CVE-2025 records published in August 2025
This page lists the 3,350 CVE-2025 records published in August 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 12 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 52815.8% of these records
- Listed in CISA KEV
- 120.4% of these records
- Reported exploited
- 80.2% of these records
- Detection signal
- 762.3% of these records
- Exploit code
- 1123.3% of these records
- Actionable vendor fix
- 2,08462.2% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in August 2025 have had from about 14 months to about 15 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-47696 | Blog Designer PRO WordPress plugin unauthenticated Non-arbitrary local file inclusion | 8.1CNA v3.1 | 0.5% | 2025-08-31 | |
| CVE-2025-31100 | WordPress School Management plugin (02-07-2025) arbitrary file upload | 9.9CNA v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9750 | Campcodes Online Learning Management System login.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9749 | HKritesh009 Grocery List Management Web App update.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-31 | |
| CVE-2025-9748 | Tenda CH22 httpd IPSECsave fromIpsecitem stack-based overflow | 9.8v3.1 | 0.8% | 2025-08-31 | |
| CVE-2025-9747 | Koillection csrf_protection_controller.js cross-site request forgery | 8.8v3.1 | 0.4% | 2025-08-31 | Fix |
| CVE-2025-9746 | Campcodes Hospital Management System Edit Doctor Specialization cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9745 | D-Link DI-500WF jhttpd version_upgrade.asp os command injection | 7.2v3.1 | 11.0% | 2025-08-31 | |
| CVE-2025-9744 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 1.8% | 2025-08-31 | Nuclei |
| CVE-2025-9743 | code-projects Human Resource Integrated System login_attendance2.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-31 | |
| CVE-2025-9742 | code-projects Human Resource Integrated System login.php SQL injection | 7.5v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9741 | code-projects Human Resource Integrated System login_query12.php SQL injection | 5.3NVD v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9740 | code-projects Human Resource Integrated System log_query.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-31 | |
| CVE-2025-9739 | Campcodes Online Water Billing System process.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9738 | Portabilis i-Educar educar_tipo_ensino_cad.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9737 | O2OA Personal Profile importmodel cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9736 | O2OA Personal Profile statement cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9735 | O2OA Personal Profile table cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9734 | O2OA Personal Profile stat cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9733 | code-projects Human Resource Integrated System login_timeee.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-31 | |
| CVE-2025-9732 | DCMTK dcm2img diybrpxt.h memory corruption | 7.8v3.1 | 0.2% | 2025-08-31 | Fix |
| CVE-2025-9731 | Tenda AC9 Administrative shadow hard-coded credentials | 7.0v3.1 | 0.1% | 2025-08-31 | |
| CVE-2025-9730 | itsourcecode Apartment Management System updateProfile.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9729 | PHPGurukul Online Course Registration student-registration.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9728 | givanz Vvveb login.tpl cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-31 | Exploit code |
| CVE-2025-9727 | D-Link DIR-816L soap.cgi soapcgi_main os command injection | 9.8v3.1 | 4.8% | 2025-08-31 | |
| CVE-2025-9726 | Campcodes Farm Management System review.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9725 | Cudy LT500E Web shadow hard-coded password | 8.8v3.1 | 0.4% | 2025-08-31 | |
| CVE-2025-9724 | Portabilis i-Educar educar_nivel_ensino_cad.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-31 | |
| CVE-2025-9723 | Portabilis i-Educar educar_tipo_regime_cad.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-31 | |
| CVE-2025-9722 | Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-31 | |
| CVE-2025-9721 | Portabilis i-Educar edit cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-31 | |
| CVE-2025-9720 | Portabilis i-Educar Cadastrar tabela de arredondamento edit cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-31 | |
| CVE-2025-9719 | O2OA Personal Profile script cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9718 | O2OA Personal Profile process cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9717 | O2OA Personal Profile unit cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9716 | O2OA Personal Profile form cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-9715 | O2OA Personal Profile script cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-31 | |
| CVE-2025-5083 | Amministrazione Trasparente WordPress plugin stored cross-site scripting | 5.5CNA v3.1 | 0.3% | 2025-08-31 | Fix |
| CVE-2025-54946 | Sunnet Corporate Training Management System SQL injection | 9.8v3.1 | 0.5% | 2025-08-30 | Fix |
| CVE-2025-54945 | Sunnet Corporate Training Management System external control of file name or path | 9.8v3.1 | 0.5% | 2025-08-30 | Fix |
| CVE-2025-54944 | Sunnet Corporate Training Management System unrestricted upload of file with dangerous type | 9.8v3.1 | 0.7% | 2025-08-30 | Fix |
| CVE-2025-54943 | Sunnet Corporate Training Management System missing authorization | 9.8v3.1 | 0.5% | 2025-08-30 | Fix |
| CVE-2025-54942 | Sunnet Corporate Training Management System missing authentication for critical function | 9.8v3.1 | 0.5% | 2025-08-30 | Fix |
| CVE-2025-38677 | Linux kernel f2fs dnode page handling out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-08-30 | Fix |
| CVE-2025-34165 | NetSupport Manager stack-based buffer overflow | 8.8CNA v4.0 | 0.5% | 2025-08-30 | Fix |
| CVE-2025-34164 | NetSupport Manager heap-based buffer overflow | 9.3CNA v4.0 | 0.7% | 2025-08-30 | Fix |
| CVE-2025-9706 | SourceCodester Water Billing System edit.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9705 | SourceCodester Water Billing System paybill.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9704 | SourceCodester Water Billing System viewbill.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9702 | SourceCodester Simple Cafe Billing System sales_report.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9701 | SourceCodester Simple Cafe Billing System receipt.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9700 | SourceCodester Online Book Store publisher_list.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9699 | SourceCodester Online Polling System Code checklogin.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-30 | |
| CVE-2025-9695 | Gallery Vault App com.thinkyeah.galleryvault vulnerability | 5.5v3.1 | 0.2% | 2025-08-30 | |
| CVE-2025-9694 | Campcodes Advanced Online Voting System login.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-30 | |
| CVE-2025-9692 | Campcodes Online Shopping System product.php SQL injection | 9.8v3.1 | 0.6% | 2025-08-30 | |
| CVE-2025-9691 | Campcodes Online Shopping System login.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9690 | SourceCodester Advanced School Management System vendordetails SQL injection | 8.8v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-9689 | SourceCodester Advanced School Management System item_select SQL injection | 8.8v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-9688 | Mupen64Plus is_viewer.c write_is_viewer integer overflow | 2.3CNA v4.0 | 0.3% | 2025-08-30 | Fix |
| CVE-2025-9687 | Portabilis i-Educar processamentoApi improper authorization | 8.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9686 | Portabilis i-Educar Listagem de áreas de conhecimento edit SQL injection | 8.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9685 | Portabilis i-Educar Listagem de áreas de conhecimento view SQL injection | 8.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9684 | Portabilis i-Educar Formula de Cálculo de Média edit SQL injection | 8.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9683 | O2OA Personal Profile form cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-9682 | O2OA Personal Profile appdict cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-9681 | O2OA Personal Profile agent cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-9680 | O2OA Personal Profile page cross-site scripting | 5.4v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9679 | itsourcecode Student Information System course_edit1.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-30 | |
| CVE-2025-9618 | Related Posts Lite WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-08-30 | |
| CVE-2025-9500 | TablePress WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-30 | Fix |
| CVE-2025-9499 | Ocean Extra WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-30 | Fix |
| CVE-2025-4956 | Pro Bulk Watermark Plugin for WordPress path traversal | 4.3CNA v3.1 | 0.3% | 2025-08-30 | |
| CVE-2025-0165 | IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data SQL injection | 7.6CNA v3.1 | 0.4% | 2025-08-30 | Fix |
| CVE-2025-58323 | NAVER MYBOX Explorer incorrect privilege assignment | 7.7CISA ADP v3.1 | 0.1% | 2025-08-29 | Fix |
| CVE-2025-58160 | Tracing logging user input may result in poisoning logs with ANSI escape sequences | 2.3CNA v4.0 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-58159 | WeGIA authenticated arbitrary file upload leading to remote code execution (RCE) | 10.0CNA v3.1 | 0.8% | 2025-08-29 | Fix |
| CVE-2025-58158 | Harness affected by arbitrary file write in Gitness LFS server | 8.8CNA v3.1 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-58157 | gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm | 7.5CNA v3.1 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-58156 | Centurion ERP authentication tokens information disclosure | 1.9CNA v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-58068 | Eventlet affected by HTTP request smuggling in unparsed trailers | 6.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-58067 | Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI | 4.2CNA v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-58066 | DoS vulnerability in ntpd-rs | 5.3CNA v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-57822 | Next.js Improper Middleware Redirect Handling leads to SSRF | 6.5CNA v3.1 | 2.5% | 2025-08-29 | NucleiFix |
| CVE-2025-57752 | Next.js affected by Cache Key Confusion for Image Optimization API Routes | 6.2CNA v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-56577 | Evope Core hard-coded cryptographic key | 8.4CISA ADP v3.1 | 0.1% | 2025-08-29 | |
| CVE-2025-55763 | civetweb URI parser buffer overflow | 7.5CISA ADP v3.1 | 1.2% | 2025-08-29 | Exploit codeFix |
| CVE-2025-55750 | Gitpod Classic affected by Bitbucket OAuth token exposure via Redirect Fragment | 6.5CNA v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-55580 | SolidInvoice cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-08-29 | Exploit code |
| CVE-2025-55579 | SolidInvoice cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-08-29 | Exploit code |
| CVE-2025-55304 | Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata | 1.8CNA v4.0 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-55202 | Opencast has a partial path traversal vulnerability in UI config | 2.7CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-55177 | Meta Platforms WhatsApp incorrect authorization | 5.4CNA v3.1 | 4.7% | 2025-08-29 | KEVKCVFix |
| CVE-2025-55173 | Next.js content injection vulnerability for Image Optimization | 4.3CNA v3.1 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-54877 | Tuleap's special and always there fields permissions are not verified in cross-tracker search | 5.3CNA v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-54777 | Konica Minolta Multiple products in bizhub series improper error handling | 5.3CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-54142 | AkamaiGhost HTTP request smuggling | 4.0CNA v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-54080 | Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata via crafted EPS file | 1.8CNA v4.0 | 0.1% | 2025-08-29 | Fix |
| CVE-2025-53508 | iND HL330-DLS OS command injection | 8.6CNA v4.0 | 1.3% | 2025-08-29 | |
| CVE-2025-53507 | iND HL330-DLS insecure storage of sensitive information | 7.1CNA v4.0 | 0.3% | 2025-08-29 | |
| CVE-2025-52861 | QNAP VioStor path traversal | 7.0CNA v4.0 | 0.6% | 2025-08-29 | Fix |
| CVE-2025-52856 | QNAP VioStor improper authentication | 9.3CNA v4.0 | 0.6% | 2025-08-29 | Fix |
| CVE-2025-48979 | Ubiquiti UISP Application An improper input validation | 3.4CISA ADP v3.1 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-47909 | Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf | 7.3CISA ADP v3.1 | 0.2% | 2025-08-29 | |
| CVE-2025-44033 | aaluoxiang oa_system SQL injection | 9.8CISA ADP v3.1 | 0.6% | 2025-08-29 | |
| CVE-2025-44015 | QNAP HybridDesk Station command injection | 2.3CNA v4.0 | 0.9% | 2025-08-29 | Fix |
| CVE-2025-43773 | Liferay Portal allows improper access through the expandoTableLocalService | 4.6CNA v4.0 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-43284 | Apple macOS out-of-bounds read | 5.5CISA ADP v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-43268 | Apple macOS incorrect permission assignment | 7.8CISA ADP v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-43255 | Apple macOS out-of-bounds read | 3.3CISA ADP v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-43187 | Apple macOS arbitrary code execution | 7.8CISA ADP v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40927 | CGI::Simple for Perl has a HTTP response splitting flaw | 7.3CISA ADP v3.1 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-40709 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40708 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40707 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40706 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40705 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40704 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40703 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-40702 | Cross-site scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 5.4v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-39247 | Hikvision HikCentral Professional some improper access control | 8.6CNA v3.1 | 0.5% | 2025-08-29 | Exploit code |
