CVE-2025 records published in November 2025
This page lists the 2,914 CVE-2025 records published in November 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 10 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 36212.4% of these records
- Listed in CISA KEV
- 100.3% of these records
- Reported exploited
- 80.3% of these records
- Detection signal
- 491.7% of these records
- Exploit code
- 832.8% of these records
- Actionable vendor fix
- 2,03369.8% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in November 2025 have had from about 11 months to about 12 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-66433 | wisc HTCondor incorrect authorization | 4.2CNA v3.1 | 0.1% | 2025-11-30 | Fix |
| CVE-2025-66432 | Oxide Omicron unprotected alternate channel | 5.0CNA v3.1 | 0.2% | 2025-11-30 | Fix |
| CVE-2025-66424 | trytond does not enforce access rights for data export | 6.5CNA v3.1 | 0.2% | 2025-11-30 | Fix |
| CVE-2025-66423 | trytond does not enforce access rights for the route of the HTML editor | 7.1CNA v3.1 | 0.2% | 2025-11-30 | Fix |
| CVE-2025-66422 | trytond allows remote attackers to obtain sensitive trace-back (server setup) information | 4.3CNA v3.1 | 0.3% | 2025-11-30 | Fix |
| CVE-2025-66421 | Tryton sao allows XSS because it does not escape completion values | 5.4CNA v3.1 | 0.2% | 2025-11-30 | Fix |
| CVE-2025-66420 | Tryton sao allows XSS via an HTML attachment | 5.4CNA v3.1 | 0.2% | 2025-11-30 | Fix |
| CVE-2025-35028 | HexStrike AI MCP server command injection | 9.1CNA v3.1 | 5.3% | 2025-11-30 | |
| CVE-2025-13795 | codingWithElias School Management System Edit Student Info student-view.php cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-11-30 | |
| CVE-2025-13793 | winston-dsouza Ecommerce-Website GET parameter header_menu.php cross-site scripting | 5.3CNA v4.0 | 0.3% | 2025-11-30 | |
| CVE-2025-13792 | Qualitor getResumo.php eval code injection | 6.9CNA v4.0 | 0.5% | 2025-11-30 | |
| CVE-2025-13791 | Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal | 6.5v3.1 | 0.5% | 2025-11-30 | |
| CVE-2025-13790 | Scada-LTS cross-site request forgery | 8.8v3.1 | 0.3% | 2025-11-30 | |
| CVE-2025-13789 | ZenTao model.php makeRequest server-side request forgery | 5.3v3.1 | 0.3% | 2025-11-30 | |
| CVE-2025-13788 | Chanjet CRM upgradeattribute.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-30 | |
| CVE-2025-13787 | ZenTao file control.php delete privileges management | 9.1v3.1 | 0.4% | 2025-11-30 | Fix |
| CVE-2025-13786 | taosir WTCMS index.php fetch code injection | 9.8v3.1 | 0.6% | 2025-11-30 | |
| CVE-2025-13785 | yungifez Skuul School Management System Image profile information disclosure | 6.5v3.1 | 0.4% | 2025-11-30 | |
| CVE-2025-13784 | yungifez Skuul School Management System SVG file edit cross-site scripting | 4.8v3.1 | 0.3% | 2025-11-30 | |
| CVE-2025-13783 | taosir WTCMS CommentadminController CommentadminController.class.php delete SQL injection | 9.8v3.1 | 0.3% | 2025-11-30 | |
| CVE-2025-13782 | taosir WTCMS SlideController SlideController.class.php delete SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-30 | |
| CVE-2025-13615 | StreamTube Core WordPress plugin unauthenticated arbitrary user password Change | 9.8CNA v3.1 | 0.4% | 2025-11-30 | Fix |
| CVE-2025-66291 | OrangeHRM interview attachment retrieval improper authorization | 5.3CNA v4.0 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-66290 | OrangeHRM candidate attachment retrieval improper authorization | 5.3CNA v4.0 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-66289 | OrangeHRM session management insufficient session expiration | 8.7CNA v4.0 | 0.3% | 2025-11-29 | Fix |
| CVE-2025-66225 | OrangeHRM is vulnerable to account takeover through Unvalidated Username in Password Reset Workflow | 8.7CNA v4.0 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-66224 | OrangeHRM is vulnerable to code execution | 9.0CNA v4.0 | 0.6% | 2025-11-29 | Exploit codeFix |
| CVE-2025-66223 | OpenObserve's Invite Token Lifecycle Misconfiguration | 8.4CNA v4.0 | 0.3% | 2025-11-29 | Fix |
| CVE-2025-66221 | Werkzeug safe_join allows Windows special device names | 6.3CNA v4.0 | 0.5% | 2025-11-29 | Fix |
| CVE-2025-66219 | willitmerge has a command injection | 6.9CNA v4.0 | 2.7% | 2025-11-29 | |
| CVE-2025-66217 | AIS-catcher integer underflow in MQTT Packet Parsing leading to heap buffer overflow | 8.8CNA v4.0 | 0.7% | 2025-11-29 | Fix |
| CVE-2025-66216 | AIS-catcher has a buffer overflow vulnerability in `AIS::Message` leading to DoS/RCE | 9.3CNA v4.0 | 0.5% | 2025-11-29 | Fix |
| CVE-2025-66201 | LibreChat is vulnerable to server-side request forgery (SSRF) in Actions Capability | 8.6CNA v4.0 | 0.3% | 2025-11-29 | Fix |
| CVE-2025-66036 | Retro is vulnerable to XSS vulnerability in input handling component | 6.1CNA v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-66034 | fontTools is vulnerable to arbitrary file write and XML injection in fontTools.varLib | 6.3CNA v3.1 | 0.5% | 2025-11-29 | Exploit codeFix |
| CVE-2025-66027 | lukevella Rallly participant API information disclosure | 7.1CNA v4.0 | 0.4% | 2025-11-29 | Fix |
| CVE-2025-65892 | Krpano reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-65540 | Exrick xmall Multiple cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-29 | |
| CVE-2025-65113 | ClipBucket v5 Unauthenticated Object Flagging vulnerability | 6.5CNA v3.1 | 0.4% | 2025-11-29 | Fix |
| CVE-2025-65112 | PubNet critical authentication bypass allows Unauthenticated Package upload and Identity spoofing | 9.4CNA v3.1 | 0.5% | 2025-11-29 | Fix |
| CVE-2025-64715 | Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic | 4.0CNA v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-61915 | OpenPrinting CUPS vulnerable to stack based out-of-bound write | 6.0CNA v3.1 | 0.5% | 2025-11-29 | Fix |
| CVE-2025-58436 | OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack | 5.1CNA v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-53939 | Kiteworks Core is vulnerable to improper input validation | 6.3CNA v3.1 | 0.7% | 2025-11-29 | Fix |
| CVE-2025-53900 | Kiteworks MFT has a privilege defined with unsafe actions | 6.5CNA v3.1 | 1.1% | 2025-11-29 | Fix |
| CVE-2025-53899 | Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel | 7.2CNA v3.1 | 0.9% | 2025-11-29 | Fix |
| CVE-2025-53897 | Kiteworks MFT has a cross-site request forgery (CSRF) | 6.8CNA v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-53896 | Kiteworks MFT is vulnerable to insufficient session expiration | 7.1CNA v3.1 | 0.2% | 2025-11-29 | Fix |
| CVE-2025-6666 | motogadget mo.lock Ignition Lock NFC hard-coded key | 1.0CNA v4.0 | 0.1% | 2025-11-29 | |
| CVE-2025-66386 | MISP relative path traversal | 4.1CNA v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-66385 | Cerebrate web parameter tampering | 9.4CNA v4.0 | 0.4% | 2025-11-28 | Fix |
| CVE-2025-66384 | MISP incorrect behavior | 8.2CNA v3.1 | 0.4% | 2025-11-28 | Fix |
| CVE-2025-66382 | libexpat algorithmic complexity | 5.5NVD v3.1 | 0.2% | 2025-11-28 | Fix |
| CVE-2025-66372 | Mustangproject allows exfiltrating files via XXE attacks | 2.8CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-66371 | Peppol-py is vulnerable to XXE attacks due to Saxon configuration | 5.0CNA v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-66370 | kivitendo XML external entity injection | 5.0CNA v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-66361 | Logpoint SIEM server-side template injection | 6.5NVD v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-66360 | Logpoint SIEM incorrect authorization | 8.8NVD v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-66359 | Logpoint SIEM cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-11-28 | Fix |
| CVE-2025-64315 | Huawei HarmonyOS access control weakness | 4.4CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-64314 | Huawei HarmonyOS type confusion | 9.3CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-64313 | Huawei HarmonyOS denial of service (DoS) vulnerability in the office service | 5.3CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-64312 | Huawei HarmonyOS permission control vulnerability in the file management module | 4.9CNA v3.1 | 0.2% | 2025-11-28 | Fix |
| CVE-2025-64311 | Huawei HarmonyOS permission control vulnerability in the Notepad module | 5.1CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-59792 | Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins | 5.3CISA ADP v3.1 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-59790 | Apache Kvrocks: RESET command grants admin privileges | 5.4CISA ADP v3.1 | 0.4% | 2025-11-28 | Fix |
| CVE-2025-58316 | Huawei HarmonyOS DoS vulnerability in the video-related system service module | 7.3CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58315 | Huawei HarmonyOS permission control vulnerability in the Wi-Fi module | 5.5CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58314 | Huawei HarmonyOS vulnerability of accessing invalid memory in the component driver module | 6.6CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58312 | Huawei HarmonyOS Permission control vulnerability in the App Lock module | 5.1CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58311 | Huawei HarmonyOS UAF vulnerability in the USB driver module | 5.8CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58310 | Huawei HarmonyOS permission control vulnerability in the distributed component | 8.0CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58309 | Huawei HarmonyOS permission control vulnerability in the startup recovery module | 6.8CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58308 | Huawei HarmonyOS vulnerability of improper criterion security check in the call module | 7.3CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58307 | Huawei HarmonyOS UAF vulnerability in the screen recording framework module | 6.4CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58305 | Huawei HarmonyOS identity authentication bypass vulnerability in the Gallery app | 6.2CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58304 | Huawei HarmonyOS permission control vulnerability in the file management module | 4.9CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58303 | Huawei HarmonyOS UAF vulnerability in the screen recording framework module | 8.4CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58302 | Huawei HarmonyOS permission control vulnerability in the settings module | 8.4CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-58294 | Huawei HarmonyOS permission control vulnerability in the print module | 6.2CNA v3.1 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-51736 | Hcltech Unica HCL Technologies Ltd file upload | 6.3CISA ADP v3.1 | 0.2% | 2025-11-28 | |
| CVE-2025-51735 | Hcltech Unica HCL Technologies Ltd CSV injection | 7.5CISA ADP v3.1 | 0.3% | 2025-11-28 | |
| CVE-2025-51734 | Hcltech Unica HCL Technologies Ltd cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-11-28 | |
| CVE-2025-51733 | Hcltech Unica HCL Technologies Ltd cross-site request forgery | 5.5CISA ADP v3.1 | 0.1% | 2025-11-28 | |
| CVE-2025-13771 | Uniong|WebITR arbitrary file read | 7.1CNA v4.0 | 0.5% | 2025-11-28 | Fix |
| CVE-2025-13770 | Uniong|WebITR SQL injection | 7.1CNA v4.0 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-13769 | Uniong|WebITR SQL injection | 7.1CNA v4.0 | 0.3% | 2025-11-28 | Fix |
| CVE-2025-13768 | Uniong|WebITR authorization bypass | 8.8NVD v3.1 | 0.4% | 2025-11-28 | Fix |
| CVE-2025-13737 | Nextend Social Login and Register WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-11-28 | Fix |
| CVE-2025-13683 | Devolutions Server information disclosure | 6.5CISA ADP v3.1 | 0.4% | 2025-11-28 | Fix |
| CVE-2025-12638 | Path traversal vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file | 8.0CNA v3.0 | 0.7% | 2025-11-28 | Fix |
| CVE-2025-12183 | Org.lz4:lz4-java out-of-bounds memory access | 8.8CNA v4.0 | 0.7% | 2025-11-28 | Fix |
| CVE-2025-12143 | ABB Terra AC wallbox stack memory corruption | 6.9CNA v4.0 | 0.2% | 2025-11-28 | Fix |
| CVE-2025-11156 | Improper Service Loading vulnerability in Netskope Endpoint DLP driver | 5.9CNA v4.0 | 0.1% | 2025-11-28 | Fix |
| CVE-2025-66314 | ZTE ElasticNet UME R32 improper privilege management | 7.5CNA v3.1 | 0.3% | 2025-11-27 | |
| CVE-2025-66040 | Spotipy has a XSS vulnerability in OAuth callback server | 3.6CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-59890 | Eaton Galileo Software path traversal | 7.3CNA v3.1 | 0.1% | 2025-11-27 | |
