CVE-2025 records published in October 2025

This page lists the 3,687 CVE-2025 records published in October 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 10 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.

Critical
42911.6% of these records
Listed in CISA KEV
100.3% of these records
Reported exploited
40.1% of these records
Detection signal
1022.8% of these records
Exploit code
1103.0% of these records
Actionable vendor fix
2,43566.0% of these records

Figures as of 2026-10-24 13:47 UTC. Records published in October 2025 have had from about 12 months to about 13 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2025 records published in October 2025, newest first: records 1 to 1,000 of 3,687
CVE Summary CVSS EPSS Published Signals
CVE-2025-64389CIRCUTOR TCPRS1plus EXCHANGE OF sensitive information IN CLEAR TEXT8.3CNA v4.00.2%2025-10-31
CVE-2025-64388CIRCUTOR TCPRS1plus denial of service through specific packets9.2CNA v4.00.4%2025-10-31
CVE-2025-64387CIRCUTOR TCPRS1plus CLICKJACKING5.1CNA v4.00.4%2025-10-31
CVE-2025-64386CIRCUTOR TCPRS1plus HIJACKING OF THE TOKEN AND GAINING access7.7CNA v4.00.4%2025-10-31
CVE-2025-64385CIRCUTOR TCPRS1plus incorrect security validation IN SENDING UDP FRAMES9.2CNA v4.00.4%2025-10-31
CVE-2025-64368Bard WordPress theme cross-site request forgery (CSRF)5.4CNA v3.10.1%2025-10-31Fix
CVE-2025-64367Groundhogg WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-31Fix
CVE-2025-64366MasterStudy LMS WordPress plugin SQL injection7.6CNA v3.10.3%2025-10-31Fix
CVE-2025-64365Ohio Extra WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-31Fix
CVE-2025-64364Masterstudy WordPress theme local file inclusion7.5CNA v3.10.4%2025-10-31Fix
CVE-2025-64363Kleo WordPress theme local file inclusion7.5CNA v3.10.4%2025-10-31Fix
CVE-2025-64362K Elements WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-31Fix
CVE-2025-64361Consulting Elementor Widgets WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-31Fix
CVE-2025-64360Consulting Elementor Widgets WordPress plugin local file inclusion7.5CNA v3.10.4%2025-10-31Fix
CVE-2025-64359Consulting WordPress theme local file inclusion7.5CNA v3.10.4%2025-10-31Fix
CVE-2025-64358Smart Coupons for WooCommerce WordPress plugin broken access control4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-64357Advanced Database Cleaner WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-31Fix
CVE-2025-64356Insert PHP Code Snippet WordPress plugin broken access control4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-64354Gutenberg WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-31Fix
CVE-2025-64353Polylang WordPress plugin deserialization of untrusted data8.8CNA v3.10.4%2025-10-31Fix
CVE-2025-64352Essential Addons for Elementor WordPress plugin broken access control2.7CNA v3.10.2%2025-10-31Fix
CVE-2025-64351Rank Math SEO WordPress plugin sensitive data exposure4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-64350Rank Math SEO WordPress plugin broken access control3.8CNA v3.10.2%2025-10-31Fix
CVE-2025-64349ELOG user profile missing authorization8.7CNA v4.00.4%2025-10-31
CVE-2025-64348ELOG configuration file authorization bypass9.3CNA v4.00.3%2025-10-31
CVE-2025-64168Agno session state overwrites between different sessions/users7.1CNA v3.10.2%2025-10-31Fix
CVE-2025-63675cryptidy allows code execution via untrusted data due to pickle.loads8.8v3.10.2%2025-10-31
CVE-2025-63563Summer Pearl Group Vacation Rental Management Platform incorrect user management6.5CISA ADP v3.10.3%2025-10-31
CVE-2025-63562Summer Pearl Group Vacation Rental Management Platform improper access control6.3v3.10.2%2025-10-31
CVE-2025-63561Summer Pearl Group Vacation Rental Management Platform denial of service7.5CNA v3.10.4%2025-10-31
CVE-2025-63469TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63468TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63467TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63466TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63465TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63464TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63463TOTOLINK LR350 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63462TOTOLINK A7000R stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63461TOTOLINK A7000R stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63460TOTOLINK A7000R stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63459TOTOLINK A7000R stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63458Tenda AX1803 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-63454Tenda AX3 stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31
CVE-2025-62618ELOG file upload stored XSS8.6CNA v4.00.3%2025-10-31Fix
CVE-2025-62267Liferay Portal web content template’s select structure page cross-site scripting4.6CNA v4.00.2%2025-10-31Fix
CVE-2025-62264Liferay Portal vulnerable to reflected XSS via the selectedLanguageId parameter5.1CNA v4.00.2%2025-10-31Fix
CVE-2025-62232Apache APISIX: Basic-auth logs plaintext credentials at info level7.5CISA ADP v3.10.5%2025-10-31Fix
CVE-2025-61427BEO GmbH BEO Atlas Einfuhr Ausfuhr userid and password parameters reflected cross-site scripting6.1CISA ADP v3.10.2%2025-10-31
CVE-2025-60749Trimble SketchUp desktop DLL hijacking7.8CISA ADP v3.10.2%2025-10-31
CVE-2025-60711Microsoft Edge (Chromium-based) remote code execution6.3CNA v3.10.4%2025-10-31Fix
CVE-2025-59501Microsoft Configuration Manager spoofing4.8CNA v3.13.3%2025-10-31Emerging ThreatsExploit codeFix
CVE-2025-58152Century Systems FutureNet MA-X series files accessible to external parties6.9CNA v4.00.3%2025-10-31
CVE-2025-58149Xen incorrect removal of permissions on PCI device unplug7.5CISA ADP v3.10.4%2025-10-31Fix
CVE-2025-58148Xen x86: Incorrect input sanitisation in Viridian hypercalls7.5CISA ADP v3.10.4%2025-10-31Fix
CVE-2025-58147Xen x86: Incorrect input sanitisation in Viridian hypercalls7.5CISA ADP v3.10.4%2025-10-31Fix
CVE-2025-57108VTK vtkGLTFDocumentLoader use-after-free9.8CISA ADP v3.10.4%2025-10-31Fix
CVE-2025-57107vtk heap-based buffer overflow7.1CISA ADP v3.10.2%2025-10-31Fix
CVE-2025-57106vtk heap-based buffer overflow7.5CISA ADP v3.10.4%2025-10-31Fix
CVE-2025-54763Century Systems FutureNet MA-X series OS command injection8.6CNA v4.01.2%2025-10-31
CVE-2025-52665Ubiquiti UniFi Access Application missing authentication10.0CISA ADP v3.141.1%2025-10-31Reported exploitedNucleiEmerging ThreatsFix
CVE-2025-52664Revive Adserver SQL injection8.8NVD v3.11.0%2025-10-31Fix
CVE-2025-52663Ubiquiti UniFi Talk Touch active debug code7.3CISA ADP v3.10.2%2025-10-31
CVE-2025-48984Veeam Backup and Replication code injection8.8CISA ADP v3.11.0%2025-10-31Fix
CVE-2025-48983Veeam Backup and Replication remote code execution10.0CNA v3.10.8%2025-10-31Fix
CVE-2025-48982Veeam Agent for Microsoft Windows improper privilege management7.8NVD v3.10.2%2025-10-31Fix
CVE-2025-48980Brave Desktop Browser cookie reliance without validation6.5CNA v3.00.3%2025-10-31Fix
CVE-2025-40603SonicWall SMA100 log files information disclosure4.5CISA ADP v3.10.5%2025-10-31Fix
CVE-2025-40106Linux kernel comedi driver denial of service–0.2%2025-10-31Fix
CVE-2025-36249IBM Jazz for Service Management is vulnerable to filter cookie not sent over SSL3.7CNA v3.10.2%2025-10-31Fix
CVE-2025-33003IBM InfoSphere Information Server is vulnerable to privilege escalation7.8CNA v3.10.1%2025-10-31Fix
CVE-2025-30191Open-Xchange OX App Suite clickjacking5.4CNA v3.10.2%2025-10-31Fix
CVE-2025-30189Open-Xchange Dovecot Pro authentication cache vulnerability7.4CNA v3.10.6%2025-10-31Fix
CVE-2025-30188Open-Xchange OX App Suite resource exhaustion7.5CNA v3.10.4%2025-10-31Fix
CVE-2025-29270Deep Sea Electronics DSE855 realtime.cgi endpoint improper access control10.0CISA ADP v3.10.4%2025-10-31
CVE-2025-27208Revive Adserver cross-site scripting6.1NVD v3.11.5%2025-10-31
CVE-2025-23050Qt out-of-bounds read3.1CNA v3.10.2%2025-10-31Fix
CVE-2025-12554Azure Access Technology BLU-IC2 Missing Security headers6.9CNA v4.00.4%2025-10-31
CVE-2025-12553Azure Access Technology BLU-IC2 Server Certificate Verification Disabled10.0CNA v4.00.2%2025-10-31
CVE-2025-12552Azure Access Technology BLU-IC2 Insufficient Password Policy6.9CNA v4.00.3%2025-10-31
CVE-2025-12547LogicalDOC Community Edition Admin Login login.jsp excessive authentication8.1NVD v3.10.8%2025-10-31
CVE-2025-12546LogicalDOC Community Edition API Key creation UI cross-site scripting5.4NVD v3.10.3%2025-10-31
CVE-2025-12521Analytify Pro WordPress plugin unauthenticated information exposure5.3CNA v3.10.3%2025-10-31Fix
CVE-2025-12509Scripts for the module Global_Shipping executable on BRAIN2 Server8.4CNA v3.10.3%2025-10-31Fix
CVE-2025-12508Bizerba BRAIN2 Unencrypted communication to Active Directory services8.4CNA v3.10.2%2025-10-31Fix
CVE-2025-12507Bizerba _connect.BRAIN insecure service configuration unquoted path8.8CNA v3.10.1%2025-10-31Fix
CVE-2025-12501Opera Norway GameMaker IDE integer overflow7.5CISA ADP v3.10.5%2025-10-31
CVE-2025-12464Red Hat Enterprise Linux 10 qemu-kvm: Stack buffer overflow in e1000 device6.2CNA v3.10.2%2025-10-31Fix
CVE-2025-12460Stored XSS vulnerability in Afterlogic Aurora webmail5.3CNA v4.00.4%2025-10-31
CVE-2025-12357ISO 15118-2 EV car chargers SLAC protocol improper channel restriction5.3CNA v4.00.8%2025-10-31
CVE-2025-12175The Events Calendar WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-12115WPC Name Your Price for WooCommerce WordPress plugin unauthenticated Price Alteration7.5CNA v3.10.3%2025-10-31Fix
CVE-2025-12094OOPSpam Anti-Spam: Spam Protection for WordPress Forms and Comments IP spoofing5.3CNA v3.10.3%2025-10-31Fix
CVE-2025-12041ERI File Library WordPress plugin missing authorization to unauthenticated Protected file download5.3CNA v3.10.3%2025-10-31Fix
CVE-2025-11975FuseWP WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-11843Therefore Online and Therefore On-Premises authentication bypass by spoofing8.8CNA v4.00.3%2025-10-31Fix
CVE-2025-11806Qzzr Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-31
CVE-2025-11602neo4j Community Edition untargeted information leak in Bolt protocol handshake6.3CNA v4.00.3%2025-10-31Fix
CVE-2025-11191RealPress WordPress plugin unauthenticated content Creation/Email Sending via REST5.3CISA ADP v3.10.3%2025-10-31Fix
CVE-2025-10897WooCommerce Designer Pro WordPress plugin unauthenticated arbitrary file read8.6CNA v3.11.9%2025-10-31NucleiExploit codeFix
CVE-2025-10693Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure7.6CNA v4.00.3%2025-10-31Fix
CVE-2025-8849Denial of service in danny-avila/LibreChat7.5NVD v3.10.3%2025-10-31Fix
CVE-2025-8489King Addons for Elementor WordPress plugin privilege escalation9.8CNA v3.19.6%2025-10-31MetasploitExploit codeFix
CVE-2025-8385Zombify WordPress plugin authenticated (Subscriber+) path traversal to arbitrary file read6.8CNA v3.10.4%2025-10-31Fix
CVE-2025-8383Depicter WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-10-31Fix
CVE-2025-7846WordPress User Extra Fields plugin arbitrary file deletion8.8CNA v3.10.7%2025-10-31Fix
CVE-2025-6520SQLi in ABIS Technology's BAPSIS9.8CNA v3.10.4%2025-10-31Fix
CVE-2025-6176Brotli decompression bomb DoS in scrapy/scrapy7.5CNA v3.00.5%2025-10-31Fix
CVE-2025-6075Python CPython quadratic complexity in os.path.expandvars with user-controlled template1.8CNA v4.00.1%2025-10-31Fix
CVE-2025-5397Jobmonster - Job Board WordPress theme authentication bypass9.8CNA v3.10.8%2025-10-31Fix
CVE-2025-4952Denial of service vulnerability in ESET security products for Windows6.8CNA v4.00.1%2025-10-31
CVE-2025-64118node-tar vulnerable to race condition leading to uninitialized memory exposure6.1CNA v4.00.1%2025-10-30Fix
CVE-2025-64116Movary vulnerable to an open redirect5.1CNA v4.00.3%2025-10-30Fix
CVE-2025-64115Movary unvalidated Referer header allows open redirect and phishing5.1CNA v4.00.3%2025-10-30Fix
CVE-2025-64112statamic cms statmatic vulnerable to stored cross-site scripting8.0CNA v3.10.3%2025-10-30Fix
CVE-2025-64096CryptoLib vulnerable to stack buffer overflow in Crypto_Key_Update due to missing TLV length check8.8CNA v3.00.5%2025-10-30Fix
CVE-2025-63885AIxBlock commit stored cross-site scripting6.1CISA ADP v3.10.2%2025-10-30
CVE-2025-63608CSZ CMS A SQL injection5.4CISA ADP v3.10.2%2025-10-30
CVE-2025-63423Each Wireless Mini Router WIRELESS-N 300M improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-63422Each Wireless Mini Router WIRELESS-N 300M web management interface improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-63298Mayuri K Pet Grooming Management Software path traversal8.2CISA ADP v3.10.5%2025-10-30Exploit code
CVE-2025-62795JumpServer Unauthorized LDAP Configuration Access via WebSocket7.1CNA v3.10.3%2025-10-30Fix
