CVE-2025 records published in September 2025
This page lists the 3,729 CVE-2025 records published in September 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 16 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 49913.4% of these records
- Listed in CISA KEV
- 160.4% of these records
- Reported exploited
- 50.1% of these records
- Detection signal
- 832.2% of these records
- Exploit code
- 1022.7% of these records
- Actionable vendor fix
- 2,26160.6% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in September 2025 have had from about 13 months to about 14 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-61792 | Quadient DS-700 iQ race condition | 6.4CNA v3.1 | 0.1% | 2025-09-30 | |
| CVE-2025-61586 | FreshRSS is vulnerable to directory enumeration by setting path in its theme field | 6.9CNA v4.0 | 0.5% | 2025-09-30 | Fix |
| CVE-2025-61584 | serverless-dns is vulnerable to command injection through pr.yml GitHub Action Workflow | 9.3CNA v4.0 | 0.4% | 2025-09-30 | Exploit codeFix |
| CVE-2025-59956 | AgentAPI exposed user chat history via a DNS rebinding attack | 6.5CNA v3.1 | 0.4% | 2025-09-30 | Fix |
| CVE-2025-59954 | Knowage Contains a remote code execution | 9.3CNA v4.0 | 0.5% | 2025-09-30 | Fix |
| CVE-2025-59952 | minio-java Client XML Tag is vulnerable to Value Substitution | 8.7CNA v4.0 | 0.5% | 2025-09-30 | Fix |
| CVE-2025-59950 | FreshRSS: Double clickjacking can lead to privilege escalation | 6.7CNA v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-59668 | NIHON KOHDEN Central Monitor CNS-6201 null pointer dereference | 8.7CNA v4.0 | 0.5% | 2025-09-30 | |
| CVE-2025-57852 | Red Hat OpenShift AI openshift-ai: Privilege escalation via excessive /etc/passwd permissions | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-57254 | Karthikg1908 Hospital Management System login page SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-56676 | Titansystems Zender improper input validation | 5.4CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-56675 | EKEN video doorbell T6 incorrect resource transfer | 3.5CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-56572 | Finance.js vulnerable to DoS via the seekZero parameter | 7.5CISA ADP v3.1 | 0.5% | 2025-09-30 | |
| CVE-2025-56571 | Finance.js vulnerable to DoS via the IRR function’s depth parameter | 7.5CISA ADP v3.1 | 0.4% | 2025-09-30 | |
| CVE-2025-56520 | dify server-side request forgery | 5.3CISA ADP v3.1 | 0.7% | 2025-09-30 | Nuclei |
| CVE-2025-56513 | Nicehash Quickminer download without integrity check | 9.8CISA ADP v3.1 | 0.4% | 2025-09-30 | |
| CVE-2025-56392 | Syauqi Collegetivity /dashboard/notes endpoint of Syaqui insecure direct object reference | 8.1CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-56301 | Chipsalliance Rocket-chip CSR trap handling vulnerability | 7.5CISA ADP v3.1 | 0.6% | 2025-09-30 | |
| CVE-2025-56207 | Money Making Opportunity NFT contract _transfer function vulnerability | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-56200 | validator validator.js has a URL validation bypass vulnerability in its isURL function | 6.1CISA ADP v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-56132 | LiquidFiles authentication bypass | 7.3CISA ADP v3.1 | 0.7% | 2025-09-30 | NucleiFix |
| CVE-2025-56018 | Senior-walter Web-based Pharmacy Product Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-55797 | FormCMS has an improper access control vulnerability in the /API/schemas/history/[schemaId] endpoint | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-55191 | argoproj argo-cd repository Credentials race condition crashes Argo CD Server | 6.5CNA v3.1 | 0.5% | 2025-09-30 | Fix |
| CVE-2025-54477 | Joomla! Core [20250902] User-Enumeration in passkey authentication method | 5.3CISA ADP v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-54476 | Joomla! Core [20250901] Inadequate content filtering within the checkAttribute filter code | 4.8CNA v4.0 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-52050 | frappe erpnext SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-52049 | frappe erpnext SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-52047 | frappe erpnext SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-52043 | frappe erpnext SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-43827 | Liferay Portal Vulnerable to IDOR via audit events | 5.3CNA v4.0 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-43826 | Liferay Portal vulnerable to XSS in Web Content translation | 4.8CNA v4.0 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-41099 | Insecure direct object reference in GPS BOLD Workplanner | 6.5NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41098 | Insecure direct object reference in GPS BOLD Workplanner | 7.5v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41097 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41096 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41095 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41094 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41093 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41092 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-41091 | Insecure direct object reference in GPS BOLD Workplanner | 4.3NVD v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-36262 | IBM Planning Analytics Local information disclosure | 4.9CNA v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-36132 | IBM Planning Analytics Local cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-34217 | Vasion Print (formerly PrinterLogic) Undocumented Hard-coded SSH Key | 9.8v3.1 | 0.7% | 2025-09-30 | |
| CVE-2025-28016 | PHPGurukul User Registration and Login and User Management System cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-24525 | Keysight Ixia Vision Product Family use of hard-coded cryptographic key | 8.7CNA v4.0 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-23293 | NVIDIA DLS component of NVIDIA License System missing authentication | 8.7CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-23292 | NVIDIA DLS component of NVIDIA License System NoSQL injection | 4.6CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-23291 | NVIDIA DLS component of NVIDIA License System cleartext storage of sensitive information | 2.4CNA v3.1 | 0.1% | 2025-09-30 | Fix |
| CVE-2025-11195 | Rapid7 AppSpider Project Name Validation Bypass | 3.3CNA v3.1 | 0.1% | 2025-09-30 | Fix |
| CVE-2025-11178 | Acronis True Image uncontrolled search path | 7.3CNA v3.0 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-11163 | SmartCrawl SEO checker, analyzer and optimizer WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-11153 | Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component | 7.5CISA ADP v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-11152 | Mozilla Firefox sandbox escape due to integer overflow in the Graphics: Canvas2D component | 8.6CISA ADP v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-11149 | @nubosoftware/node-static failure to catch exception can result in server crash | 7.5CNA v3.1 | 0.5% | 2025-09-30 | |
| CVE-2025-11148 | All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these conventions which can be abused: 1. It trusts branch nam | 9.8CNA v3.1 | 1.4% | 2025-09-30 | |
| CVE-2025-10991 | TP-Link Systems Tapo D230S1 root Access via UART | 7.0CNA v4.0 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-10859 | Mozilla Firefox Incognito cookie storage information disclosure | 4.0CISA ADP v3.1 | 0.1% | 2025-09-30 | Fix |
| CVE-2025-10725 | Red Hat OpenShift AI ClusterRole permissions privilege escalation | 9.9CNA v3.1 | 0.7% | 2025-09-30 | Fix |
| CVE-2025-10659 | MegaSys Enterprises Telenium Online Web Application OS command injection | 9.3CNA v4.0 | 1.2% | 2025-09-30 | Fix |
| CVE-2025-10217 | Hitachi Energy Asset Suite log injection | 6.0CNA v4.0 | 0.3% | 2025-09-30 | |
| CVE-2025-10196 | Survey Anyplace WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10191 | Big Post Shipping for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-10189 | BP Direct Menus WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10182 | dbview WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10179 | My AskAI WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10168 | Any News Ticker WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-10131 | All Social Share Options WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10130 | Layers WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-10128 | Eulerpool Research Systems WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-10000 | Qyrr simply and modern QR-Code creation WordPress plugin arbitrary file upload | 6.4CNA v3.1 | 0.4% | 2025-09-30 | Fix |
| CVE-2025-9993 | Bei Fen WordPress Backup plugin authenticated (Subscriber+) local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-09-30 | |
| CVE-2025-9991 | Tiny Bootstrap Elements Light WordPress plugin unauthenticated local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-09-30 | |
| CVE-2025-9948 | Chat by Chatwee WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-9946 | LockerPress WordPress Security plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-9852 | Yoga Schedule Momoyoga WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-9762 | Post By Email WordPress plugin unauthenticated arbitrary file upload via email Attachments | 9.8CNA v3.1 | 0.7% | 2025-09-30 | |
| CVE-2025-9232 | OpenSSL out-of-bounds read in HTTP client no_proxy handling | 5.9CISA ADP v3.1 | 2.0% | 2025-09-30 | Fix |
| CVE-2025-9231 | OpenSSL timing side-channel in SM2 algorithm on 64 bit ARM | 6.5CISA ADP v3.1 | 2.2% | 2025-09-30 | Fix |
| CVE-2025-9230 | OpenSSL out-of-bounds read and write in RFC 3211 KEK Unwrap | 7.5CISA ADP v3.1 | 1.6% | 2025-09-30 | Fix |
| CVE-2025-8877 | AffiliateWP WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.4% | 2025-09-30 | Fix |
| CVE-2025-8777 | planetcalc WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-8625 | Copypress Rest API WordPress plugin remote code execution | 9.8CNA v3.1 | 0.6% | 2025-09-30 | Exploit codeFix |
| CVE-2025-8624 | Nexa Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-8623 | WeedMaps Menu for WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-8608 | Mihdan: Elementor Yandex Maps WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-8566 | GutenBee Gutenberg Blocks WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-8560 | FancyTabs WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-8559 | All in One Music Player WordPress plugin path traversal | 6.5CNA v3.1 | 0.4% | 2025-09-30 | |
| CVE-2025-8214 | The Pack Elementor addon WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-8122 | Blind SQL injection in PAD CMS | 8.8v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-8121 | Blind SQL injection in PAD CMS | 8.8v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-8120 | Remote code execution via unrestricted file upload in PAD CMS | 9.8v3.1 | 0.6% | 2025-09-30 | |
| CVE-2025-8119 | Cross-site request forgery in PAD CMS | 4.3v3.1 | 0.1% | 2025-09-30 | |
| CVE-2025-8118 | Bruteforce Protection Bypass in PAD CMS | 6.5v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-8117 | Account takeover via Reset Password Functionality in PAD CMS | 7.5v3.1 | 0.3% | 2025-09-30 | |
| CVE-2025-8116 | Reflected XSS in PAD CMS | 6.1v3.1 | 0.2% | 2025-09-30 | |
| CVE-2025-7779 | Acronis True Image improper privilege management | 8.8CNA v3.0 | 0.1% | 2025-09-30 | Fix |
| CVE-2025-7493 | Red Hat Enterprise Linux 10 freeipa: Idm: Privilege escalation from host to domain admin in freeipa | 9.1CNA v3.1 | 0.6% | 2025-09-30 | Fix |
| CVE-2025-7065 | Remote code execution via unrestricted file upload in PAD CMS | 9.8v3.1 | 0.6% | 2025-09-30 | |
| CVE-2025-7063 | Remote code execution via unrestricted file upload in PAD CMS | 9.8v3.1 | 0.6% | 2025-09-30 | |
| CVE-2025-7052 | LatePoint WordPress plugin cross-site request forgery to account takeover | 8.8CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-7038 | LatePoint WordPress plugin unauthenticated authentication bypass via load_step function | 8.2CNA v3.1 | 0.4% | 2025-09-30 | Fix |
| CVE-2025-6941 | LatePoint WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 6.4CNA v3.1 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-6815 | LatePoint WordPress plugin authenticated (Administrator+) stored cross-site scripting | 5.5CNA v3.1 | 0.3% | 2025-09-30 | Fix |
| CVE-2025-6034 | Out-of-bounds read in DefaultFontOptions in NI Circuit Design Suite | 8.5CNA v4.0 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-6033 | Memory corruption issue in XML_Serialize in NI Circuit Design Suite | 8.5CNA v4.0 | 0.2% | 2025-09-30 | Fix |
| CVE-2025-61659 | magicmonty bash-git-prompt insecure temporary file | 6.8CNA v3.1 | 0.1% | 2025-09-29 | Fix |
| CVE-2025-59948 | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page | 6.7CNA v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-59942 | go-f3 module vulnerable to integer overflow leading to panic | 7.5CNA v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-59941 | go-f3 is vulnerable to Cached Justification Verification Bypass | 5.9CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-59940 | mondeja mkdocs-include-markdown-plugin improper input validation | 6.5CNA v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-59937 | go-mail has insufficient address encoding when passing mail addresses to the SMTP client | 8.2CNA v4.0 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-59933 | libvips is vulnerable to buffer over-read in poppler-based pdfload | 5.1CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-59163 | vet MCP Server SSE Transport DNS Rebinding vulnerability | 2.1CNA v4.0 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-57879 | Bug-000171009 URL manipulation vulnerability in Portal for ArcGIS | 6.1CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57878 | Bug-000174149 The Portal for ArcGIS has an unvalidated redirect | 6.1CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57877 | Reflected XSS vulnerability in Portal for ArcGIS | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57876 | Stored XSS vulnerability in Portal for ArcGIS | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57875 | Bug-000164122 reflected XSS vulnerability in Portal for ArcGIS | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57874 | Bug-000161627 reflected XSS vulnerability in Portal for ArcGIS. (,,) | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57873 | Bug-000175222 reflected XSS vulnerability in Portal for ArcGIS | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57872 | Bug-000174150 unvalidated redirect in Portal for ArcGIS | 6.1CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57871 | Bug-000174020 reflected XSS vulnerability identified in Portal for ArcGIS. (,,) | 4.8CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-57769 | FreshRSS FressRSS: Clickjacking can lead to XSS and/or privilege escalation | 5.3CNA v4.0 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-57516 | PublicCMS OS command injection | 8.2CISA ADP v3.1 | 1.1% | 2025-09-29 | |