| CVE-2025-59454 | Apache CloudStack: Lack of user permission validation leading to data leak for few APIs | 4.3CISA ADP v3.1 | 0.4% | 2025-11-27 | Fix |
| CVE-2025-59302 | Apache CloudStack: Potential remote code execution on Javascript engine defined rules | 4.7CISA ADP v3.1 | 0.5% | 2025-11-27 | Fix |
| CVE-2025-59026 | Open-Xchange OX App Suite cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-59025 | Open-Xchange OX App Suite cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-54057 | Apache SkyWalking: Stored XSS | 6.1CISA ADP v3.1 | 0.8% | 2025-11-27 | Fix |
| CVE-2025-30190 | Open-Xchange OX App Suite cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-30186 | Open-Xchange OX App Suite cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-13765 | Devolutions Server information disclosure | 4.3v3.1 | 0.4% | 2025-11-27 | Fix |
| CVE-2025-13762 | Client-Side denial of service Condition in SWS Extension prior to | 4.8CNA v4.0 | 0.1% | 2025-11-27 | Fix |
| CVE-2025-13758 | Devolutions Server information disclosure | 3.5v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13757 | Devolutions Server last usage logs SQL injection | 8.8v3.1 | 0.6% | 2025-11-27 | Fix |
| CVE-2025-13742 | pretix limited HTML injection in emails | 2.4CNA v4.0 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-13692 | Unlimited Elements For Elementor WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13680 | Tiger WordPress theme authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-11-27 | |
| CVE-2025-13675 | Tiger WordPress theme unauthenticated privilege escalation | 9.8CNA v3.1 | 0.3% | 2025-11-27 | |
| CVE-2025-13540 | Tiare Membership WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13539 | FindAll Membership WordPress plugin authentication bypass via Social login | 9.8CNA v3.1 | 0.5% | 2025-11-27 | Fix |
| CVE-2025-13538 | FindAll Listing WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13536 | Blubrry PowerPress WordPress plugin arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-11-27 | Fix |
| CVE-2025-13525 | WP Directory Kit WordPress plugin reflected cross-site scripting via order_by parameter | 6.1CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13441 | Hide Category by User Role for WooCommerce WordPress plugin missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13381 | AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13378 | AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin server-side request forgery | 6.5CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13157 | QODE Wishlist for WooCommerce WordPress plugin insecure direct object reference | 5.3CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-13143 | Poll, Survey and Quiz Maker Plugin by Opinion Stage WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-12971 | Folders WordPress plugin incorrect authorization to authenticated Folder content manipulation | 4.3CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-12758 | Validator is vulnerable to incomplete filtering of One or More Instances of Special Elements | 8.7CNA v4.0 | 0.5% | 2025-11-27 | Fix |
| CVE-2025-12713 | Soundslides WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12712 | Shouty WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12670 | wp-twitpic WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12666 | Google Drive upload and download link WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12649 | SortTable Post WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12584 | Quick View for WooCommerce WordPress plugin unauthenticated Private Product disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-12579 | Reuters Direct WordPress plugin missing authorization to unauthenticated settings reset | 5.3CNA v3.1 | 0.2% | 2025-11-27 | |
| CVE-2025-12578 | Reuters Direct WordPress plugin cross-site request forgery to settings reset | 4.3CNA v3.1 | 0.1% | 2025-11-27 | |
| CVE-2025-12559 | Mattermost information disclosure in Common Teams API | 4.3CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-12421 | Mattermost account takeover via Code Exchange endpoint | 9.9CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-12419 | Mattermost account takeover on OAuth/OpenID-enabled servers | 9.9CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-12185 | StaffList WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-12151 | Simple Folio WordPress plugin authenticated (Subscriber+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-12140 | RCE in Wirtualna Uczelnia | 9.3CNA v4.0 | 0.4% | 2025-11-27 | Fix |
| CVE-2025-12123 | Customer Reviews Collector for WooCommerce WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-10476 | WP Fastest Cache WordPress plugin missing authorization authenticated DB Cleanup actions | 4.3CNA v3.1 | 0.2% | 2025-11-27 | Fix |
| CVE-2025-8890 | Authenticated RCE in SDMC NE6037 router | 9.3CNA v4.0 | 0.9% | 2025-11-27 | Fix |
| CVE-2025-7820 | SKT PayPal for WooCommerce WordPress plugin unauthenticated Payment bypass | 7.5CNA v3.1 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-3784 | Information disclosure vulnerability in GX Works2 | 5.5CNA v3.1 | 0.1% | 2025-11-27 | Fix |
| CVE-2025-0658 | Automated Logic and Carrier Zone Controllers malformed packets denial of service | 8.7CNA v4.0 | 0.3% | 2025-11-27 | Fix |
| CVE-2025-0657 | ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range | 8.8CNA v4.0 | 0.3% | 2025-11-27 | |
| CVE-2025-66269 | Unquoted service path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM | 7.1CNA v4.0 | 0.1% | 2025-11-26 | |
| CVE-2025-66266 | Insecure SYSTEM Service Permissions in UPSilon2000V6.0 leading to trivial local privilege escalation | 9.3CNA v4.0 | 0.1% | 2025-11-26 | |
| CVE-2025-66265 | MegaTec Taiwan ClientMate insecure permissions in configuration directory (C:\\usr) | 6.9CNA v4.0 | 0.1% | 2025-11-26 | |
| CVE-2025-66264 | MegaTec Taiwan ClientMate unquoted service path in UPSilon2000V6.0 SYSTEM privilege service | 7.2CNA v4.0 | 0.1% | 2025-11-26 | |
| CVE-2025-66263 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file read | 7.5v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66262 | DB Electronica Telecomunicazioni Mozart FM Transmitter arbitrary file overwrite | 9.8v3.1 | 1.4% | 2025-11-26 | |
| CVE-2025-66261 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated OS command injection | 9.8v3.1 | 2.3% | 2025-11-26 | |
| CVE-2025-66260 | DB Electronica Telecomunicazioni Mozart FM Transmitter PostgreSQL SQL injection (status_sql.php) | 6.5NVD v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-66259 | DB Electronica Telecomunicazioni Mozart FM Transmitter authenticated Root remote code execution | 9.8v3.1 | 0.7% | 2025-11-26 | |
| CVE-2025-66258 | DB Electronica Telecomunicazioni Mozart FM Transmitter stored cross-site scripting via XML injection | 5.4NVD v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-66257 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file deletion | 9.1v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66256 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload | 9.8v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66255 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload | 9.8v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66254 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file deletion | 9.1v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66253 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated OS command injection | 9.8v3.1 | 2.3% | 2025-11-26 | |
| CVE-2025-66252 | DB Electronica Telecomunicazioni Mozart FM Transmitter infinite loop denial of service | 7.5v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66251 | DB Electronica Telecomunicazioni Mozart FM Transmitter Unauthenticated path traversal | 9.1v3.1 | 0.5% | 2025-11-26 | |
| CVE-2025-66250 | DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload | 9.8v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-66035 | Angular HTTP client has XSRF token leakage via Protocol-Relative URLs | 7.7CNA v4.0 | 0.7% | 2025-11-26 | Fix |
| CVE-2025-66031 | digitalbazaar forge node-forge ASN.1 Unbounded Recursion | 8.7CNA v4.0 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-66030 | digitalbazaar forge node-forge ASN.1 OID Integer Truncation | 6.3CNA v4.0 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-66028 | OneUptime is vulnerable to privilege escalation via Login Response Manipulation | 6.9CNA v4.0 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-66026 | REDAXO is vulnerable to reflected XSS in Mediapool Info Banner via args[types] | 6.1CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-66025 | Caido improperly Handles External Links in Markdown | 4.3CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-66022 | FACTION Unauthenticated Custom extension upload leads to RCE | 9.7CNA v3.1 | 0.7% | 2025-11-26 | Fix |
| CVE-2025-66021 | OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization | 8.6CNA v4.0 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-66020 | Valibot has a ReDoS vulnerability in `EMOJI_REGEX` | 7.5CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-66019 | pypdf manipulated LZWDecode streams can exhaust RAM | 6.6CNA v4.0 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-65966 | OneUptime Unauthorized User Creation via API | 8.8CNA v4.0 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-65963 | CFiles Unauthorized Folder/ZIP Access in Public Spaces | 5.4CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-65957 | Intercore-Productions Core-Bot information disclosure | 8.8CNA v4.0 | 0.3% | 2025-11-26 | |
| CVE-2025-65956 | Formwork CMS has a stored cross-site scripting (XSS) vulnerability in Blog Tags | 6.5CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-65681 | Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control | 3.3CISA ADP v3.1 | 0.2% | 2025-11-26 | Exploit code |
| CVE-2025-65676 | ClassroomIO stored cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-65675 | ClassroomIO stored cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-65672 | ClassroomIO insecure direct object reference | 7.5CISA ADP v3.1 | 0.4% | 2025-11-26 | Exploit code |
| CVE-2025-65670 | ClassroomIO An insecure direct object reference | 4.3CISA ADP v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-65669 | ClassroomIO missing authorization | 9.1CISA ADP v3.1 | 0.5% | 2025-11-26 | |
| CVE-2025-65278 | Komal97 Grocerymart cleartext storage of sensitive information | 7.5CISA ADP v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-65276 | Henzljw Hashtech missing authentication | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-65239 | Opencode Ussd Gateway improper access control | 4.3CISA ADP v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-65238 | Opencode Ussd Gateway information disclosure | 6.5CISA ADP v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-65237 | Opencode Ussd Gateway cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-65236 | Opencode Ussd Gateway SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-65235 | Opencode Ussd Gateway SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-65202 | TRENDnet TEW-657BRM OS command injection | 8.0CISA ADP v3.1 | 6.7% | 2025-11-26 | |
| CVE-2025-64983 | SwitchBot Smart Video Doorbell active debug code | 8.6CNA v4.0 | 0.3% | 2025-11-26 | |
| CVE-2025-64657 | Microsoft Azure Application Gateway elevation of privilege | 9.8CNA v3.1 | 0.6% | 2025-11-26 | Fix |
| CVE-2025-64656 | Microsoft Azure Application Gateway elevation of privilege | 9.4CNA v3.1 | 0.6% | 2025-11-26 | Fix |
| CVE-2025-64344 | Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer | 7.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64335 | Suricata is vulnerable to a null deref when used with base64_data | 7.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64334 | Suricata is vulnerable to unbounded memory growth for decompression | 7.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64333 | Suricata is vulnerable to a stack overflow from big content-type | 7.5CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-64332 | Suricata is vulnerable to a stack overflow on larger compressed data | 7.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64331 | Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable | 7.5CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-64330 | Suricata is vulnerable to a heap buffer overflow on verdict | 7.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64130 | Zenitel TCIV-3+ cross-site scripting | 9.3CNA v4.0 | 0.9% | 2025-11-26 | Fix |
