CVE-2025 records published in October 2025
This page lists the 3,687 CVE-2025 records published in October 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 10 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 42911.6% of these records
- Listed in CISA KEV
- 100.3% of these records
- Reported exploited
- 40.1% of these records
- Detection signal
- 1022.8% of these records
- Exploit code
- 1103.0% of these records
- Actionable vendor fix
- 2,43566.0% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in October 2025 have had from about 12 months to about 13 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-64389 | CIRCUTOR TCPRS1plus EXCHANGE OF sensitive information IN CLEAR TEXT | 8.3CNA v4.0 | 0.2% | 2025-10-31 | |
| CVE-2025-64388 | CIRCUTOR TCPRS1plus denial of service through specific packets | 9.2CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-64387 | CIRCUTOR TCPRS1plus CLICKJACKING | 5.1CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-64386 | CIRCUTOR TCPRS1plus HIJACKING OF THE TOKEN AND GAINING access | 7.7CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-64385 | CIRCUTOR TCPRS1plus incorrect security validation IN SENDING UDP FRAMES | 9.2CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-64368 | Bard WordPress theme cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.1% | 2025-10-31 | Fix |
| CVE-2025-64367 | Groundhogg WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64366 | MasterStudy LMS WordPress plugin SQL injection | 7.6CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-64365 | Ohio Extra WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64364 | Masterstudy WordPress theme local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-64363 | Kleo WordPress theme local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-64362 | K Elements WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64361 | Consulting Elementor Widgets WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64360 | Consulting Elementor Widgets WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-64359 | Consulting WordPress theme local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-64358 | Smart Coupons for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64357 | Advanced Database Cleaner WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-31 | Fix |
| CVE-2025-64356 | Insert PHP Code Snippet WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64354 | Gutenberg WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64353 | Polylang WordPress plugin deserialization of untrusted data | 8.8CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-64352 | Essential Addons for Elementor WordPress plugin broken access control | 2.7CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64351 | Rank Math SEO WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64350 | Rank Math SEO WordPress plugin broken access control | 3.8CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-64349 | ELOG user profile missing authorization | 8.7CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-64348 | ELOG configuration file authorization bypass | 9.3CNA v4.0 | 0.3% | 2025-10-31 | |
| CVE-2025-64168 | Agno session state overwrites between different sessions/users | 7.1CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-63675 | cryptidy allows code execution via untrusted data due to pickle.loads | 8.8v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-63563 | Summer Pearl Group Vacation Rental Management Platform incorrect user management | 6.5CISA ADP v3.1 | 0.3% | 2025-10-31 | |
| CVE-2025-63562 | Summer Pearl Group Vacation Rental Management Platform improper access control | 6.3v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-63561 | Summer Pearl Group Vacation Rental Management Platform denial of service | 7.5CNA v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63469 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63468 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63467 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63466 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63465 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63464 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63463 | TOTOLINK LR350 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63462 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63461 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63460 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63459 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63458 | Tenda AX1803 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-63454 | Tenda AX3 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-62618 | ELOG file upload stored XSS | 8.6CNA v4.0 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-62267 | Liferay Portal web content template’s select structure page cross-site scripting | 4.6CNA v4.0 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-62264 | Liferay Portal vulnerable to reflected XSS via the selectedLanguageId parameter | 5.1CNA v4.0 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-62232 | Apache APISIX: Basic-auth logs plaintext credentials at info level | 7.5CISA ADP v3.1 | 0.5% | 2025-10-31 | Fix |
| CVE-2025-61427 | BEO GmbH BEO Atlas Einfuhr Ausfuhr userid and password parameters reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-60749 | Trimble SketchUp desktop DLL hijacking | 7.8CISA ADP v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-60711 | Microsoft Edge (Chromium-based) remote code execution | 6.3CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-59501 | Microsoft Configuration Manager spoofing | 4.8CNA v3.1 | 3.3% | 2025-10-31 | Emerging ThreatsExploit codeFix |
| CVE-2025-58152 | Century Systems FutureNet MA-X series files accessible to external parties | 6.9CNA v4.0 | 0.3% | 2025-10-31 | |
| CVE-2025-58149 | Xen incorrect removal of permissions on PCI device unplug | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-58148 | Xen x86: Incorrect input sanitisation in Viridian hypercalls | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-58147 | Xen x86: Incorrect input sanitisation in Viridian hypercalls | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-57108 | VTK vtkGLTFDocumentLoader use-after-free | 9.8CISA ADP v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-57107 | vtk heap-based buffer overflow | 7.1CISA ADP v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-57106 | vtk heap-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-54763 | Century Systems FutureNet MA-X series OS command injection | 8.6CNA v4.0 | 1.2% | 2025-10-31 | |
| CVE-2025-52665 | Ubiquiti UniFi Access Application missing authentication | 10.0CISA ADP v3.1 | 41.1% | 2025-10-31 | Reported exploitedNucleiEmerging ThreatsFix |
| CVE-2025-52664 | Revive Adserver SQL injection | 8.8NVD v3.1 | 1.0% | 2025-10-31 | Fix |
| CVE-2025-52663 | Ubiquiti UniFi Talk Touch active debug code | 7.3CISA ADP v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-48984 | Veeam Backup and Replication code injection | 8.8CISA ADP v3.1 | 1.0% | 2025-10-31 | Fix |
| CVE-2025-48983 | Veeam Backup and Replication remote code execution | 10.0CNA v3.1 | 0.8% | 2025-10-31 | Fix |
| CVE-2025-48982 | Veeam Agent for Microsoft Windows improper privilege management | 7.8NVD v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-48980 | Brave Desktop Browser cookie reliance without validation | 6.5CNA v3.0 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-40603 | SonicWall SMA100 log files information disclosure | 4.5CISA ADP v3.1 | 0.5% | 2025-10-31 | Fix |
| CVE-2025-40106 | Linux kernel comedi driver denial of service | – | 0.2% | 2025-10-31 | Fix |
| CVE-2025-36249 | IBM Jazz for Service Management is vulnerable to filter cookie not sent over SSL | 3.7CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-33003 | IBM InfoSphere Information Server is vulnerable to privilege escalation | 7.8CNA v3.1 | 0.1% | 2025-10-31 | Fix |
| CVE-2025-30191 | Open-Xchange OX App Suite clickjacking | 5.4CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-30189 | Open-Xchange Dovecot Pro authentication cache vulnerability | 7.4CNA v3.1 | 0.6% | 2025-10-31 | Fix |
| CVE-2025-30188 | Open-Xchange OX App Suite resource exhaustion | 7.5CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-29270 | Deep Sea Electronics DSE855 realtime.cgi endpoint improper access control | 10.0CISA ADP v3.1 | 0.4% | 2025-10-31 | |
| CVE-2025-27208 | Revive Adserver cross-site scripting | 6.1NVD v3.1 | 1.5% | 2025-10-31 | |
| CVE-2025-23050 | Qt out-of-bounds read | 3.1CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-12554 | Azure Access Technology BLU-IC2 Missing Security headers | 6.9CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-12553 | Azure Access Technology BLU-IC2 Server Certificate Verification Disabled | 10.0CNA v4.0 | 0.2% | 2025-10-31 | |
| CVE-2025-12552 | Azure Access Technology BLU-IC2 Insufficient Password Policy | 6.9CNA v4.0 | 0.3% | 2025-10-31 | |
| CVE-2025-12547 | LogicalDOC Community Edition Admin Login login.jsp excessive authentication | 8.1NVD v3.1 | 0.8% | 2025-10-31 | |
| CVE-2025-12546 | LogicalDOC Community Edition API Key creation UI cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-10-31 | |
| CVE-2025-12521 | Analytify Pro WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-12509 | Scripts for the module Global_Shipping executable on BRAIN2 Server | 8.4CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-12508 | Bizerba BRAIN2 Unencrypted communication to Active Directory services | 8.4CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-12507 | Bizerba _connect.BRAIN insecure service configuration unquoted path | 8.8CNA v3.1 | 0.1% | 2025-10-31 | Fix |
| CVE-2025-12501 | Opera Norway GameMaker IDE integer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-10-31 | |
| CVE-2025-12464 | Red Hat Enterprise Linux 10 qemu-kvm: Stack buffer overflow in e1000 device | 6.2CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-12460 | Stored XSS vulnerability in Afterlogic Aurora webmail | 5.3CNA v4.0 | 0.4% | 2025-10-31 | |
| CVE-2025-12357 | ISO 15118-2 EV car chargers SLAC protocol improper channel restriction | 5.3CNA v4.0 | 0.8% | 2025-10-31 | |
| CVE-2025-12175 | The Events Calendar WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-12115 | WPC Name Your Price for WooCommerce WordPress plugin unauthenticated Price Alteration | 7.5CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-12094 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms and Comments IP spoofing | 5.3CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-12041 | ERI File Library WordPress plugin missing authorization to unauthenticated Protected file download | 5.3CNA v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-11975 | FuseWP WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-11843 | Therefore Online and Therefore On-Premises authentication bypass by spoofing | 8.8CNA v4.0 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-11806 | Qzzr Shortcode WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-31 | |
| CVE-2025-11602 | neo4j Community Edition untargeted information leak in Bolt protocol handshake | 6.3CNA v4.0 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-11191 | RealPress WordPress plugin unauthenticated content Creation/Email Sending via REST | 5.3CISA ADP v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-10897 | WooCommerce Designer Pro WordPress plugin unauthenticated arbitrary file read | 8.6CNA v3.1 | 1.9% | 2025-10-31 | NucleiExploit codeFix |
| CVE-2025-10693 | Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure | 7.6CNA v4.0 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-8849 | Denial of service in danny-avila/LibreChat | 7.5NVD v3.1 | 0.3% | 2025-10-31 | Fix |
| CVE-2025-8489 | King Addons for Elementor WordPress plugin privilege escalation | 9.8CNA v3.1 | 9.6% | 2025-10-31 | MetasploitExploit codeFix |
| CVE-2025-8385 | Zombify WordPress plugin authenticated (Subscriber+) path traversal to arbitrary file read | 6.8CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-8383 | Depicter WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-10-31 | Fix |
| CVE-2025-7846 | WordPress User Extra Fields plugin arbitrary file deletion | 8.8CNA v3.1 | 0.7% | 2025-10-31 | Fix |
| CVE-2025-6520 | SQLi in ABIS Technology's BAPSIS | 9.8CNA v3.1 | 0.4% | 2025-10-31 | Fix |
| CVE-2025-6176 | Brotli decompression bomb DoS in scrapy/scrapy | 7.5CNA v3.0 | 0.5% | 2025-10-31 | Fix |
| CVE-2025-6075 | Python CPython quadratic complexity in os.path.expandvars with user-controlled template | 1.8CNA v4.0 | 0.1% | 2025-10-31 | Fix |
| CVE-2025-5397 | Jobmonster - Job Board WordPress theme authentication bypass | 9.8CNA v3.1 | 0.8% | 2025-10-31 | Fix |
| CVE-2025-4952 | Denial of service vulnerability in ESET security products for Windows | 6.8CNA v4.0 | 0.1% | 2025-10-31 | |
| CVE-2025-64118 | node-tar vulnerable to race condition leading to uninitialized memory exposure | 6.1CNA v4.0 | 0.1% | 2025-10-30 | Fix |
| CVE-2025-64116 | Movary vulnerable to an open redirect | 5.1CNA v4.0 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-64115 | Movary unvalidated Referer header allows open redirect and phishing | 5.1CNA v4.0 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-64112 | statamic cms statmatic vulnerable to stored cross-site scripting | 8.0CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-64096 | CryptoLib vulnerable to stack buffer overflow in Crypto_Key_Update due to missing TLV length check | 8.8CNA v3.0 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-63885 | AIxBlock commit stored cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | |
| CVE-2025-63608 | CSZ CMS A SQL injection | 5.4CISA ADP v3.1 | 0.2% | 2025-10-30 | |
| CVE-2025-63423 | Each Wireless Mini Router WIRELESS-N 300M improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-63422 | Each Wireless Mini Router WIRELESS-N 300M web management interface improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-63298 | Mayuri K Pet Grooming Management Software path traversal | 8.2CISA ADP v3.1 | 0.5% | 2025-10-30 | Exploit code |
| CVE-2025-62795 | JumpServer Unauthorized LDAP Configuration Access via WebSocket | 7.1CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-62726 | n8n vulnerable to remote code execution via Git Node Pre-Commit Hook | 8.8CNA v3.1 | 0.8% | 2025-10-30 | Exploit codeFix |