CVE-2025-62726n8n vulnerable to remote code execution via Git Node Pre-Commit Hook8.8CNA v3.10.8%2025-10-30Exploit codeFix
CVE-2025-62712JumpServer Connection token leak9.6CNA v3.10.5%2025-10-30Emerging ThreatsFix
CVE-2025-62503Apache Airflow: Privilege boundary bypass in bulk APIs4.6CISA ADP v3.10.4%2025-10-30Fix
CVE-2025-62402Apache Airflow: Airflow 3 API: /API/v2/dagReports executes DAG Python in API5.4CISA ADP v3.10.5%2025-10-30Fix
CVE-2025-62266Liferay Portal is vulnerable to DNS rebinding attacks5.1CNA v4.00.2%2025-10-30Fix
CVE-2025-62265Liferay Portal is vulnerable to XSS in the Blogs widget4.8CNA v4.00.2%2025-10-30Fix
CVE-2025-62257Liferay Portal missing brute-force protection6.3CNA v4.00.4%2025-10-30Fix
CVE-2025-62231X.Org xwayland Xorg: Xmayland: Value overflow in xkbsetcompatmap7.3CNA v3.10.3%2025-10-30Fix
CVE-2025-62230X.Org X server Xkb extension client resource cleanup use-after-free7.3CNA v3.10.3%2025-10-30Fix
CVE-2025-62229X.Org xwayland Xorg: Xmayland: Use-after-free in xpresentnotify structure creation7.3CNA v3.10.5%2025-10-30Fix
CVE-2025-61498Tenda AC8 UPnP service buffer overflow7.5CISA ADP v3.10.4%2025-10-30
CVE-2025-61196BusinessNext CRMnext comments parameter code injection8.8CISA ADP v3.10.6%2025-10-30
CVE-2025-61141Sqls-server/sqls is vulnerable to command injection in the config command7.5CISA ADP v3.11.1%2025-10-30
CVE-2025-61121Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitive7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61120IO FIT AG Life Logger verification codes improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61119Karely Kanova API request parameters improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61118mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data a7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61117Senza Keto and Fasting user data API endpoints improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61116AdForest Classified authentication mechanism improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61115ABC Liquors ABC Fine Wine and Spirits login mechanism improper access control7.5CISA ADP v3.10.4%2025-10-30
CVE-2025-61114AutoBizLine 2nd Line authentication mechanism improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-61113TalkTalk API endpoints improper access control7.5CISA ADP v3.10.3%2025-10-30
CVE-2025-60950AIxBlock Data Preparation function arbitrary file upload6.1CISA ADP v3.10.3%2025-10-30
CVE-2025-60319PerfreeBlog server-side request forgery6.5CISA ADP v3.10.3%2025-10-30
CVE-2025-57109Kitware VTK vtkGLTFImporter use-after-free6.5CISA ADP v3.10.3%2025-10-30Fix
CVE-2025-56313JATOS /publix/run endpoint reflected cross-site scripting6.1CISA ADP v3.10.2%2025-10-30
CVE-2025-54941Apache Airflow: Command injection in example_dag_decorator4.6NVD v3.10.5%2025-10-30Fix
CVE-2025-54471NeuVector is shipping cryptographic material into its binary6.5CNA v3.10.3%2025-10-30Fix
CVE-2025-54470NeuVector telemetry sender is vulnerable to MITM and DoS8.6CNA v3.10.2%2025-10-30Fix
CVE-2025-54469NeuVector Enforcer is vulnerable to command injection and buffer overflow9.9CNA v3.10.5%2025-10-30Fix
CVE-2025-53883Container suse manager spacewalk-java has various XSS issues on search page9.3CNA v4.00.3%2025-10-30Fix
CVE-2025-53880SUSE Container suse/manager/4.3/proxy-httpd:latest path traversal8.7CNA v4.00.3%2025-10-30Fix
CVE-2025-52180Zucchetti AD Hoc Infinity cross-site scripting6.1CISA ADP v3.10.3%2025-10-30
CVE-2025-52179Zucchetti Ad Hoc Revolution cross-site scripting6.1CISA ADP v3.10.3%2025-10-30
CVE-2025-50739iib0011 omni-tools JSON insecure deserialization9.8CISA ADP v3.10.7%2025-10-30
CVE-2025-50736Byaidu PDFMathTranslate vulnerable to open redirect6.1CISA ADP v3.10.2%2025-10-30
CVE-2025-50574Hiruna Glamour Salon Management System blog-details.php in Hiruna Gallage's cross-site scripting6.1CISA ADP v3.10.4%2025-10-30
CVE-2025-46423Dell Unity OS command injection7.8CNA v3.10.5%2025-10-30Fix
CVE-2025-46422Dell Unity OS command injection7.8CNA v3.10.5%2025-10-30Fix
CVE-2025-46363Dell Secure Connect Gateway SCG relative path traversal4.3CNA v3.10.3%2025-10-30Fix
CVE-2025-43942Dell Unity OS command injection7.8CNA v3.10.6%2025-10-30Fix
CVE-2025-43941Dell Unity OS command injection7.2CNA v3.10.7%2025-10-30Fix
CVE-2025-43940Dell Unity OS command injection7.8CNA v3.10.6%2025-10-30Fix
CVE-2025-43939Dell Unity OS command injection7.8CNA v3.10.6%2025-10-30Fix
CVE-2025-43027Genetec Security Center improper access control9.8CNA v3.10.4%2025-10-30Fix
CVE-2025-40105Linux kernel VFS dentry cache vulnerability7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40104Linux kernel ixgbevf driver mailbox negotiation vulnerability7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40103Linux kernel SMB client tlink handling vulnerability–0.2%2025-10-30Fix
CVE-2025-40102Linux kernel KVM arm64 vCPU event injection denial of service–0.2%2025-10-30Fix
CVE-2025-40101Linux kernel Btrfs zoned block group loading memory leak–0.2%2025-10-30Fix
CVE-2025-40100Linux kernel Btrfs free space tree creation denial of service–0.2%2025-10-30Fix
CVE-2025-40099Linux kernel CIFS DFS referral parsing vulnerability9.4CNA v3.10.4%2025-10-30Fix
CVE-2025-40098Linux kernel ALSA HDA CS35L41 ACPI mute state handling null pointer dereference–0.2%2025-10-30Fix
CVE-2025-40097Linux kernel ALSA HDA component manager initialization vulnerability–0.2%2025-10-30Fix
CVE-2025-40096Linux kernel DRM scheduler job dependency tracking double free7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40095Linux kernel USB gadget RNDIS function bind path null pointer dereference7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40094Linux kernel USB gadget ACM function bind path null pointer dereference7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40093Linux kernel USB gadget ECM function bind path null pointer dereference7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40092Linux kernel USB gadget NCM function bind path null pointer dereference7.8CNA v3.10.2%2025-10-30Fix
CVE-2025-40091Linux kernel ixgbe driver devlink cleanup use-after-free–0.2%2025-10-30Fix
CVE-2025-40090Linux kernel ksmbd RPC handle list locking vulnerability7.5CNA v3.10.3%2025-10-30Fix
CVE-2025-40089Linux kernel CXL Features driver null pointer dereference–0.2%2025-10-30Fix
CVE-2025-40088Linux kernel hfsplus out-of-bounds read7.1CNA v3.10.2%2025-10-30Fix
CVE-2025-40087Linux kernel NFSD FlexFiles layout commit vulnerability7.5CNA v3.10.5%2025-10-30Fix
CVE-2025-40086Linux kernel Xe GPU driver VM bind eviction null pointer dereference–0.2%2025-10-30Fix
CVE-2025-39663Checkmk cross-site scripting through compromised remote site8.5CNA v4.00.6%2025-10-30Fix
CVE-2025-36592Dell Secure Connect Gateway (SCG) Policy Manager cross-site scripting5.4CNA v3.10.2%2025-10-30Fix
CVE-2025-36137IBM Sterling Connect:Direct for UNIX command execution7.2CNA v3.10.4%2025-10-30Fix
CVE-2025-34298Nagios Log Server Set Email privilege escalation8.8NVD v3.10.7%2025-10-30Fix
CVE-2025-34287Nagios XI privilege escalation via process_perfdata.pl7.8NVD v3.10.3%2025-10-30Fix
CVE-2025-34286Nagios XI RCE via Run Check command in CCM7.2NVD v3.12.4%2025-10-30Fix
CVE-2025-34284Nagios XI authenticated command injection via WinRM plugin8.8NVD v3.14.0%2025-10-30Fix
CVE-2025-34283Nagios XI API key disclosure via Neptune Themes6.5NVD v3.11.0%2025-10-30Fix
CVE-2025-34280Nagios Network Analyzer RCE in LDAP Certificate Removal function7.2NVD v3.11.4%2025-10-30Fix
CVE-2025-34278Nagios Network Analyzer Source Groups / Percentile Calculator menu stored XSS5.4NVD v3.10.8%2025-10-30Fix
CVE-2025-34277Nagios Log Server RCE via Malformed Dashboard ID9.8NVD v3.12.2%2025-10-30Fix
CVE-2025-34274Nagios Log Server Logstash Process Root Privileges9.8NVD v3.12.1%2025-10-30Fix
CVE-2025-34273Nagios Log Server Non-Admin Dashboard Deletion6.5NVD v3.11.0%2025-10-30Fix
CVE-2025-34272Nagios Log Server Non-Empty Default Dashboard Fallback6.5NVD v3.10.9%2025-10-30Fix
CVE-2025-34271Nagios Log Server Cluster Manager Credential Requests Sent over Plaintext9.8NVD v3.10.7%2025-10-30Fix
CVE-2025-34270Nagios Log Server AD/LDAP Import Password not Obfuscated4.9NVD v3.10.6%2025-10-30Fix
CVE-2025-34135Nagios XI Overly Permissive Permissions on Systemd Unit files4.4NVD v3.10.4%2025-10-30Fix
CVE-2025-34134Nagios XI RCE via Business Process Intelligence (BPI)7.2NVD v3.12.4%2025-10-30Fix
CVE-2025-12517Credits page not Matching Versions in Use in the Firmware2.1CNA v4.00.2%2025-10-30
CVE-2025-12516Azure Access Technology BLU-IC2 Lack of Graceful Error Handling HTTP 5xx Error10.0CNA v4.00.4%2025-10-30
CVE-2025-12515Azure Access Technology BLU-IC2 Systemic Internal Server Errors HTTP 500 Response10.0CNA v4.00.4%2025-10-30
CVE-2025-12475Blocksy Companion WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-30Fix
CVE-2025-12466Simple OAuth (OAuth2) & OpenID Connect Critical Access bypass SA-CONTRIB-2025-1147.5CISA ADP v3.10.4%2025-10-30Fix
CVE-2025-12083CivicTheme Design System Moderately critical cross-site scripting SA-CONTRIB-2025-1136.1CISA ADP v3.10.2%2025-10-30Fix
CVE-2025-12082CivicTheme Design System Moderately critical information disclosure SA-CONTRIB-2025-1127.5CISA ADP v3.10.3%2025-10-30Fix
CVE-2025-12060Keras Keras.utils.get_file utility path traversal8.9CNA v4.00.6%2025-10-30Fix
CVE-2025-11998HP Card Readers (B Models) potential information disclosure6.8CNA v4.00.2%2025-10-30
CVE-2025-11906Privilege escalation via writable configuration files in Progress Flowmon6.7CNA v3.10.1%2025-10-30Fix
CVE-2025-11881AppPresser WordPress plugin unauthorized access5.3CNA v3.10.3%2025-10-30Fix
CVE-2025-11627sminozzi Site Checkup Debug AI Troubleshooting log file log injection6.5CNA v3.10.3%2025-10-30Fix
CVE-2025-10931Umami Analytics Moderately critical cross-site scripting SA-CONTRIB-2025-1093.8CISA ADP v3.10.2%2025-10-30Fix
CVE-2025-10930Currency Moderately critical cross-site request forgery SA-CONTRIB-2025-1104.3NVD v3.10.1%2025-10-30Fix
CVE-2025-10929Reverse Proxy Header Less critical Access bypass SA-CONTRIB-2025-1115.3CISA ADP v3.10.3%2025-10-30Fix
CVE-2025-10928Access code Moderately critical Access bypass SA-CONTRIB-2025-1086.3CISA ADP v3.10.2%2025-10-30Fix
CVE-2025-10927Plausible tracking Moderately critical cross-site scripting SA-CONTRIB-2025-1076.1CISA ADP v3.10.2%2025-10-30Fix
CVE-2025-10926JSON Field Critical cross-site scripting SA-CONTRIB-2025-1066.1CISA ADP v3.10.2%2025-10-30Fix
CVE-2025-10636NS Maintenance Mode for WP WordPress plugin Admin+ stored XSS3.5CISA ADP v3.10.2%2025-10-30
CVE-2025-10348Stored cross-site scripting in URVE Smart Office5.1CNA v4.00.4%2025-10-30Fix
CVE-2025-10317Multiple cross-site request forgery in Quick.Cart5.1CNA v4.00.2%2025-10-30
CVE-2025-10008Translate WordPress with Weglot clean_options function missing authorization5.3CNA v3.10.3%2025-10-30Fix
CVE-2025-9954Acquia Dam Moderately critical Access bypass, information disclosure SA-CONTRIB-2025-1057.5CISA ADP v3.10.3%2025-10-30Fix
CVE-2025-8850Insecure API Design in danny-avila/LibreChat8.8NVD v3.10.4%2025-10-30Fix
CVE-2025-5347Zoho ManageEngine Exchange Reporter Plus stored XSS6.3CNA v3.10.5%2025-10-30Fix
CVE-2025-5343Zoho ManageEngine Exchange Reporter Plus stored XSS6.3CNA v3.10.5%2025-10-30Fix
CVE-2025-5342Zoho ManageEngine Exchange Reporter Plus denial of service (DoS)4.3CNA v3.11.1%2025-10-30Fix
CVE-2025-3356IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations8.6CNA v3.10.4%2025-10-30Fix
CVE-2025-3355IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations7.5CNA v3.10.5%2025-10-30Fix
CVE-2025-64296Facebook for WooCommerce WordPress plugin broken access control to Notice Dismissal5.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64291Premmerce User Roles WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-29Fix
CVE-2025-64290Premmerce Product Search for WooCommerce WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29Fix
CVE-2025-64289Premmerce Product Search for WooCommerce WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-29Fix
CVE-2025-64288Premmerce WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29Fix
CVE-2025-64286WP Rentals WordPress theme cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29
CVE-2025-64285Premmerce Wholesale Pricing for WooCommerce WordPress plugin broken access control5.4CNA v3.10.2%2025-10-29Fix
CVE-2025-64284Majestic Support WordPress plugin local file inclusion7.5CNA v3.10.4%2025-10-29Fix
CVE-2025-64283RTMKit WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.3%2025-10-29Fix
CVE-2025-64234Evergreen Content Poster WordPress plugin broken access control4.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64229Client Invoicing by Sprout Invoices WordPress plugin broken access control4.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64228SUMO Affiliates Pro WordPress plugin sensitive data exposure4.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64226Stockie Extra WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29Fix
