turnkey Site WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.6% | 2025-02-18 | Fix |
| CVE-2025-22657 | Atarim WordPress plugin arbitrary content deletion vulnerability | 7.5CNA v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-22656 | Cookie Monster WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-02-18 | |
| CVE-2025-22654 | Simplified WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 1.0% | 2025-02-18 | Fix |
| CVE-2025-22650 | Smartarget WordPress plugin cross-site scripting | 6.5CNA v3.1 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-22645 | Real Estate Manager WordPress plugin Captcha bypass vulnerability vulnerability | 5.3CNA v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-22639 | Distance Rate Shipping for WooCommerce WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2025-02-18 | |
| CVE-2025-22207 | Joomla! CMS Core SQL injection vulnerability in Scheduled Tasks component | 6.7CNA v4.0 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-21703 | Linux kernel netem use-after-free | 7.8CNA v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-21702 | In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_e | 7.8CNA v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-21608 | Forged packets over MQTT can show up in direct messages in Meshtastic Firmware | 5.3CNA v4.0 | 0.4% | 2025-02-18 | |
| CVE-2025-20075 | JIP InfoBridge FileMegane server-side request forgery | 7.2CNA v3.0 | 0.4% | 2025-02-18 | |
| CVE-2025-1414 | Mozilla memory safety bugs fixed in Firefox | 6.5CISA ADP v3.1 | 0.5% | 2025-02-18 | Fix |
| CVE-2025-1390 | OpenAnolis Anolis OS pam_cap: Fix potential configuration parsing error | 6.1CNA v3.1 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-1269 | Open redirect in HAVELSAN's Open Source Project Liman MYS | 4.8CNA v3.1 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-1035 | Path traversal in Komtera Technolgies' KLog Server | 5.7CNA v3.1 | 9.9% | 2025-02-18 | NucleiEmerging ThreatsFix |
| CVE-2025-1023 | SQL injection in ChurchCRM newCountName parameter via EditEventTypes.php | 9.8v3.1 | 2.5% | 2025-02-18 | Nuclei |
| CVE-2025-0981 | ChurchCRM Group Editor description field stored cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-02-18 | |
| CVE-2025-0864 | realmag777 Active Products Tables for WooCommerce reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-0817 | FormCraft - Premium WordPress Form Builder plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-0805 | Mortgage Calculator / Loan Calculator WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-02-18 | |
| CVE-2025-0796 | Mortgage Lead Capture System WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-0622 | GRUB2 gpg command hooks use-after-free | 6.4CNA v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-0521 | Post SMTP WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 0.3% | 2025-02-18 | Fix |
| CVE-2025-0425 | Cordaware bestinformed Infoclient local privilege escalation via Config Manipulation | 8.5CNA v4.0 | 0.2% | 2025-02-18 | Fix |
| CVE-2025-0424 | Cordaware bestinformed Web multiple Authenticated stored cross-site scripting | 5.1CNA v4.0 | 0.4% | 2025-02-18 | Fix |
| CVE-2025-0423 | Cordaware bestinformed Web multiple Unauthenticated stored cross-site scripting | 5.3CNA v4.0 | 0.5% | 2025-02-18 | Fix |
| CVE-2025-0422 | Cordaware bestinformed Web authenticated remote code execution via ScriptVar | 8.6CNA v4.0 | 0.9% | 2025-02-18 | Fix |
| CVE-2025-26778 | Gallery Custom Links WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26775 | BEAR WordPress plugin cross-site scripting (XSS) | 4.8v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26773 | Analytify WordPress plugin broken access control | 8.8v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-26772 | DethemeKit For Elementor WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26771 | SKT Blocks WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26770 | Waymark WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26769 | Vertex Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26758 | Spotlight Social Feeds WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.4% | 2025-02-17 | Fix |