| CVE-2025-62712 | JumpServer Connection token leak | 9.6CNA v3.1 | 0.5% | 2025-10-30 | Emerging ThreatsFix |
| CVE-2025-62503 | Apache Airflow: Privilege boundary bypass in bulk APIs | 4.6CISA ADP v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-62402 | Apache Airflow: Airflow 3 API: /API/v2/dagReports executes DAG Python in API | 5.4CISA ADP v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-62266 | Liferay Portal is vulnerable to DNS rebinding attacks | 5.1CNA v4.0 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-62265 | Liferay Portal is vulnerable to XSS in the Blogs widget | 4.8CNA v4.0 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-62257 | Liferay Portal missing brute-force protection | 6.3CNA v4.0 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-62231 | X.Org xwayland Xorg: Xmayland: Value overflow in xkbsetcompatmap | 7.3CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-62230 | X.Org X server Xkb extension client resource cleanup use-after-free | 7.3CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-62229 | X.Org xwayland Xorg: Xmayland: Use-after-free in xpresentnotify structure creation | 7.3CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-61498 | Tenda AC8 UPnP service buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-30 | |
| CVE-2025-61196 | BusinessNext CRMnext comments parameter code injection | 8.8CISA ADP v3.1 | 0.6% | 2025-10-30 | |
| CVE-2025-61141 | Sqls-server/sqls is vulnerable to command injection in the config command | 7.5CISA ADP v3.1 | 1.1% | 2025-10-30 | |
| CVE-2025-61121 | Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitive | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61120 | IO FIT AG Life Logger verification codes improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61119 | Karely Kanova API request parameters improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61118 | mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data a | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61117 | Senza Keto and Fasting user data API endpoints improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61116 | AdForest Classified authentication mechanism improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61115 | ABC Liquors ABC Fine Wine and Spirits login mechanism improper access control | 7.5CISA ADP v3.1 | 0.4% | 2025-10-30 | |
| CVE-2025-61114 | AutoBizLine 2nd Line authentication mechanism improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-61113 | TalkTalk API endpoints improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-60950 | AIxBlock Data Preparation function arbitrary file upload | 6.1CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-60319 | PerfreeBlog server-side request forgery | 6.5CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-57109 | Kitware VTK vtkGLTFImporter use-after-free | 6.5CISA ADP v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-56313 | JATOS /publix/run endpoint reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | |
| CVE-2025-54941 | Apache Airflow: Command injection in example_dag_decorator | 4.6NVD v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-54471 | NeuVector is shipping cryptographic material into its binary | 6.5CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-54470 | NeuVector telemetry sender is vulnerable to MITM and DoS | 8.6CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-54469 | NeuVector Enforcer is vulnerable to command injection and buffer overflow | 9.9CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-53883 | Container suse manager spacewalk-java has various XSS issues on search page | 9.3CNA v4.0 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-53880 | SUSE Container suse/manager/4.3/proxy-httpd:latest path traversal | 8.7CNA v4.0 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-52180 | Zucchetti AD Hoc Infinity cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-52179 | Zucchetti Ad Hoc Revolution cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-10-30 | |
| CVE-2025-50739 | iib0011 omni-tools JSON insecure deserialization | 9.8CISA ADP v3.1 | 0.7% | 2025-10-30 | |
| CVE-2025-50736 | Byaidu PDFMathTranslate vulnerable to open redirect | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | |
| CVE-2025-50574 | Hiruna Glamour Salon Management System blog-details.php in Hiruna Gallage's cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-10-30 | |
| CVE-2025-46423 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-46422 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-46363 | Dell Secure Connect Gateway SCG relative path traversal | 4.3CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-43942 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-43941 | Dell Unity OS command injection | 7.2CNA v3.1 | 0.7% | 2025-10-30 | Fix |
| CVE-2025-43940 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-43939 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-43027 | Genetec Security Center improper access control | 9.8CNA v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-40105 | Linux kernel VFS dentry cache vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40104 | Linux kernel ixgbevf driver mailbox negotiation vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40103 | Linux kernel SMB client tlink handling vulnerability | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40102 | Linux kernel KVM arm64 vCPU event injection denial of service | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40101 | Linux kernel Btrfs zoned block group loading memory leak | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40100 | Linux kernel Btrfs free space tree creation denial of service | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40099 | Linux kernel CIFS DFS referral parsing vulnerability | 9.4CNA v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-40098 | Linux kernel ALSA HDA CS35L41 ACPI mute state handling null pointer dereference | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40097 | Linux kernel ALSA HDA component manager initialization vulnerability | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40096 | Linux kernel DRM scheduler job dependency tracking double free | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40095 | Linux kernel USB gadget RNDIS function bind path null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40094 | Linux kernel USB gadget ACM function bind path null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40093 | Linux kernel USB gadget ECM function bind path null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40092 | Linux kernel USB gadget NCM function bind path null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40091 | Linux kernel ixgbe driver devlink cleanup use-after-free | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40090 | Linux kernel ksmbd RPC handle list locking vulnerability | 7.5CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-40089 | Linux kernel CXL Features driver null pointer dereference | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40088 | Linux kernel hfsplus out-of-bounds read | 7.1CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-40087 | Linux kernel NFSD FlexFiles layout commit vulnerability | 7.5CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-40086 | Linux kernel Xe GPU driver VM bind eviction null pointer dereference | – | 0.2% | 2025-10-30 | Fix |
| CVE-2025-39663 | Checkmk cross-site scripting through compromised remote site | 8.5CNA v4.0 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-36592 | Dell Secure Connect Gateway (SCG) Policy Manager cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-36137 | IBM Sterling Connect:Direct for UNIX command execution | 7.2CNA v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-34298 | Nagios Log Server Set Email privilege escalation | 8.8NVD v3.1 | 0.7% | 2025-10-30 | Fix |
| CVE-2025-34287 | Nagios XI privilege escalation via process_perfdata.pl | 7.8NVD v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-34286 | Nagios XI RCE via Run Check command in CCM | 7.2NVD v3.1 | 2.4% | 2025-10-30 | Fix |
| CVE-2025-34284 | Nagios XI authenticated command injection via WinRM plugin | 8.8NVD v3.1 | 4.0% | 2025-10-30 | Fix |
| CVE-2025-34283 | Nagios XI API key disclosure via Neptune Themes | 6.5NVD v3.1 | 1.0% | 2025-10-30 | Fix |
| CVE-2025-34280 | Nagios Network Analyzer RCE in LDAP Certificate Removal function | 7.2NVD v3.1 | 1.4% | 2025-10-30 | Fix |
| CVE-2025-34278 | Nagios Network Analyzer Source Groups / Percentile Calculator menu stored XSS | 5.4NVD v3.1 | 0.8% | 2025-10-30 | Fix |
| CVE-2025-34277 | Nagios Log Server RCE via Malformed Dashboard ID | 9.8NVD v3.1 | 2.2% | 2025-10-30 | Fix |
| CVE-2025-34274 | Nagios Log Server Logstash Process Root Privileges | 9.8NVD v3.1 | 2.1% | 2025-10-30 | Fix |
| CVE-2025-34273 | Nagios Log Server Non-Admin Dashboard Deletion | 6.5NVD v3.1 | 1.0% | 2025-10-30 | Fix |
| CVE-2025-34272 | Nagios Log Server Non-Empty Default Dashboard Fallback | 6.5NVD v3.1 | 0.9% | 2025-10-30 | Fix |
| CVE-2025-34271 | Nagios Log Server Cluster Manager Credential Requests Sent over Plaintext | 9.8NVD v3.1 | 0.7% | 2025-10-30 | Fix |
| CVE-2025-34270 | Nagios Log Server AD/LDAP Import Password not Obfuscated | 4.9NVD v3.1 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-34135 | Nagios XI Overly Permissive Permissions on Systemd Unit files | 4.4NVD v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-34134 | Nagios XI RCE via Business Process Intelligence (BPI) | 7.2NVD v3.1 | 2.4% | 2025-10-30 | Fix |
| CVE-2025-12517 | Credits page not Matching Versions in Use in the Firmware | 2.1CNA v4.0 | 0.2% | 2025-10-30 | |
| CVE-2025-12516 | Azure Access Technology BLU-IC2 Lack of Graceful Error Handling HTTP 5xx Error | 10.0CNA v4.0 | 0.4% | 2025-10-30 | |
| CVE-2025-12515 | Azure Access Technology BLU-IC2 Systemic Internal Server Errors HTTP 500 Response | 10.0CNA v4.0 | 0.4% | 2025-10-30 | |
| CVE-2025-12475 | Blocksy Companion WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-12466 | Simple OAuth (OAuth2) & OpenID Connect Critical Access bypass SA-CONTRIB-2025-114 | 7.5CISA ADP v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-12083 | CivicTheme Design System Moderately critical cross-site scripting SA-CONTRIB-2025-113 | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-12082 | CivicTheme Design System Moderately critical information disclosure SA-CONTRIB-2025-112 | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-12060 | Keras Keras.utils.get_file utility path traversal | 8.9CNA v4.0 | 0.6% | 2025-10-30 | Fix |
| CVE-2025-11998 | HP Card Readers (B Models) potential information disclosure | 6.8CNA v4.0 | 0.2% | 2025-10-30 | |
| CVE-2025-11906 | Privilege escalation via writable configuration files in Progress Flowmon | 6.7CNA v3.1 | 0.1% | 2025-10-30 | Fix |
| CVE-2025-11881 | AppPresser WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-11627 | sminozzi Site Checkup Debug AI Troubleshooting log file log injection | 6.5CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-10931 | Umami Analytics Moderately critical cross-site scripting SA-CONTRIB-2025-109 | 3.8CISA ADP v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-10930 | Currency Moderately critical cross-site request forgery SA-CONTRIB-2025-110 | 4.3NVD v3.1 | 0.1% | 2025-10-30 | Fix |
| CVE-2025-10929 | Reverse Proxy Header Less critical Access bypass SA-CONTRIB-2025-111 | 5.3CISA ADP v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-10928 | Access code Moderately critical Access bypass SA-CONTRIB-2025-108 | 6.3CISA ADP v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-10927 | Plausible tracking Moderately critical cross-site scripting SA-CONTRIB-2025-107 | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-10926 | JSON Field Critical cross-site scripting SA-CONTRIB-2025-106 | 6.1CISA ADP v3.1 | 0.2% | 2025-10-30 | Fix |
| CVE-2025-10636 | NS Maintenance Mode for WP WordPress plugin Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.2% | 2025-10-30 | |
| CVE-2025-10348 | Stored cross-site scripting in URVE Smart Office | 5.1CNA v4.0 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-10317 | Multiple cross-site request forgery in Quick.Cart | 5.1CNA v4.0 | 0.2% | 2025-10-30 | |
| CVE-2025-10008 | Translate WordPress with Weglot clean_options function missing authorization | 5.3CNA v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-9954 | Acquia Dam Moderately critical Access bypass, information disclosure SA-CONTRIB-2025-105 | 7.5CISA ADP v3.1 | 0.3% | 2025-10-30 | Fix |
| CVE-2025-8850 | Insecure API Design in danny-avila/LibreChat | 8.8NVD v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-5347 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 6.3CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-5343 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 6.3CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-5342 | Zoho ManageEngine Exchange Reporter Plus denial of service (DoS) | 4.3CNA v3.1 | 1.1% | 2025-10-30 | Fix |
| CVE-2025-3356 | IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations | 8.6CNA v3.1 | 0.4% | 2025-10-30 | Fix |
| CVE-2025-3355 | IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations | 7.5CNA v3.1 | 0.5% | 2025-10-30 | Fix |
| CVE-2025-64296 | Facebook for WooCommerce WordPress plugin broken access control to Notice Dismissal | 5.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64291 | Premmerce User Roles WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64290 | Premmerce Product Search for WooCommerce WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | Fix |
| CVE-2025-64289 | Premmerce Product Search for WooCommerce WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64288 | Premmerce WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | Fix |
| CVE-2025-64286 | WP Rentals WordPress theme cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-64285 | Premmerce Wholesale Pricing for WooCommerce WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64284 | Majestic Support WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64283 | RTMKit WordPress plugin insecure direct object references (IDOR) | 6.5CNA v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64234 | Evergreen Content Poster WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64229 | Client Invoicing by Sprout Invoices WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64228 | SUMO Affiliates Pro WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64226 | Stockie Extra WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | Fix |