| CVE-2025-39246 | Hikvision HikCentral FocSign unquoted search path | 5.3CNA v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-39245 | Hikvision HikCentral Master Lite some CSV injection | 4.7CNA v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-33038 | QNAP Qsync Central path traversal | 7.2CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-33037 | QNAP Qsync Central path traversal | 7.2CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-33036 | QNAP Qsync Central path traversal | 7.2CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-33033 | QNAP Qsync Central path traversal | 7.2CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-33032 | QNAP QTS and QuTS hero path traversal | 5.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30278 | QNAP Qsync Central improper certificate validation | 8.3CNA v4.0 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-30277 | QNAP Qsync Central improper certificate validation | 8.3CNA v4.0 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-30275 | QNAP Qsync Central null pointer dereference | 5.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-30274 | QNAP QTS and QuTS hero null pointer dereference | 5.1CNA v4.0 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-30273 | QNAP QTS and QuTS hero out-of-bounds write | 7.1CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-30272 | QNAP QTS and QuTS hero null pointer dereference | 5.1CNA v4.0 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-30271 | QNAP QTS and QuTS hero path traversal | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30270 | QNAP QTS and QuTS hero path traversal | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30268 | QNAP QTS and QuTS hero null pointer dereference | 5.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-30267 | QNAP QTS and QuTS hero null pointer dereference | 5.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-30265 | QNAP QTS and QuTS hero buffer overflow | 2.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-30264 | QNAP QTS and QuTS hero command injection | 7.7CNA v4.0 | 0.9% | 2025-08-29 | Fix |
| CVE-2025-30263 | QNAP Qsync Central null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30262 | QNAP Qsync Central null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30261 | QNAP Qsync Central resource exhaustion | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-30260 | QNAP Qsync Central resource exhaustion | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29900 | QNAP File Station 5 resource exhaustion | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29899 | QNAP File Station 5 resource exhaustion | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29898 | QNAP Qsync Central resource exhaustion | 6.0CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29894 | QNAP Qsync Central SQL injection | 7.5CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29893 | QNAP Qsync Central SQL injection | 7.5CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29890 | QNAP File Station 5 resource exhaustion | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29889 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29888 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29887 | QNAP QuRouter command injection | 7.1CNA v4.0 | 0.8% | 2025-08-29 | Fix |
| CVE-2025-29886 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29882 | QNAP QTS and QuTS hero null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29879 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29878 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29875 | QNAP File Station 5 null pointer dereference | 7.1CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-29874 | QNAP File Station 5 null pointer dereference | 5.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-22483 | QNAP License Center cross-site scripting | 7.1CNA v4.0 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-9678 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9677 | Modo Legend of the Phoenix com.duige.hzw.multilingual vulnerability | 5.5v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9676 | NCSOFT Universe App com.ncsoft.universeapp vulnerability | 5.5v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9675 | Voice Changer App improper export of Android application components | 5.5v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9674 | Transbyte Scooper News App com.hatsune.eagleee vulnerability | 5.5v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9673 | Hey Kakao App com.kakao.i.connect vulnerability | 4.8CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-9672 | Rejseplanen App de.hafas.android.rejseplanen vulnerability | 4.8CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-9671 | UAB Paytend Paytend App com.passport.cash vulnerability | 4.8CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-9670 | mixmark-io turndown commonmark-rules.js redos | 6.9CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-9669 | Jinher OA GetTreeDate.aspx SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9667 | code-projects Simple Grading System Admin Panel delete_account.php SQL injection | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9666 | code-projects Simple Grading System Admin Panel delete_student.php SQL injection | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9665 | code-projects Simple Grading System Admin Panel edit_student.php SQL injection | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9664 | code-projects Simple Grading System Admin Panel add_student_grade.php SQL injection | 8.8v3.1 | 0.5% | 2025-08-29 | |
| CVE-2025-9663 | code-projects Simple Grading System Admin Panel edit_account.php SQL injection | 8.8v3.1 | 0.5% | 2025-08-29 | |
| CVE-2025-9662 | code-projects Simple Grading System Admin Panel login.php SQL injection | 9.8v3.1 | 0.6% | 2025-08-29 | |
| CVE-2025-9660 | SourceCodester Bakeshop Online Ordering System passwordrecover.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-29 | |
| CVE-2025-9659 | O2OA Personal Profile widget cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9658 | O2OA Personal Profile dict cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9657 | O2OA Personal Profile script cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9656 | PHPGurukul Directory Management System add-directory.php cross-site scripting | 6.1v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9655 | O2OA Personal Profile person cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9654 | AiondaDotCom mcp-ssh server-simple.mjs command injection | 5.3CNA v4.0 | 1.3% | 2025-08-29 | Fix |
| CVE-2025-9653 | Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9652 | Portabilis i-Educar Cadastrar tipo de transferência page cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9651 | shafhasan chatbox chat.php SQL injection | 5.3CNA v4.0 | 0.3% | 2025-08-29 | |
| CVE-2025-9650 | yeqifu carRental AppFileUtils.java removeFileByPath path traversal | 5.3CNA v4.0 | 0.4% | 2025-08-29 | |
| CVE-2025-9649 | appneta tcpreplay send_packets.c calc_sleep_time divide by zero | 5.5v3.1 | 0.3% | 2025-08-29 | Fix |
| CVE-2025-9647 | mtons mblog list cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9646 | O2OA calendarConfig cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9645 | itsourcecode Apartment Management System r_all_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9644 | itsourcecode Apartment Management System bill_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9643 | itsourcecode Apartment Management System utility_bill_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9639 | Ai3|QbiCRMGateway arbitrary file reading through path traversal | 8.7CNA v4.0 | 0.6% | 2025-08-29 | Fix |
| CVE-2025-9619 | E4 Sistemas Mercatus ERP id resource injection | 6.9CNA v4.0 | 0.4% | 2025-08-29 | |
| CVE-2025-9610 | code-projects Online Event Judging System create_account.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9609 | Portabilis i-Educar consulta improper authorization | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9608 | Portabilis i-Educar Formula de Cálculo de Média view SQL injection | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9607 | Portabilis i-Educar Tabelas de Arredondamento view SQL injection | 8.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9606 | Portabilis i-Educar agenda_preferencias.php SQL injection | 8.8v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9605 | Tenda AC21/AC23 GetParentControlInfo stack-based overflow | 9.3CNA v4.0 | 5.1% | 2025-08-29 | |
| CVE-2025-9604 | coze-studio aes.go hard-coded key | 6.3CNA v4.0 | 0.2% | 2025-08-29 | |
| CVE-2025-9603 | Telesquare TLR-2005KSH internet.cgi command injection | 9.8v3.1 | 6.2% | 2025-08-29 | |
| CVE-2025-9602 | Xinhu RockOA index.php publicsaveAjax improper authorization | 6.5v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9601 | itsourcecode Apartment Management System employee_salary_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9600 | itsourcecode Apartment Management System member_type_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9599 | itsourcecode Apartment Management System month_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9598 | itsourcecode Apartment Management System year_setup.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9597 | itsourcecode Apartment Management System rented_all_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9596 | itsourcecode Sports Management System login.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9595 | code-projects Student Information Management System login.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-29 | |
| CVE-2025-9441 | iATS Online Forms WordPress plugin authenticated (Contributor+) SQL injection via order parameter | 6.5CNA v3.1 | 0.3% | 2025-08-29 | |
| CVE-2025-9377 | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS command injection | 8.6CNA v4.0 | 36.9% | 2025-08-29 | KEVKCVFix |
| CVE-2025-9374 | Ultimate Tag Warrior Importer WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-08-29 | |
| CVE-2025-9217 | Slider Revolution WordPress plugin arbitrary file read | 6.5CNA v3.1 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-9071 | Insecure RSA-OAEP implementation with all-zero seed for padding in Oberon PSA Crypto | 2.3CNA v4.0 | 0.2% | 2025-08-29 | |
| CVE-2025-8861 | Changing|TSA missing authentication | 9.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-8858 | Changing|Clinic Image System SQL injection | 8.7CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-8857 | Changing|Clinic Image System use of hard-coded credentials | 9.3CNA v4.0 | 0.5% | 2025-08-29 | Fix |
| CVE-2025-8619 | OSM Map Widget for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-8290 | List Subpages WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-8150 | Events Addon for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-8147 | LWSCache WordPress plugin missing authorization authenticated limited plugin activation | 4.3CNA v3.1 | 0.2% | 2025-08-29 | Fix |
| CVE-2025-7383 | Oberon microsystems PSA Crypto AES-CBC PKCS#7 padding decryption timing side channel | 5.9CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-7071 | Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library | 5.9CNA v4.0 | 0.1% | 2025-08-29 | |
| CVE-2025-5808 | Authentication bypass vulnerability discovered in the OpenText™ Self-Service Password Reset | 7.3CNA v4.0 | 0.3% | 2025-08-29 | |
| CVE-2025-4644 | User session fixation after Account Removal in PayloadCMS | 5.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-4643 | Lack of JWT Expiration after Log Out in PayloadCMS | 6.3CNA v4.0 | 0.4% | 2025-08-29 | Fix |
| CVE-2025-58335 | JetBrains Junie missing warning for unsafe actions | 5.5CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-58334 | JetBrains IDE Services missing authorization | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-58322 | NAVER MYBOX Explorer incorrect privilege assignment | 7.8CISA ADP v3.1 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-58127 | Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange | 6.9CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-58126 | Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange | 6.9CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-58125 | Lack of TLS validation in plugin Freebox V6 Agent on Checkmk Exchange | 6.9CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-58124 | Heinlein-support Check Mk Python API improper certificate validation | 6.9CNA v4.0 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-58123 | Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange | 6.9CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-58081 | DOS SS1 hard-coded password | 8.7CNA v4.0 | 0.4% | 2025-08-28 | |
| CVE-2025-58072 | DOS SS1 path traversal | 8.7CNA v4.0 | 0.6% | 2025-08-28 | |
| CVE-2025-58062 | LSTM-Kirigaya's openmcp-client vulnerable to RCE in MCP Authorization Flow | 7.3CNA v4.0 | 1.2% | 2025-08-28 | Fix |
| CVE-2025-58061 | OpenEBS Local PV RawFile persistent volume data is world readable | 5.5CNA v3.1 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-58059 | Valtimo process definition scripting engine vulnerability | 9.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-58058 | Github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives | 5.3CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-58049 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses | 5.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-58048 | Paymenter vulnerable to remote code execution via Public File Uploads | 10.0CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-58047 | Volto affected by possible DoS by invoking specific URL by anonymous user | 7.5CNA v3.1 | 0.6% | 2025-08-28 | Fix |