| CVE-2025-26754 | Timeline Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-26700 | Siber Systems RoboForm Password Manager authentication bypass | 5.2CNA v3.0 | 0.3% | 2025-02-17 | |
| CVE-2025-23845 | ImageMeta WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-17 | |
| CVE-2025-23840 | WP-NOTCAPTCHA WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-17 | |
| CVE-2025-21103 | Dell NetWorker Management Console server-side include injection | 7.8CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-1392 | D-Link DIR-816 index.html cross-site scripting | 5.4v3.1 | 8.7% | 2025-02-17 | |
| CVE-2025-1391 | Improper authorization in Keycloak Organization Mapper allows Unauthorized Organization Claims | 5.4CNA v3.1 | 0.4% | 2025-02-17 | Fix |
| CVE-2025-1389 | Learning Digital Orca HCM SQL injection | 8.8CNA v3.1 | 0.5% | 2025-02-17 | Fix |
| CVE-2025-1388 | Learning Digital Orca HCM arbitrary file upload | 8.8CNA v3.1 | 0.5% | 2025-02-17 | Fix |
| CVE-2025-1387 | Learning Digital Orca HCM improper authentication | 9.8CNA v3.1 | 0.6% | 2025-02-17 | Fix |
| CVE-2025-1381 | code-projects Real Estate Property Management System ajax_city.php SQL injection | 7.5v3.1 | 0.6% | 2025-02-17 | |
| CVE-2025-1380 | Codezips Gym Management System del_plan.php SQL injection | 9.8v3.1 | 0.5% | 2025-02-17 | |
| CVE-2025-1379 | code-projects Real Estate Property Management System CustomerReport.php SQL injection | 9.8v3.1 | 0.5% | 2025-02-17 | |
| CVE-2025-1378 | Radare2 rasm2 rasm2.c memory corruption | 4.8CNA v4.0 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-1377 | GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service | 5.5v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-1376 | GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service | 4.7v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-1374 | code-projects Real Estate Property Management System search.php SQL injection | 7.5v3.1 | 0.4% | 2025-02-17 | |
| CVE-2025-1373 | FFmpeg MOV parser mov.c mov_read_trak null pointer dereference | 5.5v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-1372 | GNU elfutils eu-readelf readelf.c print_string_section buffer overflow | 7.8v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-1371 | GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference | 5.5v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-1370 | MicroWorld eScan Antivirus Autoscan USB epsdaemon sprintf os command injection | 4.8CNA v4.0 | 2.4% | 2025-02-17 | |
| CVE-2025-1369 | MicroWord eScan Antivirus USB password os command injection | 2.0CNA v4.0 | 3.0% | 2025-02-17 | |
| CVE-2025-1368 | MicroWord eScan Antivirus mwav.conf ReadConfiguration buffer overflow | 4.6CNA v4.0 | 0.4% | 2025-02-17 | |
| CVE-2025-1367 | MicroWord eScan Antivirus USB Password sprintf buffer overflow | 4.8CNA v4.0 | 0.4% | 2025-02-17 | |
| CVE-2025-1366 | MicroWord eScan Antivirus VirusPopUp strcpy stack-based overflow | 7.8v3.1 | 0.3% | 2025-02-17 | |
| CVE-2025-1365 | GNU elfutils eu-readelf readelf.c process_symtab buffer overflow | 7.8v3.1 | 0.3% | 2025-02-17 | Fix |
| CVE-2025-0924 | WP Activity Log WordPress plugin unauthenticated stored cross-site scripting | 6.1NVD v3.1 | 1.4% | 2025-02-17 | Exploit codeFix |
| CVE-2025-0714 | Insecure storage of sensitive information in MobaXTerm | 6.5CNA v3.1 | 0.2% | 2025-02-17 | Fix |
| CVE-2025-0591 | OMRON FA Integrated Tool Package CX-One out-of-bounds read vulnerability in CX-Programmer | 7.8CNA v3.1 | 0.2% | 2025-02-17 | |
| CVE-2025-0001 | Abacus Research Abacus authenticated arbitrary file read | 6.5CNA v3.1 | 0.6% | 2025-02-17 | Fix |
| CVE-2025-26779 | Keep Backup Daily WordPress plugin arbitrary file download | 4.9CNA v3.1 | 0.5% | 2025-02-16 | Fix |
| CVE-2025-26768 | what3words Address Field WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-16 | Fix |
| CVE-2025-26767 | Qubely WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-26766 | Leyka WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-26765 | Distance Based Shipping Calculator WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-02-16 | Fix |