CVE-2025-64220Rey Core WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64219Business Directory WordPress plugin broken access control4.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64216SmartMag WordPress theme local file inclusion7.5CNA v3.10.4%2025-10-29Fix
CVE-2025-64212MasterStudy LMS Pro WordPress plugin broken access control5.4CNA v3.10.2%2025-10-29Fix
CVE-2025-64211Masterstudy Elementor Widgets WordPress plugin broken access control5.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64210Masterstudy Elementor Widgets WordPress plugin broken access control5.4CNA v3.10.2%2025-10-29Fix
CVE-2025-64208Jannah - Extensions WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64204SmartMag WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64202Sahifa WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64201PowerPress Podcasting WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29Fix
CVE-2025-64200Email Template Customizer for WooCommerce WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-29Fix
CVE-2025-64199wpresidence WordPress theme broken access control5.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64197Rehub WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64195Eduma WordPress theme local file inclusion7.5CNA v3.10.5%2025-10-29Fix
CVE-2025-64194Eduma WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-29Fix
CVE-2025-64150Jenkins Publish To Bitbucket Plugin is missing a permissions check5.4CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64149Jenkins Publish To Bitbucket Plugin vulnerable to CSRF and missing permissions check5.4CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64148Jenkins Publish To Bitbucket Plugin is missing a permissions check4.3CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64147Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form4.3CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64146Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64145Jenkins ByteGuard Build Actions Plugin missing encryption4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64144Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64143Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64142Jenkins Nexus Task Runner Plugin is missing a permission check4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64141Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64140Jenkins Azure CLI Plugin does not restrict the commands it executes8.8CISA ADP v3.10.6%2025-10-29Fix
CVE-2025-64139Jenkins Start Windocks Containers Plugin is missing a permission check4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64138Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64137Jenkins Themis Plugin is missing a permission check4.3CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64136Jenkins Themis Plugin vulnerable to cross-site request forgery4.3CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-64135Jenkins Eggplant Runner Plugin protection mechanism disabled5.9CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64134Jenkins JDepend Plugin vulnerable to XML external entity attacks7.1CISA ADP v3.10.4%2025-10-29Fix
CVE-2025-64133Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery5.4CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64132Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools5.4CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-64131Jenkins SAML Plugin does not implement a replay cache7.5CISA ADP v3.10.5%2025-10-29Fix
CVE-2025-64104LangGraph SQLite Checkpoint Filter Key SQL injection POC for SqliteStore7.3CNA v3.10.2%2025-10-29Fix
CVE-2025-64103Zitadel Bypass Second Authentication Factor8.7CNA v4.00.4%2025-10-29Fix
CVE-2025-64102Zitadel allows brute-forcing authentication factors7.7CNA v4.00.4%2025-10-29Fix
CVE-2025-64101ZITADEL vulnerable to account takeover via Malicious Forwarded header injection8.1CNA v3.10.4%2025-10-29Fix
CVE-2025-64100CKAN vulnerable to Session Cookie Fixation6.1CNA v3.10.3%2025-10-29Fix
CVE-2025-63622Fabian Online Complaint Site SQL injection9.8CISA ADP v3.10.4%2025-10-29
CVE-2025-62797CSRF in FluxCP account endpoints allows account takeover / state-changing actions8.6CNA v4.00.2%2025-10-29
CVE-2025-62792Wazuh vulnerable to heap-based buffer over-read in w_expression_match6.9CNA v4.00.4%2025-10-29Fix
CVE-2025-62791Wazuh vulnerable to null pointer dereference in DecodeCiscat6.9CNA v4.00.3%2025-10-29Fix
CVE-2025-62790Wazuh vulnerable to null pointer dereference in fim_fetch_attributes_state6.9CNA v4.00.4%2025-10-29Fix
CVE-2025-62789Wazuh vulnerable to null pointer dereference in fim_alert line 7126.9CNA v4.00.4%2025-10-29Fix
CVE-2025-62788Wazuh vulnerable to heap use-after-free in w_copy_event_for_log6.3CNA v4.00.3%2025-10-29Fix
CVE-2025-62787Wazuh vulnerable to heap-based buffer over-read in DecodeWinevt2.1CNA v4.00.4%2025-10-29Fix
CVE-2025-62786Wazuh vulnerable to Heap-based Buffer out-of-bounds write in decode_win_permissions6.3CNA v4.00.7%2025-10-29Fix
CVE-2025-62785Wazuh fillData null pointer dereference causes analysisd crash6.9CNA v4.00.4%2025-10-29Fix
CVE-2025-62776Wireless Tsukamoto WTW EAGLE uncontrolled search path8.4CNA v4.00.2%2025-10-29
CVE-2025-61959Vertikal Systems Hospital Manager Backend Services WebResource.axd handler vulnerability6.9CNA v4.00.3%2025-10-29
CVE-2025-61876Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and access tenant information belonging to other clients via modification of the tenant ID in the request URL.5.0CISA ADP v3.10.2%2025-10-29
CVE-2025-61725Excessive CPU consumption in ParseAddress in net/mail7.5CISA ADP v3.10.6%2025-10-29Fix
CVE-2025-61724Excessive CPU consumption in Reader.ReadResponse in net/textproto5.3CISA ADP v3.10.6%2025-10-29Fix
CVE-2025-61723Quadratic complexity when parsing some invalid inputs in encoding/pem7.5CISA ADP v3.10.7%2025-10-29Fix
CVE-2025-61429NCR Atleos Terminal Manager ConfigApp privilege escalation8.8CISA ADP v3.10.3%2025-10-29
CVE-2025-61234Paytef Dataphone A920 port 8888 service missing authentication7.5CISA ADP v3.10.3%2025-10-29
CVE-2025-61161Evope Collector DLL hijacking8.4CISA ADP v3.10.2%2025-10-29
CVE-2025-61156ThreatFire System Monitor kernel driver privilege escalation7.8CISA ADP v3.10.1%2025-10-29Exploit code
CVE-2025-60898Thumbnail unauthenticated server-side request forgery5.8CISA ADP v3.10.3%2025-10-29
CVE-2025-60595SPH Engineering UgCS command injection8.2CISA ADP v3.10.3%2025-10-29
CVE-2025-60542TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update6.5CISA ADP v3.10.3%2025-10-29Fix
CVE-2025-60320memoQ Auto Update Service privilege escalation6.7CISA ADP v3.10.1%2025-10-29
CVE-2025-60075hpb seo plugin for WordPress cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-29
CVE-2025-58939Super Store Finder WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-29
CVE-2025-58711Blog Designer PRO WordPress plugin broken access control5.3CNA v3.10.3%2025-10-29
CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tls5.3CISA ADP v3.10.5%2025-10-29Fix
CVE-2025-58188Panic when validating certificates with DSA public keys in crypto/x5097.5CISA ADP v3.10.4%2025-10-29Fix
CVE-2025-58187Quadratic complexity when checking name constraints in crypto/x5097.5CISA ADP v3.10.4%2025-10-29Fix
CVE-2025-58186Lack of limit when parsing cookies can cause memory exhaustion in net/http5.3CISA ADP v3.10.6%2025-10-29Fix
CVE-2025-58185Parsing DER payload can cause memory exhaustion in encoding/asn15.3CISA ADP v3.10.6%2025-10-29Fix
CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tar4.3CISA ADP v3.10.4%2025-10-29Fix
CVE-2025-57931Popup box WordPress plugin cross-site request forgery (CSRF)5.3CNA v3.10.1%2025-10-29Fix
CVE-2025-57227Kingosoft Technology Kingo ROOT privilege escalation7.8CISA ADP v3.10.1%2025-10-29Exploit code
CVE-2025-56558Dyson MQTT server unprotected alternate channel3.0CNA v3.10.4%2025-10-29Fix
CVE-2025-54549Arista Networks DANZ Monitoring Fabric upgrade image validation improper signature verification5.9CNA v3.10.1%2025-10-29
CVE-2025-54548Arista Networks DANZ Monitoring Fabric debug API information disclosure4.3CNA v3.10.2%2025-10-29
CVE-2025-54547Arista DANZ Monitoring Fabric SSH session multiplexing insufficient session expiration5.3CNA v3.10.1%2025-10-29
CVE-2025-54546Arista DANZ Monitoring Fabric SSH port forwarding incorrect permission assignment7.5CNA v3.10.2%2025-10-29
CVE-2025-54545Arista DANZ Monitoring Fabric CLI sandbox privilege escalation7.8CNA v3.10.1%2025-10-29
CVE-2025-54459Vertikal Systems Hospital Manager Backend Services trace endpoint information disclosure8.7CNA v4.00.4%2025-10-29
CVE-2025-54384CKAN stored XSS vulnerability in Markdown description fields6.3CNA v3.10.2%2025-10-29Fix
CVE-2025-49042WooCommerce WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-29Fix
CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/url5.3CISA ADP v3.10.5%2025-10-29Fix
CVE-2025-40085Linux kernel USB audio card registration null pointer dereference–0.2%2025-10-29Fix
CVE-2025-40084Linux kernel ksmbd IPC handle parsing vulnerability7.1CNA v3.10.2%2025-10-29Fix
CVE-2025-40083Linux kernel QFQ packet scheduler vulnerability–0.2%2025-10-29Fix
CVE-2025-12479Azure Access Technology BLU-IC2 systemic lack of cross-site request forgery Token Implementation10.0CNA v4.00.2%2025-10-29
CVE-2025-12478Azure Access Technology BLU-IC2 Non-Compliant TLS Configuration10.0CNA v4.00.2%2025-10-29
CVE-2025-12477Azure Access Technology BLU-IC2 Server Version Disclosure10.0CNA v4.00.3%2025-10-29
CVE-2025-12476Azure Access Technology BLU-IC2 resource Lacking AuthN10.0CNA v4.00.3%2025-10-29
CVE-2025-12461Unprotected access to parts of the application in Epsilon RH by Grupo Castilla6.9CNA v4.00.3%2025-10-29
CVE-2025-12450LiteSpeed Cache WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2025-10-29Fix
CVE-2025-12148floragunn Search Guard FLX field masking information disclosure6.0CNA v4.00.3%2025-10-29
CVE-2025-12147floragunn Search Guard FLX field-level security information disclosure6.0CNA v4.00.3%2025-10-29
CVE-2025-12142ABB Terra AC wallbox BSS(Block Started by Symbol) memory corruption6.9CNA v4.00.2%2025-10-29Fix
CVE-2025-12058Vulnerability in Keras Model.load_model leading to arbitrary Local File Loading and SSRF5.9CNA v4.00.2%2025-10-29Fix
CVE-2025-11705Anti-Malware Security and Brute-Force Firewall WordPress plugin arbitrary file read6.5CNA v3.10.5%2025-10-29Fix
CVE-2025-11702Missing authorization in GitLab8.5CNA v3.10.6%2025-10-29Fix
CVE-2025-11632jgrietveld Call Now Button missing authorization4.3CNA v3.10.3%2025-10-29Fix
CVE-2025-11587jgrietveld Call Now Button missing authorization4.3CNA v3.10.2%2025-10-29Fix
CVE-2025-11466Allegra DatabaseBackupBL directory traversal information disclosure4.9CNA v3.01.6%2025-10-29Fix
CVE-2025-11465Ashlar-Vellum Cobalt CO File Parsing use-after-free remote code execution7.8NVD v3.10.2%2025-10-29
CVE-2025-11464Ashlar-Vellum Cobalt CO File Parsing heap-based buffer overflow remote code execution7.8NVD v3.10.2%2025-10-29
CVE-2025-11463Ashlar-Vellum Cobalt XE File Parsing integer overflow remote code execution7.8NVD v3.10.2%2025-10-29
CVE-2025-11232ISC Kea invalid characters cause assert7.5CNA v3.10.4%2025-10-29Fix
CVE-2025-11203LiteLLM Information health API_KEY information disclosure3.5CNA v3.00.3%2025-10-29Exploit codeFix
CVE-2025-11202win-cli-mcp-server resolveCommandPath command injection remote code execution9.8CNA v3.02.8%2025-10-29
CVE-2025-11201MLflow Tracking Server Model Creation directory traversal remote code execution9.8v3.126.3%2025-10-29Fix
CVE-2025-11200MLflow weak password requirements authentication bypass9.8v3.11.5%2025-10-29Fix
CVE-2025-10934GIMP XWD File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.6%2025-10-29Fix
CVE-2025-10932Progress MOVEit Transfer AS2 module allows uncontrolled file uploads8.2CNA v3.10.5%2025-10-29Fix
CVE-2025-10925GIMP ILBM File Parsing stack-based buffer overflow remote code execution7.8CNA v3.03.1%2025-10-29Fix
CVE-2025-10924GIMP FF File Parsing integer overflow remote code execution7.8CNA v3.00.5%2025-10-29Fix
CVE-2025-10923GIMP WBMP File Parsing integer overflow remote code execution7.8CNA v3.00.5%2025-10-29Fix
CVE-2025-10922GIMP DCM File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.8%2025-10-29Fix
CVE-2025-10921GIMP HDR File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.6%2025-10-29Fix
CVE-2025-10920GIMP ICNS File Parsing out-of-bounds write remote code execution7.8CNA v3.00.5%2025-10-29Fix
CVE-2025-9871Razer Synapse 3 Chroma Connect link following local privilege escalation7.8CNA v3.00.2%2025-10-29