| CVE-2025-64129 | Zenitel TCIV-3+ out-of-bounds write | 7.0CNA v4.0 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-64128 | Zenitel TCIV-3+ OS command injection | 10.0CNA v4.0 | 2.4% | 2025-11-26 | Fix |
| CVE-2025-64127 | Zenitel TCIV-3+ OS command injection | 10.0CNA v4.0 | 2.4% | 2025-11-26 | Fix |
| CVE-2025-64126 | Zenitel TCIV-3+ OS command injection | 10.0CNA v4.0 | 2.4% | 2025-11-26 | Fix |
| CVE-2025-63938 | Tinyproxy integer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-62728 | Apache Hive: SQL injection vulnerability when processing delete column statistics requests | 5.4CISA ADP v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-62593 | Ray-Project Ray code injection | 9.4CNA v4.0 | 62.5% | 2025-11-26 | KEVNucleiExploit codeFix |
| CVE-2025-62354 | cursor OS command improper neutralization | 9.8CNA v3.1 | 1.4% | 2025-11-26 | Fix |
| CVE-2025-59820 | KDE Krita improper quantity validation | 6.7CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-59390 | Apache Druid’s Kerberos authenticator uses a weak fallback secret | 9.8CISA ADP v3.1 | 0.6% | 2025-11-26 | Fix |
| CVE-2025-56396 | RuoYi improper access control | 8.8v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-55471 | youlai-boot missing authorization | 7.5CISA ADP v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-55469 | youlai-boot incorrect authorization | 9.8v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-55174 | KDE Skanpage incorrect behavior | 3.2CNA v3.1 | 0.1% | 2025-11-26 | Fix |
| CVE-2025-50433 | Monnit Imonnit weak password recovery | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-50402 | Fastcom FAC1200R buffer overflow | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-50399 | Fastcom FAC1200R buffer overflow | 9.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-46175 | RuoYi missing authorization | 7.5v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-46174 | RuoYi missing authorization | 7.5v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-45311 | fail2ban-client v0.11.2 insecure permissions | 8.8CISA ADP v3.1 | 0.4% | 2025-11-26 | |
| CVE-2025-40934 | XML-Sig for Perl improperly validates XML without signatures | 9.3CISA ADP v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-26155 | ncp-e Secure Enterprise Client untrusted search path | 9.8CISA ADP v3.1 | 0.6% | 2025-11-26 | |
| CVE-2025-20373 | Sensitive information disclosure in “_internal“ index through Splunk Add-on for Palo Alto Networks | 2.7CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-13735 | ASR Lapwing_Linux out-of-bounds read in nr flc | 7.4CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-13674 | Access of uninitialized pointer in Wireshark | 5.5CNA v3.1 | 0.1% | 2025-11-26 | Fix |
| CVE-2025-13611 | Insertion of sensitive information into log file in GitLab | 2.0CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-13601 | GLib: Integer overflow in in g_escape_uri_string | 7.7CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-13084 | Opto 22 groov View exposure of sensitive information through Metadata | 6.1CNA v4.0 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-12848 | XSS vulnerability when rendering filename in Webform Multiform | 7.0CNA v4.0 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-12653 | Authentication bypass by spoofing in GitLab | 6.5CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-12571 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.5% | 2025-11-26 | Fix |
| CVE-2025-12061 | Tax Service Electronic HDM WordPress plugin unauthenticated arbitrary SQL execution | 8.6CISA ADP v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-11461 | Frappe CRM multiple SQL Injections in Dashboard controller | 8.8v3.1 | 0.3% | 2025-11-26 | |
| CVE-2025-9558 | zephyrproject-rtos Zephyr Bluetooth: Mesh: Out-of-bound write in gen_prov_start | 7.6CNA v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-9557 | zephyrproject-rtos Zephyr Bluetooth: Mesh: Out-of-bound write in gen_prov_cont | 7.6CNA v3.1 | 0.2% | 2025-11-26 | |
| CVE-2025-9191 | Houzez WordPress theme authenticated (Subscriber+) PHP object injection via Saved Search | 6.3CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-9163 | Houzez WordPress theme unauthenticated stored cross-site scripting via SVG file upload | 6.1CNA v3.1 | 0.2% | 2025-11-26 | Fix |
| CVE-2025-7449 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.4% | 2025-11-26 | Fix |
| CVE-2025-6195 | Direct request (forced browsing) in GitLab | 4.3CNA v3.1 | 0.3% | 2025-11-26 | Fix |
| CVE-2025-2486 | UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu | 3.7CNA v4.0 | 0.1% | 2025-11-26 | Fix |
| CVE-2025-66017 | CGGMP21 presignatures can be used in the way that significantly reduces security | 8.2CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-66016 | CGGMP24 is missing a check in the ZK proof used in CGGMP21 | 9.3CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-65965 | Grype has a credential disclosure vulnerability in Grype JSON output | 8.2CNA v4.0 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-65961 | Contao is vulnerable to cross-site scripting in templates | 3.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-65960 | Contao is vulnerable to remote code execution in template closures | 6.6CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-65953 | NanoMQ UAF of retain message due to invalid MQTTV5 properties | 6.0CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-65952 | Console is vulnerable to path traversal regarding custom assets | 8.7CNA v4.0 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-65951 | mescuwa Entropy Derby VDF timelock encryption weak cryptographic algorithm | 8.7CNA v3.1 | 0.1% | 2025-11-25 | |
| CVE-2025-65944 | Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true` | 5.1CNA v4.0 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-65942 | VictoriaMetrics Snappy Decoder DoS vulnerability is causing OOM | 2.7CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-65647 | PHPGurukul Online Shopping Portal Track order function insecure direct object reference | 4.3CISA ADP v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-65085 | Heap-based buffer overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share | 9.8v3.1 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-65084 | Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share | 9.8v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-65018 | LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered | 7.1CNA v3.1 | 0.3% | 2025-11-25 | Exploit codeFix |
| CVE-2025-64761 | OpenBao Privileged Operator Identity Group Root Escalation | 7.5CNA v4.0 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-64730 | Sony SNC-CX600W cross-site scripting | 6.1v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-64720 | LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` | 7.1CNA v3.1 | 0.4% | 2025-11-25 | Exploit codeFix |
| CVE-2025-64713 | Bytecode Alliance WebAssembly Micro Runtime fast interpreter out-of-bounds access | 5.1CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-64704 | WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction | 4.7CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-64693 | Intercom Security Point (Windows) of MaLion heap-based buffer overflow | 9.3CNA v4.0 | 0.7% | 2025-11-25 | |
| CVE-2025-64506 | libpng png_write_image_8bit out-of-bounds read | 6.1CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-64505 | LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index | 6.1CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-64304 | Fuji Television Network "FOD" App hard-coded cryptographic key | 5.1CNA v4.0 | 0.1% | 2025-11-25 | |
| CVE-2025-64067 | Primakon Project Contract Management insecure direct object reference | 5.3CISA ADP v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-64066 | Primakon Project Contract Management missing authorization | 8.6CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-64065 | Primakon Project Contract Management improper authorization | 8.8CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-64064 | Primakon Project Contract Management privilege escalation | 8.8CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-64063 | Primakon Project Contract Management improper authorization | 9.8CISA ADP v3.1 | 0.4% | 2025-11-25 | |
| CVE-2025-64062 | Primakon Project Contract Management improper authorization | 8.8CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-64061 | Primakon Project Contract Management system information disclosure | 4.3CISA ADP v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-64050 | REDAXO CMS is vulnerable to RCE attack through its template management component | 7.2CISA ADP v3.1 | 0.9% | 2025-11-25 | Fix |
| CVE-2025-64049 | REDAXO CMS is vulnerable to XSS through its module management component | 4.8CISA ADP v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-63735 | Ruckus Wireless RUCKUS Unleashed reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-25 | Exploit code |
| CVE-2025-63729 | SyroTech Sy-gpon-1110-wdont cleartext storage of sensitive information | 9.0CISA ADP v3.1 | 0.1% | 2025-11-25 | |
| CVE-2025-62703 | Fugue is vulnerable to remote code execution by Pickle deserialization via FlaskRPCServer | 8.8CNA v3.1 | 0.7% | 2025-11-25 | |
| CVE-2025-62691 | Intercom Security Point (Windows) of MaLion stack-based buffer overflow | 9.3CNA v4.0 | 0.7% | 2025-11-25 | |
| CVE-2025-62497 | Sony SNC-CX600W cross-site request forgery | 6.5v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-62155 | QuantumNous New API has SSRF Bypass | 8.5CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-61168 | SIGB PMB deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | Fix |
| CVE-2025-61167 | SIGB PMB SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-60739 | Ilevia Eve X1 Server Firmware cross-site request forgery | 9.6CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-59485 | Intercom Security Point (Windows) of MaLion incorrect default permissions | 4.8CNA v4.0 | 0.1% | 2025-11-25 | |
| CVE-2025-59373 | ASUS MyASUS restore mechanism local privilege escalation | 8.5CNA v4.0 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-59372 | ASUS Router path traversal | 6.9CNA v4.0 | 0.6% | 2025-11-25 | Fix |
| CVE-2025-59371 | ASUS Router insufficient randomness | 7.5CNA v4.0 | 0.8% | 2025-11-25 | Fix |
| CVE-2025-59370 | ASUS Router OS command injection | 7.5CNA v4.0 | 1.0% | 2025-11-25 | Fix |
| CVE-2025-59369 | ASUS Router SQL injection | 5.9CNA v4.0 | 0.5% | 2025-11-25 | Fix |
| CVE-2025-59368 | ASUS Router integer underflow | 6.0CNA v4.0 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-59366 | ASUS Router path traversal | 9.2CNA v4.0 | 15.8% | 2025-11-25 | Fix |
| CVE-2025-59365 | ASUS Router stack-based buffer overflow | 6.9CNA v4.0 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-58360 | OSGeo GeoServer improper restriction of XML external entity reference | 8.2CNA v3.1 | 60.0% | 2025-11-25 | KEVNucleiEmerging ThreatsExploit codeFix |
| CVE-2025-51746 | jishenghua jshERP deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | |
| CVE-2025-51745 | jishenghua jshERP deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | |
| CVE-2025-51744 | jishenghua jshERP deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | |
| CVE-2025-51743 | jishenghua jshERP deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | |
| CVE-2025-51742 | jishenghua jshERP deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.5% | 2025-11-25 | |
| CVE-2025-51741 | Interviewx Echo denial of service | 7.5CISA ADP v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-40890 | Stored cross-site scripting (XSS) in Dashboards in Guardian/CMC | 5.8CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-36134 | IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure | 3.7CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-34350 | UnForm Server Doc Flow Unauthenticated File Read | 8.7CNA v4.0 | 1.0% | 2025-11-25 | Fix |