| CVE-2025-26761 | Easy Elementor Addons WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-26759 | Content Snippet Manager WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-16 | Fix |
| CVE-2025-26755 | WP Airbnb Review Slider WordPress plugin SQL injection | 7.6CNA v3.1 | 0.4% | 2025-02-16 | Fix |
| CVE-2025-23975 | Botnet Attack Blocker WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-16 | |
| CVE-2025-22689 | Forex Calculators WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-22680 | Ad Inserter Pro WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-22676 | Upcasted S3 Offload WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-16 | Fix |
| CVE-2025-22291 | LTL Freight Quotes WordPress plugin enituretechnology missing authorization | 5.3CNA v3.1 | 0.3% | 2025-02-16 | Fix |
| CVE-2025-22290 | LTL Freight Quotes FreightQuote Edition WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-02-16 | Fix |
| CVE-2025-22289 | LTL Freight Quotes Unishippers Edition WordPress plugin broken access control | 9.8v3.1 | 0.4% | 2025-02-16 | Fix |
| CVE-2025-22286 | LTL Freight Quotes Worldwide Express Edition WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-16 | Fix |
| CVE-2025-22284 | LTL Freight Quotes Unishippers Edition WordPress plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-02-16 | Fix |
| CVE-2025-1364 | MicroWord eScan Antivirus USB Protection service passPrompt stack-based overflow | 6.6v3.1 | 0.4% | 2025-02-16 | |
| CVE-2025-1360 | Internet Web Solutions Sublime CRM HTTP POST request inicio.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-02-16 | |
| CVE-2025-1359 | SIAM Industria de Automação e Monitoramento qrcode.jsp cross-site scripting | 5.3CNA v4.0 | 0.8% | 2025-02-16 | |
| CVE-2025-1358 | Pix Software Vivaz cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-02-16 | |
| CVE-2025-1357 | Seventh D-Guard HTTP GET request path traversal | 5.3CNA v4.0 | 0.5% | 2025-02-16 | |
| CVE-2025-1356 | needyamin Library Card System card.php SQL injection | 7.5v3.1 | 0.5% | 2025-02-16 | |
| CVE-2025-1355 | needyamin Library Card System Add Picture signup.php unrestricted upload | 9.8v3.1 | 0.9% | 2025-02-16 | |
| CVE-2025-1354 | ASUS RT-N12E RT-N10E/ cross-site scripting | 4.8CNA v4.0 | 0.5% | 2025-02-16 | |
| CVE-2025-1353 | Kong Insomnia profapi.dll untrusted search path | 7.3CNA v4.0 | 0.2% | 2025-02-16 | |
| CVE-2025-1352 | GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption | 7.5v3.1 | 0.7% | 2025-02-16 | Fix |
| CVE-2025-1341 | PMWeb setting weak password | 8.1v3.1 | 1.1% | 2025-02-16 | |
| CVE-2025-1340 | TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow | 8.7CNA v4.0 | 16.7% | 2025-02-16 | |
| CVE-2025-1339 | TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection | 8.8v3.1 | 2.6% | 2025-02-16 | |
| CVE-2025-1338 | NUUO Camera handle_config.php print_file command injection | 6.9CNA v4.0 | 51.1% | 2025-02-16 | Reported exploitedNucleiExploit code |
| CVE-2025-1337 | Eastnets PaymentSafe BIC Search cross-site scripting | 5.1CNA v4.0 | 0.5% | 2025-02-16 | |
| CVE-2025-1336 | CmsEasy image_admin.php deleteimg_action path traversal | 8.1v3.1 | 1.0% | 2025-02-16 | |
| CVE-2025-1335 | CmsEasy file_admin.php deleteimg_action path traversal | 8.1v3.1 | 0.9% | 2025-02-16 | |
| CVE-2025-1332 | FastCMS template menu menu cross-site scripting | 4.8v3.1 | 0.4% | 2025-02-16 | |
| CVE-2025-26819 | getmonero Monero resource exhaustion | 7.5v3.1 | 0.5% | 2025-02-15 | Fix |
| CVE-2025-26793 | Hirsch Enterphone MESH default password | 10.0CNA v4.0 | 2.4% | 2025-02-15 | Nuclei |
| CVE-2025-22209 | Extension JoomSky.com SQL injection in JS jobs component for Joomla | 4.7CISA ADP v3.1 | 0.3% | 2025-02-15 | |
| CVE-2025-22208 | Extension JoomSky.com SQL injection in JS jobs component for Joomla | 4.7CISA ADP v3.1 | 0.7% | 2025-02-15 | Emerging Threats |
| CVE-2025-21401 | Microsoft Edge (Chromium-based) security feature bypass | 4.5CNA v3.1 | 0.3% | 2025-02-15 | Fix |