| CVE-2025-57483 | tawk.to chatbox widget v4 reflected cross-site scripting | 8.1CISA ADP v3.1 | 0.3% | 2025-09-29 | |
| CVE-2025-57428 | Each Italy Wireless Mini Router WIRELESS-N 300M Telnet debug shell default credentials | 6.5CISA ADP v3.1 | 0.2% | 2025-09-29 | Exploit code |
| CVE-2025-57424 | MyCourts profile field stored cross-site scripting | 7.3CISA ADP v3.1 | 0.3% | 2025-09-29 | |
| CVE-2025-57266 | ThriveX Blogging Framework assistant API endpoint vulnerability | 9.8CISA ADP v3.1 | 0.4% | 2025-09-29 | |
| CVE-2025-57197 | Payeer Android application PIN change feature improper access control | 6.0CISA ADP v3.1 | 0.2% | 2025-09-29 | |
| CVE-2025-56807 | Fairsketch RISE Ultimate Project Manager cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-09-29 | Exploit code |
| CVE-2025-56795 | mealie cross-site scripting | 9.0CISA ADP v3.1 | 0.4% | 2025-09-29 | Exploit code |
| CVE-2025-56764 | Trivisionsecurity Trivision Nc-227wf Firmware response discrepancy | 5.3CISA ADP v3.1 | 0.3% | 2025-09-29 | Exploit code |
| CVE-2025-56449 | Obsidian Scheduler REST API authentication bypass | 8.2CISA ADP v3.1 | 0.4% | 2025-09-29 | |
| CVE-2025-56234 | Nanda Automation Technology AT_NA2000 PLC TCP sequence validation denial of service | 7.5CISA ADP v3.1 | 0.3% | 2025-09-29 | |
| CVE-2025-56233 | OpenIndiana SunOS kernel TCP sequence validation denial of service | 7.5CISA ADP v3.1 | 0.3% | 2025-09-29 | |
| CVE-2025-55795 | Openml Frontend insecure direct object reference | 3.5CISA ADP v3.1 | 0.3% | 2025-09-29 | |
| CVE-2025-54875 | FreshRSS: Unauthorized creation of admin user when registration is enabled | 9.8CNA v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-54592 | FreshRSS has Incomplete Session Termination on Logout | 8.8CNA v4.0 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-54591 | FreshRSS: Unauthenticated users can view default user's information | 7.5CNA v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-51495 | Cesanta Mongoose WebSocket component integer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-48006 | Saison Technology DataSpider Servista XML external entity injection | 9.1NVD v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-45376 | Dell Repository Manager (DRM) improper handling of insufficient permissions | 7.5CNA v3.1 | 0.1% | 2025-09-29 | Fix |
| CVE-2025-43820 | Liferay Portal vulnerable to cross-site scripting in the Calendar widget | 4.8CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43818 | Liferay Portal vulnerable to cross-site scripting in the Calendar widget | 4.8CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43817 | Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter | 4.8CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43815 | Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page | 5.1CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43813 | Liferay Portal vulnerable to path traversal and denial of service in the ComboServlet | 6.9CNA v4.0 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-43812 | Liferay Portal vulnerable to cross-site scripting in the web content template | 4.8CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43811 | Liferay Portal vulnerable to cross-site scripting in the related asset selector | 4.8CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-43400 | Apple macOS out-of-bounds write | 6.3CISA ADP v3.1 | 7.0% | 2025-09-29 | Fix |
| CVE-2025-41252 | VMware NSX observable discrepancy | 7.5CNA v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-41251 | VMware NSX weak password recovery | 8.1CNA v3.1 | 0.8% | 2025-09-29 | Fix |
| CVE-2025-41250 | VMware vCenter header injection | 8.5CNA v3.1 | 0.6% | 2025-09-29 | Fix |
| CVE-2025-41246 | VMware Tools improper authorisation | 7.6CNA v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-41245 | VMSA-2025-0015: VMware Aria Operations and VMware tools updates address multiple vulnerabilities | 4.9CNA v3.1 | 0.6% | 2025-09-29 | Fix |
| CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools privilege defined with unsafe actions | 7.8CNA v3.1 | 8.6% | 2025-09-29 | KEVExploit codeFix |
| CVE-2025-36352 | IBM License Metric Tool cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-36351 | IBM License Metric Tool REST API improper access control | 4.3CNA v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-36245 | IBM InfoSphere Information Server command execution | 8.8CNA v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-36099 | IBM WebSphere Application Server denial of service | 4.9CNA v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-35034 | Medical Informatics Engineering Enterprise Health reflected cross-site scripting via portlet_user_id | 6.1NVD v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-35033 | Medical Informatics Engineering Enterprise Health CSV injection | 4.3NVD v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-35032 | Medical Informatics Engineering Enterprise Health arbitrary file upload | 9.9NVD v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-35031 | Medical Informatics Engineering Enterprise Health includes session token in debug output | 5.5NVD v3.1 | 0.1% | 2025-09-29 | Fix |
| CVE-2025-35030 | Medical Informatics Engineering Enterprise Health cross-site request forgery | 8.8NVD v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-34235 | Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE | 7.8NVD v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-34234 | Vasion Print (formerly PrinterLogic) Hard-coded Encryption Private Keys | 7.5NVD v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-34233 | Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents | 6.8NVD v3.1 | 0.6% | 2025-09-29 | Fix |
| CVE-2025-34232 | Vasion Print (formerly PrinterLogic) blind SSRF via Lexmark dellCheck.php | 5.3v3.1 | 0.6% | 2025-09-29 | Fix |
| CVE-2025-34231 | Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php | 8.6v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-34230 | Vasion Print (formerly PrinterLogic) blind SSRF via HP log_off_single_sign_on.php | 5.8v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-34229 | Vasion Print (formerly PrinterLogic) blind SSRF via HP installApp.php | 5.8v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-34228 | Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php | 8.6v3.1 | 0.8% | 2025-09-29 | Fix |
| CVE-2025-34225 | Vasion Print (formerly PrinterLogic) SSRF via console_release Directory | 8.6v3.1 | 0.8% | 2025-09-29 | Fix |
| CVE-2025-34224 | Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification | 9.1v3.1 | 1.0% | 2025-09-29 | Fix |
| CVE-2025-34223 | Vasion Print (formerly PrinterLogic) Insecure Installation Credentials | 9.8v3.1 | 1.2% | 2025-09-29 | Fix |
| CVE-2025-34222 | Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates | 9.1v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-34221 | Vasion Print Virtual Appliance Host Docker bridge network missing authentication | 9.8v3.1 | 1.5% | 2025-09-29 | Fix |
| CVE-2025-34220 | Vasion Print (formerly PrinterLogic) Unauthenticated API leaks group information | 5.3v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-34218 | Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance | 9.8v3.1 | 1.0% | 2025-09-29 | Fix |
| CVE-2025-34216 | Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API | 9.8v3.1 | 0.8% | 2025-09-29 | Fix |
| CVE-2025-34215 | Vasion Print (formerly PrinterLogic) unauthenticated firmware update endpoint RCE | 9.8v3.1 | 1.1% | 2025-09-29 | Fix |
| CVE-2025-34212 | Vasion Print (formerly PrinterLogic) Insecure Build Pipeline | 9.8v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-34211 | Vasion Print (formerly PrinterLogic) Hard-coded SSL Certificate and Private Keys | 4.9NVD v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-34209 | Vasion Print (formerly PrinterLogic) Hard-coded GPG Private Key | 7.2NVD v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-34207 | Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration | 9.8v3.1 | 0.7% | 2025-09-29 | Fix |
| CVE-2025-34196 | Vasion Print (formerly PrinterLogic) Hard-coded PrinterLogic CA Private Key and hard-coded password | 9.8v3.1 | 0.5% | 2025-09-29 | Fix |
| CVE-2025-30247 | Western Digital My Cloud user interface OS command injection | 9.3CNA v4.0 | 1.1% | 2025-09-29 | Fix |
| CVE-2025-11155 | SATO S86-ex 203dpi WEAK ENCODING FOR password IN device server CONFIGURATION | 6.8CNA v4.0 | 0.2% | 2025-09-29 | |
| CVE-2025-11147 | Reflected cross-site scripting (XSS) vulnerability in Apt-Cacher-NG | 5.4v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-11146 | Reflected cross-site scripting (XSS) vulnerability in Apt-Cacher-NG | 5.4v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-11141 | Ruijie NBR2100G-E branch_passw.php listAction os command injection | 5.1CNA v4.0 | 3.8% | 2025-09-29 | |
| CVE-2025-11140 | Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm XML external entity reference | 9.8NVD v3.1 | 0.6% | 2025-09-29 | |
| CVE-2025-11139 | Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal | 9.8NVD v3.1 | 0.7% | 2025-09-29 | |
| CVE-2025-11138 | mirweiye wenkucms common.php createPathOne os command injection | 8.8NVD v3.1 | 4.2% | 2025-09-29 | |
| CVE-2025-11137 | Gstarsoft GstarCAD File Renaming cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-09-29 | |
| CVE-2025-11136 | YiFang CMS Backend File.php webUploader unrestricted upload | 7.2NVD v3.1 | 0.4% | 2025-09-29 | |
| CVE-2025-11135 | pmTicket Project-Management-Software Cookie class.database.php loadLanguage deserialization | 6.9CNA v4.0 | 0.4% | 2025-09-29 | |
| CVE-2025-11134 | Cudy TR1200 Wireless settings config cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-09-29 | |
| CVE-2025-11130 | iHongRen pptp-vpn XPC Service HelperTool.m shouldAcceptNewConnection missing authentication | 8.6CNA v4.0 | 0.2% | 2025-09-29 | |
| CVE-2025-11126 | Apeman ID71 system.ini hard-coded credentials | 9.3CNA v4.0 | 0.6% | 2025-09-29 | |
| CVE-2025-11125 | langleyfcu Online Banking System Error message connection_error.php cross-site scripting | 5.3CNA v4.0 | 0.3% | 2025-09-29 | |
| CVE-2025-10504 | ABB Terra AC wallbox heap memory corruption | 6.9CNA v4.0 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10346 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10345 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10344 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10343 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10342 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-10341 | HTML injection in Perfex CRM | 6.1v3.1 | 0.2% | 2025-09-29 | Fix |
| CVE-2025-9904 | Canon Generic Plus PCL6 Printer Driver incorrect behavior order | 6.9CNA v4.0 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-9903 | Canon Generic Plus UFR II Printer Driver out-of-bounds write | 5.9CNA v4.0 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-9648 | Denial of service in CivetWeb | 8.7CNA v4.0 | 0.8% | 2025-09-29 | Fix |
| CVE-2025-8868 | Chef Automate compliance service SQL injection | 9.8CNA v3.1 | 25.9% | 2025-09-29 | NucleiFix |
| CVE-2025-7698 | Canon Generic Plus UFR II Printer Driver out-of-bounds read | 5.9CNA v4.0 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-7104 | Mass assignment in danny-avila/LibreChat | 7.5NVD v3.1 | 0.3% | 2025-09-29 | Fix |
| CVE-2025-6724 | Chef Automate SQL injection | 8.8CNA v3.1 | 0.4% | 2025-09-29 | Fix |
| CVE-2025-11124 | code-projects Project Monitoring System postjob.php cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-09-28 | |
| CVE-2025-11123 | Tenda AC18 saveAutoQos stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-09-28 | |
| CVE-2025-11122 | Tenda AC18 WizardHandle stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-09-28 | |
| CVE-2025-11121 | Tenda AC18 AdvSetLanip command injection | 8.8NVD v3.1 | 3.7% | 2025-09-28 | |
| CVE-2025-11120 | Tenda AC8 SetServerConfig formSetServerConfig buffer overflow | 8.7CNA v4.0 | 3.7% | 2025-09-28 | Emerging Threats |
| CVE-2025-11119 | itsourcecode Hostel Management System POST request index.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11118 | CodeAstro Student Grading System adminLogin.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11117 | Tenda CH22 GstDhcpSetSer formWrlExtraGet buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-09-28 | |
| CVE-2025-11116 | code-projects Simple Scheduling System add.home.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11115 | code-projects Simple Scheduling System addtime.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11114 | CodeAstro Online Leave Application leaveAplicationForm.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11113 | CodeAstro Online Leave Application signup.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11112 | PHPGurukul Employee Record Management System myprofile.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11111 | Campcodes Advanced Online Voting Management System candidates_edit.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11110 | Campcodes Online Learning Management System school_year.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11109 | Campcodes Computer Sales and Inventory System us_edit.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-28 | |