| CVE-2025-57819 | Sangoma FreePBX authentication bypass | 10.0CNA v4.0 | 95.0% | 2025-08-28 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-57767 | Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request | 7.5CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-57759 | Contao has improper privilege management for page and article fields | 4.3CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-57758 | Contao has improper access control in the back end voters | 4.3CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-57757 | Contao discloses information in the news module | 5.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-57756 | Contao discloses sensitive information in the front end search index | 5.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-57220 | Tenda AC10 'ate' service improper input validation | 5.3CISA ADP v3.1 | 0.8% | 2025-08-28 | |
| CVE-2025-57219 | Tenda AC10 privilege escalation | 5.3CISA ADP v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-57218 | Tenda AC10 stack-based buffer overflow | 5.3CISA ADP v3.1 | 0.6% | 2025-08-28 | Emerging Threats |
| CVE-2025-57217 | Tenda AC10 stack-based buffer overflow | 5.3CISA ADP v3.1 | 0.5% | 2025-08-28 | Emerging Threats |
| CVE-2025-57215 | Tenda AC10 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-56236 | FormCms avatar upload feature has a stored cross-site scripting (XSS) | 6.1CISA ADP v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-55583 | D-Link DIR-868L missing authentication | 9.8CISA ADP v3.1 | 7.0% | 2025-08-28 | Emerging Threats |
| CVE-2025-55175 | Reflected XSS in QuickCMS | 6.1v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-54995 | Asterisk remotely exploitable leak of RTP UDP ports and internal resources | 6.5CNA v3.1 | 0.5% | 2025-08-28 | Fix |
| CVE-2025-54819 | DOS SS1 path traversal | 7.1CNA v4.0 | 0.5% | 2025-08-28 | |
| CVE-2025-54762 | DOS SS1 unrestricted file upload | 9.3CNA v4.0 | 0.5% | 2025-08-28 | |
| CVE-2025-54742 | WpEvently WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-54738 | Jobmonster WordPress theme broken authentication | 9.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-54734 | B Slider WordPress plugin broken access control | 5.8CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-54733 | All Bootstrap Blocks WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-54731 | YouTube Showcase WordPress plugin PHP object injection | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-54725 | Golo WordPress theme broken authentication | 9.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-54724 | Golo WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-54720 | Nest Addons WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-54716 | Ireca WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-54714 | Zephyr Project Manager WordPress plugin broken access control | 7.1CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-54710 | Tiktok Feed WordPress plugin broken access control | 7.1CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-54544 | Stored XSS in QuickCMS | 4.8v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-54543 | Stored XSS in QuickCMS | 4.8v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-54542 | OpenSolution QuickCMS Sending Password in GET request | 5.5v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-54541 | Cross-site request forgery in QuickCMS | 4.3v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-54540 | Reflected XSS in QuickCMS | 6.1v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-54029 | WooCommerce csv import export WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53970 | DOS SS1 unrestricted file upload | 9.3CNA v4.0 | 0.5% | 2025-08-28 | |
| CVE-2025-53588 | UPC/EAN/GTIN Code Generator WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53584 | WP Ticket Customer Service Software and Support Ticket System WordPress plugin PHP object injection | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-53583 | Employee Spotlight WordPress plugin PHP object injection | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-53579 | Captcha.eu WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-53578 | Kipso WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53576 | Ovatheme Events WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53572 | WP Easy Contact WordPress plugin PHP object injection | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-53396 | DOS SS1 incorrect permission assignment | 7.3CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-53337 | LifePress WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-53334 | Jannah WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53328 | Poll, Survey and Quiz Maker Plugin by Opinion Stage WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-08-28 | Fix |
| CVE-2025-53326 | Gutenify WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-08-28 | Fix |
| CVE-2025-53289 | Theme Blvd Widget Areas WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53250 | Chartbeat WordPress plugin server side request forgery (SSRF) | 6.4CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53248 | Magazine WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-53247 | BlogMarks WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-53244 | Magazine Elite WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-53243 | Employee Directory Staff Listing and Team Directory plugin for WordPress PHP object injection | 8.1CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-53230 | Page Manager for Elementor WordPress plugin broken access control | 7.6CNA v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-53227 | Magazine Saga WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-53225 | e-Boekhouden.nl WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53224 | NextGEN Gallery Search WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53223 | Theme Switcher Reloaded WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53220 | XmasB Quotes WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-53216 | Glamer WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-53215 | Yahoo! WebPlayer WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-52761 | WP Funnel Manager WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-52460 | DOS SS1 files accessible to external parties | 6.9CNA v4.0 | 0.3% | 2025-08-28 | |
| CVE-2025-52054 | Tenda AC8 improper authentication | 5.3CISA ADP v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-51972 | PuneethReddyHC online-shopping-system-advanced login.php SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-51971 | PuneethReddyHC online-shopping-system-advanced register.php reflected cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-51969 | PuneethReddyHC online-shopping-system-advanced product.php page SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-51968 | PuneethReddyHC online-shopping-system-advanced action.php file SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-51967 | Oranbyte School Management System reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-51643 | Meitrack T366l-g information disclosure | 2.4CISA ADP v3.1 | 0.3% | 2025-08-28 | Exploit code |
| CVE-2025-49407 | Houzez WordPress theme cross-site scripting (XSS) | 8.8CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-49405 | Houzez WordPress theme local file inclusion | 4.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-49404 | Listeo Core WordPress plugin SQL command improper neutralization | 8.5CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-49402 | Exertio Framework WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-49388 | Miraculous Core WordPress plugin privilege escalation | 9.8CNA v3.1 | 6.1% | 2025-08-28 | Exploit codeFix |
| CVE-2025-49387 | Drag and Drop File Upload for Elementor Forms WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-49383 | Neresa WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-48963 | Acronis Cyber Protect Cloud Agent externally controlled resource reference | 7.3CNA v3.0 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-48365 | Custom Comment WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48364 | rajce WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48363 | Popup for CF7 with Sweet Alert WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48362 | Hesabfa Accounting WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48361 | Hesabfa Accounting WordPress plugin sensitive data exposure via Log file | 5.3CNA v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-48360 | Varnish/Nginx Proxy Caching WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48359 | ATT YouTube Widget WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48358 | Risk Free Cash On Delivery (COD) WooCommerce WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48357 | Century ToolKit WordPress plugin cross-site request forgery (CSRF) to arbitrary plugin activation | 5.4CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48356 | Kanpress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48354 | Better Post and Filter Widgets for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-48353 | Clickbank WordPress Plugin (Niche Storefront) cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48352 | Yandex Site search pinger WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48351 | Kento Splash Screen WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48350 | AutoWP WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48349 | Video Gallery Vimeo and YouTube Gallery WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48348 | Site Offline WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48347 | bxSlider integration for WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48343 | WPMU Ldap Authentication WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-48327 | WP Mailgun SMTP WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-08-28 | |
| CVE-2025-48325 | WP Admin WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48324 | tli.tl auto Twitter poster WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48323 | Advance Food Menu WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48322 | Statify Widget WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-48321 | Ultimate twitter profile widget WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48320 | 百度分享按钮 WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48319 | Mesa Mesa Reservation Widget WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48318 | 多说社会化评论框 WordPress plugin cross-site request forgery (CSRF) to settings Change | 4.3CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48316 | Responsive Mobile-Friendly Tooltip WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48315 | WordPress HTML plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48314 | salubrio Add Code To Head stored cross-site scripting | 5.9CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-48313 | Tripadvisor Shortcode WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48312 | WPAvatar WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48311 | Invisible Optin WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48310 | Table Editor WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48309 | WordPress BetPress plugin Lite CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48308 | Newsletter subscription optin module WordPress plugin cross-site request forgery to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48307 | SEO For Images WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48306 | Savyour Affiliate Partner WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48305 | Goal Tracker for Patreon WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48304 | Google XML News Sitemap WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48110 | Link View WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-48109 | XM-Backup WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-48100 | bidorbuy Store Integrator WordPress plugin remote code execution (RCE) | 9.1CNA v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-46409 | DOS SS1 inadequate encryption strength | 8.7CNA v4.0 | 0.2% | 2025-08-28 | |
| CVE-2025-39496 | WooBeWoo Product Filter Pro WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-36003 | IBM Security Verify Governance Identity Manager information disclosure | 7.5CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-31979 | HCL BigFix Service Management file upload validation vulnerability | 5.4CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-31977 | A cryptographic weakness has been identified in the HCL BigFix Service Management (SM) | 5.3CNA v3.1 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-31972 | HCL BigFix Service Management (SM) is affected by a sensitive information exposure | 6.5CNA v3.1 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-31971 | AIML Solutions for HCL SX is susceptible to a URL validation vulnerability | 5.1CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-29364 | Spimsimulator Spim stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-25010 | Kibana privilege escalation via reporting_user role | 6.5CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-9594 | itsourcecode Apartment Management System complain_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-9593 | itsourcecode Apartment Management System unit_status_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-28 | |
| CVE-2025-9592 | itsourcecode Apartment Management System bill_info.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-28 | |
| CVE-2025-9591 | ZrLog Theme Configuration form config cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-08-28 | |