| CVE-2025-1302 | jsonpath-plus JSONPath Plus allows remote code execution | 9.3CNA v4.0 | 10.4% | 2025-02-15 | Reported exploitedNucleiExploit codeFix |
| CVE-2025-1005 | ElementsKit Elementor addons WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.4% | 2025-02-15 | Fix |
| CVE-2025-0997 | Google Chrome Navigation use-after-free | 8.1CISA ADP v3.1 | 0.4% | 2025-02-15 | Fix |
| CVE-2025-0996 | Google Chrome Browser UI inappropriate implementation | 5.4CISA ADP v3.1 | 0.4% | 2025-02-15 | Fix |
| CVE-2025-0995 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2025-02-15 | Fix |
| CVE-2025-0935 | Media Library Folders WordPress plugin missing authorization to plugin settings Change | 4.3CNA v3.1 | 0.3% | 2025-02-15 | Fix |
| CVE-2025-0822 | Bit Assist WordPress plugin path traversal to authenticated arbitrary file read | 6.5CNA v3.1 | 0.6% | 2025-02-15 | Fix |
| CVE-2025-26791 | DOMPurify allows cross-site scripting (XSS) | 6.1v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-26789 | Logpoint AgentX server-side template injection | 6.9CNA v4.0 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-26788 | StrongKey FIDO Server insecure direct object reference | 8.4CNA v3.1 | 0.5% | 2025-02-14 | Exploit codeFix |
| CVE-2025-26524 | No Rate Limiting vulnerability in RupeeWeb trading platform | 5.1CNA v4.0 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-26523 | Insufficient authorization vulnerability in RupeeWeb trading platform | 7.4CNA v4.0 | 0.5% | 2025-02-14 | Fix |
| CVE-2025-26522 | Authentication bypass vulnerability in RupeeWeb trading platform | 7.5CNA v4.0 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-26519 | musl-libc musl out-of-bounds write | 7.0v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-26508 | Certain HP LaserJet Pro out-of-bounds write | 8.3CNA v4.0 | 1.0% | 2025-02-14 | Fix |
| CVE-2025-26507 | Certain HP LaserJet Pro stack-based buffer overflow | 6.3CNA v4.0 | 0.9% | 2025-02-14 | Fix |
| CVE-2025-26506 | Certain HP LaserJet Pro stack-based buffer overflow | 9.2CNA v4.0 | 1.1% | 2025-02-14 | Fix |
| CVE-2025-26158 | Kashipara Online Attendance Management System cross-site scripting | 5.6CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-26157 | Darkseid Beauty Parlour Management System SQL injection | 5.9CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-26156 | PHPGurukul Online Shopping Portal Project SQL injection | 8.8CISA ADP v3.1 | 0.8% | 2025-02-14 | |
| CVE-2025-25997 | Feminer Wms path traversal | 7.5CISA ADP v3.1 | 1.1% | 2025-02-14 | |
| CVE-2025-25994 | Feminer Wms SQL injection | 7.5CISA ADP v3.1 | 0.5% | 2025-02-14 | |
| CVE-2025-25993 | Feminer Wms SQL injection | 5.1CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25992 | Feminer Wms SQL injection | 5.1CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25991 | Hoosk SQL injection | 5.1CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25990 | Hoosk cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25988 | Hoosk cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25745 | D-Link Dir-853 stack-based buffer overflow | 8.8CISA ADP v3.1 | 0.8% | 2025-02-14 | |
| CVE-2025-25740 | D-Link Dir-853 stack-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-25304 | Vega allows cross-site scripting via the vlSelectionTuples function | 6.9CNA v4.0 | 0.7% | 2025-02-14 | Fix |
| CVE-2025-25297 | HumanSignal label-studio label Studio allows server-side request forgery in the S3 Storage endpoint | 8.6CNA v3.1 | 0.7% | 2025-02-14 | Fix |
| CVE-2025-25296 | HumanSignal label-studio label Studio allows cross-site scripting | 6.1CNA v3.1 | 1.9% | 2025-02-14 | NucleiExploit codeFix |
| CVE-2025-25295 | HumanSignal label-studio label Studio has a path traversal vulnerability via image field | 8.7CNA v4.0 | 0.8% | 2025-02-14 | Fix |
| CVE-2025-25290 | @octokit/request link header parsing denial of service | 5.3CNA v3.1 | 0.8% | 2025-02-14 | Fix |