| CVE-2025-11108 | code-projects Simple Scheduling System addroom.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11107 | code-projects Simple Scheduling System addcourse.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11106 | code-projects Simple Scheduling System addfaculty.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11105 | code-projects Simple Scheduling System addsubject.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11104 | CodeAstro Electricity Billing System bill.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-09-28 | |
| CVE-2025-11103 | Projectworlds Online Tours and Travels change-image.php unrestricted upload | 7.2NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11102 | Campcodes Online Learning Management System edit_content.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11101 | itsourcecode Open Source Job Portal index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11100 | D-Link DIR-823X set_wifi_blacklists uci_set command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11099 | D-Link DIR-823X delete_prohibiting uci_del command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11098 | D-Link DIR-823X set_wifi_blacklists command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11097 | D-Link DIR-823X set_device_name command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11096 | D-Link DIR-823X diag_traceroute command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11095 | D-Link DIR-823X delete_offline_device command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11094 | code-projects E-Commerce Website admin_product_details.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11092 | D-Link DIR-823X set_switch_settings sub_412E7C command injection | 8.8NVD v3.1 | 4.1% | 2025-09-28 | |
| CVE-2025-11091 | Tenda AC21 SetStaticRouteCfg sscanf buffer overflow | 8.7CNA v4.0 | 0.7% | 2025-09-28 | |
| CVE-2025-11090 | itsourcecode Open Source Job Portal index.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-09-28 | |
| CVE-2025-11089 | kidaze CourseSelectionSystem COUNT3s4.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-28 | |
| CVE-2025-11088 | itsourcecode Open Source Job Portal index.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-09-28 | |
| CVE-2025-59945 | SysReptor Susceptible to privilege escalation by Authenticated Users | 8.1CNA v3.1 | 0.3% | 2025-09-27 | Fix |
| CVE-2025-59939 | LabRedesCefetRJ WeGIA ProdutoControle module SQL injection | 8.8CNA v3.1 | 0.4% | 2025-09-27 | Fix |
| CVE-2025-59938 | wazuh heap buffer overflow in wazuh-analysisd | 6.5CNA v3.1 | 0.4% | 2025-09-27 | Fix |
| CVE-2025-59936 | get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass | 9.4CNA v3.0 | 0.4% | 2025-09-27 | Fix |
| CVE-2025-59932 | FlagForgeCTF Unauthenticated Resource Modification/Deletion | 8.6CNA v3.1 | 0.4% | 2025-09-27 | Fix |
| CVE-2025-36239 | IBM Storage TS4500 Library cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-09-27 | Fix |
| CVE-2025-36144 | IBM watsonx.data information disclosure | 3.3CNA v3.1 | 0.1% | 2025-09-27 | Fix |
| CVE-2025-11083 | GNU Binutils Linker elfcode.h elf_swap_shdr heap-based overflow | 7.8NVD v3.1 | 0.3% | 2025-09-27 | Fix |
| CVE-2025-11082 | GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflow | 7.8NVD v3.1 | 0.3% | 2025-09-27 | Fix |
| CVE-2025-11081 | GNU Binutils objdump.c dump_dwarf_section out-of-bounds | 5.5NVD v3.1 | 0.2% | 2025-09-27 | Fix |
| CVE-2025-11080 | zhuimengshaonian wisdom-education ExamInfoController.java improper authorization | 5.3CNA v4.0 | 0.3% | 2025-09-27 | |
| CVE-2025-11079 | Campcodes Farm Management System file information disclosure | 9.8NVD v3.1 | 0.9% | 2025-09-27 | |
| CVE-2025-11078 | itsourcecode Open Source Job Portal controller.php unrestricted upload | 8.8NVD v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11077 | Campcodes Online Learning Management System add_content.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-27 | Exploit code |
| CVE-2025-11076 | Campcodes Online Learning Management System edit_teacher.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11075 | Campcodes Online Learning Management System de_activate.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11074 | code-projects Project Monitoring System login.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11073 | Keyfactor RG-EW5100BE HTTP POST request cmd command injection | 5.1CNA v4.0 | 1.9% | 2025-09-27 | |
| CVE-2025-11071 | SeaCMS Cron Task Management admin_cron.php SQL injection | 7.2v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11070 | Projectworlds Online Shopping System cart_add.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11069 | westboy CicadasCMS Add Department save cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11068 | westboy CicadasCMS save cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11067 | Projectworlds Visitor Management System Add Visitor myform.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11066 | code-projects Online Bidding System bidlist.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11064 | Campcodes Online Learning Management System teachers.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11063 | Campcodes Online Learning Management System edit_department.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11062 | Campcodes Online Learning Management System save_student.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11061 | Campcodes Online Learning Management System edit_student.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11057 | SourceCodester Pet Grooming Management Software print_inv.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11056 | ProjectsAndPrograms School Management System select-students.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-11055 | SourceCodester Online Hotel Reservation System updateaddress.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-27 | |
| CVE-2025-11054 | itsourcecode Open Source Job Portal index.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-11053 | PHPGurukul Small CRM forgot-password.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-11052 | kidaze CourseSelectionSystem COUNT3s5.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-11051 | SourceCodester Pet Grooming Management Software cross-site request forgery | 6.5NVD v3.1 | 0.3% | 2025-09-27 | |
| CVE-2025-11050 | Portabilis i-Educar periodo-lancamento improper authorization | 8.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-11049 | Portabilis i-Educar unificacao-aluno improper authorization | 8.8NVD v3.1 | 0.4% | 2025-09-27 | |
| CVE-2025-10954 | github.com/nyaruka/Phonenumbers vulnerable to improper validation of syntactic correctness of input | 7.5v3.1 | 0.5% | 2025-09-27 | Fix |
| CVE-2025-10499 | Ninja Forms WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-09-27 | Fix |
| CVE-2025-10498 | Ninja Forms WordPress plugin cross-site request forgery | 5.4NVD v3.1 | 0.2% | 2025-09-27 | Fix |
| CVE-2025-9944 | Professional Contact Form WordPress plugin cross-site request forgery to Test email Sending | 4.3CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9899 | Trust Reviews plugin for Google WordPress plugin cross-site request forgery | 6.1CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9898 | cForms Light speed fast Form Builder WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9896 | HidePost WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9894 | Sync Feedly WordPress plugin cross-site request forgery to Sync Trigger | 4.3CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9893 | VM Menu Reorder WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.1% | 2025-09-27 | |
| CVE-2025-9816 | WP Statistics WordPress plugin unauthenticated stored cross-site scripting via User-Agent Header | 7.2CNA v3.1 | 10.2% | 2025-09-27 | Exploit codeFix |
| CVE-2025-8440 | Team Members WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-27 | Fix |
| CVE-2025-8014 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.6% | 2025-09-27 | Fix |
| CVE-2025-7647 | Insecure temporary file Handling in run-llama/llama_index | 7.3CNA v3.0 | 0.1% | 2025-09-27 | Fix |
| CVE-2025-3193 | algoliasearch-helper is vulnerable to prototype pollution in _merge | 7.5v3.1 | 0.5% | 2025-09-27 | Fix |
| CVE-2025-60251 | Unitree Go2 missing authentication | 5.0CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60250 | Unitree Go2 hard-coded cryptographic key | 4.7CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60219 | WooCommerce Designer Pro WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-60186 | Google+ Comments WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60185 | kontur Admin Style WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60184 | SEO Search Permalink WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60181 | Silencesoft RSS Reader WordPress plugin server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60179 | Click and Tweet WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60177 | Recaptcha wp WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60173 | GST for WooCommerce WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60172 | Flytedesk Digital WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60171 | Conditional Cart Messages for WooCommerce WordPress plugin yourplugins cross-site request forgery | 7.1CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60170 | HTACCESS IP Blocker WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60169 | W3SCloud Contact Form 7 to Zoho CRM WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60167 | Page Manager for Elementor WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60166 | WP Subscription Forms PRO WordPress plugin arbitrary content deletion vulnerability | 4.3CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60165 | Frames WordPress theme broken access control | 4.3CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60164 | NewsmanApp WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60163 | bbp topic count WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60162 | Job Board Manager WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60161 | ZoloBlocks WordPress plugin server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60160 | Smart Related Products WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60159 | Nota Fiscal Eletrônica WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60158 | Nota Fiscal Eletrônica WooCommerce WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60157 | WP Ticket Customer Service Software and Support Ticket System WordPress plugin cross-site scripting | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60156 | AR For WordPress plugin cross-site request forgery (CSRF) | 9.6CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60155 | WP Virtual Assistant WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60154 | MWW Disclaimer Buttons WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60153 | Subscribe To Unlock WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-09-26 | |
| CVE-2025-60152 | Subscribe To Unlock WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60150 | Subscribe to Download WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-09-26 | Fix |
| CVE-2025-60149 | Notely WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60148 | Subscribe to Download WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60147 | HT Feed WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60146 | Map Categories to Pages WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60145 | Lenix scss compiler WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60144 | Lenix scss compiler WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60143 | Netgsm WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60142 | Simple Meta Tags WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60141 | The Tribal WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60140 | The Tribal WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60139 | Sendle Shipping WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60138 | SKT Blocks WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60137 | Post Featured Video WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-60136 | User Notes WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60133 | PE Easy Slider WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60130 | WEDOS Global WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60129 | Yext WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60128 | Delisho WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60127 | CopySafe Web Protection WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60126 | Testimonial Slider WordPress plugin local file inclusion | 8.8CNA v3.1 | 0.5% | 2025-09-26 | |