| CVE-2025-9590 | Weaver E-Mobile Mobile Management Platform cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-08-28 | |
| CVE-2025-9589 | Cudy WR1200EA shadow default password | 2.0CNA v4.0 | 0.1% | 2025-08-28 | |
| CVE-2025-9586 | Comfast CF-N1 webmgnt wireless_device_dissoc command injection | 8.8v3.1 | 8.3% | 2025-08-28 | Emerging Threats |
| CVE-2025-9585 | Comfast CF-N1 webmgnt wifilith_delete_pic_file command injection | 8.8v3.1 | 5.1% | 2025-08-28 | |
| CVE-2025-9584 | Comfast CF-N1 webmgnt update_interface_png command injection | 8.8v3.1 | 8.3% | 2025-08-28 | Emerging Threats |
| CVE-2025-9583 | Comfast CF-N1 webmgnt ping_config command injection | 8.8v3.1 | 5.1% | 2025-08-28 | |
| CVE-2025-9582 | Comfast CF-N1 webmgnt ntp_timezone command injection | 9.8v3.1 | 5.3% | 2025-08-28 | |
| CVE-2025-9581 | Comfast CF-N1 webmgnt multi_pppoe command injection | 9.8v3.1 | 5.3% | 2025-08-28 | |
| CVE-2025-9580 | LB-LINK BL-X26 HTTP set_blacklist os command injection | 8.8v3.1 | 5.5% | 2025-08-28 | |
| CVE-2025-9579 | LB-LINK BL-X26 HTTP set_hidessid_cfg os command injection | 8.8v3.1 | 5.7% | 2025-08-28 | |
| CVE-2025-9578 | Acronis Cyber Protect Cloud Agent incorrect permission assignment | 7.8CNA v3.0 | 0.1% | 2025-08-28 | Fix |
| CVE-2025-9577 | TOTOLINK X2000R Administrative shadow.sample default credentials | 7.0v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-9576 | seeedstudio ReSpeaker Administrative shadow default credentials | 7.0v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-9575 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 upload.cgi cgiMain os command injection | 8.8v3.1 | 6.9% | 2025-08-28 | Emerging Threats |
| CVE-2025-9376 | sminozzi Stop Bad Bots login cookie check incorrect authorization | 6.5CNA v3.1 | 0.4% | 2025-08-28 | Fix |
| CVE-2025-9352 | Pronamic Google Maps WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-9346 | Booking Calendar WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-9345 | File Manager WordPress plugin path traversal | 4.9CNA v3.1 | 0.5% | 2025-08-28 | Fix |
| CVE-2025-9344 | UsersWP WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-9195 | Solidigm D7-PS1010/D7-PS1030 firmware of some improper input validation | 4.4CNA v3.1 | 0.1% | 2025-08-28 | |
| CVE-2025-8977 | Simple Download Monitor WordPress plugin SQL injection | 6.5CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-8897 | Beaver Builder Plugin (Lite Version) WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-8603 | Unlimited Elements For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-8073 | Dynamic AJAX Product Filters for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-8067 | Udisks: Out-of-bounds read in udisks daemon | 8.5CNA v3.1 | 0.7% | 2025-08-28 | Exploit codeFix |
| CVE-2025-7956 | Ajax Search Lite WordPress plugin missing authorization unauthenticated Basic information exposure | 5.3CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-7955 | RingCentral Communications - Missing Server‑Side Verification to authentication bypass | 9.8CNA v3.1 | 0.7% | 2025-08-28 | Exploit codeFix |
| CVE-2025-7812 | Video Share VOD WordPress plugin cross-site request forgery | 8.8CNA v3.1 | 0.3% | 2025-08-28 | Fix |
| CVE-2025-6255 | Dynamic AJAX Product Filters for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-28 | Fix |
| CVE-2025-6203 | Vault unauthenticated denial of service through complex json payload | 7.5CNA v3.1 | 0.7% | 2025-08-28 | Fix |
| CVE-2025-0951 | AI Hub WordPress theme missing authorization | 4.3CNA v3.1 | 0.2% | 2025-08-28 | |
| CVE-2025-58218 | Small Package Quotes USPS Edition WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-58217 | Instant Breaking News WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-58216 | WP Thumbtack Review Slider WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58213 | Booking System Trafft WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58212 | Epeken All Kurir WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58211 | Chatbox Manager WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58209 | Transcoder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58208 | PDF for Elementor Forms + Drag And Drop Template Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58205 | ElementInvader Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58204 | Podlove Podcast Publisher WordPress plugin open redirection | 4.7CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58203 | Solace Extra WordPress plugin server side request forgery (SSRF) | 4.4CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58202 | Simple Page Access Restriction WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-58201 | AfterShip Tracking WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58198 | Xpro Theme Builder WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58197 | Simple Download Monitor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58196 | UiCore Elements WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58195 | Xpro Elementor Addons WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58194 | Bold Page Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58193 | Uncanny Automator WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58192 | WP Bulk Delete WordPress plugin broken access control | 5.4v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-58050 | PCRE2: Heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS | 6.9CNA v4.0 | 0.8% | 2025-08-27 | Fix |
| CVE-2025-57846 | Digital Arts i-フィルター incorrect default permissions | 8.5CNA v4.0 | 0.2% | 2025-08-27 | |
| CVE-2025-57821 | Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL | 4.2CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-57797 | PFU ScanSnap Manager installers incorrect privilege assignment | 8.5CNA v4.0 | 0.1% | 2025-08-27 | |
| CVE-2025-56694 | Lumasoft Fotoshare Cloud client-side enforcement of server-side security | 5.8CISA ADP v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-55618 | Hyundai Navigation cross-site scripting | 7.3CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-55582 | D-Link Dcs-825l Firmware improper privilege management | 6.6CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-55495 | Tenda AC6 buffer overflow | 6.5CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-55422 | FoxCMS cross-site scripting | 8.8CISA ADP v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-54598 | Bevy cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-53105 | GLPI permits unauthorized rules execution order | 7.5CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-52122 | The Freeform CraftCMS plugin contains an server-side template injection (SSTI) | 9.8CISA ADP v3.1 | 0.6% | 2025-08-27 | Exploit codeFix |
| CVE-2025-51667 | Ryansu Simple Admin simple-admin-core SQL injection | 7.0CISA ADP v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-50989 | OPNsense OS command injection | 8.8CISA ADP v3.1 | 10.1% | 2025-08-27 | Fix |
| CVE-2025-50986 | Diskoverdata Diskover cross-site scripting | 5.6CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-50985 | Diskoverdata Diskover cross-site scripting | 5.6CISA ADP v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-50984 | Diskoverdata Diskover SQL injection | 5.3CISA ADP v3.1 | 0.3% | 2025-08-27 | |
| CVE-2025-50983 | Readarr SQL injection | 8.3CISA ADP v3.1 | 0.3% | 2025-08-27 | |
| CVE-2025-50979 | NodeBB SQL injection | 8.6CISA ADP v3.1 | 9.2% | 2025-08-27 | |
| CVE-2025-50978 | Gitblit cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-27 | |
| CVE-2025-50977 | Gitblit cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-27 | |
| CVE-2025-50972 | AbanteCart SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-08-27 | |
| CVE-2025-50428 | raspap-webgui command injection | 9.8CISA ADP v3.1 | 1.6% | 2025-08-27 | Exploit code |
| CVE-2025-49040 | Backup Bolt WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-27 | |
| CVE-2025-49039 | Link View WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-49035 | Admin Menu Groups WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-27 | |
| CVE-2025-48081 | Printeers Print and Ship WordPress plugin directory traversal | 5.3CNA v3.1 | 0.3% | 2025-08-27 | |
| CVE-2025-43882 | Dell ThinOS 10 unauthorized access | 7.8CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-43730 | Dell ThinOS 10 argument injection | 8.4CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-43729 | Dell ThinOS 10 incorrect permission assignment | 7.8CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-43728 | Dell ThinOS 10 protection mechanism failure | 9.6CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-40779 | Kea crash upon interaction between specific client options and subnet selection | 7.5CNA v3.1 | 0.5% | 2025-08-27 | Fix |
| CVE-2025-34523 | Arcserve UDP Pre-authentication heap overflow | 9.8v3.1 | 0.5% | 2025-08-27 | Fix |
| CVE-2025-34522 | Arcserve UDP Pre-authentication heap overflow | 9.8v3.1 | 0.6% | 2025-08-27 | Fix |
| CVE-2025-34521 | Arcserve UDP reflected cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-34520 | Arcserve UDP authentication bypass | 9.8v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-34163 | Dongsheng Logistics Software unauthenticated arbitrary file upload | 10.0CNA v4.0 | 0.7% | 2025-08-27 | |
| CVE-2025-34162 | Bian Que Feijiu Intelligent Emergency and Quality Control System SQL injection via GetLyfsByParams | 9.3CNA v4.0 | 0.6% | 2025-08-27 | |
| CVE-2025-34161 | Coolify Git Repository field command injection in Project Deployment Workflow | 8.8NVD v3.1 | 3.0% | 2025-08-27 | Fix |
| CVE-2025-34160 | AnyShare ServiceAgent API unauthenticated RCE | 10.0CNA v4.0 | 0.8% | 2025-08-27 | Fix |
| CVE-2025-34159 | Coolify Docker Compose Directive injection in Application Deployment Workflow | 8.8NVD v3.1 | 1.0% | 2025-08-27 | Exploit codeFix |
| CVE-2025-34157 | Coolify stored cross-site scripting (XSS) in Project Name field | 9.0v3.1 | 0.5% | 2025-08-27 | Exploit codeFix |
| CVE-2025-30064 | CLININET session verification vulnerability | 8.8CNA v4.0 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-30063 | CGM CLININET excessive permissions on configuration files containing database logins and passwords | 9.4CNA v4.0 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-30061 | CGM CLININET SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter | 6.9CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30060 | CGM CLININET SQL injection in ReturnUserUnitsXML.pl via the UserID parameter | 6.9CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30059 | CGM CLININET authenticated SQL injection in PrepareCDExportJSON.pl | 6.9CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30058 | CGM CLININET SQL injection in getPatientIdentifier function of PatientService.pl | 6.9CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30057 | CGM CLININET authenticated RCE with uhcapache privileges in ConvertToPDF | 9.4CNA v4.0 | 0.7% | 2025-08-27 | Fix |
| CVE-2025-30056 | CGM CLININET calling system commands via RunCommand | 9.4CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30055 | CGM CLININET conditional RCE via the system function | 9.0CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30048 | CGM CLININET unauthenticated access to module configuration endpoint | 5.3CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30041 | CGM CLININET missing authentication in APIs returning statistical data along with session IDs | 9.0CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30040 | CGM CLININET missing authentication in API returning request logs containing session IDs | 9.0CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30039 | CGM CLININET missing authentication in API returning a list of all active sessions | 9.0CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30038 | CGM CLININET session ID leakage in Zone.Identifier of downloaded files | 7.3CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30037 | CGM CLININET missing authentication in APIs allowing data retrieval and modification | 8.8CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-30036 | CGM CLININET stored XSS permitting session takeover of arbitrary user | 8.8CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-20348 | Cisco Nexus Dashboard Unauthorized REST API vulnerability | 5.0CNA v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-20347 | Cisco Nexus Dashboard Fabric Controller Unauthorized REST API vulnerability | 5.4CNA v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-20344 | Cisco Nexus Dashboard path traversal | 6.5CNA v3.1 | 0.6% | 2025-08-27 | Fix |
| CVE-2025-20342 | Cisco Integrated Management Controller Virtual Keyboard Video Monitor stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-20317 | Cisco UCS Virtual Keyboard Video Monitor (vKVM) open redirect | 7.1CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-20296 | Cisco UCS Manager Software Stored software stored cross-site scripting | 5.4CNA v3.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-20295 | Cisco UCS Manager software command injection | 6.0CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-20294 | Cisco UCS Manager software command injection | 6.5CNA v3.1 | 1.2% | 2025-08-27 | Fix |
| CVE-2025-20292 | Cisco NXOS software command injection | 4.4CNA v3.1 | 3.2% | 2025-08-27 | Fix |
| CVE-2025-20290 | Cisco NXOS Software Sensitive Log information disclosure | 5.5CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-20262 | Cisco NX-OS Software PIM6 ephemeral query processing null pointer dereference | 5.0CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-20241 | Cisco NX-OS Software IS-IS protocol denial of service | 7.4CNA v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-9533 | TOTOLINK T10 formLoginAuth.htm improper authentication | 9.8v3.1 | 10.8% | 2025-08-27 | Emerging Threats |
| CVE-2025-9532 | Portabilis i-Educar view SQL injection | 8.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9531 | Portabilis i-Educar Agenda agenda.php SQL injection | 8.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9529 | Campcodes Payroll Management System index.php include file inclusion | 7.2v3.1 | 0.5% | 2025-08-27 | |