| CVE-2025-25289 | @octokit/request-error authorization header parsing denial of service | 5.3CNA v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-25288 | @octokit/plugin-paginate-rest pagination iterator denial of service | 5.3CNA v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-25285 | @octokit/endpoint endpoint parse function denial of service | 5.3CNA v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-25206 | elabftw incorrect input validation could allow an authenticated user to read sensitive information | 8.3CNA v3.1 | 0.5% | 2025-02-14 | Fix |
| CVE-2025-25204 | `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: | 6.3CNA v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-24700 | WP Event Aggregator WordPress plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24699 | WP Coder WordPress plugin CSRF to cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2025-02-14 | Fix |
| CVE-2025-24692 | Bulk Menu Edit WordPress plugin broken access control | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24688 | WP Mailster WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24641 | Better WishList API WordPress plugin stored cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-14 | Fix |
| CVE-2025-24617 | AcyMailing WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24616 | Uix Page Builder WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24615 | Analytics Cat WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-14 | Fix |
| CVE-2025-24614 | Post Timeline WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24607 | IdeaPush WordPress plugin broken access control | 9.8v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-24592 | SysBasics Customize My Account for WooCommerce WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24567 | WP Mailster WordPress plugin sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-24566 | Intro Tour Tutorial DeepPresentation WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-14 | Fix |
| CVE-2025-24565 | WP2LEADS WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24564 | Contact Form With Shortcode WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24558 | CRM Perks WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-24554 | AWcode Toolkit WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-23905 | Admin Options Pages WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-23857 | Essential WP Real Estate WordPress plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23853 | NoFollow Free WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23851 | Coronavirus (COVID-19) Outbreak Data Widgets WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23790 | Easy Code Placement WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23789 | URL Shortener WooCommerce WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23788 | Easy Filter WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-14 | |
| CVE-2025-23787 | Easy Bet WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23786 | Email to Download WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23771 | Push Notification for Post and BuddyPress WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-23766 | OPSI Israel Domestic Shipments WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-23751 | Data Dash WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23750 | Custom Widget Creator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23748 | Singsys -Awesome Gallery WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23742 | Podamibe Twilio Private Call WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23658 | Advanced Angular Contact Form WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23657 | WordPress-to-candidate for Salesforce CRM plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23655 | Contact Form 7 Paystack Add-on WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23653 | Form To Online Booking WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23652 | Fabio Zuanon Add custom content after post reflected cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23651 | Scroll Top WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23650 | Tidy.ro WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23648 | AdsMiddle WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23647 | WP-Clap WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23646 | Library Instruction Recorder WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23598 | Recip.ly WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23571 | Internal Links Generator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23568 | WP Login Attempt Log WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23534 | WPLingo WordPress plugin arbitrary content deletion vulnerability | 6.5CNA v3.1 | 0.4% | 2025-02-14 | |