CVE-2025-9870Razer Synapse 3 RazerPhilipsHueUninstall link following local privilege escalation7.8CNA v3.00.2%2025-10-29
CVE-2025-9869Razer Synapse 3 Macro module link following local privilege escalation7.8CNA v3.00.2%2025-10-29
CVE-2025-9544Doppler Forms WordPress plugin Subscriber+ limited plugin installation6.5CISA ADP v3.10.2%2025-10-29Fix
CVE-2025-4665Adobe WordPress plugin Contact Form CFDB7 SQL injection9.6CNA v3.10.3%2025-10-29Fix
CVE-2025-1549WatchGuard Mobile VPN with SSL Local Privilege Escallation6.3CNA v4.00.2%2025-10-29Fix
CVE-2025-64095DNN Platform HTML editor provider unrestricted file upload10.0CNA v3.147.0%2025-10-28NucleiEmerging ThreatsExploit codeFix
CVE-2025-64094dnnsoftware Dnn.Platform DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload6.4CNA v3.10.2%2025-10-28Fix
CVE-2025-62802dnnsoftware Dnn.Platform DNN CKEditor Provider allows unauthenticated upload out-of-the-box4.3CNA v3.10.2%2025-10-28Fix
CVE-2025-62801FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name5.4CNA v4.00.2%2025-10-28Fix
CVE-2025-62800FastMCP vulnerable to reflected XSS in client's callback page5.3CNA v4.00.3%2025-10-28Fix
CVE-2025-62798Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax5.4CNA v3.10.2%2025-10-28Fix
CVE-2025-62796PrivateBin persistent HTML injection in attachment filename enables redirect and defacement5.8CNA v3.10.3%2025-10-28Fix
CVE-2025-62794RichardoC GitHub Workflow Updater token storage vulnerability3.8CNA v3.10.1%2025-10-28Fix
CVE-2025-62777PLANEX COMMUNICATIONS MZK-DP300N hard-coded credentials8.7CNA v4.00.3%2025-10-28
CVE-2025-62727Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse7.5CNA v3.10.8%2025-10-28Exploit codeFix
CVE-2025-62368taigaio taiga-back taiga Authenticated remote code execution9.1CNA v3.11.6%2025-10-28MetasploitExploit codeFix
CVE-2025-62367taigaio taiga-back Taiga blind SQL injection Time Based4.8CNA v3.10.2%2025-10-28Fix
CVE-2025-61598Discourse is missing Cache-Control response header on error responses6.3CNA v4.00.3%2025-10-28Fix
CVE-2025-61235Dataphone A920 packet improper input validation9.1CISA ADP v3.10.4%2025-10-28
CVE-2025-61155GameDriverX64.sys IOCTL handler denial of service5.5CISA ADP v3.10.3%2025-10-28Exploit code
CVE-2025-61128WAVLINK QUANTUM D3G/WL-WN530HG3 firmware M30HG3_V240730 stack-based buffer overflow9.1CISA ADP v3.10.7%2025-10-28Emerging Threats
CVE-2025-61107FRRouting null pointer dereference7.5CISA ADP v3.10.6%2025-10-28Fix
CVE-2025-61106FRRouting null pointer dereference7.5CISA ADP v3.10.6%2025-10-28Fix
CVE-2025-61104FRRouting null pointer dereference7.5CISA ADP v3.10.6%2025-10-28Fix
CVE-2025-61103FRRouting null pointer dereference7.5CISA ADP v3.10.6%2025-10-28Fix
CVE-2025-61080Clear2Pay Bank Visibility Payment Execution ID parameter reflected cross-site scripting5.4CISA ADP v3.10.2%2025-10-28
CVE-2025-61043An out-of-bounds read vulnerability has been discovered in Monkey's Audio 11.31, specifically in the CAPECharacterHelper::GetUTF16FromUTF8 function. The issue arises from improper handling of the length of the input UTF-8 string, causing the function to read past the memory boundary. This vulnerabil9.1CISA ADP v3.10.5%2025-10-28
CVE-2025-60858Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers to intercept or extract sensitive information.7.5CISA ADP v3.10.3%2025-10-28
CVE-2025-60805BESSystem BES Application Server pre-resource configuration option information disclosure7.5CISA ADP v3.10.4%2025-10-28
CVE-2025-60800jishenghua jshERP information disclosure7.5CISA ADP v3.10.3%2025-10-28Exploit code
CVE-2025-60355Zhyd OneBlog server-side template injection9.8CISA ADP v3.10.5%2025-10-28
CVE-2025-60354blog-vue-springboot unauthorized access7.5CISA ADP v3.10.3%2025-10-28
CVE-2025-60349Prevx pxscan.sys driver denial of service7.5CISA ADP v3.10.4%2025-10-28Exploit code
CVE-2025-59837Astro allows bypass of image proxy domain validation leading to SSRF and potential XSS7.2CNA v3.10.4%2025-10-28Fix
CVE-2025-56399alexusmai laravel-file-manager file upload feature code injection8.8CISA ADP v3.10.6%2025-10-28Exploit code
CVE-2025-55758Extension jdownloads.com CSRF vectors in jDownloads component for Joomla5.4CISA ADP v3.10.1%2025-10-28
CVE-2025-54605Bitcoin Core resource exhaustion7.5CISA ADP v3.10.4%2025-10-28Fix
CVE-2025-54604Bitcoin Core resource exhaustion7.5CISA ADP v3.10.4%2025-10-28Fix
CVE-2025-53855GCC Productions Fade In XML parser functionality out-of-bounds write7.8CNA v3.10.3%2025-10-28
CVE-2025-53814GCC Productions Fade In XML parser functionality use-after-free7.8CNA v3.10.3%2025-10-28
CVE-2025-43024HP ThinPro SP8 Security Updates5.1CNA v4.00.3%2025-10-28Fix
CVE-2025-43017HP ThinPro SP8 Security Updates8.5CNA v4.00.3%2025-10-28Fix
CVE-2025-41090Improper access control in CCN-CERT microCLAUDIA7.6CNA v4.00.3%2025-10-28Exploit code
CVE-2025-40843Buffer overflow in CodeChecker log command5.9CNA v3.10.2%2025-10-28Fix
CVE-2025-40082Linux kernel hfsplus out-of-bounds read7.1CNA v3.10.2%2025-10-28Fix
CVE-2025-40081Linux kernel ARM SPE perf buffer offset calculation integer overflow7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40080Linux kernel NBD socket type validation vulnerability–0.2%2025-10-28Fix
CVE-2025-40079Linux kernel RISC-V BPF struct_ops return values denial of service7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40078Linux kernel BPF sock_addr access checks vulnerability–0.2%2025-10-28Fix
CVE-2025-40077Linux kernel f2fs file system vulnerability–0.2%2025-10-28Fix
CVE-2025-40076Linux kernel R-Car PCIe host controller null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40075Linux kernel TCP metrics cache vulnerability8.1CNA v3.10.4%2025-10-28Fix
CVE-2025-40074Linux kernel ipv4 use-after-free9.8CNA v3.10.5%2025-10-28Fix
CVE-2025-40073Linux kernel MSM DRM SSPP plane validation null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40072Linux kernel fanotify mount marks null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40071In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_up–0.2%2025-10-28Fix
CVE-2025-40070Linux kernel PPS character device registration vulnerability–0.2%2025-10-28Fix
CVE-2025-40069Linux kernel MSM DRM VM_BIND vulnerability7.8CNA v3.10.1%2025-10-28Fix
CVE-2025-40068Linux kernel NTFS3 runlist decoder integer overflow8.4CNA v3.10.2%2025-10-28Fix
CVE-2025-40067Linux kernel NTFS3 index allocation vulnerability7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40066Linux kernel mt7996 Wi-Fi driver null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40065Linux kernel RISC-V KVM hgatp register handling vulnerability–0.2%2025-10-28Fix
CVE-2025-40064Linux kernel SMC pnet device lookup use-after-free7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40063Linux kernel crypto compression API vulnerability7.0CNA v3.10.1%2025-10-28Fix
CVE-2025-40062Linux kernel HiSilicon QM crypto driver double free–0.2%2025-10-28Fix
CVE-2025-40061Linux kernel RDMA rxe driver race condition7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40060Linux kernel coresight TRBE buffer allocator vulnerability–0.2%2025-10-28Fix
CVE-2025-40059Linux kernel coresight driver null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40058In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must8.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40057Linux kernel PTP virtual clocks vulnerability–0.2%2025-10-28Fix
CVE-2025-40056Linux kernel vhost vringh driver vulnerability–0.2%2025-10-28Fix
CVE-2025-40055Linux kernel OCFS2 cluster connect double free–0.2%2025-10-28Fix
CVE-2025-40054Linux kernel f2fs page bio merging use-after-free7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40053Linux kernel dlink null pointer dereference7.5CNA v3.10.6%2025-10-28Fix
CVE-2025-40052Linux kernel SMB client crypto buffer handling vulnerability–0.2%2025-10-28Fix
CVE-2025-40051Linux kernel vhost vringh vulnerability7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40050Linux kernel BPF verifier vulnerability–0.2%2025-10-28Fix
CVE-2025-40049Linux kernel Squashfs filesystem vulnerability–0.2%2025-10-28Fix
CVE-2025-40048In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mas7.5CNA v3.10.6%2025-10-28Fix
CVE-2025-40047Linux kernel io_uring waitid race condition7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40046Linux kernel io_uring zero-copy receive integer underflow8.6CNA v3.10.3%2025-10-28Fix
CVE-2025-40045Linux kernel wcd937x audio codec driver vulnerability7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40044Linux kernel UDF filesystem out-of-bounds read7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40043Linux kernel NFC NCI packet parsing improper input validation8.8CNA v3.10.3%2025-10-28Fix
CVE-2025-40042Linux kernel kprobe tracing initialization race condition–0.2%2025-10-28Fix
CVE-2025-40041Linux kernel LoongArch BPF struct ops denial of service7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40040Linux kernel KSM madvise handling denial of service7.8CNA v3.10.4%2025-10-28Exploit codeKCVFix
CVE-2025-40039Linux kernel ksmbd RPC handle list race condition8.8CNA v3.10.3%2025-10-28Fix
CVE-2025-40038Linux kernel KVM SVM fastpath emulation vulnerability7.1CNA v3.10.2%2025-10-28Fix
CVE-2025-40037Linux kernel simplefb framebuffer driver use-after-free–0.2%2025-10-28Fix
CVE-2025-40036Linux kernel fastrpc driver vulnerability–0.2%2025-10-28Fix
CVE-2025-40035Linux kernel uinput driver information disclosure–0.2%2025-10-28Fix
CVE-2025-40034Linux kernel PCI AER error reporting null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40033Linux kernel PRU remoteproc driver null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40032Linux kernel PCI endpoint test driver null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40031Linux kernel tee null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40030Linux kernel pinctrl subsystem vulnerability–0.2%2025-10-28Fix
CVE-2025-40029Linux kernel fsl-mc bus driver null pointer dereference–0.2%2025-10-28Fix
CVE-2025-40028Linux kernel binder driver double free7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40027Linux kernel 9p client request cancellation vulnerability7.8CNA v3.10.2%2025-10-28Fix
CVE-2025-40026Linux kernel KVM x86 L1 intercept handling vulnerability7.9CNA v3.10.2%2025-10-28Fix
CVE-2025-40025Linux kernel f2fs node footer validation vulnerability7.8CNA v3.10.1%2025-10-28Fix
CVE-2025-36386IBM Maximo Application Suite Maximo Manage application authentication bypass9.8CNA v3.10.6%2025-10-28Fix
CVE-2025-36085IBM Concert server-side request forgery5.4CNA v3.10.2%2025-10-28Fix
CVE-2025-36083IBM Concert heap memory information disclosure6.2CNA v3.10.1%2025-10-28Fix
CVE-2025-36081IBM Concert log injection5.3CNA v3.10.2%2025-10-28Fix
CVE-2025-34318IPFire stored XSS via DNS Creation (proxy.cgi)5.1CNA v4.00.5%2025-10-28Emerging ThreatsFix
CVE-2025-34317IPFire stored XSS via DNS Creation (dns.cgi)5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34316IPFire stored XSS via Mail Server settings5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34315IPFire stored XSS via Remote Syslog Server Address5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34314IPFire stored XSS via Time Constraint Rule URL Filter5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34313IPFire stored XSS via User Quota Rule URL Filter5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34312IPFire command injection via URL Filter Blacklist8.8v3.12.2%2025-10-28Emerging ThreatsFix
CVE-2025-34311IPFire command injection via Proxy Report Creation8.8v3.113.5%2025-10-28Emerging ThreatsFix
CVE-2025-34310IPFire stored XSS via Quality of Service (QoS) settings5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34309IPFire stored XSS via Dynamic DNS host5.4v3.15.3%2025-10-28Emerging ThreatsFix
CVE-2025-34308IPFire stored XSS via Default Time Sync5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34307IPFire stored XSS via Default Country Search5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34306IPFire stored XSS via Default IP Search Value5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34305IPFire stored XSS via multiple Methods in cleanhtml5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34304IPFire SQL injection via OpenVPN Connection Logs6.5NVD v3.10.4%2025-10-28Emerging ThreatsFix
CVE-2025-34303IPFire stored XSS via Whitelisted Host Creation5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34302IPFire stored XSS via Service Creation5.4v3.10.5%2025-10-28Emerging ThreatsFix
CVE-2025-34301IPFire stored XSS via Location Group Creation5.4v3.15.3%2025-10-28Emerging ThreatsFix
CVE-2025-33133IBM DB2 High Performance Unload out-of-bounds write6.5CNA v3.10.3%2025-10-28Fix
CVE-2025-33132IBM DB2 High Performance Unload denial of service6.5CNA v3.10.3%2025-10-28Fix