| CVE-2025-9528 | Linksys E1700 systemCommand os command injection | 7.2v3.1 | 54.5% | 2025-08-27 | Reported exploitedEmerging Threats |
| CVE-2025-9527 | Linksys E1700 QoSSetup stack-based overflow | 8.7CNA v4.0 | 1.5% | 2025-08-27 | Emerging Threats |
| CVE-2025-9526 | Linksys E1700 setSysAdm stack-based overflow | 8.7CNA v4.0 | 1.4% | 2025-08-27 | Emerging Threats |
| CVE-2025-9525 | Linksys E1700 setWan stack-based overflow | 8.7CNA v4.0 | 1.4% | 2025-08-27 | Emerging Threats |
| CVE-2025-9523 | Tenda AC1206 GetParentControlInfo stack-based overflow | 9.3CNA v4.0 | 1.1% | 2025-08-27 | |
| CVE-2025-9514 | macrozheng mall Registration weak password | 3.7NVD v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9513 | editso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryption | 6.3CNA v4.0 | 0.2% | 2025-08-27 | |
| CVE-2025-9511 | itsourcecode Apartment Management System addvisitor.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9510 | itsourcecode Apartment Management System addbranch.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9509 | itsourcecode Apartment Management System fair_info_all.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9508 | itsourcecode Apartment Management System rented_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9507 | itsourcecode Apartment Management System visitor_info.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9506 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9505 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-27 | |
| CVE-2025-9504 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9503 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-9502 | Campcodes Online Loan Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-27 | |
| CVE-2025-8490 | All-in-One WP Migration and Backup WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-7732 | Lazy Load for Videos WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-5187 | Kubernetes nodes can delete themselves by adding an OwnerReference | 6.7CNA v3.1 | 0.6% | 2025-08-27 | Fix |
| CVE-2025-5101 | Improper control of generation of code (code injection) in GitLab | 5.0CNA v3.1 | 0.1% | 2025-08-27 | Fix |
| CVE-2025-4225 | Allocation of resources without limits or throttling in GitLab | 5.3CNA v3.1 | 0.4% | 2025-08-27 | Fix |
| CVE-2025-3601 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-2313 | CGM CLININET RCE via Print.pl in uhcPrintServerPrint | 9.4CNA v4.0 | 0.2% | 2025-08-27 | Fix |
| CVE-2025-2246 | Missing authorization in GitLab | 5.8CNA v3.1 | 0.3% | 2025-08-27 | Fix |
| CVE-2025-57820 | Svelte devalue vulnerable to prototype pollution | 7.9CNA v4.0 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-57818 | Firecrawl SSRF vulnerability via malicious webhook | 6.3CNA v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-57813 | Insertion of sensitive information into log file in github.com/traPtitech/traQ | 5.9CNA v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-57810 | jsPDF Parsing of Corrupt PNGs leads to potential denial of service (DoS) | 8.7CNA v4.0 | 0.7% | 2025-08-26 | Fix |
| CVE-2025-57803 | ImageMagick: 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow | 7.5CNA v3.1 | 0.8% | 2025-08-26 | Fix |
| CVE-2025-57704 | EIP Builder XML external entity Processing information disclosure | 5.5CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-57425 | Remyandrade FAQ Management System SourceCodester stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-56432 | Nagios XI cross-site scripting | 6.1CISA ADP v3.1 | 0.9% | 2025-08-26 | Fix |
| CVE-2025-55526 | ZIE619 N8N Workflow Collection path traversal | 9.1CISA ADP v3.1 | 0.8% | 2025-08-26 | |
| CVE-2025-55443 | Telpo Mdm cleartext storage of sensitive information | 9.1CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-55298 | ImageMagick format string Bug in InterpretImageFilename leads to arbitrary code execution | 7.5CNA v3.1 | 4.5% | 2025-08-26 | Fix |
| CVE-2025-55212 | ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry: Leads to crash | 3.7CNA v3.1 | 0.9% | 2025-08-26 | Fix |
| CVE-2025-53813 | TCC Bypass via misconfigured Node fuses in Nozbe | 4.8CNA v4.0 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-53811 | TCC Bypass via misconfigured Node fuses in Mosh-Pro | 4.8CNA v4.0 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-53419 | COMMGR code injection | 7.8CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-53418 | COMMGR stack-based buffer overflow | 8.6CNA v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-52353 | Badaso CMS file upload | 9.8CISA ADP v3.1 | 0.7% | 2025-08-26 | |
| CVE-2025-52219 | Selectzero open redirect | 6.5CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-52218 | Selectzero code injection | 7.5CISA ADP v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-52217 | Selectzero cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-52184 | helpyio helpy cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-52037 | Exe-system Notescms cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-52036 | Exe-system Notescms cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-52035 | Exe-system Notescms cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-50976 | IPFire cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-50975 | IPFire cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-50974 | IPFire OS command injection | 6.5CISA ADP v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-50971 | AbanteCart path traversal | 7.5v3.1 | 1.0% | 2025-08-26 | |
| CVE-2025-50753 | Mitrastar GPT-2741GNAC-N2 restricted shell vulnerability | 8.4CISA ADP v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-48108 | School Management WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-08-26 | |
| CVE-2025-44002 | TeamViewer Full Client arbitrary file creation via Symbolic Link leading to denial of service | 6.1CNA v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-41702 | Welotec EG400Mk2-D11001-000101 egOS WebGUI Hard-Coded JWT Secret enables authentication bypass | 9.8CNA v3.1 | 0.5% | 2025-08-26 | Fix |
| CVE-2025-38676 | Linux kernel AMD IOMMU command line parsing out-of-bounds write | 7.8v3.1 | 0.4% | 2025-08-26 | Exploit codeFix |
| CVE-2025-36729 | RACOM M!DGE2 privilege escalation via SDK Testing endpoint | 7.2CNA v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-35115 | Agiloft insecure download of system packages | 9.2CNA v4.0 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-35114 | Agiloft local privilege escalation via default credentials | 8.7CNA v4.0 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-35113 | Agiloft improper neutralization in EUI template engine | 7.2v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-35112 | Agiloft XML external entity local path traversal | 4.9v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-29992 | Mahara information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-29901 | QNAP File Station 5 null pointer dereference | 7.1CNA v4.0 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-26417 | Google Android DownloadProvider.java information disclosure | 4.0CISA ADP v3.1 | 0.3% | 2025-08-26 | Exploit codeFix |
| CVE-2025-25737 | Kapsch Ris-9160 weak password requirements | 6.8CISA ADP v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-25736 | Kapsch Ris-9260 missing authentication | 6.8CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-25735 | Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time. | 4.6CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-25734 | Kapsch Ris-9160 arbitrary code execution | 6.8CISA ADP v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-25733 | Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the devic | 3.5CISA ADP v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-25732 | Kapsch Ris-9160 insecure storage of sensitive information | 6.8CISA ADP v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-23315 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-23314 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-23313 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-23312 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-23307 | NVIDIA NeMo Curator code injection | 7.8CNA v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-22413 | Google Android hyp-main.c privilege escalation | 4.0CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22412 | Google Android sdp_server.cc use-after-free | 8.8CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-22411 | Google Android sdp_discovery.cc use-after-free | 8.8CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-22410 | Google Android multiple locations privilege escalation | 8.4CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22409 | Google Android rfc_ts_frames.cc privilege escalation | 8.4CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22408 | Google Android rfc_utils.cc remote code execution | 9.8CISA ADP v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-22407 | Google Android hidd_conn.cc information disclosure | 5.5CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22406 | Google Android bnep_utils.cc code execution | 8.4CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22405 | Google Android multiple locations privilege escalation | 8.4CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22404 | Google Android avct_lcb_act.cc privilege escalation | 8.4CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-22403 | Google Android sdp_discovery.cc remote code execution | 9.8CISA ADP v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-9492 | Campcodes Online Water Billing System addclient1.php SQL injection | 9.8v3.1 | 0.6% | 2025-08-26 | |
| CVE-2025-9491 | Microsoft Windows LNK file UI misrepresentation remote code execution | 7.8v3.1 | 73.0% | 2025-08-26 | Reported exploitedExploit codeFix |
| CVE-2025-9483 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 singlePortForwardAdd stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-26 | |
| CVE-2025-9482 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portRangeForwardAdd stack-based overflow | 8.7CNA v4.0 | 9.0% | 2025-08-26 | Emerging Threats |
| CVE-2025-9481 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setIpv6 stack-based overflow | 8.7CNA v4.0 | 1.4% | 2025-08-26 | Emerging Threats |
| CVE-2025-9478 | Google Chrome ANGLE use-after-free | 8.8CISA ADP v3.1 | 7.3% | 2025-08-26 | Fix |
| CVE-2025-9476 | SourceCodester Human Resource Information System editemployee_process.php unrestricted upload | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9475 | SourceCodester Human Resource Information System editemployee_process.php unrestricted upload | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9474 | Mihomo Party Socket sysproxy.ts enableSysProxy temp file | 2.0CNA v4.0 | 0.1% | 2025-08-26 | |
| CVE-2025-9473 | SourceCodester Online Bank Management System feedback.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9472 | itsourcecode Apartment Management System add_owner_utility.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9471 | itsourcecode Apartment Management System add_maintenance_cost.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9470 | itsourcecode Apartment Management System add_m_committee.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9469 | itsourcecode Apartment Management System add_fund.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9468 | itsourcecode Apartment Management System add_bill.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-26 | |
| CVE-2025-9461 | diyhi bbs File Compression FilePackageManageAction.java information disclosure | 7.5v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9444 | 1000 Projects Online Project Report Submission and Evaluation System SQL injection | 9.8v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9443 | Tenda CH22 editUserName formeditUserName buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-08-26 | |
| CVE-2025-9440 | 1000 Projects Online Project Report Submission and Evaluation System cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9439 | 1000 Projects Online Project Report Submission and Evaluation System cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9438 | 1000 Projects Online Project Report Submission and Evaluation System cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9434 | 1000 Projects Online Project Report Submission and Evaluation System cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9433 | mtons mblog Admin Panel list cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9432 | mtons mblog Admin Panel list cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9431 | mtons mblog search cross-site scripting | 6.1v3.1 | 0.4% | 2025-08-26 | |
| CVE-2025-9430 | mtons mblog update cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-9429 | mtons mblog Post submit cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-26 | |
| CVE-2025-9277 | SiteSEO SEO Simplified WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-9190 | TCC Bypass via misconfigured Node fuses in Cursor | 4.8CNA v4.0 | 0.2% | 2025-08-26 | |
| CVE-2025-9172 | Vibes WordPress plugin unauthenticated SQL injection via `resource` parameter | 7.5CNA v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-8700 | Privilege escalation via get-task-allow entitlement in Invoice Ninja | 4.8CNA v4.0 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-8597 | MacVim privilege escalation via get-task-allow entitlement in MacVim.app | 4.8CNA v4.0 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-8447 | GitHub Enterprise Server repository diff feature improper access control | 7.0CNA v4.0 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-8424 | Improper access control on the NetScaler Management interface | 8.7CNA v4.0 | 3.3% | 2025-08-26 | KCV |
| CVE-2025-7776 | NetScaler ADC and Gateway PCoIP Profile vulnerability | 8.8CNA v4.0 | 8.1% | 2025-08-26 | Fix |