| CVE-2025-60125 | FoodBook WordPress theme sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60124 | Simple Colorbox WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60123 | HivePress Claim Listings WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60122 | HivePress Claim Listings WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60121 | WooEvents WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60120 | WP Directory Kit WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60119 | CoSchedule WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60118 | PGS Core WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60117 | Vehica Core WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60116 | Grand Conference Theme Custom Post Type WordPress plugin broken access control | 8.8v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60115 | Instapage WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60114 | YayCurrency WordPress plugin remote code execution (RCE) | 6.6CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60113 | Groovy Menu WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60112 | aThemes Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60111 | Javo Core WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-60110 | AllInOne - Banner Rotator WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60109 | LambertGroup - AllInOne - Content Slider WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60108 | LambertGroup - AllInOne - Banner with Thumbnails WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60107 | LambertGroup - AllInOne - Banner with Playlist WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60106 | EmailKit WordPress plugin arbitrary content deletion vulnerability | 4.9CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-60105 | Ditty WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60104 | Gallery Custom Links WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60103 | ListingPro WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-60102 | WPFront User Role Editor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60101 | Woostify WordPress theme cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60100 | XStore WordPress theme content injection | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60099 | Embed Any Document WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60098 | Theme My Login WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60097 | TheGem WordPress theme broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60096 | TheGem (Elementor) WordPress theme broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60095 | Stackable WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60094 | Stackable WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60093 | Download Manager WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-60092 | Download Manager WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60040 | wp-mpdf WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-60017 | Unitree Go2 OS command injection | 8.2CNA v3.1 | 1.1% | 2025-09-26 | |
| CVE-2025-59934 | Formbricks missing JWT signature verification | 9.4CNA v3.1 | 9.1% | 2025-09-26 | Exploit codeFix |
| CVE-2025-59845 | apollographql embeddable-explorer Apollo Embedded Sandbox and Explorer vulnerable to CSRF | 8.2CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-59844 | SonarSource sonarqube-scan-action argument injection vulnerability in SonarQube Scan action | 7.7CNA v4.0 | 1.5% | 2025-09-26 | Fix |
| CVE-2025-59843 | FlagForgeCTF exposes User Emails via Public /API/user/[username] API | 6.9CNA v4.0 | 0.4% | 2025-09-26 | Exploit codeFix |
| CVE-2025-59842 | JupyterLab LaTeX typesetter links did not enforce `noopener` attribute | 2.1CNA v4.0 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-59362 | squid-cache squid stack-based buffer overflow | 4.0CISA ADP v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-59012 | Traveler WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-59011 | Traveler WordPress theme arbitrary content deletion vulnerability | 7.5CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-59010 | Permalink Manager Lite WordPress plugin sensitive data exposure | 7.5CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-59002 | BM Content Builder WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-58919 | Wide Banner WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-58917 | Quantities and Units for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-58914 | Di Themes Demo Site Importer WordPress plugin cross-site request forgery (CSRF) to plugin activation | 4.3CNA v3.1 | 0.1% | 2025-09-26 | |
| CVE-2025-58385 | Doxense Watchdoc hard-coded credentials | 7.1CISA ADP v3.1 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-58384 | DOXENSE WATCHDOC .NET Remoting library insecure deserialization | 10.0CISA ADP v3.1 | 0.7% | 2025-09-26 | |
| CVE-2025-57692 | Dotnetfoundation Piranha CMS PiranhaCMS stored XSS | 6.8CISA ADP v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-57292 | Doist Todoist cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-56463 | Mercusys MW305R information disclosure | 6.8CISA ADP v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-56383 | Notepad++ uncontrolled search path | 8.4CISA ADP v3.1 | 0.4% | 2025-09-26 | Exploit code |
| CVE-2025-55848 | D-Link DIR-823X command injection | 8.8CISA ADP v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-55847 | WAVLINK Wl-wn586x3a buffer overflow | 8.8CISA ADP v3.1 | 2.0% | 2025-09-26 | |
| CVE-2025-55187 | DriveLock improper privilege management | 9.9CISA ADP v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-54831 | Apache Airflow: Connection sensitive details exposed to users with read permissions | 6.5CISA ADP v3.1 | 0.9% | 2025-09-26 | Fix |
| CVE-2025-48326 | Acclectic Media Organizer WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-48107 | Uncode WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-45994 | Arandasoft Passrecovery information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-36326 | IBM Controller information disclosure | 3.7CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-36274 | IBM Aspera HTTP Gateway information disclosure | 7.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-35027 | Unitree multiple Robotic Products command injection | 7.3CNA v3.1 | 2.7% | 2025-09-26 | |
| CVE-2025-27006 | Authorsy WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-26258 | Remyandrade Employee Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11060 | Red Hat OpenShift Service Mesh 3 surrealdb: Surrealdb is vulnerable to unauthorized data exposure | 5.7CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-11048 | Portabilis i-Educar consulta-dispensas improper authorization | 8.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11047 | Portabilis i-Educar aluno improper authorization | 8.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11046 | Tencent WeKnora test testEmbeddingModel server-side request forgery | 9.8NVD v3.1 | 0.5% | 2025-09-26 | |
| CVE-2025-11045 | WAYOS LQ_04/LQ_05/LQ_06/LQ_07/LQ_09 usb_paswd.asp command injection | 6.9CNA v4.0 | 2.0% | 2025-09-26 | |
| CVE-2025-11042 | Allocation of resources without limits or throttling in GitLab | 4.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-11041 | itsourcecode Open Source Job Portal index.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-11040 | code-projects Hostel Management System index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11039 | Campcodes Computer Sales and Inventory System us_edit1.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11038 | itsourcecode Online Clinic Management System details.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-11037 | code-projects E-Commerce Website admin_index_search.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-26 | |
| CVE-2025-11036 | code-projects E-Commerce Website admin_account_update.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-09-26 | |
| CVE-2025-11035 | Jinher OA text XML external entity reference | 9.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11034 | Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal | 5.3CNA v4.0 | 0.4% | 2025-09-26 | |
| CVE-2025-11033 | kidaze CourseSelectionSystem COUNT3s7.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11032 | kidaze CourseSelectionSystem COUNT3s6.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11031 | DataTables examples.php path traversal | 6.9CNA v4.0 | 0.8% | 2025-09-26 | Fix |
| CVE-2025-11030 | Tutorials-Website Employee Management System all-applied-leave.php improper authorization | 6.9CNA v4.0 | 0.4% | 2025-09-26 | |
| CVE-2025-11029 | givanz Vvveb cross-site request forgery | 8.8NVD v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-11028 | givanz Vvveb Image information disclosure | 7.5NVD v3.1 | 0.6% | 2025-09-26 | |
| CVE-2025-11027 | givanz Vvveb SVG file cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-11026 | givanz Vvveb Configuration file information disclosure | 7.5NVD v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-11025 | Information disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-11021 | libsoup cookie date parser out-of-bounds read | 7.5CNA v3.1 | 0.6% | 2025-09-26 | Fix |
| CVE-2025-11019 | Total.js CMS files menu cross-site scripting | 4.8NVD v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11018 | Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal | 7.5NVD v3.1 | 1.0% | 2025-09-26 | |
| CVE-2025-11017 | OGRECave Ogre OgreLogManager.cpp stream null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11016 | kalcaddle kodbox index.class.php fileOut path traversal | 5.3CNA v4.0 | 0.5% | 2025-09-26 | |
| CVE-2025-11015 | OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines | 4.8CNA v4.0 | 0.1% | 2025-09-26 | |
| CVE-2025-11014 | OGRECave Ogre Image OgreSTBICodec.cpp encode heap-based overflow | 7.8NVD v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11013 | BehaviorTree XML parser xml_parsing.cpp loadDocImpl null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11012 | BehaviorTree Diagnostic message script_parser.cpp ParseScript stack-based overflow | 7.8v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11011 | BehaviorTree json_export.cpp fromJson null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-11010 | vstakhov libucl ucl_util.c ucl_include_common heap-based overflow | 4.8CNA v4.0 | 0.2% | 2025-09-26 | |
| CVE-2025-11000 | Open Babel PQSformat.cpp ReadMolecule null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10999 | Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10998 | Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10997 | Open Babel chemkinformat.cpp CheckSpecies heap-based overflow | 7.8v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10996 | Open Babel smilesformat.cpp ParseSmiles heap-based overflow | 7.8v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10995 | Open Babel zipstreamimpl.h underflow memory corruption | 7.8v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10994 | Open Babel gamessformat.cpp ReadMolecule use-after-free | 7.8v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10993 | MuYuCMS Template Management admin.php code injection | 7.2v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-10992 | roncoo roncoo-pay lookupList improper authorization | 6.9CNA v4.0 | 0.4% | 2025-09-26 | |
| CVE-2025-10989 | yangzongzhuan RuoYi selectAll improper authorization | 8.8v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-10988 | YunaiV ruoyi-vue-pro transfer improper authorization | 8.8v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-10987 | YunaiV yudao-cloud HTTP request transfer improper authorization | 8.8v3.1 | 0.3% | 2025-09-26 | |
| CVE-2025-10981 | JeecgBoot exportXls improper authorization | 6.5v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-10980 | JeecgBoot exportXls improper authorization | 6.5v3.1 | 0.4% | 2025-09-26 | |
| CVE-2025-10871 | Missing authorization in GitLab | 3.8CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-10868 | Business Logic Errors in GitLab | 3.5CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10867 | Allocation of resources without limits or throttling in GitLab | 3.5CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10858 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.6% | 2025-09-26 | Fix |
| CVE-2025-10752 | OAuth Single Sign On SSO (OAuth Client) WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10747 | WP-DownloadManager WordPress plugin authenticated (Admin+) arbitrary file upload | 7.2CNA v3.1 | 0.7% | 2025-09-26 | Fix |
| CVE-2025-10745 | specialk Banhammer secret key generation insufficient randomness | 5.3CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-10657 | Docker Desktop with ECI fails to Enforce Socket Command Restrictions | 8.7CNA v4.0 | 0.1% | 2025-09-26 | Fix |
| CVE-2025-10544 | Unrestricted uploading of dangerous file types to AvePoint products | 8.6CNA v4.0 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10490 | Zephyr Project Manager WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10377 | System Dashboard WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10307 | Backuply Backup, Restore, Migrate and Clone WordPress plugin arbitrary file deletion | 6.5CNA v3.1 | 0.7% | 2025-09-26 | Fix |
| CVE-2025-10180 | Markdown Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10178 | CM Business Directory WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10173 | ShopEngine Elementor WooCommerce Builder Addon WordPress plugin unauthorized access | 2.7CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-10137 | Snow Monkey WordPress theme unauthenticated blind server-side request forgery | 5.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10136 | TweetThis Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-10037 | Featured Image from URL (FIFU) WordPress plugin authenticated (Admin+) SQL injection | 4.9CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-10036 | Featured Image from URL (FIFU) WordPress plugin authenticated (Admin+) SQL injection | 4.9CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-9985 | Featured Image from URL (FIFU) WordPress plugin unauthenticated information exposure via Log file | 5.3CNA v3.1 | 12.3% | 2025-09-26 | NucleiFix |
| CVE-2025-9984 | Featured Image from URL WordPress plugin missing authorization password Protected post disclosure | 5.3CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-9958 | Insertion of sensitive information into sent data in GitLab | 7.7CNA v3.1 | 0.5% | 2025-09-26 | Fix |
| CVE-2025-9642 | Improper neutralization of input during web page generation (cross-site scripting) in GitLab | 8.7CNA v3.1 | 0.5% | 2025-09-26 | Fix |
| CVE-2025-9490 | Popup Maker WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-9267 | Seagate Toolkit untrusted search path | 7.0CNA v4.0 | 0.3% | 2025-09-26 | Exploit codeFix |