CVE-2025-33131IBM DB2 High Performance Unload buffer overflow6.5CNA v3.10.3%2025-10-28Fix
CVE-2025-33126IBM DB2 High Performance Unload denial of service6.5CNA v3.10.3%2025-10-28Fix
CVE-2025-27093Sliver does not restricted traffic between Wireguard clients6.3CNA v3.10.3%2025-10-28Fix
CVE-2025-12425Azure Access Technology BLU-IC2 local privilege escalation10.0CNA v4.00.2%2025-10-28
CVE-2025-12424Azure Access Technology BLU-IC2 privilege escalation through SUID-bit Binary10.0CNA v4.00.3%2025-10-28
CVE-2025-12423Azure Access Technology BLU-IC2 denial of service Protocol Manipulation10.0CNA v4.00.3%2025-10-28
CVE-2025-12422Azure Access Technology BLU-IC2 vulnerable Upgrade feature (arbitrary file write)10.0CNA v4.00.5%2025-10-28
CVE-2025-12390Keycloak vulnerable to session takeovers due to reuse of session identifiers6.0CNA v3.10.1%2025-10-28Fix
CVE-2025-12380Mozilla Firefox use-after-free in WebGPU internals triggered from a compromised child process9.8CISA ADP v3.10.3%2025-10-28Fix
CVE-2025-12378code-projects Simple Food Ordering System addproduct.php unrestricted upload9.8NVD v3.10.5%2025-10-28
CVE-2025-12347MaxSite CMS save-file-ajax.php unrestricted upload8.8NVD v3.10.4%2025-10-28
CVE-2025-12346MaxSite CMS HTTP header uploads-require-maxsite.php unrestricted upload8.8NVD v3.10.4%2025-10-28
CVE-2025-12344Yonyou U8 Cloud request Header NCloudGatewayServlet unrestricted upload5.3CNA v4.00.3%2025-10-28
CVE-2025-12342Serdar Bayram Ghost Hot Spot Login Auth.php SQL injection6.9CNA v4.00.3%2025-10-28
CVE-2025-12341ermig1979 AntiDupl Delete Duplicate Image AntiDupl.NET.WinForms.exe link following8.5CNA v4.00.2%2025-10-28
CVE-2025-12339Campcodes Retro Basketball Shoes Online Store admin_football.php SQL injection9.8NVD v3.10.4%2025-10-28
CVE-2025-12338Campcodes Retro Basketball Shoes Online Store admin_product.ph SQL injection9.8NVD v3.10.5%2025-10-28
CVE-2025-12337Campcodes Retro Basketball Shoes Online Store admin_feature.php SQL injection9.8NVD v3.10.5%2025-10-28
CVE-2025-12336Campcodes Retro Basketball Shoes Online Store admin_index.php SQL injection9.8NVD v3.10.5%2025-10-28
CVE-2025-12335code-projects E-Commerce Website supplier_update.php cross-site scripting6.1NVD v3.10.4%2025-10-28
CVE-2025-12332SourceCodester Student Grades Management System admin.php delete_user cross-site scripting4.8NVD v3.10.4%2025-10-28
CVE-2025-12103Openshift-ai: Trusty ai grants all authenticated users to list pods in any namespace5.0CNA v3.10.3%2025-10-28Fix
CVE-2025-11735HUSKY Products Filter Professional for WooCommerce WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2025-10-28Fix
CVE-2025-11375Consul's event endpoint is vulnerable to denial of service6.5CNA v3.10.4%2025-10-28Fix
CVE-2025-11374Consul's KV endpoint is vulnerable to denial of service6.5CNA v3.10.4%2025-10-28Fix
CVE-2025-10939keycloak Org.Keycloak/keycloak-quarkus-server: Unable to restrict access to the admin console3.7CNA v3.10.4%2025-10-28Fix
CVE-2025-10151Softing Industrial Automation smartLink HW-PN improper locking7.2CNA v4.00.2%2025-10-28
CVE-2025-10150Softing Industrial Automation smartLink HW-PN webserver crash caused by scanning on TCP port 808.7CNA v4.00.3%2025-10-28
CVE-2025-9313Unauthorized database access in Asseco mMedica9.3CNA v4.00.4%2025-10-28Fix
CVE-2025-1038Hitachi Energy TropOS 4th Gen OS command injection7.5CNA v4.00.3%2025-10-28Fix
CVE-2025-1037Hitachi Energy TropOS 4th Gen improper privilege management7.5CNA v4.00.2%2025-10-28Fix
CVE-2025-1036Hitachi Energy TropOS 4th Gen command injection8.7CNA v4.01.0%2025-10-28Fix
CVE-2025-62988Slider Templates WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.2%2025-10-27
CVE-2025-62987Builderall Builder for WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62986FanBridge signup WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62985Simple Pull Quote WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62984WP AdCenter WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62983Posts By Tag WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62982Dynamic User Directory WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-27Fix
CVE-2025-62981WP Gravity Forms Zoho CRM and Bigin WordPress plugin open redirection4.7CNA v3.10.2%2025-10-27Fix
CVE-2025-62980Persian Admnin Fonts WordPress plugin broken access control5.4CNA v3.10.2%2025-10-27Fix
CVE-2025-62979ACF to REST API WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-10-27
CVE-2025-62978KiotViet Sync WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27
CVE-2025-62977百度站长SEO合集(支持百度/神马/Bing/头条推送) WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62976Sendle Shipping WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62975Raychat WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-27
CVE-2025-62974Headline Analyzer WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62973BuddyForms WordPress plugin broken access control5.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62972WebinarPress WordPress plugin broken access control4.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62971Attesa Extra WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62970Link Whisper Free WordPress plugin broken access control5.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62969NextMove Lite WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62968WP Last Modified Info WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62967DirectoryPress WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62966GoCache WordPress plugin broken access control5.4CNA v3.10.2%2025-10-27Fix
CVE-2025-62965Admin Management Xtended WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62964MDTF WordPress plugin broken access control5.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62963Estatik WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62962CloudSearch WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62959Paid Videochat Turnkey Site WordPress plugin remote code execution (RCE)9.1CNA v3.10.5%2025-10-27Fix
CVE-2025-62958Simple Content Templates for Blog Posts and Pages WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-27
CVE-2025-62957NikanWP WooCommerce Reporting WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27Fix
CVE-2025-62956Reloadly WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62954Revive Old Posts WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62953Welcart e-Commerce WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62952ChatBot WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62951H5P WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62949Activity Plus Reloaded for BuddyPress WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62948Date counter WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62947Publitio WordPress plugin sensitive data exposure5.0CNA v3.10.3%2025-10-27
CVE-2025-62946Everest Backup WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62945Did Prestashop Display WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62944MSTW CSV EXPORTER WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27
CVE-2025-62943Next Page, Not Next Post WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62942WP Mapbox GL JS Maps WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62941Events Maker by dFactory WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62940Blox Lite WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62939Open Currency Converter WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62938Reoon Email Verifier WordPress plugin broken access control4.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62937Post List Featured Image WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62936xSmart WordPress theme content injection4.3CNA v3.10.3%2025-10-27
CVE-2025-62935Open Close WooCommerce Store WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62934WP Business Hours WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62933Awesome Testimonials WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62932Table Block by RioVizual WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62931MSN Partner Hub WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27
CVE-2025-62930MapSVG WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62929Testimonial Slider WordPress plugin broken access control6.5CNA v3.10.3%2025-10-27
CVE-2025-62928SEO Meta Description Updater WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27
CVE-2025-62927Nelio Content WordPress plugin broken access control6.5CNA v3.10.3%2025-10-27Fix
CVE-2025-62925Conversios.io WordPress plugin broken access control5.4CNA v3.10.3%2025-10-27Fix
CVE-2025-62924Post Grid and Gutenberg Blocks WordPress plugin broken access control6.5CNA v3.10.3%2025-10-27Fix
CVE-2025-62923Marquee Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62922Export Categories WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27
CVE-2025-62921Bulk Auto Image Title Attribute WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62920USERCENTRICS CMP WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-27
CVE-2025-62919TS Demo Importer WordPress plugin broken access control5.4CNA v3.10.3%2025-10-27
CVE-2025-62918IgnitionDeck WordPress plugin broken access control5.4CNA v3.10.3%2025-10-27
CVE-2025-62917Tooltipy WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62916Flights and Hotels Booking WP WordPress plugin broken access control5.4CNA v3.10.3%2025-10-27
CVE-2025-62915SMS Contact Form 7 Notifications by ClickSend WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27
CVE-2025-62913Opal Service WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62912SiteGround Email Marketing WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62911Rock Convert WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62910Video Gallery by Huzzaz WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62909Smart WeTransfer WordPress plugin broken access control4.3CNA v3.10.3%2025-10-27
CVE-2025-62907Custom Post Type Attachment WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62906Referral Link Tracker WordPress plugin broken access control4.3CNA v3.10.3%2025-10-27
CVE-2025-62905Query Posts WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62904WP Geo WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62903WPC Smart Messages for WooCommerce WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62902WP Popup Builder WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62900Popular Posts by Webline WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62899Photospace Responsive WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-10-27
CVE-2025-62898Links shortcode WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62897WP Recipe Maker WordPress plugin content injection5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62896Multilang Contact Form WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27Fix
CVE-2025-62895Atarim WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62894ACF Recent Posts Widget WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27
CVE-2025-62892Sunshine Photo Cart WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62891Off-Canvas Sidebars and Menus (Slidebars) WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-27Fix
CVE-2025-62890Premmerce Brands for WooCommerce WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-27Fix
CVE-2025-62889King Addons for Elementor WordPress plugin broken access control6.5CNA v3.10.3%2025-10-27Fix
CVE-2025-62887King Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62886Pricing Table builder WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-10-27
CVE-2025-62885WP VR WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-62884Coupon Affiliates WordPress plugin broken access control5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62883Premmerce User Roles WordPress plugin broken access control4.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62882Seriously Simple Podcasting WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62881WP-Lister Lite for eBay WordPress plugin broken access control4.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62793eLabFTW HTML / CSS injection via Malicious SVG upload leads to Credential Theft / clickjacking6.8CNA v3.10.3%2025-10-27Fix
CVE-2025-62784InventoryGui allows item duplication in GUIs which use GuiStorageElement5.3CNA v4.00.2%2025-10-27Fix
CVE-2025-62783InventoryGui affected by item duplication in GUIs which use GuiStorageElement5.0CNA v3.10.3%2025-10-27Fix
CVE-2025-62782InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement5.9CNA v4.00.3%2025-10-27Fix
CVE-2025-62781PILOS is missing session regeneration after password change5.0CNA v3.10.2%2025-10-27Fix