| CVE-2025-64220 | Rey Core WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64219 | Business Directory WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64216 | SmartMag WordPress theme local file inclusion | 7.5CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64212 | MasterStudy LMS Pro WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64211 | Masterstudy Elementor Widgets WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64210 | Masterstudy Elementor Widgets WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64208 | Jannah - Extensions WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64204 | SmartMag WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64202 | Sahifa WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64201 | PowerPress Podcasting WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | Fix |
| CVE-2025-64200 | Email Template Customizer for WooCommerce WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64199 | wpresidence WordPress theme broken access control | 5.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64197 | Rehub WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64195 | Eduma WordPress theme local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-64194 | Eduma WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64150 | Jenkins Publish To Bitbucket Plugin is missing a permissions check | 5.4CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64149 | Jenkins Publish To Bitbucket Plugin vulnerable to CSRF and missing permissions check | 5.4CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64148 | Jenkins Publish To Bitbucket Plugin is missing a permissions check | 4.3CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64147 | Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form | 4.3CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64146 | Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64145 | Jenkins ByteGuard Build Actions Plugin missing encryption | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64144 | Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64143 | Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64142 | Jenkins Nexus Task Runner Plugin is missing a permission check | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64141 | Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64140 | Jenkins Azure CLI Plugin does not restrict the commands it executes | 8.8CISA ADP v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-64139 | Jenkins Start Windocks Containers Plugin is missing a permission check | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64138 | Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64137 | Jenkins Themis Plugin is missing a permission check | 4.3CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64136 | Jenkins Themis Plugin vulnerable to cross-site request forgery | 4.3CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64135 | Jenkins Eggplant Runner Plugin protection mechanism disabled | 5.9CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64134 | Jenkins JDepend Plugin vulnerable to XML external entity attacks | 7.1CISA ADP v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64133 | Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery | 5.4CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64132 | Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools | 5.4CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-64131 | Jenkins SAML Plugin does not implement a replay cache | 7.5CISA ADP v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-64104 | LangGraph SQLite Checkpoint Filter Key SQL injection POC for SqliteStore | 7.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64103 | Zitadel Bypass Second Authentication Factor | 8.7CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64102 | Zitadel allows brute-forcing authentication factors | 7.7CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64101 | ZITADEL vulnerable to account takeover via Malicious Forwarded header injection | 8.1CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-64100 | CKAN vulnerable to Session Cookie Fixation | 6.1CNA v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-63622 | Fabian Online Complaint Site SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-10-29 | |
| CVE-2025-62797 | CSRF in FluxCP account endpoints allows account takeover / state-changing actions | 8.6CNA v4.0 | 0.2% | 2025-10-29 | |
| CVE-2025-62792 | Wazuh vulnerable to heap-based buffer over-read in w_expression_match | 6.9CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-62791 | Wazuh vulnerable to null pointer dereference in DecodeCiscat | 6.9CNA v4.0 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-62790 | Wazuh vulnerable to null pointer dereference in fim_fetch_attributes_state | 6.9CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-62789 | Wazuh vulnerable to null pointer dereference in fim_alert line 712 | 6.9CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-62788 | Wazuh vulnerable to heap use-after-free in w_copy_event_for_log | 6.3CNA v4.0 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-62787 | Wazuh vulnerable to heap-based buffer over-read in DecodeWinevt | 2.1CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-62786 | Wazuh vulnerable to Heap-based Buffer out-of-bounds write in decode_win_permissions | 6.3CNA v4.0 | 0.7% | 2025-10-29 | Fix |
| CVE-2025-62785 | Wazuh fillData null pointer dereference causes analysisd crash | 6.9CNA v4.0 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-62776 | Wireless Tsukamoto WTW EAGLE uncontrolled search path | 8.4CNA v4.0 | 0.2% | 2025-10-29 | |
| CVE-2025-61959 | Vertikal Systems Hospital Manager Backend Services WebResource.axd handler vulnerability | 6.9CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-61876 | Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and access tenant information belonging to other clients via modification of the tenant ID in the request URL. | 5.0CISA ADP v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-61725 | Excessive CPU consumption in ParseAddress in net/mail | 7.5CISA ADP v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-61724 | Excessive CPU consumption in Reader.ReadResponse in net/textproto | 5.3CISA ADP v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-61723 | Quadratic complexity when parsing some invalid inputs in encoding/pem | 7.5CISA ADP v3.1 | 0.7% | 2025-10-29 | Fix |
| CVE-2025-61429 | NCR Atleos Terminal Manager ConfigApp privilege escalation | 8.8CISA ADP v3.1 | 0.3% | 2025-10-29 | |
| CVE-2025-61234 | Paytef Dataphone A920 port 8888 service missing authentication | 7.5CISA ADP v3.1 | 0.3% | 2025-10-29 | |
| CVE-2025-61161 | Evope Collector DLL hijacking | 8.4CISA ADP v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-61156 | ThreatFire System Monitor kernel driver privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2025-10-29 | Exploit code |
| CVE-2025-60898 | Thumbnail unauthenticated server-side request forgery | 5.8CISA ADP v3.1 | 0.3% | 2025-10-29 | |
| CVE-2025-60595 | SPH Engineering UgCS command injection | 8.2CISA ADP v3.1 | 0.3% | 2025-10-29 | |
| CVE-2025-60542 | TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update | 6.5CISA ADP v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-60320 | memoQ Auto Update Service privilege escalation | 6.7CISA ADP v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-60075 | hpb seo plugin for WordPress cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-58939 | Super Store Finder WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-58711 | Blog Designer PRO WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-29 | |
| CVE-2025-58189 | ALPN negotiation error contains attacker controlled information in crypto/tls | 5.3CISA ADP v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-58188 | Panic when validating certificates with DSA public keys in crypto/x509 | 7.5CISA ADP v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-58187 | Quadratic complexity when checking name constraints in crypto/x509 | 7.5CISA ADP v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-58186 | Lack of limit when parsing cookies can cause memory exhaustion in net/http | 5.3CISA ADP v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-58185 | Parsing DER payload can cause memory exhaustion in encoding/asn1 | 5.3CISA ADP v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-58183 | Unbounded allocation when parsing GNU sparse map in archive/tar | 4.3CISA ADP v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-57931 | Popup box WordPress plugin cross-site request forgery (CSRF) | 5.3CNA v3.1 | 0.1% | 2025-10-29 | Fix |
| CVE-2025-57227 | Kingosoft Technology Kingo ROOT privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2025-10-29 | Exploit code |
| CVE-2025-56558 | Dyson MQTT server unprotected alternate channel | 3.0CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-54549 | Arista Networks DANZ Monitoring Fabric upgrade image validation improper signature verification | 5.9CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-54548 | Arista Networks DANZ Monitoring Fabric debug API information disclosure | 4.3CNA v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-54547 | Arista DANZ Monitoring Fabric SSH session multiplexing insufficient session expiration | 5.3CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-54546 | Arista DANZ Monitoring Fabric SSH port forwarding incorrect permission assignment | 7.5CNA v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-54545 | Arista DANZ Monitoring Fabric CLI sandbox privilege escalation | 7.8CNA v3.1 | 0.1% | 2025-10-29 | |
| CVE-2025-54459 | Vertikal Systems Hospital Manager Backend Services trace endpoint information disclosure | 8.7CNA v4.0 | 0.4% | 2025-10-29 | |
| CVE-2025-54384 | CKAN stored XSS vulnerability in Markdown description fields | 6.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-49042 | WooCommerce WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-47912 | Insufficient validation of bracketed IPv6 hostnames in net/url | 5.3CISA ADP v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-40085 | Linux kernel USB audio card registration null pointer dereference | – | 0.2% | 2025-10-29 | Fix |
| CVE-2025-40084 | Linux kernel ksmbd IPC handle parsing vulnerability | 7.1CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-40083 | Linux kernel QFQ packet scheduler vulnerability | – | 0.2% | 2025-10-29 | Fix |
| CVE-2025-12479 | Azure Access Technology BLU-IC2 systemic lack of cross-site request forgery Token Implementation | 10.0CNA v4.0 | 0.2% | 2025-10-29 | |
| CVE-2025-12478 | Azure Access Technology BLU-IC2 Non-Compliant TLS Configuration | 10.0CNA v4.0 | 0.2% | 2025-10-29 | |
| CVE-2025-12477 | Azure Access Technology BLU-IC2 Server Version Disclosure | 10.0CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-12476 | Azure Access Technology BLU-IC2 resource Lacking AuthN | 10.0CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-12461 | Unprotected access to parts of the application in Epsilon RH by Grupo Castilla | 6.9CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-12450 | LiteSpeed Cache WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-12148 | floragunn Search Guard FLX field masking information disclosure | 6.0CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-12147 | floragunn Search Guard FLX field-level security information disclosure | 6.0CNA v4.0 | 0.3% | 2025-10-29 | |
| CVE-2025-12142 | ABB Terra AC wallbox BSS(Block Started by Symbol) memory corruption | 6.9CNA v4.0 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-12058 | Vulnerability in Keras Model.load_model leading to arbitrary Local File Loading and SSRF | 5.9CNA v4.0 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall WordPress plugin arbitrary file read | 6.5CNA v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-11702 | Missing authorization in GitLab | 8.5CNA v3.1 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-11632 | jgrietveld Call Now Button missing authorization | 4.3CNA v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-11587 | jgrietveld Call Now Button missing authorization | 4.3CNA v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-11466 | Allegra DatabaseBackupBL directory traversal information disclosure | 4.9CNA v3.0 | 1.6% | 2025-10-29 | Fix |
| CVE-2025-11465 | Ashlar-Vellum Cobalt CO File Parsing use-after-free remote code execution | 7.8NVD v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-11464 | Ashlar-Vellum Cobalt CO File Parsing heap-based buffer overflow remote code execution | 7.8NVD v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-11463 | Ashlar-Vellum Cobalt XE File Parsing integer overflow remote code execution | 7.8NVD v3.1 | 0.2% | 2025-10-29 | |
| CVE-2025-11232 | ISC Kea invalid characters cause assert | 7.5CNA v3.1 | 0.4% | 2025-10-29 | Fix |
| CVE-2025-11203 | LiteLLM Information health API_KEY information disclosure | 3.5CNA v3.0 | 0.3% | 2025-10-29 | Exploit codeFix |
| CVE-2025-11202 | win-cli-mcp-server resolveCommandPath command injection remote code execution | 9.8CNA v3.0 | 2.8% | 2025-10-29 | |
| CVE-2025-11201 | MLflow Tracking Server Model Creation directory traversal remote code execution | 9.8v3.1 | 26.3% | 2025-10-29 | Fix |
| CVE-2025-11200 | MLflow weak password requirements authentication bypass | 9.8v3.1 | 1.5% | 2025-10-29 | Fix |
| CVE-2025-10934 | GIMP XWD File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-10932 | Progress MOVEit Transfer AS2 module allows uncontrolled file uploads | 8.2CNA v3.1 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-10925 | GIMP ILBM File Parsing stack-based buffer overflow remote code execution | 7.8CNA v3.0 | 3.1% | 2025-10-29 | Fix |
| CVE-2025-10924 | GIMP FF File Parsing integer overflow remote code execution | 7.8CNA v3.0 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-10923 | GIMP WBMP File Parsing integer overflow remote code execution | 7.8CNA v3.0 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-10922 | GIMP DCM File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.8% | 2025-10-29 | Fix |