| CVE-2025-9044 | Mapster WP Maps WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-8906 | Widgets for Tiktok Feed WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-8200 | Mega Elements Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-7691 | Privilege defined with unsafe actions in GitLab | 6.5CNA v3.1 | 0.4% | 2025-09-26 | Fix |
| CVE-2025-6396 | XSS in Webbeyaz's web site | 6.1CNA v3.1 | 0.2% | 2025-09-26 | |
| CVE-2025-5069 | Incorrect Ownership Assignment in GitLab | 3.5CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-4957 | ProfileGrid WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-09-26 | Fix |
| CVE-2025-1862 | Authenticated arbitrary file upload in multiple WSO2 Products | 6.7CNA v3.1 | 0.5% | 2025-09-26 | Fix |
| CVE-2025-1396 | Username Enumeration in multiple WSO2 Products with Multi-Attribute Login Enabled | 3.7CNA v3.1 | 0.3% | 2025-09-26 | Fix |
| CVE-2025-60249 | CIRCL vulnerability-Lookup cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-25 | |
| CVE-2025-60019 | Red Hat Enterprise Linux 10 glib-networking: Uninitialized memory dereferences on glib-networking | 3.7CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-60018 | glib-networking OpenSSL backend out-of-bounds read | 4.8CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-59841 | FlagForgeCTF's Improper Session Handling allows Access after Logout | 9.8CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-59839 | Star Citizen EmbedVideo extension stored XSS | 8.6CNA v3.1 | 0.3% | 2025-09-25 | |
| CVE-2025-59838 | Monkeytype Vulnerable to Self-XSS on loading saved custom text | 2.4CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-59834 | Command injection in adb-mcp MCP Server | 9.8CNA v3.1 | 2.5% | 2025-09-25 | |
| CVE-2025-59832 | Horilla ticket comment editor stored cross-site scripting | 9.9CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-59831 | snowyu git-commiters.js `git-comiters` command injection | 8.7CNA v4.0 | 2.3% | 2025-09-25 | Fix |
| CVE-2025-59830 | Rack QueryParser resource exhaustion | 7.5CNA v3.1 | 0.6% | 2025-09-25 | Fix |
| CVE-2025-59823 | Gardener extension provider for AWS Terraformer code injection | 9.9CNA v3.0 | 0.5% | 2025-09-25 | Fix |
| CVE-2025-59817 | Zenitel TCIS-3+ authenticated remote code execution in zForm_auto_config | 8.4CNA v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-59816 | Zenitel ICX500 authenticated Union based SQL-injection in the search input field | 7.3CNA v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-59815 | Zenitel ICX500 authenticated remote code execution in the Billing Administration portal | 8.4CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-59814 | Zenitel ICX500 unauthenticated SQL-injection in password field | 8.8CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-59426 | lobe-chat has an open redirect | 4.3CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-59422 | Dify has broken access control on Log message endpoint allows Reading of Chats of Others | 6.0CNA v4.0 | 0.2% | 2025-09-25 | |
| CVE-2025-59408 | Flock Safety Bravo Compute Box Firmware weak cryptographic algorithm | 7.3CISA ADP v3.1 | 0.3% | 2025-09-25 | |
| CVE-2025-59404 | Flock Safety Bravo Edge AI Compute Device bootloader vulnerability | 7.5CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-59402 | Flock Safety Bravo Edge AI Compute Device EDL/QDL Firehose loader vulnerability | 5.4CISA ADP v3.1 | 0.2% | 2025-09-25 | |
| CVE-2025-57632 | libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses with many chained PDU | 7.5CISA ADP v3.1 | 0.6% | 2025-09-25 | Fix |
| CVE-2025-57623 | TOTOLINK N600R Firmware null pointer dereference | 5.3CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-57446 | O-RAN Near Realtime RIC Subscription Manager API denial of service | 7.5CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-57317 | apidoc-core is vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-56769 | Hutool allows remote code execution (RCE) via the QLExpressEngine class | 6.5CISA ADP v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-55560 | Linux Foundation PyTorch denial of service | 7.5v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-55559 | Google TensorFlow denial of service | 7.5CISA ADP v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-55558 | Linux Foundation PyTorch buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-09-25 | Fix |
| CVE-2025-55557 | Linux Foundation PyTorch uncaught exception | 7.5v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-55556 | Google TensorFlow embedded malicious code | 6.5CISA ADP v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-55554 | Linux Foundation PyTorch integer overflow | 5.3CISA ADP v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-55553 | Linux Foundation PyTorch uncaught exception | 7.5v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-55552 | Linux Foundation PyTorch integer overflow | 7.5v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-55551 | Linux Foundation PyTorch denial of service | 7.5v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-48707 | Stormshield Network Security improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-46153 | Linux Foundation PyTorch bernoulli_p decomposition vulnerability | 5.3CISA ADP v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-46152 | Linux Foundation PyTorch out-of-bounds write | 5.3CISA ADP v3.1 | 0.5% | 2025-09-25 | Fix |
| CVE-2025-46150 | PyTorch FractionalMaxPool2d vulnerability | 5.3CISA ADP v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-46149 | Linux Foundation PyTorch reachable assertion | 5.3CISA ADP v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-46148 | PyTorch PairwiseDistance function vulnerability | 5.3CISA ADP v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-43993 | Dell Wireless 5932e unquoted search path | 7.8CNA v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-43943 | Dell Cloud Disaster Recovery OS command injection | 6.7CNA v3.1 | 0.5% | 2025-09-25 | Fix |
| CVE-2025-43816 | Liferay Portal and DXP vulnerable to a memory leak | 6.9CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-40838 | Ericsson Indoor Connect 8855 insufficiently protected credentials | 5.1CNA v4.0 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-40837 | Ericsson Indoor Connect 8855 missing authorization | 8.7CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-40836 | Ericsson Indoor Connect 8855 improper input validation | 8.7CNA v4.0 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-40698 | SQL injection vulnerability in Prevengos | 8.7CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-36857 | Rapid7 Appspider broken access control | 3.3CNA v3.1 | 0.1% | 2025-09-25 | Fix |
| CVE-2025-36601 | Dell PowerScale OneFS information disclosure | 4.0CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-34227 | Nagios XI Configuration Wizard Authenticated command injection | 8.8v3.1 | 25.4% | 2025-09-25 | Exploit codeFix |
| CVE-2025-33116 | IBM Watson Studio on Cloud Pak for Data cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-29157 | SMARTBEAR Swagger Petstore command injection | 6.5CISA ADP v3.1 | 0.5% | 2025-09-25 | |
| CVE-2025-29156 | SMARTBEAR Swagger Petstore petstore v.1.0.7 cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-29155 | SMARTBEAR Swagger Petstore command injection | 6.5CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-27262 | Ericsson Indoor Connect 8855 improper neutralization of special elements used in an OS command | 8.5CNA v4.0 | 0.7% | 2025-09-25 | Fix |
| CVE-2025-27261 | Ericsson Indoor Connect 8855 improper neutralization of special elements used in an SQL command | 8.7CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-26482 | Dell PowerEdge R770 information disclosure | 4.9CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-26333 | Dell BSAFE Crypto-J information disclosure through error messages | 5.9CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-26278 | Dref is vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-21056 | Samsung Mobile Retail Mode improper input validation | 6.6CNA v3.1 | 0.2% | 2025-09-25 | |
| CVE-2025-20363 | Cisco IOS heap-based buffer overflow | 9.0CNA v3.1 | 6.9% | 2025-09-25 | Reported exploitedFix |
| CVE-2025-20362 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) missing authorization | 6.5CNA v3.1 | 87.1% | 2025-09-25 | KEVNucleiEmerging ThreatsKCVFix |
| CVE-2025-20333 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) buffer overflow | 9.9CNA v3.1 | 71.2% | 2025-09-25 | KEVEmerging ThreatsKCVFix |
| CVE-2025-11005 | TOTOLINK X6000R unauthenticated command injection | 9.8NVD v3.1 | 1.3% | 2025-09-25 | Emerging Threats |
| CVE-2025-10979 | JeecgBoot exportXls improper authorization | 6.5v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-10978 | JeecgBoot Filter exportXls improper authorization | 6.5v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-10977 | JeecgBoot deleteBatch improper authorization | 5.3v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-10976 | JeecgBoot getDepartUserList improper authorization | 5.3v3.1 | 0.4% | 2025-09-25 | |
| CVE-2025-10975 | GuanxingLu vlarl ZeroMQ reasoning_server.py run_reasoning_server deserialization | 5.3CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10974 | giantspatula SewKinect endpoint calculate pickle.loads deserialization | 5.3CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10973 | JackieDYH Resume-management-system show.php SQL injection | 6.9CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10967 | MuFen-mker PHP-Usermm chkuser.php SQL injection | 6.9CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10965 | LazyAGI LazyLLM server.py lazyllm_call deserialization | 5.3CNA v4.0 | 0.4% | 2025-09-25 | |
| CVE-2025-10964 | Wavlink NU516U1 firewall.cgi sub_401B30 command injection | 8.8v3.1 | 6.8% | 2025-09-25 | |
| CVE-2025-10963 | Wavlink NU516U1 firewall.cgi sub_4016F0 command injection | 8.8v3.1 | 6.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10962 | Wavlink NU516U1 SetName wireless.cgi sub_403198 command injection | 8.8v3.1 | 6.8% | 2025-09-25 | |
| CVE-2025-10961 | Wavlink NU516U1 Delete_Mac_list wireless.cgi sub_4030C0 command injection | 8.0v3.1 | 8.1% | 2025-09-25 | Emerging Threats |
| CVE-2025-10960 | Wavlink NU516U1 DeleteMac wireless.cgi sub_402D1C command injection | 8.8v3.1 | 6.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10959 | Wavlink NU516U1 firewall.cgi sub_401778 command injection | 8.8v3.1 | 6.6% | 2025-09-25 | Emerging Threats |
| CVE-2025-10958 | Wavlink NU516U1 AddMac wireless.cgi sub_403010 command injection | 8.8v3.1 | 6.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10957 | Unrestricted FTP Access vulnerability in Syrotech Router | 8.7CNA v4.0 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-10953 | UTT 1200GW/1250GW formApMail buffer overflow | 8.7CNA v4.0 | 4.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10952 | geyang ml-logger file server.py stream_handler information disclosure | 6.9CNA v4.0 | 0.5% | 2025-09-25 | Exploit code |
| CVE-2025-10951 | geyang ml-logger server.py log_handler path traversal | 6.9CNA v4.0 | 0.6% | 2025-09-25 | |
| CVE-2025-10950 | geyang ml-logger Ping server.py log_handler deserialization | 5.3CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10949 | Changsha Developer Technology iView Editor Markdown cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10948 | MikroTik RouterOS libjson.so print parse_json_element buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10947 | Sistemas Pleno Gestão de Locação CPF validarCpf authorization | 6.9CNA v4.0 | 0.4% | 2025-09-25 | |
| CVE-2025-10946 | nuz007 smsboom dy.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10945 | nuz007 smsboom d.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10944 | yi-ge get-header-ip ip.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10943 | MikeCen WeChat-Face-Recognition wx.php valid cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-09-25 | |
| CVE-2025-10942 | H3C Magic B3 aspForm EditMacList buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-09-25 | Emerging Threats |
| CVE-2025-10941 | Topaz SERVCore Teller Installer SERVCoreTeller_2..msi permission | 8.5CNA v4.0 | 0.1% | 2025-09-25 | |
| CVE-2025-10940 | Total.js CMS Layout admin layouts_save cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-09-25 | |
| CVE-2025-10911 | Red Hat Enterprise Linux 10 libxslt: Use-after-free with key data stored cross-rvt | 5.5CNA v3.1 | 0.2% | 2025-09-25 | Fix |
| CVE-2025-10880 | Insufficiently protected credentials in Dingtian DT-R002 | 7.5v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-10879 | Insufficiently protected credentials in Dingtian DT-R002 | 5.3NVD v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-10542 | Insecure default Admin Credentials Enable Full Administrative Access in iMonitor EAM | 9.8CISA ADP v3.1 | 0.7% | 2025-09-25 | |
| CVE-2025-10541 | Local privilege escalation via Insecure Update Mechanism in iMonitor EAM | 7.8CISA ADP v3.1 | 0.2% | 2025-09-25 | |
| CVE-2025-10540 | Unencrypted and Unauthenticated Communication allows data exposure and Manipulation in iMonitor EAM | 6.5CISA ADP v3.1 | 0.1% | 2025-09-25 | |
| CVE-2025-10467 | Stored XSS in Proliz Software's OBS | 8.9CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-10449 | Path traversal in Saysis Computer Systems' Saysis Web Portal | 8.6CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-10438 | Path traversal in Yordam BT's Yordam Katalog | 8.6CNA v3.1 | 0.4% | 2025-09-25 | Fix |
| CVE-2025-5494 | Zoho Endpoint Central privilege escalation | 3.9CNA v3.1 | 0.3% | 2025-09-25 | Fix |