CVE-2025-62779Frappe Learning users were able to add HTML through input fields in the Job form1.2CNA v4.00.2%2025-10-27Fix
CVE-2025-62778Frappe Learning allowed students to access the Quiz form via direct URL1.3CNA v4.00.2%2025-10-27Fix
CVE-2025-62725Docker Compose vulnerable to path traversal via OCI Artifact Layer Annotations8.9CNA v4.013.7%2025-10-27Fix
CVE-2025-62594ImageMagick CLAHEImage function denial of service4.7CNA v3.10.4%2025-10-27Fix
CVE-2025-62524THM-Health PILOS X-Powered-By header information disclosure5.3CNA v3.10.3%2025-10-27Fix
CVE-2025-62523PILOS Misconfigured the Access-Control-Allow-Origin header6.3CNA v3.10.2%2025-10-27Fix
CVE-2025-62263Liferay Portal vulnerable to cross-site scripting4.8CNA v4.00.2%2025-10-27Fix
CVE-2025-62262Liferay Portal vulnerable to information exposure4.6CNA v4.00.1%2025-10-27Fix
CVE-2025-62261Liferay Portal Stores Password Reset Tokens in Plain Text6.9CNA v4.00.3%2025-10-27Fix
CVE-2025-62260Liferay Portal vulnerable to DoS via Crafted Headless API request7.1CNA v4.00.4%2025-10-27Fix
CVE-2025-62259Liferay Portal Does not Limit Access to APIs before Email Verification6.9CNA v4.00.2%2025-10-27Fix
CVE-2025-62258Liferay Portal vulnerable to CSRF in Headless APIs7.0CNA v4.00.2%2025-10-27Fix
CVE-2025-62253Liferay Portal vulnerable to open redirect6.9CNA v4.00.2%2025-10-27Fix
CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS5.3CISA ADP v3.11.2%2025-10-27Fix
CVE-2025-61482NetKnights privacyIDEA Authenticator OTP secret storage insecure storage of sensitive information7.2CISA ADP v3.10.1%2025-10-27
CVE-2025-61481MikroTik RouterOS and SwOS cleartext transmission of sensitive information10.0CISA ADP v3.10.3%2025-10-27
CVE-2025-61385Pg8000 SQL injection vulnerability via a specially crafted Python list input9.6CISA ADP v3.10.4%2025-10-27Fix
CVE-2025-61247online-shopping-system-php login.php SQL injection8.2CISA ADP v3.10.2%2025-10-27
CVE-2025-61105FRRouting null pointer dereference7.5CISA ADP v3.10.5%2025-10-27Fix
CVE-2025-61102FRRouting null pointer dereference7.5CISA ADP v3.10.5%2025-10-27Fix
CVE-2025-61101FRRouting null pointer dereference7.5CISA ADP v3.10.5%2025-10-27Fix
CVE-2025-61100FRRouting null pointer dereference7.5CISA ADP v3.10.5%2025-10-27Fix
CVE-2025-61099FRRouting null pointer dereference7.5CISA ADP v3.10.5%2025-10-27Fix
CVE-2025-60983Rubikon Banking Solution reflected cross-site scripting5.4CISA ADP v3.10.2%2025-10-27
CVE-2025-60982Educare ERP insecure direct object reference5.4CISA ADP v3.10.2%2025-10-27
CVE-2025-60791Easywork Enterprise license activation cleartext storage of sensitive information6.2CISA ADP v3.10.1%2025-10-27Exploit code
CVE-2025-60425Nagios Fusion session hijacking8.6CISA ADP v3.11.0%2025-10-27Fix
CVE-2025-60424Nagios Fusion improper authentication7.6CISA ADP v3.10.7%2025-10-27Exploit codeFix
CVE-2025-60291eTimeTrackLite Web improper access control9.1CISA ADP v3.10.3%2025-10-27
CVE-2025-59463SICK TLOC100-100 all Firmware denial of service (DoS) via chunk size mismatch4.3CNA v3.10.4%2025-10-27
CVE-2025-59462SICK TLOC100-100 all Firmware denial of service (DoS) via delayed or missing client response6.5CNA v3.10.5%2025-10-27
CVE-2025-59461SICK TLOC100-100 all Firmware API does not require authentication7.6CNA v3.10.5%2025-10-27
CVE-2025-59460SICK TLOC100-100 with Firmware unsecure access configuration7.5CNA v3.10.4%2025-10-27Fix
CVE-2025-59459SICK TLOC100-100 denial of service (DoS) via resource consumption5.5CNA v3.10.3%2025-10-27Fix
CVE-2025-59151Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection8.2CNA v3.10.4%2025-10-27Fix
CVE-2025-58918Entrada WordPress theme cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-10-27
CVE-2025-58356Constellation allows insecure use of LUKS2 persistent storage partitions8.3CNA v4.00.1%2025-10-27Fix
CVE-2025-55754Apache Tomcat: Console manipulation via escape sequences in log messages9.6CISA ADP v3.110.2%2025-10-27Fix
CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled7.5CISA ADP v3.164.4%2025-10-27Emerging ThreatsExploit codeFix
CVE-2025-54970Baesystems Socet Gxp improper access control6.5CISA ADP v3.10.3%2025-10-27Fix
CVE-2025-54969Baesystems Socet Gxp cross-site request forgery6.1CISA ADP v3.10.1%2025-10-27
CVE-2025-54968Baesystems Socet Gxp improper access control8.8CISA ADP v3.10.4%2025-10-27Fix
CVE-2025-54967Baesystems Socet Gxp cross-site scripting6.5CISA ADP v3.10.4%2025-10-27Fix
CVE-2025-54965Baesystems Socet Gxp cross-site scripting6.1CISA ADP v3.10.2%2025-10-27Fix
CVE-2025-53533Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page5.1CNA v4.00.6%2025-10-27NucleiExploit codeFix
CVE-2025-52268StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.7.5CISA ADP v3.10.3%2025-10-27
CVE-2025-52264StarCharge Artemis AC Charger 7-22 kW download.cgi buffer overflow8.0CISA ADP v3.10.3%2025-10-27
CVE-2025-52263Artemis AC Charger 7-22 kW web configuration module vulnerability8.0CISA ADP v3.10.2%2025-10-27
CVE-2025-50055OpenVPN Access Server SAML Authentication module cross-site scripting6.4CISA ADP v3.10.2%2025-10-27
CVE-2025-48088Ultimate Addons for WPBakery Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-46602Dell SupportAssist OS Recovery sensitive information in an accessible file4.4CNA v3.10.1%2025-10-27Fix
CVE-2025-46583DOS vulnerability in ZTE MC889A Pro product5.3CNA v3.10.4%2025-10-27
CVE-2025-46582Private key disclosure vulnerability in ZTE ZXMP M721 Product7.7CNA v3.10.3%2025-10-27
CVE-2025-41384Reflected cross-site scripting (XSS) in SuiteCRM6.1v3.10.2%2025-10-27Fix
CVE-2025-41068Reachable assertion vulnerability in Open5GS7.5NVD v3.10.4%2025-10-27Fix
CVE-2025-41067Reachable assertion vulnerability in Open5GS7.5NVD v3.10.4%2025-10-27Exploit codeFix
CVE-2025-41009SQL injection on the virtual campus platform of Diseño de Recursos Educativos9.3CNA v4.00.3%2025-10-27
CVE-2025-36170IBM QRadar SIEM cross-site scripting6.4CNA v3.10.2%2025-10-27Fix
CVE-2025-36138IBM QRadar SIEM cross-site scripting6.4CNA v3.10.2%2025-10-27Fix
CVE-2025-36121HTML injection vulnerability in a Specific URL endpoint of the IBM OpenPages application5.4CNA v3.10.2%2025-10-27Fix
CVE-2025-36007IBM QRadar SIEM incorrect privilege assignment7.8CNA v3.10.1%2025-10-27Fix
CVE-2025-34292BeWelcome/Rox PHP object injection RCE9.4CNA v4.00.8%2025-10-27
CVE-2025-34133Wimi Teamwork API cross-site request forgery7.0CNA v4.00.3%2025-10-27Fix
CVE-2025-32785Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management2.0CNA v4.00.3%2025-10-27Fix
CVE-2025-27225Rocket Software Trufusion Enterprise information disclosure7.5CISA ADP v3.118.4%2025-10-27Nuclei
CVE-2025-27224Rocket Software Trufusion Enterprise path traversal9.8CISA ADP v3.10.9%2025-10-27
CVE-2025-27223Rocket Software Trufusion Enterprise sensitive cookie without the HttpOnly flag7.5CISA ADP v3.12.2%2025-10-27Nuclei
CVE-2025-27222Rocket Software Trufusion Enterprise path traversal8.6CISA ADP v3.12.0%2025-10-27Reported exploitedNuclei
CVE-2025-26862PingFederate unexpected browser flow initiation in redirectless mode0.0CNA v4.00.3%2025-10-27Fix
CVE-2025-12365Azure Access Technology BLU-IC2 Error Messages Wrapped in HTTP header6.9CNA v4.00.3%2025-10-27
CVE-2025-12364Azure Access Technology BLU-IC2 weak password Policy10.0CNA v4.00.3%2025-10-27
CVE-2025-12363Azure Access Technology BLU-IC2 email password disclosure10.0CNA v4.00.3%2025-10-27
CVE-2025-12351Honeywell S35 Series Cameras user controller privilege escalation6.8CNA v3.10.2%2025-10-27Fix
CVE-2025-12334code-projects E-Commerce Website product_add.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12333code-projects E-Commerce Website supplier_add.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12331Willow CMS add unrestricted upload7.2NVD v3.10.4%2025-10-27
CVE-2025-12330Willow CMS Add Post add cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12329shawon100 RUET OJ details.php SQL injection6.5NVD v3.10.3%2025-10-27
CVE-2025-12328shawon100 RUET OJ contestproblem.php SQL injection6.5NVD v3.10.3%2025-10-27
CVE-2025-12327shawon100 RUET OJ description.php SQL injection6.5NVD v3.10.3%2025-10-27
CVE-2025-12326shawon100 RUET OJ POST request process.php SQL injection7.5NVD v3.10.5%2025-10-27
CVE-2025-12325SourceCodester Best Salon Management System forgot-password.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12322Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflow8.7CNA v4.00.8%2025-10-27
CVE-2025-12316code-projects Courier Management System edit-courier.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12315code-projects Food Ordering System menu.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12314code-projects Food Ordering System deleteitem.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12313D-Link DI-7001 MINI msp_info.htm command injection9.8NVD v3.14.0%2025-10-27
CVE-2025-12312PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12311PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12310VirtFusion Email Change _settings excessive authentication6.9CNA v4.00.4%2025-10-27
CVE-2025-12309code-projects Nero Social Networking Site friendprofile.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12308code-projects Nero Social Networking Site deletemessage.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12307code-projects Nero Social Networking Site addfriend.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12306code-projects Nero Social Networking Site acceptoffres.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12305quequnlong shiyi-blog Job SysJobController.java deserialization9.8NVD v3.10.5%2025-10-27
CVE-2025-12304dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization5.3CNA v4.00.3%2025-10-27
CVE-2025-12303PHPGurukul Curfew e-Pass Management System admin-profile.php cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12302code-projects Simple Food Ordering System editproduct.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12301code-projects Simple Food Ordering System editproduct.php unrestricted upload9.8NVD v3.10.5%2025-10-27
CVE-2025-12300code-projects Simple Food Ordering System addcategory.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12299code-projects Simple Food Ordering System addproduct.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12298code-projects Simple Food Ordering System editcategory.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12297atjiu pybbs UserApiController.java information disclosure5.3CNA v4.00.4%2025-10-27
CVE-2025-12296D-Link DAP-2695 Firmware Update sub_4174B0 os command injection9.8NVD v3.17.0%2025-10-27
CVE-2025-12295D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification8.1NVD v3.10.4%2025-10-27
CVE-2025-12294SourceCodester Point of Sales delete_category.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12293SourceCodester Point of Sales category.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12292SourceCodester Point of Sales index.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12291ashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted upload5.1CNA v4.00.3%2025-10-27
CVE-2025-12290A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some unknown functionality of the file /i/359. The manipulation of the argument keywords leads to cross site scripting. The attack is possible to b5.3CNA v4.00.4%2025-10-27
CVE-2025-12289A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unknown functionality of the file /Point/index/activity_state/1/category_id/1001. Executing manipulation of the argument category_id can lead to5.3CNA v4.00.4%2025-10-27
CVE-2025-12288Bdtask Pharmacy Management System User Profile edit_user authorization8.8NVD v3.10.5%2025-10-27
CVE-2025-12287Bdtask Wholesale Inventory Control and Inventory Management System edit_profile SQL injection7.2NVD v3.10.5%2025-10-27
CVE-2025-12286VeePN AVService avservice.exe unquoted search path7.3CNA v4.00.2%2025-10-27
CVE-2025-12283code-projects Client Details System authorization8.1NVD v3.10.5%2025-10-27
CVE-2025-12282code-projects Client Details System manage-users.php cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12281code-projects Client Details System clientview.php cross-site scripting5.4NVD v3.10.3%2025-10-27
CVE-2025-12280code-projects Client Details System update-clients.php cross-site scripting5.4NVD v3.10.3%2025-10-27
CVE-2025-12279code-projects Client Details System welcome.php cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12277Abdullah-Hasan-Sajjad Online-School studentLogin.php SQL injection6.9CNA v4.00.3%2025-10-27
CVE-2025-12276LearnHouse Image information disclosure7.5v3.10.4%2025-10-27
CVE-2025-12274Tenda CH22 P2pListFilter fromP2pListFilter buffer overflow8.7CNA v4.00.7%2025-10-27Emerging Threats
CVE-2025-12273Tenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflow9.8NVD v3.11.0%2025-10-27Emerging Threats