| CVE-2025-10921 | GIMP HDR File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.6% | 2025-10-29 | Fix |
| CVE-2025-10920 | GIMP ICNS File Parsing out-of-bounds write remote code execution | 7.8CNA v3.0 | 0.5% | 2025-10-29 | Fix |
| CVE-2025-9871 | Razer Synapse 3 Chroma Connect link following local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-10-29 | |
| CVE-2025-9870 | Razer Synapse 3 RazerPhilipsHueUninstall link following local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-10-29 | |
| CVE-2025-9869 | Razer Synapse 3 Macro module link following local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-10-29 | |
| CVE-2025-9544 | Doppler Forms WordPress plugin Subscriber+ limited plugin installation | 6.5CISA ADP v3.1 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-4665 | Adobe WordPress plugin Contact Form CFDB7 SQL injection | 9.6CNA v3.1 | 0.3% | 2025-10-29 | Fix |
| CVE-2025-1549 | WatchGuard Mobile VPN with SSL Local Privilege Escallation | 6.3CNA v4.0 | 0.2% | 2025-10-29 | Fix |
| CVE-2025-64095 | DNN Platform HTML editor provider unrestricted file upload | 10.0CNA v3.1 | 47.0% | 2025-10-28 | NucleiEmerging ThreatsExploit codeFix |
| CVE-2025-64094 | dnnsoftware Dnn.Platform DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload | 6.4CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-62802 | dnnsoftware Dnn.Platform DNN CKEditor Provider allows unauthenticated upload out-of-the-box | 4.3CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-62801 | FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name | 5.4CNA v4.0 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-62800 | FastMCP vulnerable to reflected XSS in client's callback page | 5.3CNA v4.0 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-62798 | Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax | 5.4CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-62796 | PrivateBin persistent HTML injection in attachment filename enables redirect and defacement | 5.8CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-62794 | RichardoC GitHub Workflow Updater token storage vulnerability | 3.8CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-62777 | PLANEX COMMUNICATIONS MZK-DP300N hard-coded credentials | 8.7CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-62727 | Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse | 7.5CNA v3.1 | 0.8% | 2025-10-28 | Exploit codeFix |
| CVE-2025-62368 | taigaio taiga-back taiga Authenticated remote code execution | 9.1CNA v3.1 | 1.6% | 2025-10-28 | MetasploitExploit codeFix |
| CVE-2025-62367 | taigaio taiga-back Taiga blind SQL injection Time Based | 4.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-61598 | Discourse is missing Cache-Control response header on error responses | 6.3CNA v4.0 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-61235 | Dataphone A920 packet improper input validation | 9.1CISA ADP v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-61155 | GameDriverX64.sys IOCTL handler denial of service | 5.5CISA ADP v3.1 | 0.3% | 2025-10-28 | Exploit code |
| CVE-2025-61128 | WAVLINK QUANTUM D3G/WL-WN530HG3 firmware M30HG3_V240730 stack-based buffer overflow | 9.1CISA ADP v3.1 | 0.7% | 2025-10-28 | Emerging Threats |
| CVE-2025-61107 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-61106 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-61104 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-61103 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-61080 | Clear2Pay Bank Visibility Payment Execution ID parameter reflected cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-10-28 | |
| CVE-2025-61043 | An out-of-bounds read vulnerability has been discovered in Monkey's Audio 11.31, specifically in the CAPECharacterHelper::GetUTF16FromUTF8 function. The issue arises from improper handling of the length of the input UTF-8 string, causing the function to read past the memory boundary. This vulnerabil | 9.1CISA ADP v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-60858 | Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers to intercept or extract sensitive information. | 7.5CISA ADP v3.1 | 0.3% | 2025-10-28 | |
| CVE-2025-60805 | BESSystem BES Application Server pre-resource configuration option information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-60800 | jishenghua jshERP information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2025-10-28 | Exploit code |
| CVE-2025-60355 | Zhyd OneBlog server-side template injection | 9.8CISA ADP v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-60354 | blog-vue-springboot unauthorized access | 7.5CISA ADP v3.1 | 0.3% | 2025-10-28 | |
| CVE-2025-60349 | Prevx pxscan.sys driver denial of service | 7.5CISA ADP v3.1 | 0.4% | 2025-10-28 | Exploit code |
| CVE-2025-59837 | Astro allows bypass of image proxy domain validation leading to SSRF and potential XSS | 7.2CNA v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-56399 | alexusmai laravel-file-manager file upload feature code injection | 8.8CISA ADP v3.1 | 0.6% | 2025-10-28 | Exploit code |
| CVE-2025-55758 | Extension jdownloads.com CSRF vectors in jDownloads component for Joomla | 5.4CISA ADP v3.1 | 0.1% | 2025-10-28 | |
| CVE-2025-54605 | Bitcoin Core resource exhaustion | 7.5CISA ADP v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-54604 | Bitcoin Core resource exhaustion | 7.5CISA ADP v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-53855 | GCC Productions Fade In XML parser functionality out-of-bounds write | 7.8CNA v3.1 | 0.3% | 2025-10-28 | |
| CVE-2025-53814 | GCC Productions Fade In XML parser functionality use-after-free | 7.8CNA v3.1 | 0.3% | 2025-10-28 | |
| CVE-2025-43024 | HP ThinPro SP8 Security Updates | 5.1CNA v4.0 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-43017 | HP ThinPro SP8 Security Updates | 8.5CNA v4.0 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-41090 | Improper access control in CCN-CERT microCLAUDIA | 7.6CNA v4.0 | 0.3% | 2025-10-28 | Exploit code |
| CVE-2025-40843 | Buffer overflow in CodeChecker log command | 5.9CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40082 | Linux kernel hfsplus out-of-bounds read | 7.1CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40081 | Linux kernel ARM SPE perf buffer offset calculation integer overflow | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40080 | Linux kernel NBD socket type validation vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40079 | Linux kernel RISC-V BPF struct_ops return values denial of service | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40078 | Linux kernel BPF sock_addr access checks vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40077 | Linux kernel f2fs file system vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40076 | Linux kernel R-Car PCIe host controller null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40075 | Linux kernel TCP metrics cache vulnerability | 8.1CNA v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-40074 | Linux kernel ipv4 use-after-free | 9.8CNA v3.1 | 0.5% | 2025-10-28 | Fix |
| CVE-2025-40073 | Linux kernel MSM DRM SSPP plane validation null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40072 | Linux kernel fanotify mount marks null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40071 | In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_up | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40070 | Linux kernel PPS character device registration vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40069 | Linux kernel MSM DRM VM_BIND vulnerability | 7.8CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-40068 | Linux kernel NTFS3 runlist decoder integer overflow | 8.4CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40067 | Linux kernel NTFS3 index allocation vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40066 | Linux kernel mt7996 Wi-Fi driver null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40065 | Linux kernel RISC-V KVM hgatp register handling vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40064 | Linux kernel SMC pnet device lookup use-after-free | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40063 | Linux kernel crypto compression API vulnerability | 7.0CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-40062 | Linux kernel HiSilicon QM crypto driver double free | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40061 | Linux kernel RDMA rxe driver race condition | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40060 | Linux kernel coresight TRBE buffer allocator vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40059 | Linux kernel coresight driver null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40058 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must | 8.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40057 | Linux kernel PTP virtual clocks vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40056 | Linux kernel vhost vringh driver vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40055 | Linux kernel OCFS2 cluster connect double free | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40054 | Linux kernel f2fs page bio merging use-after-free | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40053 | Linux kernel dlink null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-40052 | Linux kernel SMB client crypto buffer handling vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40051 | Linux kernel vhost vringh vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40050 | Linux kernel BPF verifier vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40049 | Linux kernel Squashfs filesystem vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40048 | In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mas | 7.5CNA v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-40047 | Linux kernel io_uring waitid race condition | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40046 | Linux kernel io_uring zero-copy receive integer underflow | 8.6CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-40045 | Linux kernel wcd937x audio codec driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40044 | Linux kernel UDF filesystem out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40043 | Linux kernel NFC NCI packet parsing improper input validation | 8.8CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-40042 | Linux kernel kprobe tracing initialization race condition | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40041 | Linux kernel LoongArch BPF struct ops denial of service | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40040 | Linux kernel KSM madvise handling denial of service | 7.8CNA v3.1 | 0.4% | 2025-10-28 | Exploit codeKCVFix |
| CVE-2025-40039 | Linux kernel ksmbd RPC handle list race condition | 8.8CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-40038 | Linux kernel KVM SVM fastpath emulation vulnerability | 7.1CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40037 | Linux kernel simplefb framebuffer driver use-after-free | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40036 | Linux kernel fastrpc driver vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40035 | Linux kernel uinput driver information disclosure | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40034 | Linux kernel PCI AER error reporting null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40033 | Linux kernel PRU remoteproc driver null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40032 | Linux kernel PCI endpoint test driver null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40031 | Linux kernel tee null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40030 | Linux kernel pinctrl subsystem vulnerability | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40029 | Linux kernel fsl-mc bus driver null pointer dereference | – | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40028 | Linux kernel binder driver double free | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40027 | Linux kernel 9p client request cancellation vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40026 | Linux kernel KVM x86 L1 intercept handling vulnerability | 7.9CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-40025 | Linux kernel f2fs node footer validation vulnerability | 7.8CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-36386 | IBM Maximo Application Suite Maximo Manage application authentication bypass | 9.8CNA v3.1 | 0.6% | 2025-10-28 | Fix |
| CVE-2025-36085 | IBM Concert server-side request forgery | 5.4CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-36083 | IBM Concert heap memory information disclosure | 6.2CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-36081 | IBM Concert log injection | 5.3CNA v3.1 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-34318 | IPFire stored XSS via DNS Creation (proxy.cgi) | 5.1CNA v4.0 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34317 | IPFire stored XSS via DNS Creation (dns.cgi) | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34316 | IPFire stored XSS via Mail Server settings | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34315 | IPFire stored XSS via Remote Syslog Server Address | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34314 | IPFire stored XSS via Time Constraint Rule URL Filter | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34313 | IPFire stored XSS via User Quota Rule URL Filter | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34312 | IPFire command injection via URL Filter Blacklist | 8.8v3.1 | 2.2% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34311 | IPFire command injection via Proxy Report Creation | 8.8v3.1 | 13.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34310 | IPFire stored XSS via Quality of Service (QoS) settings | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34309 | IPFire stored XSS via Dynamic DNS host | 5.4v3.1 | 5.3% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34308 | IPFire stored XSS via Default Time Sync | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34307 | IPFire stored XSS via Default Country Search | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34306 | IPFire stored XSS via Default IP Search Value | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34305 | IPFire stored XSS via multiple Methods in cleanhtml | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34304 | IPFire SQL injection via OpenVPN Connection Logs | 6.5NVD v3.1 | 0.4% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34303 | IPFire stored XSS via Whitelisted Host Creation | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34302 | IPFire stored XSS via Service Creation | 5.4v3.1 | 0.5% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-34301 | IPFire stored XSS via Location Group Creation | 5.4v3.1 | 5.3% | 2025-10-28 | Emerging ThreatsFix |