| CVE-2025-33205 | NVIDIA NeMo Framework inclusion of untrusted functionality | 7.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33204 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33203 | NVIDIA NeMo Agent ToolKit server-side request forgery | 7.6CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-33200 | NVIDIA DGX Spark sensitive information not cleared before reuse | 2.3CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33199 | NVIDIA DGX Spark incorrect control flow | 3.2CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33198 | NVIDIA DGX Spark sensitive information not cleared before reuse | 3.3CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33197 | NVIDIA DGX Spark null pointer dereference | 4.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33196 | NVIDIA DGX Spark sensitive information not cleared before reuse | 4.4CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33195 | NVIDIA DGX Spark tampering | 4.4CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33194 | NVIDIA DGX Spark information disclosure | 5.7CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33193 | NVIDIA DGX Spark improper integrity check validation | 5.7CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33192 | NVIDIA DGX Spark null pointer dereference | 5.7CNA v3.1 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-33191 | NVIDIA DGX Spark denial of service | 5.7CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33190 | NVIDIA DGX Spark out-of-bounds write | 6.7CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33189 | NVIDIA DGX Spark out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33188 | NVIDIA DGX Spark improper privilege management | 8.0CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-33187 | NVIDIA DGX Spark improper privilege management | 9.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-21621 | GeoServer reflected cross-site scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format | 6.1CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13644 | MongoDB may be susceptible to Invariant Failure due to batched delete | 7.1CNA v4.0 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13643 | MongoDB Server may allow queries to be terminated by unauthorized users | 2.3CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-13597 | AI Feeds WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 1.0% | 2025-11-25 | Exploit codeFix |
| CVE-2025-13595 | CIBELES AI WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 1.0% | 2025-11-25 | Exploit codeFix |
| CVE-2025-13559 | EduKart Pro WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-13558 | Blog2Social WordPress plugin missing authorization authenticated arbitrary post Trashing | 5.4CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13507 | MongoDB Server time-series operations may cause internal BSON size limit to be exceed | 7.1CNA v4.0 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13502 | The WebKitGTK Team webkitgtk out-of-bounds read | 7.5CNA v3.1 | 0.6% | 2025-11-25 | Fix |
| CVE-2025-13483 | Missing authentication for critical function in SiRcom SMART Alert (SiSA) | 8.8CNA v4.0 | 0.4% | 2025-11-25 | |
| CVE-2025-13467 | Org.Keycloak.storage.ldap: Keycloak: Deserialization of untrusted data in LDAP user federation | 5.5CNA v3.1 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-13452 | The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This | 4.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-13414 | gwendydd Chamber Dashboard Business Directory missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-13405 | buywptemplates Ace Post Type Builder missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13404 | docjojo atec Duplicate Page and Post missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13389 | nmedia OrderConvo order lookup endpoint information disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13386 | Social Images Widget WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-13385 | Bookme WordPress plugin authenticated (Admin+) SQL injection via filter[status] parameter | 4.9CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-13383 | Job Board by BestWebSoft WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-13382 | Frontend File Manager WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-13380 | AI Engine for WordPress: ChatGPT, GPT Content Generator plugin arbitrary file read | 6.5CNA v3.1 | 0.5% | 2025-11-25 | Exploit code |
| CVE-2025-13376 | ProjectList WordPress plugin authenticated (Editor+) arbitrary file upload | 7.2CNA v3.1 | 0.6% | 2025-11-25 | |
| CVE-2025-13370 | ProjectList WordPress plugin authenticated (Editor+) SQL injection via id parameter | 4.9CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-13311 | Just Highlight WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-13068 | Telegram Bot and Channel WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-12893 | MongoDB Server improper certificate validation | 2.3CNA v4.0 | 0.1% | 2025-11-25 | Fix |
| CVE-2025-12816 | node-forge has an interpretation conflict vulnerability via its ASN.1 Validator Desynchronization | 8.6CISA ADP v3.1 | 0.7% | 2025-11-25 | Fix |
| CVE-2025-12742 | Remote code execution in Looker via Teradata JDBC driver | 7.5CNA v4.0 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-12645 | Inline frame Iframe WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-12634 | Refund Request for WooCommerce WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-12587 | Peer Publish WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-12586 | Conditional Maintenance Mode for WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-12525 | Locker Content WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-11-25 | Fix |
| CVE-2025-12043 | Autochat Automatic Conversation WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-25 | |
| CVE-2025-12040 | Wishlist for WooCommerce WordPress plugin insecure direct object reference | 6.5CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-12032 | ZWeb - Social Mobile WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-12025 | YouTube Subscribe WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-25 | |
| CVE-2025-12003 | ASUS Router path traversal | 8.2CNA v4.0 | 0.6% | 2025-11-25 | Fix |
| CVE-2025-10646 | Search Exclude missing authorization to Authenticated Search Settings Modification | 4.3CNA v3.1 | 0.2% | 2025-11-25 | Fix |
| CVE-2025-9803 | Improper authentication in lunary-ai/Lunary | 8.8NVD v3.1 | 0.5% | 2025-11-25 | Fix |
| CVE-2025-9624 | OpenSearch Nested Boolean/Disjunction asymmetric DoS | 7.5v3.1 | 0.5% | 2025-11-25 | Fix |
| CVE-2025-6389 | Sneeit Framework WordPress plugin remote code execution | 9.8CNA v3.1 | 76.1% | 2025-11-25 | Reported exploitedNucleiEmerging ThreatsExploit codeFix |
| CVE-2025-0248 | HCL iNotes is susceptible to a reflected cross-site scripting (XSS) | 8.1CNA v3.1 | 0.4% | 2025-11-25 | Fix |
| CVE-2025-65998 | Apache Syncope: Default AES key used for internal password encryption | 7.5CISA ADP v3.1 | 0.5% | 2025-11-24 | Fix |
| CVE-2025-65503 | Redboltz Async MQTT endpoint destructors use-after-free | 5.5NVD v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-65502 | Cesanta Mongoose add_ca_certs null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65501 | libcoap coap_dtls_info_callback in OISM null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65500 | libcoap null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65499 | libcoap improper array index validation | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65498 | libcoap null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65497 | libcoap null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65496 | libcoap null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-65495 | libcoap denial of service | 7.5CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-65494 | libcoap null pointer dereference | 7.5CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-65493 | libcoap src/coap_openssl.c in OISM null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-64048 | Yccms cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-64047 | OpenRapid RapidCMS cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-63958 | Millensys Vision Tools Workspace missing authentication | 9.8CISA ADP v3.1 | 0.5% | 2025-11-24 | |
| CVE-2025-63953 | Magewell Ultra Encode Aio /usapi?method=add-user component cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-63952 | Magewell Pro Convert 12G Sdi 4K Plus /mwapi?method=add-user component cross-site request forgery | 5.7CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-63914 | Cinnamon kotaemon decompression bomb | 6.5CISA ADP v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-63674 | Blurams A31C command injection | 6.8v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-63498 | Alinto SOGo cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-24 | Exploit codeFix |
| CVE-2025-63435 | Xtooltech Xtool Anyscan missing authentication | 4.3CISA ADP v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-63434 | Xtooltech Xtool Anyscan download without integrity check | 8.8CISA ADP v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-63433 | Xtooltech Xtool Anyscan hard-coded credentials | 4.6CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-63432 | Xtooltech Xtool Anyscan man-in-the-middle | 4.6CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-60917 | Craws OpenAtlas reflected cross-site scripting | 4.6CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-60916 | Craws OpenAtlas reflected cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-60915 | Craws OpenAtlas path traversal | 8.1CISA ADP v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-60914 | Craws OpenAtlas cross-site scripting | 4.6CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-60638 | free5gc denial of service | 7.5CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-60633 | Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API | 6.5CISA ADP v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-60632 | Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API | 6.5CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-56423 | Craws OpenAtlas observable discrepancy | 5.3CISA ADP v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-56401 | Ziragroup Wbrm SQL injection | 7.6CISA ADP v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-56400 | Tuya SmartLife OAuth implementation of the cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-54563 | Desktopalert Pingalert Application Server Incorrect improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-54347 | Desktopalert Pingalert Application Server path traversal | 9.9CISA ADP v3.1 | 0.7% | 2025-11-24 | Fix |
| CVE-2025-54341 | Desktopalert Pingalert Application Server hard-coded credentials | 5.3CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-54338 | Desktopalert Pingalert Application Server Incorrect improper access control | 7.5CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-52539 | AMD Xilinx Run Time (XRT) stack-based buffer overflow | 7.3CNA v3.1 | 0.1% | 2025-11-24 | |
| CVE-2025-52538 | AMD Xilinx Run Time (XRT) integer overflow | 8.0CNA v3.1 | 0.1% | 2025-11-24 | |
| CVE-2025-48511 | AMD μProf improper index validation | 5.5CNA v3.1 | 0.1% | 2025-11-24 | Fix |
| CVE-2025-48510 | Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. | 7.1CNA v3.1 | 0.1% | 2025-11-24 | Fix |
| CVE-2025-44018 | GL.iNet GL-AXT1800 improper certificate validation | 8.3CNA v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-41729 | Janitza UMG 96-PA DoS via Modbus Read command | 7.5CNA v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-41087 | Cross-site scripting (XSS) stored in Taclia's web application | 5.1CNA v4.0 | 0.3% | 2025-11-24 | |
| CVE-2025-41017 | Davantis DFUSION camera perspective settings endpoint missing authorization | 6.9CNA v4.0 | 0.3% | 2025-11-24 | |
| CVE-2025-41016 | Davantis DFUSION alarm media endpoint missing authorization | 8.7CNA v4.0 | 0.3% | 2025-11-24 | |
| CVE-2025-40213 | Linux kernel Bluetooth mesh management commands vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-24 | Fix |
| CVE-2025-40212 | Linux kernel NFSD file handle lookup use-after-free | 9.8CNA v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-36150 | IBM Concert information disclosure | 5.9CNA v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-36112 | IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure | 5.3CNA v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-29933 | AMD μProf out-of-bounds write | 5.5CNA v3.1 | 0.1% | 2025-11-24 | Fix |
| CVE-2025-13609 | Keylime: Keylime: Registrar allows identity takeover via duplicate uuid registration | 8.2CNA v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-13596 | Improper error handling leading to sensitive information disclosure in CIGES | 2.7CNA v4.0 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-13589 | Otsuka Information Technology|FMS reflected cross-site scripting | 5.1CNA v4.0 | 0.4% | 2025-11-24 | |