| CVE-2025-7775 | Citrix NetScaler memory overflow | 9.2CNA v4.0 | 20.3% | 2025-08-26 | KEVExploit codeKCVFix |
| CVE-2025-6366 | Event List WordPress plugin authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-6247 | WordPress Automatic Plugin WordPress plugin cross-site request forgery | 4.7CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-5931 | Dokan Pro WordPress plugin authenticated (Vendor+) privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-2697 | IBM Cognos Command Center HTTP open redirect | 7.4CNA v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-1994 | IBM Cognos Command Center code execution | 7.8CNA v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-1501 | Incorrect authorization for traces request/download in CMC | 5.3CNA v4.0 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-1494 | IBM Cognos Command Center clickjacking | 6.1CNA v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-0093 | Google Android AdapterService.java information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-0092 | Google Android AdapterService.java insecure permissions | 6.5CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-0086 | Google Android AccountManagerService.java information disclosure | 6.2CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-0084 | Google Android multiple locations out-of-bounds write | 8.8CISA ADP v3.1 | 0.2% | 2025-08-26 | Fix |
| CVE-2025-0083 | Google Android multiple locations information disclosure | 4.0CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-0082 | Google Android TelecomServiceImpl.java information disclosure | 5.5CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-0081 | Google Android dng_lossless_jpeg.cpp crash | 7.5CISA ADP v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-0080 | Google Android multiple locations privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-0079 | Google Android multiple locations privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2025-08-26 | Fix |
| CVE-2025-0078 | Google Android main.cpp privilege escalation | 8.8CISA ADP v3.1 | 0.3% | 2025-08-26 | Fix |
| CVE-2025-0075 | Google Android sdp_server.cc remote code execution | 9.8CISA ADP v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-0074 | Google Android sdp_discovery.cc remote code execution | 9.8CISA ADP v3.1 | 0.4% | 2025-08-26 | Fix |
| CVE-2025-57814 | request-filtering-agent SSRF Bypass via HTTPS requests | 5.5CNA v4.0 | 0.5% | 2025-08-25 | Fix |
| CVE-2025-57811 | Craft potential remote code execution via Twig SSTI | 6.1CNA v4.0 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-57809 | XGrammar affected by denial of service by infinite recursion grammars | 7.7CNA v4.0 | 0.5% | 2025-08-25 | Fix |
| CVE-2025-57805 | The Scratch Channel tsc-web-client article publish endpoint improper input validation | 8.7CNA v4.0 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-57804 | h2 allows HTTP request smuggling due to illegal characters in headers | 6.9CNA v4.0 | 1.7% | 2025-08-25 | Fix |
| CVE-2025-57802 | Airlink Labs Daemon mounted data directory symlink following | 8.7CNA v4.0 | 0.4% | 2025-08-25 | |
| CVE-2025-57773 | Dataease DB2 Aspectweaver deserialization arbitrary file write | 8.2CNA v4.0 | 8.9% | 2025-08-25 | Fix |
| CVE-2025-57772 | Dataease H2 JDBC RCE Bypass | 8.2CNA v4.0 | 10.0% | 2025-08-25 | Fix |
| CVE-2025-57760 | Langflow vulnerable to privilege escalation via CLI Superuser Creation | 8.8CNA v3.1 | 0.5% | 2025-08-25 | Fix |
| CVE-2025-56216 | PHPGurukul Hospital Management System SQL injection | 8.5CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-56215 | PHPGurukul Hospital Management System SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-56214 | PHPGurukul Hospital Management System SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-56212 | PHPGurukul Hospital Management System SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-55575 | SMM Panel SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-55574 | docmost cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-55409 | FoxCMS cross-site scripting | 8.8CISA ADP v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-55301 | the-scratch-channel.github.io The Scratch Channel allows Username Modification | 6.7CNA v3.1 | 0.2% | 2025-08-25 | |
| CVE-2025-54494 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54493 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54492 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54491 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54490 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54489 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54488 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54487 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54486 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54485 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54484 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54483 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54482 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54481 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54480 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54462 | The Biosig Project libbiosig Nex parsing functionality heap-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-54370 | PHPOffice PhpSpreadsheet HTML reader server-side request forgery | 8.7CNA v4.0 | 0.8% | 2025-08-25 | Fix |
| CVE-2025-54301 | Extension norrnext.com stored XSS vulnerability in Quantum Manager component for Joomla | 8.5CNA v4.0 | 0.3% | 2025-08-25 | |
| CVE-2025-54300 | Extension norrnext.com stored XSS vulnerability in Quantum Manager component for Joomla | 8.5CNA v4.0 | 0.3% | 2025-08-25 | |
| CVE-2025-53853 | The Biosig Project libbiosig ISHNE parsing functionality heap-based buffer overflow | 9.8v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-53557 | The Biosig Project libbiosig MFER parsing functionality heap-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-53518 | The Biosig Project libbiosig ABF parsing functionality integer overflow | 9.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-53511 | The Biosig Project libbiosig MFER parsing functionality heap-based buffer overflow | 9.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-53510 | SAIL Image Decoding Library PSD Image Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-53120 | Securden Unified PAM path traversal in file upload | 9.4CNA v3.1 | 11.4% | 2025-08-25 | |
| CVE-2025-53119 | Securden Unified PAM unauthenticated unrestricted file upload | 7.5CNA v3.1 | 14.7% | 2025-08-25 | |
| CVE-2025-53118 | Securden Unified PAM authentication bypass | 9.8CNA v3.1 | 32.9% | 2025-08-25 | Reported exploitedNuclei |
| CVE-2025-53085 | SAIL Image Decoding Library PSD RLE Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-52930 | SAIL Image Decoding Library BMPv3 RLE Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-52581 | The Biosig Project libbiosig GDF parsing functionality integer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-52461 | The Biosig Project libbiosig Nex parsing functionality out-of-bounds read | 9.1v3.1 | 0.5% | 2025-08-25 | Fix |
| CVE-2025-52456 | SAIL Image Decoding Library WebP Image Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-52130 | WebErpMesv2 file upload | 5.4CISA ADP v3.1 | 0.2% | 2025-08-25 | |
| CVE-2025-51281 | D-Link DI-8100 buffer overflow | 7.0CISA ADP v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-50900 | getrebuild rebuild improper access control | 9.8CISA ADP v3.1 | 0.7% | 2025-08-25 | |
| CVE-2025-50722 | SparkShop insecure permissions | 9.8CISA ADP v3.1 | 0.8% | 2025-08-25 | |
| CVE-2025-50383 | Easy!Appointments SQL injection | 8.1CISA ADP v3.1 | 0.4% | 2025-08-25 | Exploit codeFix |
| CVE-2025-50129 | SAIL Image Decoding Library PCX Image Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-48303 | Post Type Converter WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-25 | |
| CVE-2025-48005 | The Biosig Project libbiosig RHS2000 parsing functionality heap-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-46411 | The Biosig Project libbiosig MFER parsing functionality stack-based buffer overflow | 9.8v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-46407 | SAIL Image Decoding Library BMPv3 Palette Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-45968 | System Pdv insecure direct object reference | 9.8CISA ADP v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-44179 | Hitron CGNF-TWN telnet service command injection | 6.5CISA ADP v3.1 | 0.8% | 2025-08-25 | |
| CVE-2025-44178 | DASAN GPON ONU H660WM UPnP WAN interface improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-43960 | Adminer PHP object injection issue leads to denial of service | 8.6CISA ADP v3.1 | 0.7% | 2025-08-25 | Exploit code |
| CVE-2025-35984 | SAIL Image Decoding Library PCX Image Decoding functionality of the memory corruption | 8.8CNA v3.1 | 1.4% | 2025-08-25 | Fix |
| CVE-2025-32468 | SAIL Image Decoding Library BMPv3 Image Decoding functionality of the memory corruption | 8.8CNA v3.1 | 0.9% | 2025-08-25 | Fix |
| CVE-2025-29525 | DASAN GPON ONU H660WM control panel default credentials | 5.3CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-29524 | DASAN GPON ONU H660WM system_diagnostic_main.asp information disclosure | 6.5CISA ADP v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-29523 | D-Link DSL-7740C command injection | 7.2CISA ADP v3.1 | 2.1% | 2025-08-25 | |
| CVE-2025-29522 | D-Link DSL-7740C command injection | 6.5CISA ADP v3.1 | 1.4% | 2025-08-25 | |
| CVE-2025-29521 | D-Link DSL-7740C default credentials | 5.3CISA ADP v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-29520 | D-Link DSL-7740C privilege escalation | 5.3CISA ADP v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-29519 | D-Link DSL-7740C EXE parameter command injection | 5.3CISA ADP v3.1 | 1.7% | 2025-08-25 | |
| CVE-2025-29517 | D-Link DSL-7740C command injection | 6.8CISA ADP v3.1 | 1.6% | 2025-08-25 | |
| CVE-2025-29516 | D-Link DSL-7740C command injection | 7.2CISA ADP v3.1 | 2.1% | 2025-08-25 | |
| CVE-2025-29515 | D-Link DSL-7740C improper access control | 9.8CISA ADP v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-29514 | D-Link DSL-7740C improper access control | 9.8CISA ADP v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-29421 | PerfreeBlog arbitrary file read | 7.5CISA ADP v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-29420 | PerfreeBlog path traversal | 7.5CISA ADP v3.1 | 0.9% | 2025-08-25 | |
| CVE-2025-26467 | Apache Cassandra unsafe privilege definition | 8.8CISA ADP v3.1 | 0.5% | 2025-08-25 | Fix |
| CVE-2025-9426 | itsourcecode Online Tour and Travel Management System package.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9425 | itsourcecode Online Tour and Travel Management System enquiry.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9424 | Ruijie WS7204-A branch_import.php os command injection | 9.8v3.1 | 15.2% | 2025-08-25 | |
| CVE-2025-9423 | Campcodes Online Water Billing System editecex.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9422 | oitcode samarium Team Image team cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9421 | itsourcecode Apartment Management System addcomplain.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9420 | itsourcecode Apartment Management System addfloor.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9419 | itsourcecode Apartment Management System addunit.php SQL injection | 9.8v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-9418 | itsourcecode Apartment Management System addowner.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9417 | itsourcecode Apartment Management System addemployee.php SQL injection | 8.8v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9416 | oitcode samarium Pages Image webpage cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-08-25 | |
| CVE-2025-9415 | GreenCMS index.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9414 | kalcaddle kodbox Download from Link serverDownload server-side request forgery | 4.9v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9413 | lostvip-com ruoyi-go system_router.go SelectListByPage SQL injection | 9.8v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9412 | lostvip-com ruoyi-go DictDataDao.go SelectListByPage SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9411 | lostvip-com ruoyi-go LoginInforService.go SelectPageList SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9410 | lostvip-com ruoyi-go GenTableDao.go SelectListByPage SQL injection | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9409 | lostvip-com ruoyi-go CommonController.go DownloadUpload path traversal | 6.5v3.1 | 0.8% | 2025-08-25 | |
| CVE-2025-9407 | mtons mblog profile cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9406 | xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload | 9.8v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9405 | Open5GS gmm-sm.c gmm_state_exception assertion | 6.9CNA v4.0 | 0.6% | 2025-08-25 | |
| CVE-2025-9404 | Scada-LTS Folder pointHierarchySLTS cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9403 | jqlang jq JSON jq_test.c run_jq_tests assertion | 5.5v3.1 | 0.2% | 2025-08-25 | Fix |
| CVE-2025-9402 | HuangDou UTCMS Config update.php server-side request forgery | 7.2v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-9401 | HuangDou UTCMS Login login.php comparison | 6.3CNA v4.0 | 0.4% | 2025-08-25 | |
| CVE-2025-9400 | YiFang CMS P_file.php mergeMultipartUpload unrestricted upload | 8.8v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9399 | YiFang CMS L_tool.php SQL injection | 8.8v3.1 | 0.3% | 2025-08-25 | |
| CVE-2025-9398 | YiFang CMS Migrate.php exportInstallTable information disclosure | 7.5v3.1 | 0.5% | 2025-08-25 | |
| CVE-2025-9118 | Dataform path traversal | 10.0CNA v4.0 | 0.7% | 2025-08-25 | Fix |