| CVE-2025-33133 | IBM DB2 High Performance Unload out-of-bounds write | 6.5CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-33132 | IBM DB2 High Performance Unload denial of service | 6.5CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-33131 | IBM DB2 High Performance Unload buffer overflow | 6.5CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-33126 | IBM DB2 High Performance Unload denial of service | 6.5CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-27093 | Sliver does not restricted traffic between Wireguard clients | 6.3CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-12425 | Azure Access Technology BLU-IC2 local privilege escalation | 10.0CNA v4.0 | 0.2% | 2025-10-28 | |
| CVE-2025-12424 | Azure Access Technology BLU-IC2 privilege escalation through SUID-bit Binary | 10.0CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-12423 | Azure Access Technology BLU-IC2 denial of service Protocol Manipulation | 10.0CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-12422 | Azure Access Technology BLU-IC2 vulnerable Upgrade feature (arbitrary file write) | 10.0CNA v4.0 | 0.5% | 2025-10-28 | |
| CVE-2025-12390 | Keycloak vulnerable to session takeovers due to reuse of session identifiers | 6.0CNA v3.1 | 0.1% | 2025-10-28 | Fix |
| CVE-2025-12380 | Mozilla Firefox use-after-free in WebGPU internals triggered from a compromised child process | 9.8CISA ADP v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-12378 | code-projects Simple Food Ordering System addproduct.php unrestricted upload | 9.8NVD v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-12347 | MaxSite CMS save-file-ajax.php unrestricted upload | 8.8NVD v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-12346 | MaxSite CMS HTTP header uploads-require-maxsite.php unrestricted upload | 8.8NVD v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-12344 | Yonyou U8 Cloud request Header NCloudGatewayServlet unrestricted upload | 5.3CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-12342 | Serdar Bayram Ghost Hot Spot Login Auth.php SQL injection | 6.9CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-12341 | ermig1979 AntiDupl Delete Duplicate Image AntiDupl.NET.WinForms.exe link following | 8.5CNA v4.0 | 0.2% | 2025-10-28 | |
| CVE-2025-12339 | Campcodes Retro Basketball Shoes Online Store admin_football.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-12338 | Campcodes Retro Basketball Shoes Online Store admin_product.ph SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-12337 | Campcodes Retro Basketball Shoes Online Store admin_feature.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-12336 | Campcodes Retro Basketball Shoes Online Store admin_index.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-28 | |
| CVE-2025-12335 | code-projects E-Commerce Website supplier_update.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-12332 | SourceCodester Student Grades Management System admin.php delete_user cross-site scripting | 4.8NVD v3.1 | 0.4% | 2025-10-28 | |
| CVE-2025-12103 | Openshift-ai: Trusty ai grants all authenticated users to list pods in any namespace | 5.0CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-11735 | HUSKY Products Filter Professional for WooCommerce WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-11375 | Consul's event endpoint is vulnerable to denial of service | 6.5CNA v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-11374 | Consul's KV endpoint is vulnerable to denial of service | 6.5CNA v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-10939 | keycloak Org.Keycloak/keycloak-quarkus-server: Unable to restrict access to the admin console | 3.7CNA v3.1 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-10151 | Softing Industrial Automation smartLink HW-PN improper locking | 7.2CNA v4.0 | 0.2% | 2025-10-28 | |
| CVE-2025-10150 | Softing Industrial Automation smartLink HW-PN webserver crash caused by scanning on TCP port 80 | 8.7CNA v4.0 | 0.3% | 2025-10-28 | |
| CVE-2025-9313 | Unauthorized database access in Asseco mMedica | 9.3CNA v4.0 | 0.4% | 2025-10-28 | Fix |
| CVE-2025-1038 | Hitachi Energy TropOS 4th Gen OS command injection | 7.5CNA v4.0 | 0.3% | 2025-10-28 | Fix |
| CVE-2025-1037 | Hitachi Energy TropOS 4th Gen improper privilege management | 7.5CNA v4.0 | 0.2% | 2025-10-28 | Fix |
| CVE-2025-1036 | Hitachi Energy TropOS 4th Gen command injection | 8.7CNA v4.0 | 1.0% | 2025-10-28 | Fix |
| CVE-2025-62988 | Slider Templates WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62987 | Builderall Builder for WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62986 | FanBridge signup WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62985 | Simple Pull Quote WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62984 | WP AdCenter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62983 | Posts By Tag WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62982 | Dynamic User Directory WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62981 | WP Gravity Forms Zoho CRM and Bigin WordPress plugin open redirection | 4.7CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62980 | Persian Admnin Fonts WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62979 | ACF to REST API WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62978 | KiotViet Sync WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62977 | 百度站长SEO合集(支持百度/神马/Bing/头条推送) WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62976 | Sendle Shipping WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62975 | Raychat WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62974 | Headline Analyzer WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62973 | BuddyForms WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62972 | WebinarPress WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62971 | Attesa Extra WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62970 | Link Whisper Free WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62969 | NextMove Lite WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62968 | WP Last Modified Info WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62967 | DirectoryPress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62966 | GoCache WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62965 | Admin Management Xtended WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62964 | MDTF WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62963 | Estatik WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62962 | CloudSearch WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62959 | Paid Videochat Turnkey Site WordPress plugin remote code execution (RCE) | 9.1CNA v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-62958 | Simple Content Templates for Blog Posts and Pages WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62957 | NikanWP WooCommerce Reporting WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-62956 | Reloadly WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62954 | Revive Old Posts WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62953 | Welcart e-Commerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62952 | ChatBot WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62951 | H5P WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62949 | Activity Plus Reloaded for BuddyPress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62948 | Date counter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62947 | Publitio WordPress plugin sensitive data exposure | 5.0CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62946 | Everest Backup WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62945 | Did Prestashop Display WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62944 | MSTW CSV EXPORTER WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62943 | Next Page, Not Next Post WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62942 | WP Mapbox GL JS Maps WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62941 | Events Maker by dFactory WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62940 | Blox Lite WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62939 | Open Currency Converter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62938 | Reoon Email Verifier WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62937 | Post List Featured Image WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62936 | xSmart WordPress theme content injection | 4.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62935 | Open Close WooCommerce Store WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62934 | WP Business Hours WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62933 | Awesome Testimonials WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62932 | Table Block by RioVizual WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62931 | MSN Partner Hub WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62930 | MapSVG WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62929 | Testimonial Slider WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62928 | SEO Meta Description Updater WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62927 | Nelio Content WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62925 | Conversios.io WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62924 | Post Grid and Gutenberg Blocks WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62923 | Marquee Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62922 | Export Categories WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62921 | Bulk Auto Image Title Attribute WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62920 | USERCENTRICS CMP WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62919 | TS Demo Importer WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62918 | IgnitionDeck WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62917 | Tooltipy WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62916 | Flights and Hotels Booking WP WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62915 | SMS Contact Form 7 Notifications by ClickSend WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62913 | Opal Service WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62912 | SiteGround Email Marketing WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62911 | Rock Convert WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62910 | Video Gallery by Huzzaz WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62909 | Smart WeTransfer WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62907 | Custom Post Type Attachment WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62906 | Referral Link Tracker WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-62905 | Query Posts WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62904 | WP Geo WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62903 | WPC Smart Messages for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62902 | WP Popup Builder WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62900 | Popular Posts by Webline WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62899 | Photospace Responsive WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62898 | Links shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62897 | WP Recipe Maker WordPress plugin content injection | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62896 | Multilang Contact Form WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-62895 | Atarim WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62894 | ACF Recent Posts Widget WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-62892 | Sunshine Photo Cart WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62891 | Off-Canvas Sidebars and Menus (Slidebars) WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-62890 | Premmerce Brands for WooCommerce WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-62889 | King Addons for Elementor WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62887 | King Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62886 | Pricing Table builder WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-62885 | WP VR WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62884 | Coupon Affiliates WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62883 | Premmerce User Roles WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62882 | Seriously Simple Podcasting WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62881 | WP-Lister Lite for eBay WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62793 | eLabFTW HTML / CSS injection via Malicious SVG upload leads to Credential Theft / clickjacking | 6.8CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62784 | InventoryGui allows item duplication in GUIs which use GuiStorageElement | 5.3CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62783 | InventoryGui affected by item duplication in GUIs which use GuiStorageElement | 5.0CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62782 | InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement | 5.9CNA v4.0 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62781 | PILOS is missing session regeneration after password change | 5.0CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62779 | Frappe Learning users were able to add HTML through input fields in the Job form | 1.2CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62778 | Frappe Learning allowed students to access the Quiz form via direct URL | 1.3CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62725 | Docker Compose vulnerable to path traversal via OCI Artifact Layer Annotations | 8.9CNA v4.0 | 13.7% | 2025-10-27 | Fix |