| CVE-2025-23525 | Kv Compose Email From Dashboard WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23523 | HSS Embed Streaming Video WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23492 | CantonBolo 淘宝客插件 reflected cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23474 | Live Dashboard WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23431 | Envato Affiliater WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23428 | QMean WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-23406 | DMG MORI Digital Co., LTD. and NXTech Cente TCP/IPv4 out-of-bounds read | 5.3CNA v3.0 | 0.4% | 2025-02-14 | |
| CVE-2025-22705 | Disqus Popular Posts WordPress plugin CSRF to reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-02-14 | |
| CVE-2025-22702 | Photography WordPress theme broken access control | 6.3CNA v3.1 | 0.3% | 2025-02-14 | |
| CVE-2025-22698 | Accessibility Suite by Ability, Inc WordPress plugin Multiple broken access control | 6.3CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-22630 | Widget Options WordPress plugin arbitrary code execution | 9.9CNA v3.1 | 1.1% | 2025-02-14 | Fix |
| CVE-2025-1298 | TECNO com.transsion.carlcare authentication bypass by spoofing | 9.8CISA ADP v3.1 | 0.5% | 2025-02-14 | |
| CVE-2025-1239 | WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in Blocked Sites List | 4.8CNA v4.0 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-1071 | WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in spamBlocker module | 4.8CNA v4.0 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-1053 | Brocade SANnav encryption key is logged in the debug logs | 8.6CNA v4.0 | 0.2% | 2025-02-14 | Fix |
| CVE-2025-0867 | Privilege escalation in MEAC300 | 9.9CNA v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-0821 | Bit Assist WordPress plugin authenticated (Subscriber+) SQL injection via id parameter | 6.5v3.1 | 0.6% | 2025-02-14 | Fix |
| CVE-2025-0593 | SICK Lector8xx and InspectorP8xx vulnerable for code execution | 8.8CNA v3.1 | 0.8% | 2025-02-14 | Fix |
| CVE-2025-0592 | SICK Lector8xx and InspectorP8xx vulnerable for code execution | 8.8CNA v3.1 | 0.4% | 2025-02-14 | Fix |
| CVE-2025-0503 | Mattermost Leaked User IDs and Metadata of Deleted DMs | 3.1CNA v3.1 | 0.3% | 2025-02-14 | Fix |
| CVE-2025-0178 | WatchGaurd Firebox host header injection | 5.1CNA v4.0 | 0.2% | 2025-02-14 | Fix |
| CVE-2025-26582 | TinyMCE Advanced qTranslate fix editor problems WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26580 | Page/Post Specific Social Share Buttons WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26578 | Simple Documentation WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26577 | DX-auto-publish WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26574 | Google Drive WP Media WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26572 | WP PHPList WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26571 | Wibiya Toolbar WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26570 | Glance That WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26569 | Post Thumbs WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26568 | Easy Amazon Product Information WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26567 | Font Awesome WP WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26562 | RSS FIlter WordPress plugin CSRF to stored cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26561 | Elfsight Yottie Lite WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26558 | Aparat Responsive WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26552 | Naver Syndication V2 WordPress plugin CSRF to stored cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-02-13 | |