| CVE-2025-13588 | lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery | 5.3CNA v4.0 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-13586 | SourceCodester Online Student Clearance System changepassword.php SQL injection | 7.2NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13585 | itsourcecode COVID Tracking System login.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-13584 | Eigenfocus Description cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-13583 | code-projects Question Paper Generator POST parameter signupscript.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-13582 | code-projects Jonnys Liquor GET parameter detail.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-13581 | itsourcecode Student Information System schedule_edit1.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13580 | code-projects Library System mail.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13579 | code-projects Library System return.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13578 | code-projects Library System Login index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-13577 | PHPGurukul Hostel Management System register-complaint.php cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-13576 | code-projects Blog Site admin.php improper authorization | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13575 | code-projects Blog Site Category blog.php category_exists SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13574 | code-projects Online Bidding System addcategory.php categoryadd unrestricted upload | 7.2NVD v3.1 | 0.4% | 2025-11-24 | |
| CVE-2025-13573 | Projectworlds can pass malicious payloads add_book.php unrestricted upload | 8.8NVD v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-13466 | body-parser vulnerable to denial of service when URL encoding is used | 5.5CNA v4.0 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-12978 | Fluent Bit input plugins tag key matching vulnerability | 5.4CISA ADP v3.1 | 0.4% | 2025-11-24 | Fix |
| CVE-2025-12977 | Fluent Bit input plugins tag key handling improper input validation | 9.1CISA ADP v3.1 | 0.7% | 2025-11-24 | Fix |
| CVE-2025-12972 | Fluent Bit out_file output plugin path traversal | 5.3CISA ADP v3.1 | 0.9% | 2025-11-24 | Fix |
| CVE-2025-12970 | Fluent Bit in_docker input plugin buffer overflow | 8.8CISA ADP v3.1 | 1.0% | 2025-11-24 | Fix |
| CVE-2025-12969 | Fluent Bit in_forward input plugin missing authentication | 6.5CISA ADP v3.1 | 0.6% | 2025-11-24 | Fix |
| CVE-2025-12741 | Arbitrary file write in Denodo dialect of Looker allows remote code execution | 7.7CNA v4.0 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-12740 | Remote command execution in Looker via IBM DB2 JDBC drive | 7.7CNA v4.0 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-12739 | Cross-site scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise | 7.3CNA v4.0 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-12629 | Broken Link Manager WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-12628 | WP 2FA WordPress plugin Second Factor bypass | 6.3CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-12569 | WP Front User Submit WordPress plugin open redirect | 4.7CISA ADP v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-12394 | Backup Migration WordPress plugin unauthenticated Backup download | 5.9CISA ADP v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-11921 | Bjango iStats iStat Menus local privilege escalation | 8.5CNA v4.0 | 0.6% | 2025-11-24 | Fix |
| CVE-2025-10555 | Dassault Systèmes DELMIA Service Process Engineer stored cross-site scripting | 8.7CNA v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-10554 | Dassault Systèmes ENOVIA Product Manager Requirements stored cross-site scripting | 8.7CNA v3.1 | 0.2% | 2025-11-24 | Fix |
| CVE-2025-10144 | Perfect Brands for WooCommerce WordPress plugin authenticated (Contributor+) SQL injection | 6.5CNA v3.1 | 0.3% | 2025-11-24 | Fix |
| CVE-2025-7402 | Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager unauthenticated SQL injection | 7.5CNA v3.1 | 0.3% | 2025-11-24 | |
| CVE-2025-0007 | AMD Xilinx Run Time (XRT) privilege escalation | 5.7CNA v3.1 | 0.1% | 2025-11-24 | |
| CVE-2025-0005 | AMD Xilinx Run Time (XRT) integer overflow | 7.3CNA v3.1 | 0.1% | 2025-11-24 | |
| CVE-2025-0003 | AMD Xilinx Run Time (XRT) use-after-free | 7.3CNA v3.1 | 0.2% | 2025-11-24 | |
| CVE-2025-54515 | AMD Versal Adaptive SoC Devices improper quantity validation | 1.0CNA v4.0 | 0.1% | 2025-11-23 | |
| CVE-2025-48507 | AMD Kria™ SOM improper quantity validation | 8.6CNA v4.0 | 0.2% | 2025-11-23 | Exploit code |
| CVE-2025-13572 | Projectworlds Advanced Library Management System delete_admin.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13571 | code-projects Simple Food Ordering System listorder.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-23 | |
| CVE-2025-13570 | itsourcecode COVID Tracking System page SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-23 | |
| CVE-2025-13569 | itsourcecode COVID Tracking System page SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-23 | |
| CVE-2025-13568 | itsourcecode COVID Tracking System page SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-23 | |
| CVE-2025-13567 | itsourcecode COVID Tracking System page SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-23 | |
| CVE-2025-13566 | jarun nnn nnn.c run_cmd_as_plugin double free | 4.8CNA v4.0 | 0.1% | 2025-11-23 | |
| CVE-2025-13565 | SourceCodester Inventory Management System resetPassword.php password recovery | 9.1NVD v3.1 | 0.5% | 2025-11-23 | |
| CVE-2025-13564 | SourceCodester Pre-School Management System FilehelperController.php removefile denial of service | 7.1NVD v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13562 | D-Link DIR-852 gena.cgi command injection | 9.8NVD v3.1 | 6.2% | 2025-11-23 | Emerging Threats |
| CVE-2025-13561 | SourceCodester Company Website CMS index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13560 | SourceCodester Company Website CMS reset-password.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13557 | Campcodes Online Polling System registeracc.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13556 | Campcodes Online Polling System checklogin.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13555 | Campcodes School File Management System Login index.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13554 | Campcodes Supplier Management System Login index.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13553 | D-Link DWR-M920 formPinManageSetup sub_41C7FC buffer overflow | 8.7CNA v4.0 | 0.7% | 2025-11-23 | Fix |
| CVE-2025-13552 | D-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-11-23 | Fix |
| CVE-2025-13551 | D-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-11-23 | Fix |
| CVE-2025-13550 | D-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-11-23 | Fix |
| CVE-2025-13549 | D-Link DIR-822K formNtp sub_455524 buffer overflow | 8.7CNA v4.0 | 0.7% | 2025-11-23 | Fix |
| CVE-2025-13548 | D-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-11-23 | Fix |
| CVE-2025-13547 | D-Link DIR-822K/DWR-M920 formDdns memory corruption | 8.7CNA v4.0 | 0.7% | 2025-11-23 | Fix |
| CVE-2025-13546 | ashraf-kabir travel-agency Search results.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13545 | ashraf-kabir travel-agency index.php SQL injection | 7.2v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-13544 | ashraf-kabir travel-agency customer_register.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-11-23 | |
| CVE-2025-12800 | WP Shortcodes Plugin Shortcodes Ultimate WordPress plugin server-side request forgery | 6.4CNA v3.1 | 0.2% | 2025-11-23 | Fix |
| CVE-2025-13526 | OneClick Chat to Order WordPress plugin insecure direct object reference | 7.5CNA v3.1 | 0.4% | 2025-11-22 | Fix |
| CVE-2025-13384 | CP Contact Form with PayPal WordPress plugin missing authorization | 7.5CNA v3.1 | 0.4% | 2025-11-22 | Fix |
| CVE-2025-13318 | Booking Calendar Contact Form WordPress plugin missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-22 | Fix |
| CVE-2025-13317 | Appointment Booking Calendar WordPress plugin missing authorization arbitrary Booking Confirmation | 5.3CNA v3.1 | 0.3% | 2025-11-22 | Fix |
| CVE-2025-13136 | GSheetConnector For Ninja Forms WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-22 | Fix |
| CVE-2025-12889 | wolfSSL TLS 1.2 client can Downgrade Digest Used | 2.3CNA v4.0 | 0.1% | 2025-11-22 | Fix |
| CVE-2025-12877 | IDonate WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-22 | Fix |
| CVE-2025-12752 | Subscriptions and Memberships for PayPal WordPress plugin unauthenticated Fake Payment creation | 5.3CNA v3.1 | 0.2% | 2025-11-22 | Fix |
| CVE-2025-11186 | Cookie Notice and Compliance for GDPR / CCPA WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-22 | Fix |
| CVE-2025-66115 | Easy Invoice WordPress plugin local file inclusion | 6.6CNA v3.1 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-66114 | Show Variations as Single Products Woocommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66113 | Better Chat Support for Messenger WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66112 | Accessibility Toolkit by WebYes WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66111 | Nelio Popups WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66110 | Tiktok Feed WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66109 | Cart Weight for WooCommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66108 | TNC Toolbox: Web Performance WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66107 | Subscriptions and Memberships for PayPal WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66106 | Featured Post Creative WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66101 | CBX Bookmark and Favorite WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66099 | Chat Help WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66098 | Travelers' Map WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66097 | I Order Terms WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-66096 | Table Block by Tableberg WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66095 | KiviCare WordPress plugin SQL injection | 8.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66093 | Extensions for Leaflet Map WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66092 | Accordion Slider WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66091 | Stylish Cost Calculator WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66090 | SKT Skill Bar WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66089 | Product Feed for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66087 | PropertyHive WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66086 | SMS Alert Order Notifications WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66085 | Arconix Shortcodes WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66084 | FluentCommunity WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66083 | WpEvently WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66082 | WpEvently WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66081 | Head Meta Data WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66079 | Gutenverse Form WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66077 | Legal Pages WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66075 | WP Cookie Notice for GDPR, CCPA and ePrivacy Consent WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66073 | WP Webhooks WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-66072 | UsersWP WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66071 | Custom Order Numbers for WooCommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66069 | PPOM for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66067 | Funnel Builder by FunnelKit WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66066 | Envo Extra WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66065 | Gutenverse WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66064 | Giveaways and Contests by RafflePress WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-66063 | WP Google Review Slider WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66062 | WP YouTube Lyte WordPress plugin open redirection | 3.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66061 | Seriously Simple Podcasting WordPress plugin cross-site request forgery (CSRF) | 4.3v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-66060 | Seriously Simple Podcasting WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66059 | Seriously Simple Podcasting WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66057 | Bold Page Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-66056 | Uncanny Automator WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-66055 | Email Subscribers and Newsletters WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-66053 | Enfold WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-65947 | thread-amount is vulnerable to resource exhaustion (Memory and Handle leaks) on Windows and macOS | 8.7CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-65946 | RooCodeInc Roo-Code roo Code is vulnerable to potential remote code execution | 8.1CNA v3.1 | 0.7% | 2025-11-21 | Fix |