| CVE-2025-60020 | NNCP relative path traversal | 6.4CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-59833 | FlagForgeCTF Hint Exposure via API | 7.5CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-59828 | anthropics claude-code Claude Code vulnerable to arbitrary code execution | 7.7CNA v4.0 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-59827 | FlagForgeCTF is missing authorization in main-v2 | 8.2CNA v3.0 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-59824 | Omni Wireguard SideroLink potential escape | 0.5CNA v4.0 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-59525 | Horilla has Improper Input Sanitization leading to XSS and admin account takeover | 7.7CNA v4.0 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-59524 | Horilla stored XSS vulnerability via file upload in Reimbursement Panel | 7.7CNA v4.0 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-59343 | tar-fs path traversal | 8.7CNA v4.0 | 0.6% | 2025-09-24 | Fix |
| CVE-2025-59305 | langfuse background migration endpoints improper authorization | 7.6CISA ADP v3.1 | 0.3% | 2025-09-24 | |
| CVE-2025-59251 | Microsoft Edge (Chromium-based) remote code execution | 7.6CNA v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-58457 | Apache ZooKeeper: Insufficient permission Check in AdminServer Snapshot/Restore commands | 4.3CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-58319 | File Parsing memory corruption in CNCSoft-G2 | 7.8CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-58317 | File Parsing memory corruption in CNCSoft-G2 | 7.8CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-57354 | Counterpart vulnerable to prototype pollution | 6.5CISA ADP v3.1 | 0.5% | 2025-09-24 | |
| CVE-2025-57353 | Messageformat prototype pollution | 5.3CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-57352 | Min-document vulnerable to prototype pollution | 5.3CISA ADP v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-57351 | Ts-fns has prototype pollution | 6.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57350 | Csvtojson has a prototype pollution | 8.6CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-57349 | Messageformat has a prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-57348 | Node-cube vulnerable to prototype pollution | 6.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57347 | TBO47 Dagre-d3-es prototype pollution | 9.8CISA ADP v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-57330 | Web3-core-subscriptions has a prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57329 | Web3-core-method is vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57328 | Toggle-array vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57327 | Spmrc vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57326 | Sassdoc-extras vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57325 | Rollbar vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-57324 | Parse is vulnerable to prototype pollution | 6.5CISA ADP v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-57323 | Mpregular vulnerable to prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57321 | Magix-combine-ex vulnerable to prototype pollution | 9.8CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57320 | Json-schema-editor-visual vulnerable to prototype pollution | 6.5CISA ADP v3.1 | 0.3% | 2025-09-24 | |
| CVE-2025-57319 | fast-redact nestedRestore function prototype pollution | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-57318 | Csvjson vulnerable to prototype injection | 7.5CISA ADP v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-56819 | running-elephant Datart OS command injection | 9.8CISA ADP v3.1 | 3.2% | 2025-09-24 | NucleiExploit code |
| CVE-2025-56816 | running-elephant Datart path traversal | 8.8CISA ADP v3.1 | 1.4% | 2025-09-24 | |
| CVE-2025-56815 | running-elephant Datart path traversal | 7.1CISA ADP v3.1 | 0.6% | 2025-09-24 | |
| CVE-2025-56241 | Aztech DSL5005EN firmware sysAccess.asp vulnerability | 7.5CISA ADP v3.1 | 6.7% | 2025-09-24 | Exploit code |
| CVE-2025-55322 | Microsoft OmniParser remote code execution | 7.3CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-55178 | Llama Stack could potentially allow for remote code execution | 5.3CISA ADP v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-54520 | Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platform resulting in a loss of confidentiality. | 8.6CNA v4.0 | 0.2% | 2025-09-24 | |
| CVE-2025-52907 | TOTOLINK X6000R improper input validation | 8.8NVD v3.1 | 0.8% | 2025-09-24 | |
| CVE-2025-52906 | TOTOLINK X6000R command injection | 9.8NVD v3.1 | 12.8% | 2025-09-24 | Emerging Threats |
| CVE-2025-48869 | Horilla unauthorized access to Candidate Resume files due to broken access control | 7.5CNA v3.1 | 0.4% | 2025-09-24 | |
| CVE-2025-48868 | Horilla vulnerable to authenticated RCE via eval in project_bulk_archive | 7.2CNA v3.1 | 2.5% | 2025-09-24 | Exploit code |
| CVE-2025-48867 | Horilla stored cross-site scripting (XSS) vulnerability in Project and Task modules | 4.8CNA v3.1 | 0.2% | 2025-09-24 | |
| CVE-2025-48459 | Apache IoTDB: Deserialization of untrusted data | 5.3v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-48392 | Apache IoTDB resource exhaustion | 7.5v3.1 | 0.6% | 2025-09-24 | Fix |
| CVE-2025-47329 | Qualcomm Snapdragon release of invalid pointer or reference in Android Core | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-47328 | Qualcomm Snapdragon buffer over-read in WLAN HAL | 7.5CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-47327 | Qualcomm Snapdragon use-after-free in Camera | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-47326 | Qualcomm Snapdragon buffer over-read in WLAN HAL | 7.5CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-47318 | Qualcomm Snapdragon buffer over-read in BT controller | 7.5CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-47317 | Qualcomm Snapdragon buffer over-read in BT controller | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-47316 | Qualcomm Snapdragon double free in Video | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-47315 | Qualcomm Snapdragon use-after-free in Automotive software platform based on QNX | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-47314 | Qualcomm Snapdragon improper input validation in Automotive software platform based on QNX | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-43819 | Liferay Portal and DXP does not properly expire sessions | 5.3CNA v4.0 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-43779 | Liferay Portal reflected cross-site scripting | 6.9CNA v4.0 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-41716 | WAGO Solution Builder Unauthenticated User Enumeration via missing authentication | 5.3CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-41715 | WAGO Device Sphere missing authentication for Database Access in Web application | 9.8CNA v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-39890 | Linux kernel ath12k Wi-Fi driver memory leak | 5.5v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-39889 | Linux kernel Bluetooth L2CAP inadequate encryption strength | 8.1CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27077 | Qualcomm Snapdragon use-after-free in Automotive software platform based on QNX | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27037 | Qualcomm Snapdragon use-after-free in Camera driver | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27036 | Qualcomm Snapdragon buffer over-read in Video | 6.1CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27034 | Qualcomm Snapdragon improper validation of array index in Multi-Mode Call Processor | 9.8CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-27033 | Qualcomm Snapdragon buffer over-read in Video | 6.1CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27032 | Qualcomm Snapdragon hypervisor improper access control | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-27030 | Qualcomm Snapdragon buffer over-read in Audio | 6.1CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-23354 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23353 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23349 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23348 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23346 | NVIDIA CUDA Toolkit null pointer dereference | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23340 | NVIDIA CUDA Toolkit out-of-bounds read | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23339 | NVIDIA CUDA Toolkit stack-based buffer overflow | 3.3CNA v3.1 | 0.4% | 2025-09-24 | Exploit codeFix |
| CVE-2025-23338 | NVIDIA CUDA Toolkit improper array index validation | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23308 | NVIDIA CUDA Toolkit heap-based buffer overflow | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23275 | NVIDIA CUDA Toolkit out-of-bounds write | 4.2CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-23274 | NVIDIA nvJPEG out-of-bounds read | 4.5CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-23273 | NVIDIA CUDA Toolkit divide by zero | 2.5CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-23272 | NVIDIA nvJPEG out-of-bounds read | 5.7CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23271 | NVIDIA CUDA Toolkit out-of-bounds read | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23255 | NVIDIA CUDA Toolkit out-of-bounds read | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-23248 | NVIDIA CUDA Toolkit out-of-bounds read | 3.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-21488 | Qualcomm Snapdragon buffer over-read in Data Network Stack and Connectivity | 8.2CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-21487 | Qualcomm Snapdragon buffer over-read in Data Network Stack and Connectivity | 8.2CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-21484 | Qualcomm Snapdragon buffer over-read in Data Network Stack and Connectivity | 8.2CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-21483 | Qualcomm Snapdragon RTP packet reassembly memory corruption | 9.8CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-21482 | Qualcomm Snapdragon RSA PKCS padding decoding cryptographic weakness | 7.1CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-21481 | Qualcomm Snapdragon buffer copy without checking size of input in HLOS | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-21476 | Qualcomm Snapdragon buffer copy without checking size of input in Computer Vision | 7.8CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-20365 | Cisco Aironet Access Point Software IPv6 router advertisement processing vulnerability | 4.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20364 | Cisco Aironet Access Point Software (IOS XE Controller) origin validation error | 4.3CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-20352 | Cisco IOS and IOS XE Software SNMP denial of service and remote code execution | 7.7CNA v3.1 | 41.5% | 2025-09-24 | KEVEmerging ThreatsFix |
| CVE-2025-20339 | Cisco SD-WAN vEdge Software Access Control List Bypass vulnerability | 5.8CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-20338 | Cisco IOS XE Software arbitrary command execution | 6.0CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20334 | Cisco IOS XE Software command injection | 8.8CNA v3.1 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-20327 | Cisco IOS improper type validation | 7.7CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-20316 | Cisco IOS XE Software improper access control | 5.3CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-20315 | Cisco IOS XE Software buffer access with incorrect length | 8.6CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-20314 | Cisco IOS XE Software improper input validation | 6.7CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20313 | Cisco IOS XE Software path traversal | 6.7CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20312 | Cisco IOS XE Software infinite loop | 7.7CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-20311 | Cisco IOS XE Software Ethernet frame handling denial of service | 7.4CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20293 | Cisco IOS XE Software incomplete cleanup | 5.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-20240 | Cisco IOS XE Software reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-20160 | Cisco IOS improper authentication | 8.1CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-20149 | Cisco IOS buffer overflow | 6.5CNA v3.1 | 0.1% | 2025-09-24 | Fix |
| CVE-2025-10909 | Mangati NovoSGA SVG file admin cross-site scripting | 2.1CISA ADP v3.1 | 0.3% | 2025-09-24 | |
| CVE-2025-10906 | Magnetism Studios Endurance NSXPC helper service missing authentication | 8.6CNA v4.0 | 0.2% | 2025-09-24 | |
| CVE-2025-10894 | Red Hat Multicluster Global Hub nx: Nx/devkit: Malicious versions of nx and plugins published to npm | 9.6CNA v3.1 | 0.6% | 2025-09-24 | Exploit code |
| CVE-2025-10892 | Google Chrome V8 integer overflow | 8.8v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-10891 | Google Chrome V8 integer overflow | 8.8CISA ADP v3.1 | 6.9% | 2025-09-24 | Fix |
| CVE-2025-10890 | Google Chrome V8 side-channel information leak | 9.1CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-10585 | Google Chromium V8 type confusion | 9.8NVD v3.1 | 5.4% | 2025-09-24 | KEVFix |
| CVE-2025-10502 | Google Chrome ANGLE heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-10501 | Google Chrome WebRTC use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-10500 | Google Chrome Dawn use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-10360 | Insufficiently protected credentials in Puppet Enterprise and | 6.9CNA v4.0 | 0.2% | 2025-09-24 | |
| CVE-2025-9353 | Themify Builder WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-09-24 | Fix |
| CVE-2025-9054 | MultiLoca WordPress plugin unauthorized access | 9.8CNA v3.1 | 0.4% | 2025-09-24 | Fix |
| CVE-2025-9031 | Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web | 4.3CNA v3.1 | 0.2% | 2025-09-24 | Fix |
| CVE-2025-8869 | Fallback tar extraction in pip doesn't check symbolic links point to extraction directory | 5.9CNA v4.0 | 0.5% | 2025-09-24 | Fix |