| CVE-2025-8997 | OpenText Enterprise Security Manager information exposure | 5.7CNA v4.0 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-8627 | Unauthenticated protocol commands on TP-Link KP303 | 8.7CNA v4.0 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-8562 | Custom Query Shortcode WordPress plugin path traversal | 6.5CNA v3.1 | 0.4% | 2025-08-25 | Fix |
| CVE-2025-7426 | MINOVA TTA information disclosure and credential exposure | 9.3CNA v4.0 | 0.3% | 2025-08-25 | |
| CVE-2025-6737 | Securden Unified PAM Shared SSH Key and Cloud Infrastructure | 7.2CNA v3.1 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-6188 | Arista EOS LspPing Echo Reply handling authentication bypass by spoofing | 7.5CNA v3.1 | 0.4% | 2025-08-25 | |
| CVE-2025-5514 | Denial of service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module | 5.3CNA v3.1 | 0.6% | 2025-08-25 | |
| CVE-2025-5302 | Denial of service (DOS) in JSONReader in run-llama/llama_index | 8.6CNA v3.0 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-5191 | Unquoted search path vulnerability in the Utility for Industrial Computers (Windows) | 7.3CNA v4.0 | 0.2% | 2025-08-25 | Fix |
| CVE-2025-3478 | OpenText Enterprise Security Manager stored XSS | 8.5CNA v4.0 | 0.3% | 2025-08-25 | Fix |
| CVE-2025-3456 | Arista Networks EOS accounting logs information disclosure | 3.8CNA v3.1 | 0.1% | 2025-08-25 | |
| CVE-2025-36174 | IBM Integrated Analytics System file upload | 8.0CNA v3.1 | 0.4% | 2025-08-24 | Fix |
| CVE-2025-36157 | IBM Engineering Lifecycle Management incorrect authorization | 9.8CNA v3.1 | 0.6% | 2025-08-24 | Fix |
| CVE-2025-9397 | givanz Vvveb media.php unrestricted upload | 9.8v3.1 | 0.5% | 2025-08-24 | |
| CVE-2025-9396 | ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference | 5.5v3.1 | 0.3% | 2025-08-24 | Fix |
| CVE-2025-9395 | wangsongyan wblog backup.go RestorePost server-side request forgery | 5.3CNA v4.0 | 0.3% | 2025-08-24 | |
| CVE-2025-9394 | PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use-after-free | 5.5v3.1 | 0.2% | 2025-08-24 | |
| CVE-2025-9393 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaProfile stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-24 | |
| CVE-2025-9392 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 qosClassifier stack-based overflow | 8.7CNA v4.0 | 5.3% | 2025-08-24 | Emerging Threats |
| CVE-2025-9391 | Bjskzy Zhiyou ERP com.artery.workflow.ServiceImpl getFieldValue SQL injection | 9.8v3.1 | 0.4% | 2025-08-24 | |
| CVE-2025-9390 | Vim xxd xxd.c main buffer overflow | 5.5v3.1 | 0.3% | 2025-08-24 | Fix |
| CVE-2025-9389 | Vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption | 5.5v3.1 | 0.2% | 2025-08-24 | Fix |
| CVE-2025-9388 | Scada-LTS watch_list.shtm cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-24 | |
| CVE-2025-9387 | DCN DCME-720 Web Management Backend ip_block.php os command injection | 9.8v3.1 | 7.7% | 2025-08-24 | |
| CVE-2025-9386 | appneta tcpreplay tcprewrite get.c get_l2len_protocol use-after-free | 5.5v3.1 | 0.2% | 2025-08-24 | Fix |
| CVE-2025-9385 | appneta tcpreplay tcprewrite edit_packet.c fix_ipv6_checksums use-after-free | 5.5v3.1 | 0.2% | 2025-08-24 | Fix |
| CVE-2025-9384 | appneta tcpreplay parse_args.c tcpedit_post_args null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-24 | Fix |
| CVE-2025-9383 | FNKvision Y215 CCTV Camera passwd crypt weak hash | 2.0CNA v4.0 | 0.1% | 2025-08-24 | |
| CVE-2025-9382 | FNKvision Y215 CCTV Camera Telnet Sevice s1_rf_test_config backdoor | 5.4CNA v4.0 | 0.2% | 2025-08-24 | |
| CVE-2025-9381 | FNKvision Y215 CCTV Camera wpa_supplicant.conf information disclosure | 1.0CNA v4.0 | 0.1% | 2025-08-24 | |
| CVE-2025-9380 | FNKvision Y215 CCTV Camera firmware passwd hard-coded credentials | 8.5CNA v4.0 | 0.1% | 2025-08-24 | |
| CVE-2025-9379 | Belkin AX1800 Firmware Update data authenticity | 8.6CNA v4.0 | 0.3% | 2025-08-24 | |
| CVE-2025-8208 | Spexo Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-24 | Fix |
| CVE-2025-43770 | Liferay Portal vulnerable to reflected XSS with the referer and forward parameter | 6.9CNA v4.0 | 0.2% | 2025-08-23 | Fix |
| CVE-2025-43769 | Liferay Portal vulnerable to stored XSS in components portlet | 4.6CNA v4.0 | 0.2% | 2025-08-23 | Fix |
| CVE-2025-43768 | Liferay Portal JSONWS API endpoint shares sensitive information | 5.1CNA v4.0 | 0.3% | 2025-08-23 | Fix |
| CVE-2025-43767 | Liferay Portal allows open redirect in /c/Portal/edit_info_item parameter redirect | 5.1CNA v4.0 | 0.2% | 2025-08-23 | Fix |
| CVE-2025-43766 | Liferay Portal allows unrestricted upload of file in the style books component | 6.8CNA v4.0 | 0.4% | 2025-08-23 | Fix |
| CVE-2025-43765 | Liferay Portal stored cross-site scripting in text field of the web content structure | 6.9CNA v4.0 | 0.2% | 2025-08-23 | Fix |
| CVE-2025-43764 | Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet | 6.9CNA v4.0 | 0.3% | 2025-08-23 | Fix |
| CVE-2025-9363 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflow | 8.7CNA v4.0 | 4.4% | 2025-08-23 | Emerging Threats |
| CVE-2025-9362 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 urlFilterManageRule stack-based overflow | 8.8v3.1 | 0.6% | 2025-08-23 | |
| CVE-2025-9361 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 ipRangeBlockManageRule stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-23 | |
| CVE-2025-9360 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 accessControlAdd stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-08-23 | |
| CVE-2025-9359 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_checkCredentialsByBBS stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-23 | |
| CVE-2025-9358 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setSysAdm stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-23 | |
| CVE-2025-9357 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchByBBS stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-23 | |
| CVE-2025-9131 | Ogulo 360° Tour WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-23 | Fix |
| CVE-2025-9048 | Wptobe-memberships WordPress plugin authenticated (Subscriber+) arbitrary file deletion | 8.1CNA v3.1 | 0.6% | 2025-08-23 | |
| CVE-2025-8062 | WS Theme Addons WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-23 | |
| CVE-2025-7957 | ShortcodeHub WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-23 | |
| CVE-2025-7842 | Silencesoft RSS Reader WordPress plugin cross-site request forgery to RSS Feed deletion | 4.3CNA v3.1 | 0.1% | 2025-08-23 | |
| CVE-2025-7841 | Sertifier Certificate and Badge Maker for WordPress WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-08-23 | Fix |
| CVE-2025-7839 | Restore Permanently delete Post or Page Data WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-08-23 | |
| CVE-2025-7828 | WP Filter and Combine RSS Feeds WordPress plugin missing authorization authenticated Feed deletion | 4.3CNA v3.1 | 0.2% | 2025-08-23 | |
| CVE-2025-7827 | Ni WooCommerce Customer Product Report WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-08-23 | |
| CVE-2025-7821 | WC Plus WordPress plugin missing authorization to unauthenticated settings manipulation | 5.3CNA v3.1 | 0.2% | 2025-08-23 | |
| CVE-2025-7813 | Events Calendar WordPress plugin server-side request forgery | 7.2CNA v3.1 | 0.3% | 2025-08-23 | Fix |
| CVE-2025-7642 | Simpler Checkout - authentication bypass | 9.8CNA v3.1 | 0.5% | 2025-08-23 | Fix |
| CVE-2025-5821 | Case Theme User WordPress plugin authentication bypass via Social login | 9.8CNA v3.1 | 0.7% | 2025-08-23 | Fix |
| CVE-2025-5352 | Environment Variable XSS in Analytics component in lunary-ai/Lunary | 9.6v3.1 | 0.5% | 2025-08-23 | Fix |
| CVE-2025-5060 | Bravis User WordPress plugin authentication bypass to account takeover | 8.1CNA v3.1 | 0.4% | 2025-08-23 | Fix |
| CVE-2025-57896 | Church Admin WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57895 | JobWP WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-57894 | WPPizza WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57893 | WP Fast Total Search WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-57892 | Simple Statistics for Feeds WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-57891 | Recurring PayPal Donations WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57890 | Sessions WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57888 | Jobmonster WordPress theme sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-57887 | Jobmonster WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57886 | Accessibility Checker by Equalize Digital WordPress plugin insecure direct object references (IDOR) | 5.4CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57885 | Fluent Support WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-57884 | Greenshift WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57801 | gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks | 8.6CNA v4.0 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-57800 | Audiobookshelf vulnerable to OIDC token exfiltration and account takeover | 8.8CNA v3.1 | 0.5% | 2025-08-22 | Fix |
| CVE-2025-57771 | Roo-Code potential remote code execution via auto-execute command parsing flaw | 8.1CNA v3.1 | 0.7% | 2025-08-22 | Fix |
| CVE-2025-57770 | ZITADEL user enumeration vulnerability in login UI | 5.3CNA v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-57699 | Western Digital Kitfox unquoted search path | 8.4CNA v4.0 | 0.2% | 2025-08-22 | |
| CVE-2025-57105 | D-Link DI-7400G+ command injection | 9.8CISA ADP v3.1 | 2.9% | 2025-08-22 | Emerging Threats |
| CVE-2025-55745 | UnoPim Quick Export feature is vulnerable to CSV injection | 2.5CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-55741 | Unopim/unopim allows unauthorized product deletion via mass-delete endpoint | 8.1CNA v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-55637 | Reolink Smart 2k+ Plug-in Wi-fi Video Doorbell With Chime Firmware command injection | 9.8v3.1 | 1.7% | 2025-08-22 | |
| CVE-2025-55634 | Reolink Smart 2k+ Plug-in Wi-fi Video Doorbell With Chime Firmware denial of service | 7.5CISA ADP v3.1 | 0.5% | 2025-08-22 | |
| CVE-2025-55631 | Reolink Video Doorbell with Chime session management denial of service | 4.0CISA ADP v3.1 | 0.1% | 2025-08-22 | |
| CVE-2025-55630 | Reolink Smart 2k+ Plug-in Wi-fi Video Doorbell With Chime Firmware improper access control | 7.3v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-55629 | Reolink Smart insecure permissions | 6.5CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55627 | Reolink Video Doorbell with Chime account creation privilege escalation | 5.3CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55626 | Reolink Smart An insecure direct object reference | 5.3CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55625 | Reolink An open redirect | 6.3CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55624 | Reolink open redirect | 5.3CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-55623 | Reolink authentication bypass | 5.4CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-55622 | Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience. | 6.5CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-55621 | Reolink An insecure direct object reference | 6.5CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55620 | Reolink valuateJavascript function cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55619 | Reolink hard-coded cryptographic key | 9.8CISA ADP v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55613 | Tenda O3 buffer overflow | 9.8CISA ADP v3.1 | 0.6% | 2025-08-22 | |
| CVE-2025-55611 | D-Link DIR-619L buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55606 | Tenda AX3 buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55605 | Tenda AX3 buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55603 | Tenda AX3 buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55602 | D-Link DIR-619L buffer overflow | 7.5NVD v3.1 | 0.5% | 2025-08-22 | |
| CVE-2025-55599 | D-Link DIR-619L buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55581 | D-Link Dcs-825l Firmware improper privilege management | 7.3CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-55573 | new-api cross-site scripting | 8.8CISA ADP v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-55455 | DooTask unrestricted file upload | 3.5CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-55454 | DooTask component /msg/sendfiles arbitrary file upload | 8.8CISA ADP v3.1 | 0.7% | 2025-08-22 | |
| CVE-2025-55398 | mouse07410 asn1c UPER decoder improper input validation | 9.8CISA ADP v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-54813 | Apache LOG4CXX: Improper escaping with JSONLayout | 6.3CNA v4.0 | 1.3% | 2025-08-22 | Fix |
| CVE-2025-54812 | Apache LOG4CXX: Improper HTML escaping in HTMLLayout | 2.1CNA v4.0 | 1.2% | 2025-08-22 | Fix |
| CVE-2025-53363 | Dpanel has an arbitrary file read | 4.8CNA v4.0 | 0.5% | 2025-08-22 | |
| CVE-2025-52451 | Salesforce Tableau Server improper input validation | 8.5CISA ADP v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-52450 | Salesforce Tableau Server path traversal | 6.5CISA ADP v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-52287 | Elite deserialization of untrusted data | 8.8CISA ADP v3.1 | 0.5% | 2025-08-22 | |
| CVE-2025-52095 | Pdq Smart Deploy insufficiently protected credentials | 9.8CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-52094 | Pdq Smart Deploy insecure permissions | 7.8CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-52085 | Yoosee An SQL injection | 8.8CISA ADP v3.1 | 0.5% | 2025-08-22 | |
| CVE-2025-51825 | JeecgBoot SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-51605 | Shopizer origin validation error | 8.1CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-51092 | Vishnusivadas Login-signup SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-08-22 | |