| CVE-2025-65111 | authzed SpiceDB LookupResources API insecure inherited permissions | 2.9CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-65109 | Minder does not sandbox http.send in Rego programs | 8.5CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-65108 | md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter | 10.0CNA v3.1 | 0.9% | 2025-11-21 | Fix |
| CVE-2025-65107 | Langfuse SSO account takeover via CSRF or phishing attack | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-65106 | LangChain vulnerable to template injection via Attribute Access in Prompt templates | 8.3CNA v4.0 | 0.5% | 2025-11-21 | Fix |
| CVE-2025-65102 | PJSIP is vulnerable to buffer overflow in Opus PLC | 8.7CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-65092 | espressif esp-idf ESP32-P4 JPEG Decoder Header Parsing vulnerability | 6.9CNA v4.0 | 0.4% | 2025-11-21 | |
| CVE-2025-64767 | hpke-js reuses AEAD nonces | 9.1CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-64762 | authkit-nextjs may let session cookies be cached in CDNs | 8.0CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-64755 | @anthropic-ai/claude-code has Sed Command Validation Bypass that allows arbitrary File Writes | 8.7CNA v4.0 | 0.6% | 2025-11-21 | Fix |
| CVE-2025-64751 | OpenFGA Improper Policy Enforcement | 5.8CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-64695 | LogStare Installer of LogStare Collector uncontrolled search path | 8.4CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-64483 | Wazuh API Agent Configuration has improper access control in Agent Enrollment endpoint | 5.3CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-64310 | SEIKO EPSON Epson Web Control for SEIKO EPSON Projector Products missing brute-force protection | 9.3CNA v4.0 | 0.5% | 2025-11-21 | |
| CVE-2025-64299 | LogStare Collector information disclosure | 2.7NVD v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-64169 | Wazuh null pointer dereference in fim_alert line 666 | 5.1CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-62687 | LogStare Collector cross-site request forgery | 6.9CNA v4.0 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-62626 | AMD Ryzen™ 9000HX Series Processors Improper handling of insufficient entropy | 7.2CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-62609 | MLX has Wild Pointer Dereference in load_gguf | 5.5CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-62608 | ml-explore MLX NumPy file loader heap-based buffer overflow | 5.5CNA v4.0 | 0.5% | 2025-11-21 | Fix |
| CVE-2025-62426 | vLLM vulnerable to DoS | 6.5CNA v3.1 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-62372 | vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | 8.3CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-62189 | LogStare Collector incorrect authorization | 5.3CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-62164 | vLLM deserialization vulnerability leading to DoS and potential RCE | 8.8CNA v3.1 | 0.9% | 2025-11-21 | Fix |
| CVE-2025-61949 | LogStare Collector cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-58097 | LogStare Collector incorrect default permissions | 7.8v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-54866 | Wazuh installation fails to protected authd.pass on Windows | 1.8CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-48502 | AMD μProf improper index validation | 5.5CNA v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-43374 | Apple iPadOS stack-based buffer overflow | 4.3CISA ADP v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-41115 | Grafana Enterprise incorrect privilege assignment | 10.0CNA v3.1 | 16.9% | 2025-11-21 | Emerging ThreatsExploit codeFix |
| CVE-2025-40211 | Linux kernel ACPI video backlight switching use-after-free | – | 0.2% | 2025-11-21 | Fix |
| CVE-2025-40210 | Linux kernel NFSv4 COMPOUND processing denial of service | 7.5CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-40209 | Linux kernel btrfs qgroup relation handling memory leak | – | 0.2% | 2025-11-21 | Fix |
| CVE-2025-36149 | IBM Concert Software clickjacking | 6.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-31266 | Apple Safari UI misrepresentation | 4.3CISA ADP v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-31248 | Apple macOS path traversal | 5.5CISA ADP v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-31216 | Apple iPadOS improper access control | 2.4CISA ADP v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-30201 | Wazuh NetNTLMv2 Hash Theft in multiple Centralized Configuration Capabilities | 7.7CNA v3.1 | 0.8% | 2025-11-21 | Fix |
| CVE-2025-29934 | AMD EPYC™ 9004 Series Processors incomplete cleanup | 5.3CNA v3.1 | 0.1% | 2025-11-21 | |
| CVE-2025-13524 | AWS Wickr call termination process improper resource release | 6.8CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-13499 | Access of uninitialized pointer in Wireshark | 7.8CNA v3.1 | 0.1% | 2025-11-21 | Fix |
| CVE-2025-13485 | itsourcecode Online File Management System ajax.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-21 | |
| CVE-2025-13470 | RNP Vulnerable PKESK session keys | 7.7CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-13432 | HashiCorp Terraform Enterprise state versions incorrect authorization | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-13357 | Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth method | 7.4CNA v3.1 | 0.5% | 2025-11-21 | Fix |
| CVE-2025-13322 | WP AUDIO GALLERY WordPress plugin arbitrary file deletion | 8.1CNA v3.1 | 0.6% | 2025-11-21 | |
| CVE-2025-13159 | Flo Forms WordPress plugin stored cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-11-21 | |
| CVE-2025-13156 | appsbd Vitepos category image unrestricted file upload | 8.8CNA v3.1 | 0.7% | 2025-11-21 | Fix |
| CVE-2025-13149 | Schedule Post Changes With PublishPress Future: Unpublish WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-13142 | Custom Post Type WordPress plugin cross-site request forgery to Custom post type deletion | 4.3CNA v3.1 | 0.1% | 2025-11-21 | |
| CVE-2025-13141 | HT Mega Absolute Addons For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-13138 | WP Directory Kit WordPress plugin unauthenticated SQL injection via select_2_ajax function | 7.5CNA v3.1 | 1.5% | 2025-11-21 | NucleiFix |
| CVE-2025-13135 | HotelRunner Booking Widget WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-13134 | AuthorSure WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.1% | 2025-11-21 | |
| CVE-2025-13132 | Dia: Increased Spoof Risk; Missing full screen toast | 7.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12973 | S2B AI Assistant file upload function unrestricted file upload | 7.2CNA v3.1 | 0.9% | 2025-11-21 | Exploit codeFix |
| CVE-2025-12964 | Magical Products Display WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12935 | FluentCRM - Marketing Automation For WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12894 | Import WP WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12888 | wolfSSL Constant Time issue with Xtensa-based ESP32 and X22519 | 1.0CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12881 | WP Swings Return Refund and Exchange for WooCommerce order messages insecure direct object reference | 5.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12750 | Groundhogg WordPress plugin authenticated (Admin+) SQL injection | 4.9CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12747 | Tainacan WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12746 | Tainacan WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12661 | Pollcaster Shortcode WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-12660 | Padlet Shortcode WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-12170 | Checkbox WordPress plugin missing authorization to unauthenticated Log Clearing | 5.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12169 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12160 | Simple User Registration WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12138 | URL Image Importer WordPress plugin authenticated (Author+) arbitrary file upload | 8.8CNA v3.1 | 0.7% | 2025-11-21 | Fix |
| CVE-2025-12135 | WPBookit WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-11-21 | Exploit codeFix |
| CVE-2025-12086 | WP Swings Return Refund and Exchange For WooCommerce insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12085 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12066 | WP Delete Post Copies WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12039 | BigBuy Dropshipping Connector for WooCommerce WordPress plugin spoofing | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-12023 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-12022 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11985 | Realty Portal WordPress plugin missing authorization authenticated arbitrary options update | 8.8CNA v3.1 | 0.4% | 2025-11-21 | |
| CVE-2025-11973 | 简数采集器 WordPress plugin authenticated (Admin+) arbitrary file read | 4.9CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-11936 | wolfSSL potential DoS vulnerability | 6.3CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-11935 | Forward Secrecy Violation in WolfSSL TLS 1.3 | 6.3CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11934 | wolfSSL improper validation of Signature Algorithm Used in TLS 1.3 CertificateVerify | 2.1CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11933 | DoS vulnerability in wolfSSL TLS 1.3 CKS extension | 2.3CNA v4.0 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-11932 | wolfSSL timing side-channel in PSK Binder Verification | 2.3CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-11931 | wolfSSL integer underflow leads to out-of-bounds access in XChaCha20-Poly1305 Decrypt | 2.1CNA v4.0 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-11885 | EchBay Admin Security WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11826 | WP Company Info WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11815 | UiPress lite WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11808 | Shortcode for Google Street View WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11803 | WPSite Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11802 | Bulma Shortcodes WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11801 | AudioTube WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11800 | Surbma MiniCRM Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11799 | Affiliate AI Lite WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11773 | Cryptocurrency (Token) WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11771 | Cryptocurrency (Token) WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-11770 | BrightTALK WordPress Shortcode plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11768 | Islamic Phrases WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11767 | Tips Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11765 | Stock Tools WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11764 | Shortcodes Bootstrap WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11763 | Display Pages Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | |
| CVE-2025-11456 | ELEX WordPress HelpDesk and Customer Ticketing System plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 0.7% | 2025-11-21 | Fix |
| CVE-2025-11368 | LearnPress WordPress plugin information disclosure | 5.3CNA v3.1 | 1.0% | 2025-11-21 | NucleiFix |
| CVE-2025-11127 | Mstoreapp Mobile App login AJAX action privilege escalation | 9.8CISA ADP v3.1 | 0.3% | 2025-11-21 | |