CVE-2025-12272Tenda CH22 addressNat fromAddressNat buffer overflow9.8NVD v3.10.8%2025-10-27Emerging Threats
CVE-2025-12271Tenda CH22 RouteStatic fromRouteStatic buffer overflow9.8NVD v3.11.0%2025-10-27Emerging Threats
CVE-2025-12270LearnHouse Student Assignment Submission sub_file resource injection7.5v3.10.4%2025-10-27
CVE-2025-12269LearnHouse Account setting previews cross-site scripting5.4v3.10.3%2025-10-27
CVE-2025-12268LearnHouse Course Thumbnail courses unrestricted upload9.8v3.10.4%2025-10-27
CVE-2025-12267abhicodebox ModernShop search cross-site scripting5.3CNA v4.00.3%2025-10-27
CVE-2025-12266Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection5.3CNA v4.00.3%2025-10-27
CVE-2025-12265Tenda CH22 VirtualSer fromVirtualSer buffer overflow9.8NVD v3.11.0%2025-10-27Emerging Threats
CVE-2025-12264Wisencode Create Support Ticket handler cross-site scripting5.1CNA v4.00.2%2025-10-27
CVE-2025-12263code-projects Online Event Judging System edit_judge.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12262code-projects Online Event Judging System edit_criteria.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12261CodeAstro Gym Management System remove-announcement.php SQL injection8.8NVD v3.10.5%2025-10-27
CVE-2025-12260TOTOLINK A3300R POST parameter cstecgi.cgi setSyslogCfg stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12259TOTOLINK A3300R POST parameter cstecgi.cgi setScheduleCfg stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12258TOTOLINK A3300R POST parameter cstecgi.cg setOpModeCfg stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12257SourceCodester Online Student Result System view_result.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12256code-projects Online Event Judging System edit_contestant.php SQL injection8.8NVD v3.10.4%2025-10-27
CVE-2025-12255code-projects Online Event Judging System add_contestant.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12254code-projects Online Event Judging System add_judge.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12253AMTT Hotel Broadband Operation System get_expiredtime.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12252code-projects Online Event Judging System action.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12251OpenWGA Admin UI cross-site scripting5.1CNA v4.00.3%2025-10-27
CVE-2025-12250OpenWGA TMLScript API WGA.file path traversal5.1CNA v4.00.5%2025-10-27
CVE-2025-12249Axosoft Scrum and Bug Tracking Edit Ticket page CSV injection5.3CNA v4.00.3%2025-10-27
CVE-2025-12248CLTPHP search.html SQL injection6.9CNA v4.00.3%2025-10-27
CVE-2025-12247Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search path7.3CNA v4.00.2%2025-10-27Fix
CVE-2025-12246chatwoot Admin IframeLoader.vue cross-site scripting6.1v3.10.4%2025-10-27
CVE-2025-12245chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation5.3v3.10.3%2025-10-27
CVE-2025-12244code-projects Simple E-Banking System register.php cross-site scripting6.1NVD v3.10.4%2025-10-27
CVE-2025-12243code-projects Client Details System GET parameter welcome.php SQL injection8.8NVD v3.10.4%2025-10-27
CVE-2025-12242CodeAstro Gym Management System check-attendance.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12241TOTOLINK A3300R POST parameter cstecgi.cgi setLanguageCfg stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12240TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow9.8NVD v3.10.8%2025-10-27
CVE-2025-12239TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflow9.8NVD v3.10.8%2025-10-27
CVE-2025-12238code-projects Automated Voting System user.php SQL injection8.8NVD v3.10.3%2025-10-27
CVE-2025-12237Projectworlds Advanced Library Management System index.php SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12236Tenda CH22 DhcpListClient fromDhcpListClient buffer overflow8.8NVD v3.13.5%2025-10-27Emerging Threats
CVE-2025-12235Tenda CH22 SetIpBind fromSetIpBind buffer overflow8.0NVD v3.15.2%2025-10-27Emerging Threats
CVE-2025-12234Tenda CH22 SafeMacFilter fromSafeMacFilter buffer overflow8.8NVD v3.11.1%2025-10-27Emerging Threats
CVE-2025-12233Tenda CH22 SafeUrlFilter fromSafeUrlFilter buffer overflow8.8NVD v3.14.7%2025-10-27Emerging Threats
CVE-2025-12232Tenda CH22 SafeClientFilter fromSafeClientFilter buffer overflow9.8NVD v3.14.9%2025-10-27Emerging Threats
CVE-2025-12231Projectworlds Expense Management System Expense Categories create cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12230Projectworlds Expense Management System Currency create cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12229Projectworlds Expense Management System Roles page create cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12228Projectworlds Expense Management System Users page create cross-site scripting4.8NVD v3.10.3%2025-10-27
CVE-2025-12227Projectworlds Gate Pass Management System add-pass.php cross-site scripting5.4NVD v3.10.2%2025-10-27
CVE-2025-12226SourceCodester Best House Rental Management System admin_class.php save_house SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12225Tenda AC6 HTTP Request WifiGuestSet stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12224Iqbolshoh php-business-website contact.php cross-site scripting5.1CNA v4.00.3%2025-10-27
CVE-2025-12223Bdtask Flight Booking Software Package Information package-information unrestricted upload8.8NVD v3.10.4%2025-10-27
CVE-2025-12222Bdtask Flight Booking Software Deposit deposit unrestricted upload8.8NVD v3.10.4%2025-10-27
CVE-2025-12215Projectworlds Online Shopping System login_submit.php SQL injection9.8NVD v3.10.4%2025-10-27
CVE-2025-12214Tenda O3 sysAutoReboot GetValue stack-based overflow8.7CNA v4.00.8%2025-10-27
CVE-2025-12213Tenda O3 setVlanConfig GetValue stack-based overflow8.7CNA v4.00.8%2025-10-27
CVE-2025-12212Tenda O3 setNetworkService GetValue stack-based overflow8.7CNA v4.00.8%2025-10-27
CVE-2025-12211Tenda O3 setDmzInfo GetValue stack-based overflow9.8NVD v3.10.8%2025-10-27
CVE-2025-12210Tenda O3 AdvSetLanip GetValue stack-based overflow9.8NVD v3.11.1%2025-10-27
CVE-2025-12209Tenda O3 setDhcpConfig GetValue stack-based overflow8.7CNA v4.01.0%2025-10-27
CVE-2025-12208SourceCodester Best House Rental Management System admin_class.php login2 SQL injection9.8NVD v3.10.5%2025-10-27
CVE-2025-12207Kamailio Grammar Rule cfg.y yyerror_at null pointer dereference5.5v3.10.2%2025-10-27
CVE-2025-12206Kamailio rvalue.c rve_is_constant null pointer dereference5.5v3.10.2%2025-10-27
CVE-2025-12205Kamailio Configuration file cfg.lex sr_push_yy_state use-after-free7.8v3.10.2%2025-10-27
CVE-2025-12204Kamailio Configuration file rvalue.c rve_destroy heap-based overflow7.8v3.10.3%2025-10-27
CVE-2025-12203givanz Vvveb Code Editor functions.php sanitizeFileName path traversal4.9NVD v3.10.4%2025-10-27
CVE-2025-12202ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery5.3CNA v4.00.3%2025-10-27
CVE-2025-12201ajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted upload7.2NVD v3.10.6%2025-10-27
CVE-2025-12080Intent Abuse in Google messages for Wear OS for Silent Message Sending6.9CNA v4.00.1%2025-10-27Fix
CVE-2025-12055MPDV Mikrolab MIP 2, FEDRA 2 and HYDRA X $SCHEMAS$ filename parameter path traversal7.5CISA ADP v3.13.8%2025-10-27Nuclei
CVE-2025-11989Missing authorization in GitLab3.7CNA v3.10.2%2025-10-27Fix
CVE-2025-11974Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.4%2025-10-27Fix
CVE-2025-11971Incorrect authorization in GitLab6.5CNA v3.10.2%2025-10-27Fix
CVE-2025-11955Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise8.2CNA v4.00.2%2025-10-27Fix
CVE-2025-11682Stored cross-site scripting in Perx Customer Engagement and Loyalty Platform7.1CNA v4.00.2%2025-10-27Fix
CVE-2025-11447Allocation of resources without limits or throttling in GitLab7.5CNA v3.10.8%2025-10-27Fix
CVE-2025-11248Zoho ManageEngine Endpoint Central Sensitive Information Logged3.2CNA v3.10.5%2025-10-27Fix
CVE-2025-11154IDonate WordPress plugin unauthenticated user deletion5.4CISA ADP v3.10.1%2025-10-27Fix
CVE-2025-10497Allocation of resources without limits or throttling in GitLab7.5CNA v3.10.6%2025-10-27Fix
CVE-2025-10023Centreon Infra Monitoring Services Meta-services module stored cross-site scripting6.2CNA v3.10.2%2025-10-27Fix
CVE-2025-9164Multiple DLL search order hijacking vulnerabilities in Docker Desktop Installer for Windows8.8CNA v4.00.1%2025-10-27
CVE-2025-8432Centreon Infra Monitoring incorrect default permissions8.4CNA v3.10.4%2025-10-27Fix
CVE-2025-6601Business Logic Errors in GitLab2.7CNA v3.10.3%2025-10-27Fix
CVE-2025-12285Azure Access Technology BLU-IC2 Missing Initial Password Change10.0CNA v4.00.3%2025-10-26
CVE-2025-12284Azure Access Technology BLU-IC2 lack of Input Validation6.9CNA v4.00.2%2025-10-26
CVE-2025-12278Azure Access Technology BLU-IC2 Logout Functionality not Working6.9CNA v4.00.2%2025-10-26
CVE-2025-12275Azure Access Technology BLU-IC2 Mail Configuration File Manipulation + command execution10.0CNA v4.00.5%2025-10-26
CVE-2025-8709SQL injection in langchain-ai/langchain7.3CNA v3.00.2%2025-10-26Fix
CVE-2025-55757Extension virtuemart.net XSS in VirtueMart component for Joomla6.1CISA ADP v3.10.2%2025-10-25
CVE-2025-12221Azure Access Technology BLU-IC2 CSRF Token not properly Implemented2.1CNA v4.00.2%2025-10-25
CVE-2025-12220Azure Access Technology BLU-IC2 busybox multiple Known vulnerabilities10.0CNA v4.00.4%2025-10-25
CVE-2025-12219Azure Access Technology BLU-IC2 and BLU-IC4 vulnerable third-party component10.0CNA v4.00.4%2025-10-25
CVE-2025-12218Azure Access Technology BLU-IC2 weak default credentials10.0CNA v4.00.3%2025-10-25
CVE-2025-12217Azure Access Technology BLU-IC2 SNMP Default Community String (public)6.9CNA v4.00.3%2025-10-25
CVE-2025-12216Azure Access Technology BLU-IC2 Malicious / Malformed App can be Installed but not Uninstalled10.0CNA v4.00.2%2025-10-25
CVE-2025-12095Simple Registration for WooCommerce WordPress plugin cross-site request forgery8.8CNA v3.10.2%2025-10-25Fix
CVE-2025-12034Fast Velocity Minify WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-10-25Fix
CVE-2025-12005WP VR WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-25Fix
CVE-2025-11976FuseWP WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-10-25Fix
CVE-2025-11897The7 Ultimate WordPress and WooCommerce theme stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-11893Charitable Donation Plugin for WordPress Fundraising with Recurring Donations and More SQL injection6.5CNA v3.10.4%2025-10-25Fix
CVE-2025-11888ShopEngine Elementor WooCommerce Builder Addon WordPress plugin unauthorized access2.7CNA v3.10.2%2025-10-25Fix
CVE-2025-11879GenerateBlocks WordPress plugin improper authorization to authenticated arbitrary options disclosure6.5CNA v3.10.3%2025-10-25Fix
CVE-2025-11875SpendeOnline.org WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-11823ShopLentor WordPress plugin stored cross-site scripting5.4NVD v3.10.2%2025-10-25Fix
CVE-2025-11760eRoom WordPress plugin information disclosure5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-11564Tutor LMS WordPress plugin unauthorized access5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-11497Advanced Database Cleaner WordPress plugin cross-site request forgery to settings manipulation4.3CNA v3.10.2%2025-10-25Fix
CVE-2025-11269Product Filter by WBW WordPress plugin missing authorization to unauthenticated settings update5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-11255Password Policy Manager WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-25Fix
CVE-2025-11244Password Protected WordPress plugin unauthenticated authorization bypass via IP Address spoofing3.7CNA v3.10.3%2025-10-25Fix
CVE-2025-11238Watu Quiz WordPress plugin unauthenticated stored cross-site scripting via HTTP Referer7.2CNA v3.10.3%2025-10-25Fix
CVE-2025-10737Open Source Genesis Framework WordPress theme stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-10694User Feedback WordPress plugin unauthorized access5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-10637Social Feed Gallery WordPress plugin missing authorization to unauthenticated information exposure5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-10580Widget Options The #1 WordPress Widget and Block Control plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-10579BackWPup WordPress plugin missing authorization to sensitive information exposure5.3CNA v3.10.3%2025-10-25Fix
CVE-2025-10488wpWax Directorist add_listing_action AJAX action path traversal8.1CNA v3.10.9%2025-10-25Fix
CVE-2025-9322Stripe Payment Forms WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2025-10-25Fix