| CVE-2025-59826 | FlagForgeCTF vulnerable to Unauthorized Problem Creation | 7.6CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59825 | astral-sh tokio-tar astral-tokio-tar has a path traversal in tar extraction | 6.1CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59822 | Http4s vulnerable to HTTP request smuggling due to improper handling of HTTP trailer section | 6.3CNA v4.0 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-59821 | dnnsoftware Dnn.Platform DNN vulnerable to reflected cross-site scripting (XSS) using URL to profile | 6.5CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59548 | dnnsoftware Dnn.Platform DNN vulnerable to reflected cross-site scripting in CKEditor File Browser | 5.9CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59547 | DNN Platform CKEditor file uploader vulnerability | 5.3CNA v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-59546 | dnnsoftware Dnn.Platform DNN vulnerable to stored XSS using Backend Admin Credentials | 2.4CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59545 | dnnsoftware Dnn.Platform DNN vulnerable to stored cross-site scripting (XSS) in the Prompt module | 9.1CNA v3.1 | 0.5% | 2025-09-23 | Fix |
| CVE-2025-59539 | dnnsoftware Dnn.Platform DNN affected by stored cross-site scripting in Profile Biography field | 6.3CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59534 | CryptoLib command injection vulnerability in initialize_kerberos_keytab_file_login | 7.3CNA v3.1 | 0.9% | 2025-09-23 | Fix |
| CVE-2025-59484 | AutomationDirect CLICK PLUS use of a broken or risky cryptographic algorithm | 8.7CNA v4.0 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-58915 | Request a Quote WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-58674 | WordPress core (Author+) cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-58473 | AutomationDirect CLICK PLUS improper resource shutdown or release | 8.2CNA v4.0 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-58354 | kata-containers kata Containers coco-tdx malicious host can circumvent initdata verification | 6.9CNA v4.0 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-58246 | WordPress core (Contributor+) sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-58069 | AutomationDirect CLICK PLUS use of hard-coded cryptographic key | 6.9CNA v4.0 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-57882 | AutomationDirect CLICK PLUS improper resource shutdown or release | 8.2CNA v4.0 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-57639 | Tenda AC9 OS command injection | 6.5CISA ADP v3.1 | 1.0% | 2025-09-23 | |
| CVE-2025-57638 | Tenda AC9 buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-57637 | D-Link Di-7100g buffer overflow | 7.5CISA ADP v3.1 | 0.7% | 2025-09-23 | |
| CVE-2025-57636 | D-Link Di-7100g OS command injection | 6.5CISA ADP v3.1 | 1.1% | 2025-09-23 | |
| CVE-2025-57407 | GP247 and S-Cart have a stored cross-site scripting (XSS) | 5.4CISA ADP v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-56394 | free5gc heap-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-56311 | C-Data FD602GW-DX-R410 firmware reboot endpoint cross-site request forgery | 6.5CISA ADP v3.1 | 0.1% | 2025-09-23 | Exploit code |
| CVE-2025-56304 | YzmCMS cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-09-23 | |
| CVE-2025-56146 | Indian Bank IndSMART Android app NuWebViewActivity improper certificate validation | 5.3CISA ADP v3.1 | 0.2% | 2025-09-23 | |
| CVE-2025-55780 | Artifex MuPDF function break_word_for_overflow_wrap null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2025-09-23 | Exploit codeFix |
| CVE-2025-55069 | AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator | 8.7CNA v4.0 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-55038 | AutomationDirect CLICK PLUS missing authorization | 7.6CNA v4.0 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-54855 | AutomationDirect CLICK PLUS cleartext storage of sensitive information | 4.1CNA v4.0 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-54081 | LizardByte Sunshine SunshineService unquoted search path | 6.7CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-52905 | TOTOLINK X6000R argument injection | 7.5NVD v3.1 | 8.1% | 2025-09-23 | |
| CVE-2025-51005 | Broadcom tcpreplay heap-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-45326 | Magdesign Pocketvj Control Panel command injection | 6.5CISA ADP v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-42907 | Server-side request forgery in SAP BI Platform | 4.3CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39888 | Linux kernel FUSE out-of-bounds write | 7.8CNA v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39887 | Linux kernel osnoise tracer null pointer dereference | 5.5v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39886 | Linux kernel BPF timer vulnerability | 5.5v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39885 | Linux kernel OCFS2 fiemap deadlock | 5.5v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39884 | Linux kernel Btrfs inode cache race condition | 4.7v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39883 | Linux kernel memory failure handling out-of-bounds read | 7.1v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39882 | Linux kernel MediaTek DRM driver use-after-free | 8.4CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39881 | Linux kernel kernfs file polling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39880 | Linux kernel libceph messenger incorrect type conversion | 9.8CNA v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-39879 | Linux kernel Ceph client null pointer dereference | 5.5NVD v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39878 | Linux kernel Ceph client null pointer dereference | 5.5NVD v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39877 | Linux kernel DAMON sysfs interface use-after-free | 7.8v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39876 | Linux kernel FEC Ethernet driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39875 | Linux kernel igb Ethernet driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39874 | Linux kernel macsec feature synchronization vulnerability | 5.5v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-39873 | Linux kernel Xilinx CAN driver frame transmission use-after-free | 7.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39872 | Linux kernel HSR port device lookup use-after-free | 7.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39871 | Linux kernel idxd driver device removal use-after-free | 7.8NVD v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39870 | Linux kernel idxd driver work queue setup double free | 7.8v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39869 | Linux kernel TI eDMA driver queue priority map vulnerability | 8.4CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-39868 | Linux kernel erofs filesystem DAX unmount handling vulnerability | 7.8CNA v3.1 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-29084 | CSZ CMS CSZ-CMS v.1.3.0 SQL injection | 6.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-29083 | CSZ CMS CSZ-CMS v.1.3.0 SQL injection | 6.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-26399 | SolarWinds Web Help Desk deserialization of untrusted data | 9.8CNA v3.1 | 90.1% | 2025-09-23 | KEVNucleiFix |
| CVE-2025-10857 | Campcodes Point Of Sale System POS login.php SQL injection | 9.8v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10851 | Campcodes Gym Management System ajax.php SQL injection | 9.8v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10848 | Campcodes Society Membership Information System check_student.php SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10846 | Portabilis i-Educar edit SQL injection | 8.8NVD v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10845 | Portabilis i-Educar view SQL injection | 8.8NVD v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10844 | Portabilis i-Educar aluno SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10843 | Reservation Online Hotel Reservation System paypalpayout.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10842 | code-projects Online Bidding System wew.php SQL injection | 9.8v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10841 | code-projects Online Bidding System weweee.php SQL injection | 9.8v3.1 | 0.6% | 2025-09-23 | |
| CVE-2025-10840 | SourceCodester Pet Grooming Management Software print-payment.php SQL injection | 8.8NVD v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10839 | SourceCodester Pet Grooming Management Software inv-print.php SQL injection | 8.8NVD v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10838 | Tenda AC21 WifiExtraSet sub_45BB10 buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-09-23 | Emerging Threats |
| CVE-2025-10837 | code-projects Simple Food Ordering System order.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-09-23 | |
| CVE-2025-10836 | SourceCodester Pet Grooming Management Software print1.php SQL injection | 9.8v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10835 | SourceCodester Pet Grooming Management Software view_payorder.php SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10834 | itsourcecode Open Source Job Portal login.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10833 | 1000projects Bookstore Management System login.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10832 | SourceCodester Pet Grooming Management Software fetch_product_details.php SQL injection | 9.8v3.1 | 0.5% | 2025-09-23 | |
| CVE-2025-10831 | Campcodes Computer Sales and Inventory System pro_edit1.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10830 | Campcodes Computer Sales and Inventory System inv_edit1.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10829 | Campcodes Computer Sales and Inventory System sup_edit1.php SQL injection | 9.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10828 | SourceCodester Pet Grooming Management Software edit.php SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10827 | PHPJabbers Restaurant Menu Maker preview.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10826 | Campcodes Online Beauty Parlor Management System sales-reports-detail.php SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10825 | Campcodes Online Beauty Parlor Management System view-appointment.php SQL injection | 8.8v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10824 | axboe fio init.c __parse_jobs_ini use-after-free | 4.8CNA v4.0 | 0.1% | 2025-09-23 | |
| CVE-2025-10823 | axboe fio options.c str_buffer_pattern_cb null pointer dereference | 4.8CNA v4.0 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-10822 | fuyang_lipengjun platform queryAll SysSmsLogController improper authorization | 5.3CNA v4.0 | 0.4% | 2025-09-23 | |
| CVE-2025-10548 | Missing certificate validation in CleverControl Installer allows remote code execution | 6.5CISA ADP v3.1 | 0.4% | 2025-09-23 | |
| CVE-2025-10412 | MooMoo Product Options and Price Calculation Formulas for WooCommerce unrestricted file upload | 9.8CNA v3.1 | 0.6% | 2025-09-23 | Fix |
| CVE-2025-10380 | Advanced Views Display Posts, Custom Fields, and More WordPress plugin remote code execution | 8.8CNA v3.1 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-10244 | Autodesk Fusion HTML Payload stored cross-site scripting (XSS) | 8.7CNA v3.1 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-10184 | OnePlus OxygenOS Telephony provider permission bypass | 8.2CNA v4.0 | 3.8% | 2025-09-23 | Exploit code |
| CVE-2025-10147 | Podlove Podcast Publisher WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 0.9% | 2025-09-23 | Exploit codeFix |
| CVE-2025-9966 | Novakon P series (P07 execution with unnecessary privileges | 7.3CNA v4.0 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-9965 | Novakon P series (P07 UDP service weak authentication | 9.3CNA v4.0 | 0.5% | 2025-09-23 | Fix |
| CVE-2025-9964 | Novakon P series (P07 weak authentication for Root User | 8.6CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-9963 | Novakon P series (P07 path traversal | 9.4CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-9962 | Novakon P series (P07 unauthenticated buffer overflow | 10.0CNA v4.0 | 1.1% | 2025-09-23 | Fix |
| CVE-2025-9900 | Red Hat Enterprise Linux 10 Libtiff: Libtiff write-what-where | 8.8CNA v3.1 | 1.0% | 2025-09-23 | Fix |
| CVE-2025-9846 | Unrestricted file upload in TaletSys Inka.Net | 10.0CNA v3.1 | 1.0% | 2025-09-23 | Fix |
| CVE-2025-9844 | Salesforce CLI uncontrolled search path | 8.8CISA ADP v3.1 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-9798 | Stored XSS in Netcad Software's Netigma | 8.9CNA v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-9588 | OS command injection in Iron Mountain's enVision | 9.8v3.1 | 1.1% | 2025-09-23 | Fix |
| CVE-2025-9495 | Viessmann Vitogate 300 authentication bypass | 8.7CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-9494 | Viessmann Vitogate 300 OS command injection | 8.5CNA v4.0 | 0.7% | 2025-09-23 | Fix |
| CVE-2025-9342 | IDOR in Anadolu Hayat Emeklilik's AHE Mobile | 6.5CNA v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-9321 | WPCasa WordPress plugin unauthenticated code injection | 9.8CNA v3.1 | 0.8% | 2025-09-23 | Fix |
| CVE-2025-8902 | Widget Options - Extended WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-8410 | RTI Connext Professional use-after-free | 5.8CNA v4.0 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-8354 | Autodesk Revit RFA File Parsing type confusion | 7.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-8282 | SureForms WordPress plugin Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-7106 | Authorization bypass due to Incorrect Access Control in danny-avila/LibreChat | 5.3v3.1 | 0.3% | 2025-09-23 | Fix |
| CVE-2025-6921 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 7.5v3.1 | 0.5% | 2025-09-23 | Fix |
| CVE-2025-5717 | Authenticated remote code execution in multiple WSO2 Products via Event Processor Admin service | 6.8CNA v3.1 | 0.7% | 2025-09-23 | Fix |
| CVE-2025-4993 | Untrusted pointer dereference vulnerability in RTI Connext Professional allows Pointer Manipulation | 8.3CNA v4.0 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-4760 | Authenticated stored cross-site scripting in multiple WSO2 Products | 4.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-4582 | RTI Connext Professional Core Libraries buffer over-read | 4.8CNA v4.0 | 0.1% | 2025-09-23 | Fix |