| CVE-2025-11087 | Zegen Core WordPress plugin cross-site request forgery to arbitrary file upload | 8.8CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-11003 | UiPress lite WordPress plugin missing authorization authenticated stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-10938 | UiPress lite WordPress plugin missing authorization authenticated sensitive information exposure | 6.5CNA v3.1 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-10054 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access | 4.3NVD v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-10039 | ELEX WordPress HelpDesk and Customer Ticketing System plugin insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2025-11-21 | Fix |
| CVE-2025-9825 | Missing authorization in GitLab | 5.0CNA v3.1 | 0.4% | 2025-11-21 | Fix |
| CVE-2025-0504 | Black Duck SCA Project privilege escalation | 5.3CNA v4.0 | 0.2% | 2025-11-21 | Fix |
| CVE-2025-65226 | Tenda AC21 buffer overflow | 4.3CISA ADP v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-65223 | Tenda AC21 stack-based buffer overflow | 4.3CISA ADP v3.1 | 0.3% | 2025-11-20 | Emerging Threats |
| CVE-2025-65222 | Tenda AC21 stack-based buffer overflow | 4.3CISA ADP v3.1 | 2.4% | 2025-11-20 | Emerging Threats |
| CVE-2025-65221 | Tenda AC21 stack-based buffer overflow | 4.3CISA ADP v3.1 | 0.3% | 2025-11-20 | Emerging Threats |
| CVE-2025-65220 | Tenda AC21 stack-based buffer overflow | 4.3CISA ADP v3.1 | 0.2% | 2025-11-20 | Emerging Threats |
| CVE-2025-64984 | Kaspersky Endpoint Security cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-64770 | iCam365 P201 missing authentication for ONVIF in iCam Cameras | 7.0CNA v4.0 | 0.2% | 2025-11-20 | |
| CVE-2025-64660 | Microsoft GitHub Copilot and Visual Studio Code remote code execution | 8.0CNA v3.1 | 0.6% | 2025-11-20 | Fix |
| CVE-2025-64655 | Microsoft Dynamics OmniChannel SDK Storage Containers elevation of privilege | 8.8CNA v3.1 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-64524 | OpenPrinting cups-filters rastertopclx filter heap-based buffer overflow | 3.3CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-64428 | dataease injection | 8.9CNA v4.0 | 0.6% | 2025-11-20 | Fix |
| CVE-2025-64185 | Open OnDemand RPM packages create world writable locations | 6.9CNA v4.0 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-64027 | Snipe-IT has cross-site scripting vulnerability in CSV import workflow | 6.1CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-63889 | ThinkPHP out-of-bounds read | 7.5CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-63888 | ThinkPHP remote file inclusion | 9.8CISA ADP v3.1 | 0.6% | 2025-11-20 | Exploit code |
| CVE-2025-63848 | Swi-prolog Swish stored cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-20 | Exploit code |
| CVE-2025-63807 | 2dogz Blogin weak authentication | 9.8CISA ADP v3.1 | 0.5% | 2025-11-20 | |
| CVE-2025-63685 | Quark Cloud Drive DLL hijacking | 9.8CISA ADP v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-62875 | Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock | 6.9CNA v4.0 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62731 | Stored XSS in SOPlanning | 4.8v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62730 | Privilege escalation via incorrect authorization in SOPlanning | 8.8v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-62729 | Stored XSS in SOPlanning | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62724 | Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU) | 4.3CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62709 | ClipBucket v5 is vulnerable to password reset link manipulation | 6.8CNA v3.1 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-62674 | iCam365 P201 missing authentication for RTSP in iCam Cameras | 7.0CNA v4.0 | 0.2% | 2025-11-20 | |
| CVE-2025-62459 | Microsoft Defender Portal spoofing | 8.3CNA v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-62346 | HCL Glovius Cloud is susceptible to a cross-site request forgery (CSRF) | 6.8CNA v3.1 | 0.1% | 2025-11-20 | |
| CVE-2025-62297 | Stored XSS in SOPlanning | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62296 | Stored XSS in SOPlanning | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62295 | Stored XSS in SOPlanning | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62294 | SOPlanning Predictable Generation of Password Recovery Token | 7.5v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-62293 | Broken access control in SOPlanning | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-62207 | Microsoft Azure Monitor elevation of privilege | 8.6CNA v3.1 | 0.7% | 2025-11-20 | Fix |
| CVE-2025-61138 | Qlik Sense sensitive information in an accessible file | 7.5CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-60799 | phppgadmin contains an incorrect access control vulnerability | 6.1CISA ADP v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-60798 | phppgadmin contains a SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-60797 | phppgadmin contains a SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-60796 | phppgadmin vulnerable to cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-60794 | @Perfood/couch-auth may expose session tokens, passwords | 6.5CISA ADP v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-60738 | Ilevia Eve X1 Server Firmware OS command injection | 9.8CISA ADP v3.1 | 1.0% | 2025-11-20 | Emerging Threats |
| CVE-2025-60737 | Ilevia Eve X1 Server Firmware cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-59245 | Microsoft SharePoint Online elevation of privilege | 9.8CNA v3.1 | 1.1% | 2025-11-20 | Fix |
| CVE-2025-55128 | Revive Adserver resource exhaustion | 6.5CNA v3.0 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-55127 | Revive Adserver improper neutralization | 5.4CISA ADP v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-55126 | Revive Adserver cross-site scripting | 6.5CNA v3.0 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-55124 | Revive Adserver improper neutralization | 6.1CNA v3.0 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-55123 | Revive Adserver improper neutralization | 5.4v3.1 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-52671 | Revive Adserver SQL error message to information disclosure | 4.3CNA v3.0 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-52670 | Revive Adserver missing authorization | 6.5NVD v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-52669 | Revive Adserver information disclosure | 4.3CNA v3.0 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-52668 | Revive Adserver cross-site scripting | 5.4NVD v3.1 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-52667 | Revive Adserver cross-site scripting | 5.4v3.1 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-52666 | Revive Adserver settings improper neutralization | 2.7CNA v3.0 | 0.4% | 2025-11-20 | Fix |
| CVE-2025-52410 | Vishalmathur Institute-of-current-students SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-49752 | Microsoft Azure Bastion elevation of privilege | 10.0CNA v3.1 | 0.9% | 2025-11-20 | Fix |
| CVE-2025-48987 | Revive Adserver improper neutralization | 6.1v3.1 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-48986 | Revive Adserver authorization bypass | 8.8CNA v3.0 | 0.6% | 2025-11-20 | Fix |
| CVE-2025-41076 | LimeSurvey session handling information disclosure | 6.5v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-41075 | LimeSurvey opt-in endpoint denial of service | 7.5v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-41074 | LimeSurvey opt-out endpoint denial of service | 7.5v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-40605 | SonicWall Email Security relative path traversal | 5.3CISA ADP v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-40604 | SonicWall Email Security download without integrity check | 9.8v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-40601 | SonicWall SonicOS stack-based buffer overflow | 7.5CISA ADP v3.1 | 1.2% | 2025-11-20 | Fix |
| CVE-2025-36161 | IBM Concert software information disclosure | 5.9CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-36160 | IBM Concert information disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-36159 | IBM Concert Improper Log Neutralization | 6.2CNA v3.1 | 0.1% | 2025-11-20 | Fix |
| CVE-2025-36158 | IBM Concert information disclosure | 5.1CNA v3.1 | 0.1% | 2025-11-20 | Fix |
| CVE-2025-36153 | IBM Concert cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-36072 | IBM webMethods Integration deserialization | 8.8CNA v3.1 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-35029 | Medical Informatics Engineering Enterprise Health stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-34320 | BASIS BBj unauthenticated arbitrary file read RCE | 9.3CNA v4.0 | 0.8% | 2025-11-20 | Fix |
| CVE-2025-25613 | Fs S3150-8t2f cleartext storage of sensitive information | 7.5CISA ADP v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-13484 | Campcodes Complete Online Beauty Parlor Management System customer-list.php cross-site scripting | 6.1v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-13469 | Public Knowledge Project omp/ojs Payment Instructions setting paymentForm.tpl cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-11-20 | |
| CVE-2025-13468 | SourceCodester Alumni Management System Delete admin_class.php delete_event authorization | 8.1v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-13451 | SourceCodester Online Shop Project action.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-13450 | SourceCodester Online Shop Project register.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-13449 | code-projects Online Shop Project login.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-13446 | Tenda AC21 SetSysTimeCfg stack-based overflow | 9.8v3.1 | 3.9% | 2025-11-20 | |
| CVE-2025-13445 | Tenda AC21 SetIpMacBind stack-based overflow | 9.8v3.1 | 3.9% | 2025-11-20 | |
| CVE-2025-13443 | macrozheng mall delete access control | 6.5v3.1 | 0.2% | 2025-11-20 | |
| CVE-2025-13442 | UTT 进取 750W formPdbUpConfig system command injection | 9.8v3.1 | 19.5% | 2025-11-20 | Emerging Threats |
| CVE-2025-13437 | Arbitrary node_modules Directory Deletion in Google zx | 5.6CNA v4.0 | 0.1% | 2025-11-20 | Fix |
| CVE-2025-13435 | Dreampie Resty HttpClient HttpClient.java request path traversal | 8.1v3.1 | 0.7% | 2025-11-20 | |
| CVE-2025-13434 | jameschz Hush Framework HTTP host Header Util.php HTTP headers for scripting syntax | 7.5v3.1 | 0.5% | 2025-11-20 | |
| CVE-2025-13433 | Muse Group MuseHub Windows Service Muse.Updater.exe unquoted search path | 7.3CNA v4.0 | 0.1% | 2025-11-20 | |
| CVE-2025-13425 | Google denial of service in OSV-SCALIBR | 1.9CNA v4.0 | 0.1% | 2025-11-20 | Exploit codeFix |
| CVE-2025-13424 | Campcodes Supplier Management System add_product.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-13423 | Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload | 7.2v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-13422 | freeprojectscodes Sports Club Management System change_s_pwd.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-13087 | Command injection in Opto22 Groov REST API | 7.5CNA v4.0 | 7.0% | 2025-11-20 | Emerging ThreatsFix |
| CVE-2025-12778 | Ultimate Member Widgets for Elementor WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-12502 | Attention Bar SQL injection | 6.8CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-12414 | Looker account compromise via punycode homograph attack | 9.2CNA v4.0 | 0.5% | 2025-11-20 | Fix |
| CVE-2025-12121 | Lite XL system.exec function OS command injection | 7.3CISA ADP v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-12120 | Lite XL project file loader code injection | 7.3CISA ADP v3.1 | 0.3% | 2025-11-20 | |
| CVE-2025-11676 | UPnP DOS in TL-WR940N V6 | 7.1CNA v4.0 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-10571 | ABB Ability Edgenius authentication bypass | 9.4CNA v4.0 | 0.3% | 2025-11-20 | Fix |
| CVE-2025-5092 | LightGallery WP WordPress plugin cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-20 | Fix |
| CVE-2025-0645 | Arbitrary file upload in Narkom Communication Technologies' Pyxis Signage | 7.2CNA v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-0643 | XSS in Narkom Communication Technologies' Pyxis Signage | 7.2CNA v3.1 | 0.4% | 2025-11-20 | |