| CVE-2025-62594 | ImageMagick CLAHEImage function denial of service | 4.7CNA v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-62524 | THM-Health PILOS X-Powered-By header information disclosure | 5.3CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62523 | PILOS Misconfigured the Access-Control-Allow-Origin header | 6.3CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62263 | Liferay Portal vulnerable to cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62262 | Liferay Portal vulnerable to information exposure | 4.6CNA v4.0 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-62261 | Liferay Portal Stores Password Reset Tokens in Plain Text | 6.9CNA v4.0 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-62260 | Liferay Portal vulnerable to DoS via Crafted Headless API request | 7.1CNA v4.0 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-62259 | Liferay Portal Does not Limit Access to APIs before Email Verification | 6.9CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62258 | Liferay Portal vulnerable to CSRF in Headless APIs | 7.0CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-62253 | Liferay Portal vulnerable to open redirect | 6.9CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-61795 | Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS | 5.3CISA ADP v3.1 | 1.2% | 2025-10-27 | Fix |
| CVE-2025-61482 | NetKnights privacyIDEA Authenticator OTP secret storage insecure storage of sensitive information | 7.2CISA ADP v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-61481 | MikroTik RouterOS and SwOS cleartext transmission of sensitive information | 10.0CISA ADP v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-61385 | Pg8000 SQL injection vulnerability via a specially crafted Python list input | 9.6CISA ADP v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-61247 | online-shopping-system-php login.php SQL injection | 8.2CISA ADP v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-61105 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-61102 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-61101 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-61100 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-61099 | FRRouting null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-60983 | Rubikon Banking Solution reflected cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-60982 | Educare ERP insecure direct object reference | 5.4CISA ADP v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-60791 | Easywork Enterprise license activation cleartext storage of sensitive information | 6.2CISA ADP v3.1 | 0.1% | 2025-10-27 | Exploit code |
| CVE-2025-60425 | Nagios Fusion session hijacking | 8.6CISA ADP v3.1 | 1.0% | 2025-10-27 | Fix |
| CVE-2025-60424 | Nagios Fusion improper authentication | 7.6CISA ADP v3.1 | 0.7% | 2025-10-27 | Exploit codeFix |
| CVE-2025-60291 | eTimeTrackLite Web improper access control | 9.1CISA ADP v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-59463 | SICK TLOC100-100 all Firmware denial of service (DoS) via chunk size mismatch | 4.3CNA v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-59462 | SICK TLOC100-100 all Firmware denial of service (DoS) via delayed or missing client response | 6.5CNA v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-59461 | SICK TLOC100-100 all Firmware API does not require authentication | 7.6CNA v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-59460 | SICK TLOC100-100 with Firmware unsecure access configuration | 7.5CNA v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-59459 | SICK TLOC100-100 denial of service (DoS) via resource consumption | 5.5CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-59151 | Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection | 8.2CNA v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-58918 | Entrada WordPress theme cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-58356 | Constellation allows insecure use of LUKS2 persistent storage partitions | 8.3CNA v4.0 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-55754 | Apache Tomcat: Console manipulation via escape sequences in log messages | 9.6CISA ADP v3.1 | 10.2% | 2025-10-27 | Fix |
| CVE-2025-55752 | Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | 7.5CISA ADP v3.1 | 64.4% | 2025-10-27 | Emerging ThreatsExploit codeFix |
| CVE-2025-54970 | Baesystems Socet Gxp improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-54969 | Baesystems Socet Gxp cross-site request forgery | 6.1CISA ADP v3.1 | 0.1% | 2025-10-27 | |
| CVE-2025-54968 | Baesystems Socet Gxp improper access control | 8.8CISA ADP v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-54967 | Baesystems Socet Gxp cross-site scripting | 6.5CISA ADP v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-54965 | Baesystems Socet Gxp cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-53533 | Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page | 5.1CNA v4.0 | 0.6% | 2025-10-27 | NucleiExploit codeFix |
| CVE-2025-52268 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. | 7.5CISA ADP v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-52264 | StarCharge Artemis AC Charger 7-22 kW download.cgi buffer overflow | 8.0CISA ADP v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-52263 | Artemis AC Charger 7-22 kW web configuration module vulnerability | 8.0CISA ADP v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-50055 | OpenVPN Access Server SAML Authentication module cross-site scripting | 6.4CISA ADP v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-48088 | Ultimate Addons for WPBakery Page Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-46602 | Dell SupportAssist OS Recovery sensitive information in an accessible file | 4.4CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-46583 | DOS vulnerability in ZTE MC889A Pro product | 5.3CNA v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-46582 | Private key disclosure vulnerability in ZTE ZXMP M721 Product | 7.7CNA v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-41384 | Reflected cross-site scripting (XSS) in SuiteCRM | 6.1v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-41068 | Reachable assertion vulnerability in Open5GS | 7.5NVD v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-41067 | Reachable assertion vulnerability in Open5GS | 7.5NVD v3.1 | 0.4% | 2025-10-27 | Exploit codeFix |
| CVE-2025-41009 | SQL injection on the virtual campus platform of Diseño de Recursos Educativos | 9.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-36170 | IBM QRadar SIEM cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-36138 | IBM QRadar SIEM cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-36121 | HTML injection vulnerability in a Specific URL endpoint of the IBM OpenPages application | 5.4CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-36007 | IBM QRadar SIEM incorrect privilege assignment | 7.8CNA v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-34292 | BeWelcome/Rox PHP object injection RCE | 9.4CNA v4.0 | 0.8% | 2025-10-27 | |
| CVE-2025-34133 | Wimi Teamwork API cross-site request forgery | 7.0CNA v4.0 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-32785 | Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management | 2.0CNA v4.0 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-27225 | Rocket Software Trufusion Enterprise information disclosure | 7.5CISA ADP v3.1 | 18.4% | 2025-10-27 | Nuclei |
| CVE-2025-27224 | Rocket Software Trufusion Enterprise path traversal | 9.8CISA ADP v3.1 | 0.9% | 2025-10-27 | |
| CVE-2025-27223 | Rocket Software Trufusion Enterprise sensitive cookie without the HttpOnly flag | 7.5CISA ADP v3.1 | 2.2% | 2025-10-27 | Nuclei |
| CVE-2025-27222 | Rocket Software Trufusion Enterprise path traversal | 8.6CISA ADP v3.1 | 2.0% | 2025-10-27 | Reported exploitedNuclei |
| CVE-2025-26862 | PingFederate unexpected browser flow initiation in redirectless mode | 0.0CNA v4.0 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-12365 | Azure Access Technology BLU-IC2 Error Messages Wrapped in HTTP header | 6.9CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12364 | Azure Access Technology BLU-IC2 weak password Policy | 10.0CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12363 | Azure Access Technology BLU-IC2 email password disclosure | 10.0CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12351 | Honeywell S35 Series Cameras user controller privilege escalation | 6.8CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-12334 | code-projects E-Commerce Website product_add.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12333 | code-projects E-Commerce Website supplier_add.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12331 | Willow CMS add unrestricted upload | 7.2NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12330 | Willow CMS Add Post add cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12329 | shawon100 RUET OJ details.php SQL injection | 6.5NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12328 | shawon100 RUET OJ contestproblem.php SQL injection | 6.5NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12327 | shawon100 RUET OJ description.php SQL injection | 6.5NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12326 | shawon100 RUET OJ POST request process.php SQL injection | 7.5NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12325 | SourceCodester Best Salon Management System forgot-password.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12322 | Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-10-27 | |
| CVE-2025-12316 | code-projects Courier Management System edit-courier.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12315 | code-projects Food Ordering System menu.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12314 | code-projects Food Ordering System deleteitem.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12313 | D-Link DI-7001 MINI msp_info.htm command injection | 9.8NVD v3.1 | 4.0% | 2025-10-27 | |
| CVE-2025-12312 | PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12311 | PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12310 | VirtFusion Email Change _settings excessive authentication | 6.9CNA v4.0 | 0.4% | 2025-10-27 | |
| CVE-2025-12309 | code-projects Nero Social Networking Site friendprofile.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12308 | code-projects Nero Social Networking Site deletemessage.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12307 | code-projects Nero Social Networking Site addfriend.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12306 | code-projects Nero Social Networking Site acceptoffres.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12305 | quequnlong shiyi-blog Job SysJobController.java deserialization | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12304 | dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization | 5.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12303 | PHPGurukul Curfew e-Pass Management System admin-profile.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12302 | code-projects Simple Food Ordering System editproduct.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12301 | code-projects Simple Food Ordering System editproduct.php unrestricted upload | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12300 | code-projects Simple Food Ordering System addcategory.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12299 | code-projects Simple Food Ordering System addproduct.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12298 | code-projects Simple Food Ordering System editcategory.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12297 | atjiu pybbs UserApiController.java information disclosure | 5.3CNA v4.0 | 0.4% | 2025-10-27 | |
| CVE-2025-12296 | D-Link DAP-2695 Firmware Update sub_4174B0 os command injection | 9.8NVD v3.1 | 7.0% | 2025-10-27 | |
| CVE-2025-12295 | D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification | 8.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12294 | SourceCodester Point of Sales delete_category.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12293 | SourceCodester Point of Sales category.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12292 | SourceCodester Point of Sales index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12291 | ashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted upload | 5.1CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12290 | A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some unknown functionality of the file /i/359. The manipulation of the argument keywords leads to cross site scripting. The attack is possible to b | 5.3CNA v4.0 | 0.4% | 2025-10-27 | |
| CVE-2025-12289 | A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unknown functionality of the file /Point/index/activity_state/1/category_id/1001. Executing manipulation of the argument category_id can lead to | 5.3CNA v4.0 | 0.4% | 2025-10-27 | |
| CVE-2025-12288 | Bdtask Pharmacy Management System User Profile edit_user authorization | 8.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12287 | Bdtask Wholesale Inventory Control and Inventory Management System edit_profile SQL injection | 7.2NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12286 | VeePN AVService avservice.exe unquoted search path | 7.3CNA v4.0 | 0.2% | 2025-10-27 | |
| CVE-2025-12283 | code-projects Client Details System authorization | 8.1NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12282 | code-projects Client Details System manage-users.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12281 | code-projects Client Details System clientview.php cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12280 | code-projects Client Details System update-clients.php cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12279 | code-projects Client Details System welcome.php cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12277 | Abdullah-Hasan-Sajjad Online-School studentLogin.php SQL injection | 6.9CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12276 | LearnHouse Image information disclosure | 7.5v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12274 | Tenda CH22 P2pListFilter fromP2pListFilter buffer overflow | 8.7CNA v4.0 | 0.7% | 2025-10-27 | Emerging Threats |
| CVE-2025-12273 | Tenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflow | 9.8NVD v3.1 | 1.0% | 2025-10-27 | Emerging Threats |
| CVE-2025-12272 | Tenda CH22 addressNat fromAddressNat buffer overflow | 9.8NVD v3.1 | 0.8% | 2025-10-27 | Emerging Threats |
| CVE-2025-12271 | Tenda CH22 RouteStatic fromRouteStatic buffer overflow | 9.8NVD v3.1 | 1.0% | 2025-10-27 | Emerging Threats |