| CVE-2025-26551 | Bootstrap collapse WordPress plugin CSRF to stored cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-02-13 | |
| CVE-2025-26550 | Global Meta Keyword and Description WordPress plugin CSRF to cross-site scripting | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26549 | WP Html Page Sitemap WordPress plugin CSRF to stored cross-site scripting | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26547 | My Login Logout WordPress plugin CSRF to stored cross-site scripting | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26545 | Related Posts Line-up-Exactly by Milliard WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26543 | Simple Responsive Menu WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-02-13 | |
| CVE-2025-26539 | Embed Google Map WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26538 | Prezi Embedder WordPress plugin stored cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-26511 | Cassandra-Lucene-Index allows bypass of Cassandra RBAC | 8.8CNA v3.1 | 0.6% | 2025-02-13 | Fix |
| CVE-2025-26473 | Outback Power Mojave Inverter Use of GET request method with sensitive query strings | 7.5v3.1 | 0.5% | 2025-02-13 | |
| CVE-2025-25901 | TP-Link TL-WR841ND out-of-bounds write | 7.5v3.1 | 0.5% | 2025-02-13 | |
| CVE-2025-25900 | TP-Link Tl-wr841nd V11 buffer overflow | 4.9CISA ADP v3.1 | 0.4% | 2025-02-13 | |
| CVE-2025-25899 | TP-Link Tl-wr841nd V11 improper resource release | 3.5CISA ADP v3.1 | 0.3% | 2025-02-13 | |
| CVE-2025-25898 | TP-Link TL-WR841ND out-of-bounds write | 7.5v3.1 | 0.5% | 2025-02-13 | |
| CVE-2025-25897 | TP-Link TL-WR841ND out-of-bounds write | 7.5v3.1 | 0.5% | 2025-02-13 | |
| CVE-2025-25389 | PHPGurukul Land Record System SQL injection | 9.8CISA ADP v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25388 | PHPGurukul Land Record System SQL injection | 9.8CISA ADP v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25387 | PHPGurukul Land Record System SQL injection | 7.2CISA ADP v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25357 | PHPGurukul Land Record System SQL injection | 7.2v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25356 | PHPGurukul Land Record System SQL injection | 7.2v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25355 | PHPGurukul Land Record System SQL injection | 7.2v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25354 | PHPGurukul Land Record System /admin/admin-profile.php SQL injection | 7.2v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25352 | PHPGurukul Land Record System SQL injection | 7.2v3.1 | 0.8% | 2025-02-13 | |
| CVE-2025-25287 | lakejason0 mediawiki-skins-Lakeus lakeus vulnerable to stored XSS via system messages | 4.7CNA v3.1 | 0.4% | 2025-02-13 | Fix |
| CVE-2025-25286 | Crayfish allows remote code execution via Homarus Authorization header | 9.8CNA v3.1 | 1.0% | 2025-02-13 | Fix |
| CVE-2025-25281 | Outback Power Mojave Inverter exposure of sensitive information to an unauthorized actor | 7.5v3.1 | 0.5% | 2025-02-13 | |
| CVE-2025-25195 | Zulip events can leak private channel names | 4.3CNA v3.1 | 0.4% | 2025-02-13 | |
| CVE-2025-25067 | mySCADA myPRO Manager OS command injection | 9.8v3.1 | 1.7% | 2025-02-13 | Fix |
| CVE-2025-24904 | libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked | 8.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-24903 | libsignal-service-rs Doesn't Check Origin of Sync messages | 8.5CNA v3.1 | 0.2% | 2025-02-13 | |
| CVE-2025-24889 | freedomofpress securedrop-client path traversal in sd-log Qubes virtual machine | 4.5CNA v3.1 | 0.2% | 2025-02-13 | Fix |
| CVE-2025-24888 | freedomofpress securedrop-client path traversal in SecureDrop Client API.download_reply | 8.1CNA v3.1 | 1.0% | 2025-02-13 | Fix |
| CVE-2025-24865 | mySCADA myPRO Manager missing authentication for critical function | 9.8v3.1 | 7.2% | 2025-02-13 | MetasploitKCVFix |