| CVE-2025-1255 | Untrusted pointer dereference vulnerability in RTI Connext Professional allows Pointer Manipulation | 8.3CNA v4.0 | 0.4% | 2025-09-23 | Fix |
| CVE-2025-1131 | Asterisk Unsafe Shell Sourcing in safe_asterisk leads to local privilege escalation | 7.8v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-0672 | Authentication bypass in multiple WSO2 Products via Stale FIDO Credential Association | 3.3CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-0663 | Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products | 6.8CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-0209 | Reflected cross-site scripting (XSS) in WSO2 Identity Server Account Registration Flow | 6.1CNA v3.1 | 0.2% | 2025-09-23 | Fix |
| CVE-2025-59801 | Artifex GhostXPS stack-based buffer overflow | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59800 | Artifex Ghostscript integer overflow | 5.5v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59799 | Artifex Ghostscript stack-based buffer overflow | 5.5v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59798 | Artifex Ghostscript stack-based buffer overflow | 5.5v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59797 | Profession Fit forced browsing | 5.8CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-59592 | Fernando Acosta Make Column Clickable Elementor plugin stored cross-site scripting | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59591 | wpDiscuz WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59590 | Media Library Assistant WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59589 | Soledad WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59588 | Soledad WordPress theme local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59587 | Penci Shortcodes and Performance WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59586 | Penci Portfolio WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59585 | Penci Recipe WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59584 | Penci Podcast WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59583 | Penci Filter Everything WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59582 | Ajax Load More WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.7% | 2025-09-22 | NucleiFix |
| CVE-2025-59581 | Ibtana WordPress plugin arbitrary content deletion vulnerability | 6.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-59577 | MasterStudy LMS WordPress plugin race condition | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59576 | MasterStudy LMS WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59574 | WP Travel Engine WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59573 | Cozy Blocks WordPress plugin content injection | 5.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59572 | WorkScout-Core WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59570 | Mail Mint WordPress plugin SQL injection | 7.6CNA v3.1 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59569 | CubeWP WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59568 | Zoho Flow WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-59567 | Coupon Affiliates WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59565 | Upsell Order Bump Offer for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59562 | Academy LMS WordPress plugin insecure direct object references (IDOR) | 5.5CNA v3.1 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59561 | Smart Blocks WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59559 | Payrexx Payment Gateway for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59553 | Custom iFrame for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59552 | Save as PDF WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59551 | Revive.so WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59549 | GetResponse Forms WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59535 | dnnsoftware Dnn.Platform inclusion of untrusted functionality | 6.5CNA v3.1 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59532 | Codex has sandbox bypass due to bug in path configuration logic | 8.6CNA v4.0 | 0.9% | 2025-09-22 | Exploit codeFix |
| CVE-2025-59528 | Flowise has remote code execution | 10.0CNA v3.1 | 86.2% | 2025-09-22 | Reported exploitedNucleiMetasploitExploit codeKCVFix |
| CVE-2025-59527 | FlowiseAI/Flowise has server-side request forgery (SSRF) | 7.5CNA v3.1 | 5.0% | 2025-09-22 | Fix |
| CVE-2025-59526 | Mailgen: HTML injection vulnerability in plaintext e-mails | 2.7CNA v4.0 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59434 | Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript function | 9.6CNA v3.1 | 3.4% | 2025-09-22 | |
| CVE-2025-59433 | @conventional-changelog/git-client has an argument injection | 5.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59432 | Timing Attack vulnerability in SCRAM Authentication | 6.6CNA v4.0 | 0.7% | 2025-09-22 | Fix |
| CVE-2025-59430 | FrontFin mesh-web-sdk mesh Connect JS SDK vulnerable to cross-site scripting via createLink.openLink | 8.2CNA v3.1 | 0.5% | 2025-09-22 | Fix |
| CVE-2025-59420 | Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) | 7.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-59418 | GSYT Productions BunnyPad file opening buffer overflow | 5.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-59413 | CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe parameter | 6.5CNA v3.1 | 0.4% | 2025-09-22 | Fix |
| CVE-2025-59412 | CubeCart vulnerable to HTML injection in Product Reviews allows Malicious Links and Defacement | 5.4CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-59411 | CubeCart Stored/reflected HTML injection vulnerability in Contact Enquiry | 5.4CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-59335 | CubeCart Session not Invalidated after Password Change | 7.1CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58992 | Product Catalog Simple WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58974 | WPComplete WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58973 | Easy Elementor Addons WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-09-22 | Fix |
| CVE-2025-58969 | Custom Login URL WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58968 | MaxiBlocks WordPress plugin broken access control | 5.0CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58965 | Fusion Page Builder: Extension Gallery WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58962 | Publitio WordPress plugin server side request forgery (SSRF) | 6.4CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58960 | IP Based Login WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58957 | VPSUForm WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58956 | WP Attractive Donations System WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58704 | WP Delete User Accounts WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58703 | Skyword API WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58702 | MarketKing WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58691 | Genesis Club Lite WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58690 | Doliconnect WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58689 | Tapfiliate WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58688 | Casengo Live Chat Support WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58687 | Current Age WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58686 | Perfect Brands for WooCommerce WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58685 | Cecabank WooCommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58684 | Logo Showcase WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58683 | Last Updated Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58682 | Kama Click Counter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58681 | Easy Quotes WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58680 | Gutentor WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58679 | AppMySite WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58678 | Accordion WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58677 | ShrinkTheWeb (STW) Website Previews WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58676 | HORIZONTAL SLIDER WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58675 | Interact: Embed A Quiz On Your Site WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58673 | WP User Frontend WordPress plugin content injection | 5.4CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58672 | WP User Frontend WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58671 | Auction Feed WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58670 | WP Content Protection WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58669 | Magento 2 WordPress Integration plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58668 | WPLMS WordPress theme broken access control | 9.8v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58667 | ListingPro Reviews WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58666 | Website Chat Button: Kommo integration WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58665 | Form Generator for WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58664 | Text To Speech TTS Accessibility WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58663 | Qubely WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58662 | Awesome Support WordPress plugin deserialization of untrusted data | 7.2CNA v3.1 | 0.5% | 2025-09-22 | Fix |
| CVE-2025-58661 | eZee Online Hotel Booking Engine WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58660 | Oshine Core WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58659 | Helpie FAQ WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58658 | Proof Factor Social Proof Notifications WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58657 | Grid WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58656 | Estonian Shipping Methods for WooCommerce WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58655 | Category Featured Images WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58654 | xili-language WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58653 | JSM file_get_contents Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58652 | Carousel Ultimate WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58651 | PlayerJS WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58650 | All In One SEO Pack WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58649 | All In One SEO Pack WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58648 | Simple JWT Login WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58647 | Simple Restaurant Menu WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58646 | Mobi2Go WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58645 | Gravitate Automated Tester WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58271 | AnyClip Luminous Studio WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58270 | NIX Anti-Spam Light WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58269 | WP Project Manager WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58268 | WPMK PDF Generator WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58267 | Stock Message WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58266 | Gianism WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58265 | Events Manager OpenStreetMaps WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58264 | JupiterX Core WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58263 | BuddyPress Notification Widget WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58262 | Sweet Energy Efficiency WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58261 | Mavis HTTPS to HTTP Redirection WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58260 | Highlight and Share Social Text and Image Sharing WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58259 | Nokri WordPress theme cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-09-22 | |
| CVE-2025-58258 | Lazy Blocks WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58257 | Verowa Connect WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58256 | DOAJ Export WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58255 | Custom Post Type Images WordPress plugin cross-site request forgery (CSRF) | 9.6CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58254 | StylePress for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58253 | Real Estate Manager WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58252 | Getwid WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58251 | Sticky Header Effects for Elementor WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58250 | Findgo WordPress theme cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-09-22 | Fix |
| CVE-2025-58249 | Qubely WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58248 | Pinterest Pinboard Widget WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58247 | TI WooCommerce Wishlist WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58245 | Portfolio WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58244 | Constructo WordPress theme cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58242 | Bg Church Memos WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58241 | SnapWidget Social Photo Feed Widget WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58240 | xili-tidy-tags WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58239 | WP Category Dropdown WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-09-22 | |
| CVE-2025-58238 | PilotPress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-09-22 | Fix |
| CVE-2025-58237 | LC Wizard WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 | |
| CVE-2025-58236 | Force Update Translations WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-09-22 | Fix |
| CVE-2025-58235 | Front End Users WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-09-22 |