| CVE-2025-12270 | LearnHouse Student Assignment Submission sub_file resource injection | 7.5v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12269 | LearnHouse Account setting previews cross-site scripting | 5.4v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12268 | LearnHouse Course Thumbnail courses unrestricted upload | 9.8v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12267 | abhicodebox ModernShop search cross-site scripting | 5.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12266 | Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection | 5.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12265 | Tenda CH22 VirtualSer fromVirtualSer buffer overflow | 9.8NVD v3.1 | 1.0% | 2025-10-27 | Emerging Threats |
| CVE-2025-12264 | Wisencode Create Support Ticket handler cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-10-27 | |
| CVE-2025-12263 | code-projects Online Event Judging System edit_judge.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12262 | code-projects Online Event Judging System edit_criteria.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12261 | CodeAstro Gym Management System remove-announcement.php SQL injection | 8.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12260 | TOTOLINK A3300R POST parameter cstecgi.cgi setSyslogCfg stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12259 | TOTOLINK A3300R POST parameter cstecgi.cgi setScheduleCfg stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12258 | TOTOLINK A3300R POST parameter cstecgi.cg setOpModeCfg stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12257 | SourceCodester Online Student Result System view_result.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12256 | code-projects Online Event Judging System edit_contestant.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12255 | code-projects Online Event Judging System add_contestant.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12254 | code-projects Online Event Judging System add_judge.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12253 | AMTT Hotel Broadband Operation System get_expiredtime.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12252 | code-projects Online Event Judging System action.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12251 | OpenWGA Admin UI cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12250 | OpenWGA TMLScript API WGA.file path traversal | 5.1CNA v4.0 | 0.5% | 2025-10-27 | |
| CVE-2025-12249 | Axosoft Scrum and Bug Tracking Edit Ticket page CSV injection | 5.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12248 | CLTPHP search.html SQL injection | 6.9CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12247 | Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search path | 7.3CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-12246 | chatwoot Admin IframeLoader.vue cross-site scripting | 6.1v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12245 | chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation | 5.3v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12244 | code-projects Simple E-Banking System register.php cross-site scripting | 6.1NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12243 | code-projects Client Details System GET parameter welcome.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12242 | CodeAstro Gym Management System check-attendance.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12241 | TOTOLINK A3300R POST parameter cstecgi.cgi setLanguageCfg stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12240 | TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow | 9.8NVD v3.1 | 0.8% | 2025-10-27 | |
| CVE-2025-12239 | TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflow | 9.8NVD v3.1 | 0.8% | 2025-10-27 | |
| CVE-2025-12238 | code-projects Automated Voting System user.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12237 | Projectworlds Advanced Library Management System index.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12236 | Tenda CH22 DhcpListClient fromDhcpListClient buffer overflow | 8.8NVD v3.1 | 3.5% | 2025-10-27 | Emerging Threats |
| CVE-2025-12235 | Tenda CH22 SetIpBind fromSetIpBind buffer overflow | 8.0NVD v3.1 | 5.2% | 2025-10-27 | Emerging Threats |
| CVE-2025-12234 | Tenda CH22 SafeMacFilter fromSafeMacFilter buffer overflow | 8.8NVD v3.1 | 1.1% | 2025-10-27 | Emerging Threats |
| CVE-2025-12233 | Tenda CH22 SafeUrlFilter fromSafeUrlFilter buffer overflow | 8.8NVD v3.1 | 4.7% | 2025-10-27 | Emerging Threats |
| CVE-2025-12232 | Tenda CH22 SafeClientFilter fromSafeClientFilter buffer overflow | 9.8NVD v3.1 | 4.9% | 2025-10-27 | Emerging Threats |
| CVE-2025-12231 | Projectworlds Expense Management System Expense Categories create cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12230 | Projectworlds Expense Management System Currency create cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12229 | Projectworlds Expense Management System Roles page create cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12228 | Projectworlds Expense Management System Users page create cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12227 | Projectworlds Gate Pass Management System add-pass.php cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-12226 | SourceCodester Best House Rental Management System admin_class.php save_house SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12225 | Tenda AC6 HTTP Request WifiGuestSet stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12224 | Iqbolshoh php-business-website contact.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12223 | Bdtask Flight Booking Software Package Information package-information unrestricted upload | 8.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12222 | Bdtask Flight Booking Software Deposit deposit unrestricted upload | 8.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12215 | Projectworlds Online Shopping System login_submit.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12214 | Tenda O3 sysAutoReboot GetValue stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-10-27 | |
| CVE-2025-12213 | Tenda O3 setVlanConfig GetValue stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-10-27 | |
| CVE-2025-12212 | Tenda O3 setNetworkService GetValue stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-10-27 | |
| CVE-2025-12211 | Tenda O3 setDmzInfo GetValue stack-based overflow | 9.8NVD v3.1 | 0.8% | 2025-10-27 | |
| CVE-2025-12210 | Tenda O3 AdvSetLanip GetValue stack-based overflow | 9.8NVD v3.1 | 1.1% | 2025-10-27 | |
| CVE-2025-12209 | Tenda O3 setDhcpConfig GetValue stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-10-27 | |
| CVE-2025-12208 | SourceCodester Best House Rental Management System admin_class.php login2 SQL injection | 9.8NVD v3.1 | 0.5% | 2025-10-27 | |
| CVE-2025-12207 | Kamailio Grammar Rule cfg.y yyerror_at null pointer dereference | 5.5v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-12206 | Kamailio rvalue.c rve_is_constant null pointer dereference | 5.5v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-12205 | Kamailio Configuration file cfg.lex sr_push_yy_state use-after-free | 7.8v3.1 | 0.2% | 2025-10-27 | |
| CVE-2025-12204 | Kamailio Configuration file rvalue.c rve_destroy heap-based overflow | 7.8v3.1 | 0.3% | 2025-10-27 | |
| CVE-2025-12203 | givanz Vvveb Code Editor functions.php sanitizeFileName path traversal | 4.9NVD v3.1 | 0.4% | 2025-10-27 | |
| CVE-2025-12202 | ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-10-27 | |
| CVE-2025-12201 | ajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted upload | 7.2NVD v3.1 | 0.6% | 2025-10-27 | |
| CVE-2025-12080 | Intent Abuse in Google messages for Wear OS for Silent Message Sending | 6.9CNA v4.0 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-12055 | MPDV Mikrolab MIP 2, FEDRA 2 and HYDRA X $SCHEMAS$ filename parameter path traversal | 7.5CISA ADP v3.1 | 3.8% | 2025-10-27 | Nuclei |
| CVE-2025-11989 | Missing authorization in GitLab | 3.7CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-11974 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-11971 | Incorrect authorization in GitLab | 6.5CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-11955 | Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise | 8.2CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-11682 | Stored cross-site scripting in Perx Customer Engagement and Loyalty Platform | 7.1CNA v4.0 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-11447 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.8% | 2025-10-27 | Fix |
| CVE-2025-11248 | Zoho ManageEngine Endpoint Central Sensitive Information Logged | 3.2CNA v3.1 | 0.5% | 2025-10-27 | Fix |
| CVE-2025-11154 | IDonate WordPress plugin unauthenticated user deletion | 5.4CISA ADP v3.1 | 0.1% | 2025-10-27 | Fix |
| CVE-2025-10497 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.6% | 2025-10-27 | Fix |
| CVE-2025-10023 | Centreon Infra Monitoring Services Meta-services module stored cross-site scripting | 6.2CNA v3.1 | 0.2% | 2025-10-27 | Fix |
| CVE-2025-9164 | Multiple DLL search order hijacking vulnerabilities in Docker Desktop Installer for Windows | 8.8CNA v4.0 | 0.1% | 2025-10-27 | |
| CVE-2025-8432 | Centreon Infra Monitoring incorrect default permissions | 8.4CNA v3.1 | 0.4% | 2025-10-27 | Fix |
| CVE-2025-6601 | Business Logic Errors in GitLab | 2.7CNA v3.1 | 0.3% | 2025-10-27 | Fix |
| CVE-2025-12285 | Azure Access Technology BLU-IC2 Missing Initial Password Change | 10.0CNA v4.0 | 0.3% | 2025-10-26 | |
| CVE-2025-12284 | Azure Access Technology BLU-IC2 lack of Input Validation | 6.9CNA v4.0 | 0.2% | 2025-10-26 | |
| CVE-2025-12278 | Azure Access Technology BLU-IC2 Logout Functionality not Working | 6.9CNA v4.0 | 0.2% | 2025-10-26 | |
| CVE-2025-12275 | Azure Access Technology BLU-IC2 Mail Configuration File Manipulation + command execution | 10.0CNA v4.0 | 0.5% | 2025-10-26 | |
| CVE-2025-8709 | SQL injection in langchain-ai/langchain | 7.3CNA v3.0 | 0.2% | 2025-10-26 | Fix |
| CVE-2025-55757 | Extension virtuemart.net XSS in VirtueMart component for Joomla | 6.1CISA ADP v3.1 | 0.2% | 2025-10-25 | |
| CVE-2025-12221 | Azure Access Technology BLU-IC2 CSRF Token not properly Implemented | 2.1CNA v4.0 | 0.2% | 2025-10-25 | |
| CVE-2025-12220 | Azure Access Technology BLU-IC2 busybox multiple Known vulnerabilities | 10.0CNA v4.0 | 0.4% | 2025-10-25 | |
| CVE-2025-12219 | Azure Access Technology BLU-IC2 and BLU-IC4 vulnerable third-party component | 10.0CNA v4.0 | 0.4% | 2025-10-25 | |
| CVE-2025-12218 | Azure Access Technology BLU-IC2 weak default credentials | 10.0CNA v4.0 | 0.3% | 2025-10-25 | |
| CVE-2025-12217 | Azure Access Technology BLU-IC2 SNMP Default Community String (public) | 6.9CNA v4.0 | 0.3% | 2025-10-25 | |
| CVE-2025-12216 | Azure Access Technology BLU-IC2 Malicious / Malformed App can be Installed but not Uninstalled | 10.0CNA v4.0 | 0.2% | 2025-10-25 | |
| CVE-2025-12095 | Simple Registration for WooCommerce WordPress plugin cross-site request forgery | 8.8CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-12034 | Fast Velocity Minify WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-12005 | WP VR WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11976 | FuseWP WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-10-25 | Fix |
| CVE-2025-11897 | The7 Ultimate WordPress and WooCommerce theme stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11893 | Charitable Donation Plugin for WordPress Fundraising with Recurring Donations and More SQL injection | 6.5CNA v3.1 | 0.4% | 2025-10-25 | Fix |
| CVE-2025-11888 | ShopEngine Elementor WooCommerce Builder Addon WordPress plugin unauthorized access | 2.7CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11879 | GenerateBlocks WordPress plugin improper authorization to authenticated arbitrary options disclosure | 6.5CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-11875 | SpendeOnline.org WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11823 | ShopLentor WordPress plugin stored cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11760 | eRoom WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-11564 | Tutor LMS WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-11497 | Advanced Database Cleaner WordPress plugin cross-site request forgery to settings manipulation | 4.3CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11269 | Product Filter by WBW WordPress plugin missing authorization to unauthenticated settings update | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-11255 | Password Policy Manager WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-11244 | Password Protected WordPress plugin unauthenticated authorization bypass via IP Address spoofing | 3.7CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-11238 | Watu Quiz WordPress plugin unauthenticated stored cross-site scripting via HTTP Referer | 7.2CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-10737 | Open Source Genesis Framework WordPress theme stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-10694 | User Feedback WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-10637 | Social Feed Gallery WordPress plugin missing authorization to unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-10580 | Widget Options The #1 WordPress Widget and Block Control plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-10579 | BackWPup WordPress plugin missing authorization to sensitive information exposure | 5.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-10488 | wpWax Directorist add_listing_action AJAX action path traversal | 8.1CNA v3.1 | 0.9% | 2025-10-25 | Fix |
| CVE-2025-9322 | Stripe Payment Forms WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-8666 | Testimonial Carousel For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-8588 | Gutenberg Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-8483 | Discussion Board WordPress Forum plugin authenticated (Subscriber+) arbitrary shortcode execution | 6.3CNA v3.1 | 0.3% | 2025-10-25 | Fix |
| CVE-2025-8416 | Product Filter by WBW WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.4% | 2025-10-25 | Fix |
| CVE-2025-8413 | Listeo WordPress theme stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-6680 | Tutor LMS WordPress plugin missing authorization to sensitive information exposure | 4.3CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-6639 | Tutor LMS Pro WordPress plugin insecure direct object reference | 5.4CNA v3.1 | 0.2% | 2025-10-25 | Fix |