| CVE-2025-50859 | Ehcp Easy Hosting Control Panel Change template function reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-50858 | Ehcp Easy Hosting Control Panel List MySQL Databases function reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-50733 | HTMLPreview component of artifacts.tsx NextChat contains a cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-50691 | MCSManager daemon process privilege escalation | 5.3CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-50674 | Openmediavault improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-08-22 | |
| CVE-2025-43762 | Liferay Portal users can upload an unlimited amount of files | 5.3CNA v4.0 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-43761 | Liferay Portal reflected XSS in CKeditor endpoint | 6.9CNA v4.0 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-43760 | Liferay Portal reflected cross-site scripting vulnerability via PortalUtil.escapeRedirect | 5.3CNA v4.0 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-43759 | Liferay Portal users are able to add system admin portlets to pages | 6.7CNA v4.0 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-43758 | Liferay Portal files accessible to external parties | 5.3CNA v4.0 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-43752 | Liferay Portal's Unlimited file upload could result in DoS | 5.3CNA v4.0 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-43751 | Liferay Portal User Enumeration vulnerability via the Create Account page | 6.9CNA v4.0 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-41452 | Post auth nginx configuration injection in Danfoss AK-SM8xxA Series | 6.8CNA v4.0 | 0.7% | 2025-08-22 | KCVFix |
| CVE-2025-41451 | Post-authentication OS command injection RCE in Danfoss AK-SM8xxA Series | 8.7CNA v4.0 | 3.1% | 2025-08-22 | KCVFix |
| CVE-2025-38675 | Linux kernel state race condition | 7.8CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38674 | Linux kernel DRM PRIME buffer sharing null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38673 | Linux kernel GEM framebuffer driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38672 | Linux kernel GEM DMA driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38671 | Linux kernel I2C QUP driver denial of service | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38670 | Linux kernel arm64 stack switching vulnerability | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38669 | Linux kernel GEM shmem driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38668 | Linux kernel regulator coupling null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38667 | Linux kernel IIO subsystem out-of-bounds write | 7.8CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38666 | Linux kernel AppleTalk AARP proxy use-after-free | 7.8v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38665 | Linux kernel CAN netlink interface null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38664 | Linux kernel ice null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38663 | Linux kernel NILFS2 inode handling vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38662 | Linux kernel MediaTek MT8365 I2S audio driver out-of-bounds write | 7.1CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38661 | Linux kernel Alienware WMI WMAX driver vulnerability | 7.1CNA v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38660 | Linux kernel Ceph client vulnerability | 9.8CNA v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-38659 | Linux kernel GFS2 journal recovery null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38658 | Linux kernel NVMe PCI endpoint target vulnerability | 8.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38657 | Linux kernel rtw89 multi-link switch handling out-of-bounds read | 7.3CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38656 | Linux kernel iwlwifi DVM driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38655 | Linux kernel Canaan K230 pin control driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38654 | Linux kernel Canaan K230 pin control driver vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38653 | Linux kernel procfs lseek handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38652 | Linux kernel F2FS device path handling out-of-bounds read | 7.3CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38651 | Linux kernel Landlock ID range calculation vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38650 | Linux kernel hfsplus improper locking | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38649 | Linux kernel Coresight trace subsystem infinite loop | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38648 | Linux kernel STM32 SPI driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38647 | Linux kernel rtw89 SAR ACPI init improper locking | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38646 | Linux kernel rtw89 Wi-Fi driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38645 | Linux kernel mlx5 device memory access null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38644 | Linux kernel mac80211 TDLS handling vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38643 | Linux kernel cfg80211 DFS channel availability check improper locking | 8.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38642 | Linux kernel mac80211 monitor mode reachable assertion | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38641 | Linux kernel Bluetooth USB driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38640 | Linux kernel netfilter BPF hook reachable assertion | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38639 | Linux kernel netfilter nfacct match vulnerability | 7.1CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38638 | In the Linux kernel, the following vulnerability has been resolved: ipv6: add a retry logic in net6_rt_notify() inet6_rt_notify() can be called under RCU protection only. This means the route could be changed concurrently and rt6_fill_node() could return -EMSGSIZE. Re-size the skb when this happe | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38636 | Linux kernel runtime verification da monitor tracepoints out-of-bounds read | 7.1NVD v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38635 | Linux kernel DaVinci LPSC clock driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38634 | Linux kernel CPCAP charger driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38633 | Linux kernel SpacemiT K1 clock driver denial of service | 5.5v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38632 | Linux kernel pinmux subsystem race condition | 4.7v3.1 | 0.1% | 2025-08-22 | Fix |
| CVE-2025-38631 | Linux kernel imx95-blk-ctl crash | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38630 | Linux kernel imxfb null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38629 | Linux kernel Scarlett2 USB audio driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38628 | Linux kernel mlx5 vDPA driver vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38627 | Linux kernel f2fs compression use-after-free | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38626 | Linux kernel f2fs kernel panic | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38625 | Linux kernel pds VFIO driver vulnerability | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38624 | Linux kernel pnv_php kernel panic | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38623 | Linux kernel PowerNV PCI hotplug driver denial of service | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38622 | Linux kernel UDP receive segmentation denial of service | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38621 | Linux kernel md kernel panic | 5.5v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38620 | Linux kernel zoned loop device driver use-after-free | 7.8v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38619 | Linux kernel j721e-csi2rx crash | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38618 | Linux kernel vsock binding use-after-free | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-38617 | Linux kernel net/packet race condition | 7.8CNA v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-38616 | Linux kernel TLS socket layer out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-36042 | IBM QRadar SIEM cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-33120 | IBM QRadar SIEM privilege escalation | 7.8CNA v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-29366 | mupen64plus write_rdram_regs function vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2025-08-22 | |
| CVE-2025-29365 | Spimsimulator Spim buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-08-22 | |
| CVE-2025-26498 | Salesforce Tableau Server unrestricted file upload | 7.3CISA ADP v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-26497 | Salesforce Tableau Server unrestricted file upload | 7.3CISA ADP v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-26496 | Salesforce Tableau Server, Tableau Desktop type confusion | 9.3CISA ADP v3.1 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-9356 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 inboundFilterAdd stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-22 | |
| CVE-2025-9355 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 scheduleAdd stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-08-22 | |
| CVE-2025-9341 | Bouncy Castle for Java has uncontrolled resource consumption | 5.9CNA v4.0 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-9340 | Bouncy Castle for Java has out-of-bounds write | 0.0CNA v4.0 | 0.2% | 2025-08-22 | Fix |
| CVE-2025-9331 | Spacious WordPress theme missing authorization to Autheticated (Subscriber+) Demo data import | 4.3CNA v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-9259 | Uniong|WebITR arbitrary file reading through path traversal | 7.1CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-9258 | Uniong|WebITR arbitrary file reading through path traversal | 7.1CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-9257 | Uniong|WebITR arbitrary file reading through path traversal | 7.1CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-9256 | Uniong|WebITR arbitrary file reading through path traversal | 7.1CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-9255 | Uniong|WebITR SQL injection | 8.7CNA v4.0 | 0.5% | 2025-08-22 | Fix |
| CVE-2025-9254 | Uniong|WebITR missing authentication | 9.3CNA v4.0 | 0.6% | 2025-08-22 | Fix |
| CVE-2025-8678 | WP Crontrol - Authenticated (Administrator+) blind server-side request forgery | 5.9CNA v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-8281 | WP Talroo WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.3% | 2025-08-22 | |
| CVE-2025-6791 | Centreon web second order SQL injection available to user with low privilege | 8.8CNA v3.1 | 0.3% | 2025-08-22 | Fix |
| CVE-2025-4650 | Centreon web user with high privileges is able to introduce a SQLi | 7.2CNA v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-4609 | Google Chrome incorrect permission assignment | 9.6CISA ADP v3.1 | 0.4% | 2025-08-22 | Fix |
| CVE-2025-57768 | Alanaktion phproject stored XSS in hours fields when creating or editing an issue | 6.9CNA v4.0 | 0.4% | 2025-08-21 | Fix |
| CVE-2025-57765 | WeGIA cross-site scripting (XSS) Reflected endpoint pre_cadastro_adotante.php parameter msg_e | 6.5CNA v3.1 | 0.3% | 2025-08-21 | Fix |
| CVE-2025-57764 | WeGIA cross-site scripting (XSS) Reflected endpoint cargos.php parameter msg_e | 6.5CNA v3.1 | 0.3% | 2025-08-21 | Fix |
| CVE-2025-57763 | LabRedesCefetRJ WeGIA cross-site scripting (XSS) Reflected in insere_despacho.php parameter sccs | 6.4CNA v4.0 | 0.2% | 2025-08-21 | Fix |
| CVE-2025-57762 | WeGIA dependente_docdependente.php endpoint stored cross-site scripting | 6.4CNA v4.0 | 0.2% | 2025-08-21 | Fix |
| CVE-2025-57761 | WeGIA SQL injection vulnerability | 9.4CNA v4.0 | 0.4% | 2025-08-21 | Fix |
| CVE-2025-57755 | @musistudio/claude-code-router has improper CORS configuration | 8.1CNA v4.0 | 0.3% | 2025-08-21 | Fix |
| CVE-2025-57754 | eslint-ban-moment exposed a sensitive Supabase URI in .env (credential leak) | 9.8CNA v3.1 | 0.4% | 2025-08-21 | |
| CVE-2025-57753 | vite-plugin-static-copy files not included in `src` are accessible with a crafted request | 6.0CNA v4.0 | 0.4% | 2025-08-21 | Fix |
| CVE-2025-57751 | Denial of service attack in pyLoad CNL Blueprint using dukpy.evaljs | 7.7CNA v4.0 | 0.3% | 2025-08-21 | Fix |
| CVE-2025-55744 | UnoPim vulnerable to CSRF on Product edit feature and creation of other types | 6.9CNA v4.0 | 0.2% | 2025-08-21 | Fix |
| CVE-2025-55743 | UnoPim vulnerable to remote code execution through arbitrary file upload | 7.3CNA v4.0 | 0.5% | 2025-08-21 | Fix |
| CVE-2025-55742 | UnoPim stored XSS via SVG MIME/Sanitizer Bypass | 8.0CNA v3.1 | 0.4% | 2025-08-21 | Fix |
| CVE-2025-55564 | Tenda AC15 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-08-21 | |
| CVE-2025-55524 | agent-zero insecure permissions | 7.3CISA ADP v3.1 | 0.3% | 2025-08-21 | |
| CVE-2025-55523 | agent-zero path traversal | 3.5CISA ADP v3.1 | 1.1% | 2025-08-21 | Nuclei |
| CVE-2025-55522 | Akaunting component /common/reports cross-site scripting | 6.5CISA ADP v3.1 | 0.4% | 2025-08-21 | |
| CVE-2025-55521 | Akaunting denial of service | 6.5CISA ADP v3.1 | 0.5% | 2025-08-21 | |
| CVE-2025-55420 | FoxCMS cross-site scripting | 8.8CISA ADP v3.1 | 0.5% | 2025-08-21 | |
| CVE-2025-55383 | Moss upload function vulnerability | 8.6CISA ADP v3.1 | 0.3% | 2025-08-21 | |
| CVE-2025-55371 | jishenghua jshERP improper access control | 5.3CISA ADP v3.1 | 0.3% | 2025-08-21 | |
| CVE-2025-55370 | jishenghua jshERP insecure direct object reference | 8.8CISA ADP v3.1 | 0.4% | 2025-08-21 | |
| CVE-2025-55368 | jishenghua jshERP improper access control | 8.8CISA ADP v3.1 | 0.4% | 2025-08-21 | |
| CVE-2025-55367 | jishenghua jshERP improper access control | 5.3CISA ADP v3.1 | 0.3% | 2025-08-21 | |
| CVE-2025-55366 | jishenghua jshERP privilege escalation | 5.3CISA ADP v3.1 | 0.3% | 2025-08-21 | |
| CVE-2025-55297 | espressif esp-idf ESF-IDF BluFi Example Memory Overflow vulnerability | 5.2CNA v4.0 | 0.3% | 2025-08-21 | Fix |
| CVE-2025-55231 | Microsoft Windows Storage-based Management service remote code execution | 7.5CNA v3.1 | 0.5% | 2025-08-21 | Fix |