CVE-2025-8666Testimonial Carousel For Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-8588Gutenberg Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-8483Discussion Board WordPress Forum plugin authenticated (Subscriber+) arbitrary shortcode execution6.3CNA v3.10.3%2025-10-25Fix
CVE-2025-8416Product Filter by WBW WordPress plugin unauthenticated SQL injection7.5CNA v3.10.4%2025-10-25Fix
CVE-2025-8413Listeo WordPress theme stored cross-site scripting6.4CNA v3.10.2%2025-10-25Fix
CVE-2025-6680Tutor LMS WordPress plugin missing authorization to sensitive information exposure4.3CNA v3.10.2%2025-10-25Fix
CVE-2025-6639Tutor LMS Pro WordPress plugin insecure direct object reference5.4CNA v3.10.2%2025-10-25Fix
CVE-2025-4203wpForo Forum WordPress plugin unauthenticated SQL injection via get_members function7.5CNA v3.10.4%2025-10-25Fix
CVE-2025-62868Edge CPT WordPress plugin local file inclusion8.1CNA v3.10.5%2025-10-24
CVE-2025-62723FlashMQ does not release memory of queued QoS messages4.3CNA v3.10.3%2025-10-24Fix
CVE-2025-62717Emlog Pro session verification code error due to clearing logic error2.7CNA v4.00.4%2025-10-24Fix
CVE-2025-62716Plane vulnerable to cross-site scripting via open redirect in ?next_path parameter8.1CNA v3.10.3%2025-10-24Fix
CVE-2025-62714Karmada Dashboard API unauthorized access8.7CNA v4.00.5%2025-10-24Fix
CVE-2025-62711Wasmtime vulnerable to segfault when using component resources2.1CNA v4.00.4%2025-10-24Fix
CVE-2025-61931Implem Pleasanter Body stored cross-site scripting4.8CNA v4.00.2%2025-10-24
CVE-2025-61430Simple DNS Plus DNS over TCP handling information disclosure6.5CISA ADP v3.10.3%2025-10-24
CVE-2025-60954microweber weak password requirements8.3CISA ADP v3.10.5%2025-10-24
CVE-2025-60938Openenergymonitor Emoncms improper input validation7.5CISA ADP v3.10.6%2025-10-24
CVE-2025-60936Openenergymonitor Emoncms cross-site scripting6.1CISA ADP v3.10.2%2025-10-24
CVE-2025-60803Antabot White-Jotter register API endpoint command injection9.8CISA ADP v3.10.6%2025-10-24
CVE-2025-60801jishenghua jshERP command injection8.2CISA ADP v3.10.5%2025-10-24
CVE-2025-60735PerfreeBlog unrestricted file upload7.6CISA ADP v3.10.3%2025-10-24
CVE-2025-60731PerfreeBlog unrestricted file upload7.6CISA ADP v3.10.3%2025-10-24
CVE-2025-60730PerfreeBlog incomplete cleanup7.6CISA ADP v3.10.3%2025-10-24
CVE-2025-60729PerfreeBlog buffer over-read5.3CISA ADP v3.10.3%2025-10-24
CVE-2025-60572D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.5%2025-10-24
CVE-2025-60571D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.5%2025-10-24
CVE-2025-60570D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.5%2025-10-24
CVE-2025-60569D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.5%2025-10-24
CVE-2025-60568D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60566D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60565D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60564D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60563D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60562D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60561D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60559D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60558D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60557D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60556D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60555D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60554D-Link DIR-600L buffer overflow9.8CISA ADP v3.10.4%2025-10-24
CVE-2025-60553D-Link DIR-600L buffer overflow9.8CISA ADP v3.10.4%2025-10-24
CVE-2025-60552D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60551D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60550D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60549D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60548D-Link DIR-600L buffer overflow9.8CISA ADP v3.10.4%2025-10-24
CVE-2025-60547D-Link DIR-600L stack-based buffer overflow7.5CISA ADP v3.10.4%2025-10-24
CVE-2025-60419NDIS Usermode IO driver denial of service6.2CISA ADP v3.10.1%2025-10-24
CVE-2025-58070Implem Pleasanter Preview for Attachments stored cross-site scripting5.1CNA v4.00.2%2025-10-24
CVE-2025-56438Nous W3 Smart WiFi Camera firmware update mechanism privilege escalation6.8CISA ADP v3.10.1%2025-10-24
CVE-2025-46425Dell Storage Manager XML external entity injection6.5CNA v3.10.3%2025-10-24Fix
CVE-2025-46185pgCodeKeeper credential storage vulnerability6.2CISA ADP v3.10.1%2025-10-24
CVE-2025-46183pgCodeKeeper deserialization utility deserialization of untrusted data8.2CISA ADP v3.10.3%2025-10-24
CVE-2025-43995Dell Storage Manager improper authentication9.8CNA v3.10.8%2025-10-24Fix
CVE-2025-43994Dell Storage Manager missing authentication8.6CNA v3.10.6%2025-10-24Fix
CVE-2025-40024Linux kernel vhost task handling vulnerability7.8CNA v3.10.2%2025-10-24Fix
CVE-2025-40023Linux kernel Xe GPU virtual function sysfs attributes vulnerability–0.2%2025-10-24Fix
CVE-2025-40022Linux kernel AF_ALG socket interface vulnerability–0.2%2025-10-24Fix
CVE-2025-40021Linux kernel dynamic events tracing interface vulnerability–0.2%2025-10-24Fix
CVE-2025-40020Linux kernel PEAK USB CAN driver vulnerability–0.2%2025-10-24Fix
CVE-2025-40019Linux kernel ESSIV crypto template vulnerability–0.3%2025-10-24Exploit codeFix
CVE-2025-40018Linux kernel IPVS FTP application helper use-after-free7.8CNA v3.10.2%2025-10-24Fix
CVE-2025-36361IBM App Connect Enterprise IWA authentication missing authorization6.3CNA v3.10.2%2025-10-24Fix
CVE-2025-34503Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution7.0CNA v4.00.1%2025-10-24
CVE-2025-34502Shuffle Master Deck Mate 2 Missing Secure Boot7.0CNA v4.00.2%2025-10-24Fix
CVE-2025-34500Shuffle Master Deck Mate 2 Insecure Update Chain7.0CNA v4.00.2%2025-10-24Fix
CVE-2025-34293GN4 Publishing System insecure direct object reference (IDOR) information disclosure8.6CNA v4.00.4%2025-10-24Fix
CVE-2025-12194Bouncy Castle vulnerable to uncontrolled resource consumption5.9CNA v4.00.2%2025-10-24Fix
CVE-2025-12176Azure Access Technology BLU-IC2 Undocumented Administrative Accounts10.0CNA v4.00.3%2025-10-24
CVE-2025-12136Real Cookie Banner: GDPR and ePrivacy Cookie Consent WordPress plugin server-side request forgery6.8CNA v3.10.4%2025-10-24Fix
CVE-2025-12134ZoloBlocks WordPress plugin missing authorization to unauthenticated Popup Enable/Disable5.3CNA v3.10.2%2025-10-24Fix
CVE-2025-12096Simple Excel Pricelist for WooCommerce WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-24
CVE-2025-12072mynamevenu24 Disable Content Editor For Specific Template cross-site request forgery4.3CNA v3.10.1%2025-10-24
CVE-2025-12028IndieAuth WordPress plugin cross-site request forgery to account takeover via Stolen OAuth Tokens8.8CNA v3.10.2%2025-10-24Fix
CVE-2025-12017VNPAY for Woocommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-10-24
CVE-2025-12016qnotsquiz WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-10-24
CVE-2025-12014NGINX Cache Optimizer WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-24
CVE-2025-11992Multi Item Responsive Slider WordPress plugin cross-site request forgery6.1CNA v3.10.2%2025-10-24
CVE-2025-11889AIO Forms WordPress plugin authenticated (Admin+) arbitrary file upload via Zip import7.2CNA v3.10.7%2025-10-24Fix
CVE-2025-11887Supervisor WordPress plugin missing authorization to authenticated (Subscriber+) settings update4.3CNA v3.10.2%2025-10-24Fix
CVE-2025-11576AI Chatbot Free Models WordPress plugin CSV injection4.3CNA v3.10.3%2025-10-24Fix
CVE-2025-11504Quickcreator AI Blog Writer - unauthenticated API key exposure7.5CNA v3.10.3%2025-10-24Fix
CVE-2025-11257LLM Hubspot Blog Import WordPress plugin missing authorization authenticated Hubspot import4.3CNA v3.10.2%2025-10-24
CVE-2025-11253SQLi in Aksis Technologies' Netty ERP9.8CNA v3.10.4%2025-10-24Fix
CVE-2025-11172The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-4.3CNA v3.10.2%2025-10-24
CVE-2025-11145CBK Soft enVision account footprinting information disclosure7.5CNA v3.10.3%2025-10-24Fix
CVE-2025-10902Originality.ai AI Checker WordPress plugin missing authorization authenticated Scan Log deletion4.3CNA v3.10.2%2025-10-24Fix
CVE-2025-10901Originality.ai AI Checker WordPress plugin unauthorized access4.3CNA v3.10.2%2025-10-24
CVE-2025-10874Orbit Fox WordPress plugin Author+ server-side request forgery5.5CISA ADP v3.10.2%2025-10-24Exploit codeFix
CVE-2025-10861Popup builder with Gamification WordPress plugin server-side request forgery7.5CNA v3.10.4%2025-10-24Fix
CVE-2025-1074910up Microsoft Azure Storage for WordPress media replace action missing authorization5.4CNA v3.10.3%2025-10-24Fix
CVE-2025-10748RapidResult WordPress plugin authenticated (Contributor+) SQL injection6.5CNA v3.10.3%2025-10-24Fix
CVE-2025-10740URL Shortener Plugin For WordPress missing authorization authenticated Link manipulation6.3CNA v3.10.3%2025-10-24
CVE-2025-10723PixelYourSite WordPress plugin Admin+ LFI2.7CISA ADP v3.10.3%2025-10-24Fix
CVE-2025-10701Time Clock A WordPress Employee and Volunteer Time Clock plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-24Fix
CVE-2025-10680OpenVPN OS command injection8.8CISA ADP v3.17.3%2025-10-24Fix
CVE-2025-9978Jeg Elementor Kit WordPress plugin Author+ stored XSS6.8CISA ADP v3.10.3%2025-10-24Fix
CVE-2025-9158Stored XSS in Request Tracker5.3CNA v4.00.4%2025-10-24Fix
CVE-2025-8536SQL injection in DobryCMS9.3CNA v4.00.3%2025-10-24Emerging ThreatsFix
CVE-2025-6440WooCommerce Designer Pro WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.133.3%2025-10-24Exploit code
CVE-2025-5605WSO2 Identity Server Management console of multiple authentication bypass4.3CNA v3.10.9%2025-10-24NucleiFix
CVE-2025-5350SSRF and reflected XSS vulnerability in Deprecated Try-It feature of multiple WSO2 Products5.9CNA v3.10.6%2025-10-24NucleiFix
CVE-2025-4106WatchGuard Firebox leftover debug code vulnerability8.9CNA v4.00.3%2025-10-24Fix
CVE-2025-62820Slack Nebula may accept arbitrary source IP addresses4.9CNA v3.10.2%2025-10-23Fix
CVE-2025-62713Kottster app reinitialization can be re-triggered allowing command injection in development mode7.2CNA v4.00.6%2025-10-23Fix
CVE-2025-62688AutomationDirect Productivity Suite incorrect permission assignment for critical resource6.9CNA v4.00.2%2025-10-23Fix
CVE-2025-62517Rollbar.js prototype pollution vulnerability in merge5.9CNA v3.10.4%2025-10-23Fix
CVE-2025-62499Six Apart Movable Type (Software Edition) stored cross-site scripting4.6CNA v4.00.2%2025-10-23
CVE-2025-62498AutomationDirect Productivity Suite relative path traversal8.6CNA v4.00.5%2025-10-23Fix
CVE-2025-62401Moodle: Possible to bypass timer in timed assignments4.3NVD v3.10.2%2025-10-23Fix
CVE-2025-62400Moodle: Hidden group names visible to event creators6.5NVD v3.10.3%2025-10-23Fix
CVE-2025-62399Moodle: Password brute force risk when mobile/web services enabled7.5CNA v3.10.4%2025-10-23Fix
CVE-2025-62398Moodle does not properly enforce MFA5.4CISA ADP v3.10.2%2025-10-23Fix
CVE-2025-62397Moodle: Router produces json instead of 404 error for invalid course id5.3CNA v3.10.3%2025-10-23Fix
CVE-2025-62396Moodle: Router (r.php) could expose application directories5.3CNA v3.10.3%2025-10-23Fix
CVE-2025-62395Moodle: External cohort search service leaks system cohort data4.3NVD v3.10.2%2025-10-23Fix
CVE-2025-62394Moodle: Quiz notifications sent to suspended participants4.3CNA v3.10.2%2025-10-23Fix
CVE-2025-62393Moodle: Course access permissions not properly checked in course_output_fragment_course_overview4.3NVD v3.10.2%2025-10-23Fix
CVE-2025-62256Liferay Portal and DXP do not properly restrict access to OpenAPI6.9CNA v4.00.4%2025-10-23Fix
CVE-2025-62255Liferay Portal Self cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page2.0CNA v4.00.2%2025-10-23Fix
CVE-2025-62254Liferay Portal ComboServlet denial of service via large file combination6.9CNA v4.00.6%2025-10-23Fix
CVE-2025-62236Frontier Airlines publicly available email address validation6.9CNA v4.00.3%2025-10-23Fix
CVE-2025-62169OctoPrint-SpoolManager Plugin APIs do not enforce authentication8.1CNA v3.10.5%2025-10-23Fix
CVE-2025-61977AutomationDirect Productivity Suite weak password recovery mechanism for forgotten password7.3CNA v4.00.1%2025-10-23Fix
CVE-2025-61934AutomationDirect Productivity Suite Binding to an Unrestricted IP Address9.3CNA v4.00.7%2025-10-23Fix
CVE-2025-61865I-O DATA DEVICE NarSuS App unquoted search path8.4CNA v4.00.2%2025-10-23
CVE-2025-61464Sir Gnuboard SQL injection6.5CISA ADP v3.10.2%2025-10-23
CVE-2025-61413Piranha CMS vulnerable to stored cross-site scripting (XSS)6.1CISA ADP v3.10.3%2025-10-23
CVE-2025-61136sharewarez password reset host header injection7.1CISA ADP v3.10.5%2025-10-23
CVE-2025-61132braindump password reset host header injection7.1CISA ADP v3.10.4%2025-10-23
CVE-2025-60859Sir Gnuboard cross-site scripting6.1CISA ADP v3.10.3%2025-10-23