| CVE-2025-4203 | wpForo Forum WordPress plugin unauthenticated SQL injection via get_members function | 7.5CNA v3.1 | 0.4% | 2025-10-25 | Fix |
| CVE-2025-62868 | Edge CPT WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-62723 | FlashMQ does not release memory of queued QoS messages | 4.3CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-62717 | Emlog Pro session verification code error due to clearing logic error | 2.7CNA v4.0 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-62716 | Plane vulnerable to cross-site scripting via open redirect in ?next_path parameter | 8.1CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-62714 | Karmada Dashboard API unauthorized access | 8.7CNA v4.0 | 0.5% | 2025-10-24 | Fix |
| CVE-2025-62711 | Wasmtime vulnerable to segfault when using component resources | 2.1CNA v4.0 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-61931 | Implem Pleasanter Body stored cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-10-24 | |
| CVE-2025-61430 | Simple DNS Plus DNS over TCP handling information disclosure | 6.5CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-60954 | microweber weak password requirements | 8.3CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60938 | Openenergymonitor Emoncms improper input validation | 7.5CISA ADP v3.1 | 0.6% | 2025-10-24 | |
| CVE-2025-60936 | Openenergymonitor Emoncms cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-60803 | Antabot White-Jotter register API endpoint command injection | 9.8CISA ADP v3.1 | 0.6% | 2025-10-24 | |
| CVE-2025-60801 | jishenghua jshERP command injection | 8.2CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60735 | PerfreeBlog unrestricted file upload | 7.6CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-60731 | PerfreeBlog unrestricted file upload | 7.6CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-60730 | PerfreeBlog incomplete cleanup | 7.6CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-60729 | PerfreeBlog buffer over-read | 5.3CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-60572 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60571 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60570 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60569 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2025-10-24 | |
| CVE-2025-60568 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60566 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60565 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60564 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60563 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60562 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60561 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60559 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60558 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60557 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60556 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60555 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60554 | D-Link DIR-600L buffer overflow | 9.8CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60553 | D-Link DIR-600L buffer overflow | 9.8CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60552 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60551 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60550 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60549 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60548 | D-Link DIR-600L buffer overflow | 9.8CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60547 | D-Link DIR-600L stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-10-24 | |
| CVE-2025-60419 | NDIS Usermode IO driver denial of service | 6.2CISA ADP v3.1 | 0.1% | 2025-10-24 | |
| CVE-2025-58070 | Implem Pleasanter Preview for Attachments stored cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-10-24 | |
| CVE-2025-56438 | Nous W3 Smart WiFi Camera firmware update mechanism privilege escalation | 6.8CISA ADP v3.1 | 0.1% | 2025-10-24 | |
| CVE-2025-46425 | Dell Storage Manager XML external entity injection | 6.5CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-46185 | pgCodeKeeper credential storage vulnerability | 6.2CISA ADP v3.1 | 0.1% | 2025-10-24 | |
| CVE-2025-46183 | pgCodeKeeper deserialization utility deserialization of untrusted data | 8.2CISA ADP v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-43995 | Dell Storage Manager improper authentication | 9.8CNA v3.1 | 0.8% | 2025-10-24 | Fix |
| CVE-2025-43994 | Dell Storage Manager missing authentication | 8.6CNA v3.1 | 0.6% | 2025-10-24 | Fix |
| CVE-2025-40024 | Linux kernel vhost task handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-40023 | Linux kernel Xe GPU virtual function sysfs attributes vulnerability | – | 0.2% | 2025-10-24 | Fix |
| CVE-2025-40022 | Linux kernel AF_ALG socket interface vulnerability | – | 0.2% | 2025-10-24 | Fix |
| CVE-2025-40021 | Linux kernel dynamic events tracing interface vulnerability | – | 0.2% | 2025-10-24 | Fix |
| CVE-2025-40020 | Linux kernel PEAK USB CAN driver vulnerability | – | 0.2% | 2025-10-24 | Fix |
| CVE-2025-40019 | Linux kernel ESSIV crypto template vulnerability | – | 0.3% | 2025-10-24 | Exploit codeFix |
| CVE-2025-40018 | Linux kernel IPVS FTP application helper use-after-free | 7.8CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-36361 | IBM App Connect Enterprise IWA authentication missing authorization | 6.3CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-34503 | Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution | 7.0CNA v4.0 | 0.1% | 2025-10-24 | |
| CVE-2025-34502 | Shuffle Master Deck Mate 2 Missing Secure Boot | 7.0CNA v4.0 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-34500 | Shuffle Master Deck Mate 2 Insecure Update Chain | 7.0CNA v4.0 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-34293 | GN4 Publishing System insecure direct object reference (IDOR) information disclosure | 8.6CNA v4.0 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-12194 | Bouncy Castle vulnerable to uncontrolled resource consumption | 5.9CNA v4.0 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-12176 | Azure Access Technology BLU-IC2 Undocumented Administrative Accounts | 10.0CNA v4.0 | 0.3% | 2025-10-24 | |
| CVE-2025-12136 | Real Cookie Banner: GDPR and ePrivacy Cookie Consent WordPress plugin server-side request forgery | 6.8CNA v3.1 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-12134 | ZoloBlocks WordPress plugin missing authorization to unauthenticated Popup Enable/Disable | 5.3CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-12096 | Simple Excel Pricelist for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-12072 | mynamevenu24 Disable Content Editor For Specific Template cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-10-24 | |
| CVE-2025-12028 | IndieAuth WordPress plugin cross-site request forgery to account takeover via Stolen OAuth Tokens | 8.8CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-12017 | VNPAY for Woocommerce WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-12016 | qnotsquiz WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-12014 | NGINX Cache Optimizer WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-11992 | Multi Item Responsive Slider WordPress plugin cross-site request forgery | 6.1CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-11889 | AIO Forms WordPress plugin authenticated (Admin+) arbitrary file upload via Zip import | 7.2CNA v3.1 | 0.7% | 2025-10-24 | Fix |
| CVE-2025-11887 | Supervisor WordPress plugin missing authorization to authenticated (Subscriber+) settings update | 4.3CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-11576 | AI Chatbot Free Models WordPress plugin CSV injection | 4.3CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-11504 | Quickcreator AI Blog Writer - unauthenticated API key exposure | 7.5CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-11257 | LLM Hubspot Blog Import WordPress plugin missing authorization authenticated Hubspot import | 4.3CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-11253 | SQLi in Aksis Technologies' Netty ERP | 9.8CNA v3.1 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-11172 | The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber- | 4.3CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-11145 | CBK Soft enVision account footprinting information disclosure | 7.5CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-10902 | Originality.ai AI Checker WordPress plugin missing authorization authenticated Scan Log deletion | 4.3CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-10901 | Originality.ai AI Checker WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-10-24 | |
| CVE-2025-10874 | Orbit Fox WordPress plugin Author+ server-side request forgery | 5.5CISA ADP v3.1 | 0.2% | 2025-10-24 | Exploit codeFix |
| CVE-2025-10861 | Popup builder with Gamification WordPress plugin server-side request forgery | 7.5CNA v3.1 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-10749 | 10up Microsoft Azure Storage for WordPress media replace action missing authorization | 5.4CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-10748 | RapidResult WordPress plugin authenticated (Contributor+) SQL injection | 6.5CNA v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-10740 | URL Shortener Plugin For WordPress missing authorization authenticated Link manipulation | 6.3CNA v3.1 | 0.3% | 2025-10-24 | |
| CVE-2025-10723 | PixelYourSite WordPress plugin Admin+ LFI | 2.7CISA ADP v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-10701 | Time Clock A WordPress Employee and Volunteer Time Clock plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-10-24 | Fix |
| CVE-2025-10680 | OpenVPN OS command injection | 8.8CISA ADP v3.1 | 7.3% | 2025-10-24 | Fix |
| CVE-2025-9978 | Jeg Elementor Kit WordPress plugin Author+ stored XSS | 6.8CISA ADP v3.1 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-9158 | Stored XSS in Request Tracker | 5.3CNA v4.0 | 0.4% | 2025-10-24 | Fix |
| CVE-2025-8536 | SQL injection in DobryCMS | 9.3CNA v4.0 | 0.3% | 2025-10-24 | Emerging ThreatsFix |
| CVE-2025-6440 | WooCommerce Designer Pro WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 33.3% | 2025-10-24 | Exploit code |
| CVE-2025-5605 | WSO2 Identity Server Management console of multiple authentication bypass | 4.3CNA v3.1 | 0.9% | 2025-10-24 | NucleiFix |
| CVE-2025-5350 | SSRF and reflected XSS vulnerability in Deprecated Try-It feature of multiple WSO2 Products | 5.9CNA v3.1 | 0.6% | 2025-10-24 | NucleiFix |
| CVE-2025-4106 | WatchGuard Firebox leftover debug code vulnerability | 8.9CNA v4.0 | 0.3% | 2025-10-24 | Fix |
| CVE-2025-62820 | Slack Nebula may accept arbitrary source IP addresses | 4.9CNA v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62713 | Kottster app reinitialization can be re-triggered allowing command injection in development mode | 7.2CNA v4.0 | 0.6% | 2025-10-23 | Fix |
| CVE-2025-62688 | AutomationDirect Productivity Suite incorrect permission assignment for critical resource | 6.9CNA v4.0 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62517 | Rollbar.js prototype pollution vulnerability in merge | 5.9CNA v3.1 | 0.4% | 2025-10-23 | Fix |
| CVE-2025-62499 | Six Apart Movable Type (Software Edition) stored cross-site scripting | 4.6CNA v4.0 | 0.2% | 2025-10-23 | |
| CVE-2025-62498 | AutomationDirect Productivity Suite relative path traversal | 8.6CNA v4.0 | 0.5% | 2025-10-23 | Fix |
| CVE-2025-62401 | Moodle: Possible to bypass timer in timed assignments | 4.3NVD v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62400 | Moodle: Hidden group names visible to event creators | 6.5NVD v3.1 | 0.3% | 2025-10-23 | Fix |
| CVE-2025-62399 | Moodle: Password brute force risk when mobile/web services enabled | 7.5CNA v3.1 | 0.4% | 2025-10-23 | Fix |
| CVE-2025-62398 | Moodle does not properly enforce MFA | 5.4CISA ADP v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62397 | Moodle: Router produces json instead of 404 error for invalid course id | 5.3CNA v3.1 | 0.3% | 2025-10-23 | Fix |
| CVE-2025-62396 | Moodle: Router (r.php) could expose application directories | 5.3CNA v3.1 | 0.3% | 2025-10-23 | Fix |
| CVE-2025-62395 | Moodle: External cohort search service leaks system cohort data | 4.3NVD v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62394 | Moodle: Quiz notifications sent to suspended participants | 4.3CNA v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62393 | Moodle: Course access permissions not properly checked in course_output_fragment_course_overview | 4.3NVD v3.1 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62256 | Liferay Portal and DXP do not properly restrict access to OpenAPI | 6.9CNA v4.0 | 0.4% | 2025-10-23 | Fix |
| CVE-2025-62255 | Liferay Portal Self cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page | 2.0CNA v4.0 | 0.2% | 2025-10-23 | Fix |
| CVE-2025-62254 | Liferay Portal ComboServlet denial of service via large file combination | 6.9CNA v4.0 | 0.6% | 2025-10-23 | Fix |
| CVE-2025-62236 | Frontier Airlines publicly available email address validation | 6.9CNA v4.0 | 0.3% | 2025-10-23 | Fix |
| CVE-2025-62169 | OctoPrint-SpoolManager Plugin APIs do not enforce authentication | 8.1CNA v3.1 | 0.5% | 2025-10-23 | Fix |
| CVE-2025-61977 | AutomationDirect Productivity Suite weak password recovery mechanism for forgotten password | 7.3CNA v4.0 | 0.1% | 2025-10-23 | Fix |
| CVE-2025-61934 | AutomationDirect Productivity Suite Binding to an Unrestricted IP Address | 9.3CNA v4.0 | 0.7% | 2025-10-23 | Fix |
| CVE-2025-61865 | I-O DATA DEVICE NarSuS App unquoted search path | 8.4CNA v4.0 | 0.2% | 2025-10-23 | |
| CVE-2025-61464 | Sir Gnuboard SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-10-23 | |
| CVE-2025-61413 | Piranha CMS vulnerable to stored cross-site scripting (XSS) | 6.1CISA ADP v3.1 | 0.3% | 2025-10-23 | |
| CVE-2025-61136 | sharewarez password reset host header injection | 7.1CISA ADP v3.1 | 0.5% | 2025-10-23 | |
| CVE-2025-61132 | braindump password reset host header injection | 7.1CISA ADP v3.1 | 0.4% | 2025-10-23 | |
| CVE-2025-60859 | Sir Gnuboard cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-10-23 |