| CVE-2025-65103 | OpenSTAManager has an authenticated SQL injection vulnerability in API via display parameter | 8.8CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65100 | ilbers isar Security Snapshot may Use Unintended Timestamp when Only ISAR_APT_SNAPSHOT_DATE is Set | 6.9CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-65099 | anthropics claude-code claude Code vulnerable to command execution prior to startup trust dialog | 7.7CNA v4.0 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-65095 | Lookyloo is vulnerable due to improper user input sanitization | 9.4CNA v4.0 | 0.4% | 2025-11-19 | Fix |
| CVE-2025-65094 | WBCE CMS is vulnerable to privilege escalation via Group ID Manipulation (IDOR) | 8.7CNA v4.0 | 0.4% | 2025-11-19 | Exploit codeFix |
| CVE-2025-65089 | XWiki view file macro: User can view content of office file without view rights on the attachment | 6.8CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65034 | Rallly improper authorization allows Reopening of any Finalized Poll via Public pollId | 8.1CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65033 | Rallly Broken Authorization: Any User can Pause or Resume any Poll via Poll ID Manipulation | 8.1CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65032 | lukevella Rallly participant rename function insecure direct object reference | 6.5CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65031 | Rallly improper authorization in Comment endpoint allows User Impersonation | 6.5CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65030 | Rallly improper authorization in Comment Deletion endpoint allows Unauthorized Comment Removal | 7.1CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65029 | lukevella Rallly participant deletion endpoint insecure direct object reference | 8.1CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65028 | Rallly vote update endpoint insecure direct object reference | 6.5CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-65026 | Esm.sh CDN service has JS Template Literal injection in CSS-to-JavaScript | 6.1CNA v3.1 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-65025 | Esm.sh CDN service has arbitrary file write via tarslip | 8.2CNA v3.1 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-65024 | i-Educar Authenticated Time-based SQL injection in `agenda_admin_cad.php` | 7.2CNA v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-65023 | i-Educar Authenticated Time-based SQL injection in `funcionario_vinculo_cad.php` | 7.2CNA v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-65022 | i-Educar Authenticated Time-based SQL injection in `agenda.php` | 7.2CNA v3.1 | 0.3% | 2025-11-19 | |
| CVE-2025-65021 | Rallly has Unauthorized Poll Finalization via insecure direct object reference (IDOR) | 9.1CNA v3.1 | 0.4% | 2025-11-19 | Fix |
| CVE-2025-65020 | Rallly has Unauthorized Poll Duplication via insecure direct object reference (IDOR) | 6.5CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-65019 | Astro Cloudflare adapter has a stored cross-site scripting vulnerability in /_image endpoint | 5.4CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-64765 | Astro middleware authentication checks based on url.pathname can be bypassed via URL encoded values | 6.9CNA v4.0 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-64764 | Astro is vulnerable to reflected XSS via the server islands feature | 7.1CNA v3.1 | 0.5% | 2025-11-19 | NucleiFix |
| CVE-2025-64759 | Homarr is vulnerable to stored cross-site scripting and possible privilege escalation | 8.1CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-64757 | Astro Development Server is vulnerable to arbitrary Local File Read | 3.5CNA v3.1 | 0.4% | 2025-11-19 | Fix |
| CVE-2025-64708 | authentik invitation expiry is delayed by at least 5 minutes | 5.8CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-64521 | authentik deactivated service accounts can authenticate to OAuth | 4.8CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-64408 | Apache Causeway: Java deserialization vulnerability to authenticated attackers | 6.3CISA ADP v3.1 | 10.8% | 2025-11-19 | Fix |
| CVE-2025-63932 | D-Link DIR-868L OS command injection | 7.3v3.1 | 7.6% | 2025-11-19 | Emerging Threats |
| CVE-2025-63879 | Learnwithfair Php-ecommerce-project cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-63878 | Hackerwhale Restaurant Website Restoran SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-63719 | Campcodes Online Hospital Management System SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-63371 | Onecommander path traversal | 7.5CISA ADP v3.1 | 0.7% | 2025-11-19 | |
| CVE-2025-63243 | Pixeon Weblaudos password change functionality reflected cross-site scripting | 4.6v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-63224 | Itel Idenc improper authentication | 10.0CISA ADP v3.1 | 0.7% | 2025-11-19 | |
| CVE-2025-63223 | Axeltechnology Streamermax Mk Ii missing authorization | 9.8CISA ADP v3.1 | 0.8% | 2025-11-19 | |
| CVE-2025-63221 | Axeltechnology puma missing authorization | 9.1CISA ADP v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-63220 | SOUND4 FIRST download without integrity check | 7.2CISA ADP v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-63219 | Itel Iso-fm session hijacking | 7.5CISA ADP v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-63218 | Axeltechnology WOLF1MS improper authorization | 9.8CISA ADP v3.1 | 0.6% | 2025-11-19 | |
| CVE-2025-63214 | Bridgetech Vbc Server improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-11-19 | |
| CVE-2025-63213 | QVidium Opera11 improper input validation | 9.8CISA ADP v3.1 | 0.9% | 2025-11-19 | |
| CVE-2025-63212 | Gatesair Flexiva LX1000 information disclosure | 6.5CISA ADP v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-63211 | Bridgetech Vbc Server stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-19 | |
| CVE-2025-63210 | Newtec Celoxa504 improper authentication | 9.8CISA ADP v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-63209 | Elcaradio STAR1000 information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-63208 | Bridgetech VB288 cleartext storage of sensitive information | 7.5CISA ADP v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-63207 | Rvr TEX1002LCD improper authentication | 9.8CISA ADP v3.1 | 7.4% | 2025-11-19 | Emerging Threats |
| CVE-2025-63206 | Dasan Networks DS2924 Dasan Switch authentication bypass | 9.8CISA ADP v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-63205 | Bridgetech VB120 information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-58412 | Fortinet FortiADC cross-site scripting | 4.2CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-58181 | Unbounded memory consumption in golang.org/x/Crypto/ssh | 5.3CISA ADP v3.1 | 0.6% | 2025-11-19 | Fix |
| CVE-2025-51663 | Lanol FileCodeBox authentication bypass | 7.5CISA ADP v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-51662 | Lanol FileCodeBox cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-51661 | Lanol FileCodeBox path traversal | 7.5CISA ADP v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-47914 | Malformed constraint may cause denial of service in golang.org/x/Crypto/ssh/agent | 5.3CISA ADP v3.1 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-36371 | IBM i information disclosure | 6.5CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-34337 | eGovFramework Unauthenticated Encryption Oracle via Web Editor Image upload endpoints | 8.7CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-34336 | eGovFramework unauthenticated file upload via Web Editor Image upload endpoints | 6.9CNA v4.0 | 0.6% | 2025-11-19 | |
| CVE-2025-34335 | AudioCodes Fax/IVR Appliance Authenticated command injection via ActivateLicense.php | 8.8v3.1 | 2.8% | 2025-11-19 | |
| CVE-2025-34334 | AudioCodes Fax/IVR Appliance Authenticated command injection via TestFax.php and LPE | 8.8v3.1 | 3.4% | 2025-11-19 | |
| CVE-2025-34333 | AudioCodes Fax/IVR Appliance World-Writable Webroot LPE | 7.8v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-34332 | AudioCodes Fax/IVR Appliance Insecure Service Control Scripts LPE | 7.8v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-34331 | AudioCodes Fax/IVR Appliance Unauthenticated File Read via download.php | 7.5v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-34330 | AudioCodes Fax/IVR Appliance Unauthenticated Prompt file upload via ajaxPromptUploadFile.php | 5.3v3.1 | 0.5% | 2025-11-19 | |
| CVE-2025-34329 | AudioCodes Fax/IVR Appliance Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php | 9.8v3.1 | 1.1% | 2025-11-19 | |
| CVE-2025-34328 | AudioCodes Fax/IVR Appliance Unauthenticated file upload RCE via ajaxScript.php | 9.8v3.1 | 0.7% | 2025-11-19 | |
| CVE-2025-13421 | itsourcecode Human Resource Management System NoticeStore.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-13420 | itsourcecode Human Resource Management System EventStore.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-13415 | icret EasyImages SVG Image upload.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-13412 | Campcodes Retro Basketball Shoes Online Store admin_running.php cross-site scripting | 6.1v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-13411 | Campcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-13410 | Campcodes Retro Basketball Shoes Online Store receipt.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-19 | |
| CVE-2025-13400 | Tenda CH22 WrlExtraGet formWrlExtraGet buffer overflow | 9.8v3.1 | 0.7% | 2025-11-19 | |
| CVE-2025-13397 | mrubyc alloc.c mrbc_raw_realloc null pointer dereference | 5.5v3.1 | 0.1% | 2025-11-19 | |
| CVE-2025-13396 | code-projects Courier Management System add-office.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-19 | |
| CVE-2025-13395 | codehub666 94list function.php login SQL injection | 6.9CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-13316 | Hard-coded encryption keys in Twonky Server | 8.1NVD v3.1 | 2.7% | 2025-11-19 | KCV |
| CVE-2025-13315 | Unauthenticated log access in Twonky Server | 9.8NVD v3.1 | 31.2% | 2025-11-19 | Reported exploitedNucleiExploit codeKCV |
| CVE-2025-13225 | Tanium addressed an arbitrary file deletion vulnerability in TanOS | 5.6CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-13206 | GiveWP WordPress plugin stored cross-site scripting | 6.1NVD v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-13147 | Progress MOVEit Transfer External Service Interaction (DNS) | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-13145 | WP Import Ultimate CSV XML Importer for WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.5% | 2025-11-19 | Fix |
| CVE-2025-13085 | SiteSEO WordPress plugin improper authorization | 4.3CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-13054 | User Profile Builder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-13051 | ASUSTOR ABP and AES uncontrolled search path | 9.3CNA v4.0 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-13035 | Code Snippets WordPress plugin PHP code injection | 8.0CNA v3.1 | 0.4% | 2025-11-19 | Fix |
| CVE-2025-12878 | FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12852 | NEC RakurakuMusen Start EX uncontrolled search path | 8.4CNA v4.0 | 0.1% | 2025-11-19 | |
| CVE-2025-12842 | Booking Plugin for WordPress Appointments Time Slot unauthenticated arbitrary email Sending | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12822 | WP Login and Register using JWT WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12814 | SiteSEO SEO Simplified WordPress plugin improper authorization to authenticated settings reset | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12777 | YITH WooCommerce Wishlist WordPress plugin authorization bypass | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12770 | New User Approve WordPress plugin unauthenticated sensitive information disclosure via type Juggling | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12766 | BlackBerry® AtHoc® (OnPrem) Management console insecure direct object reference | 5.0CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12751 | WSChat WordPress Live Chat plugin missing authorization authenticated settings reset | 4.3CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12743 | SQL injection in Looker Project Generation endpoint allows Access to Internal MySQL Database | 6.0CNA v4.0 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12710 | Pet-Manager Petfinder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12646 | Community Events WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12592 | Vivotek Affected device model numbers are FD7131-VVTK default credentials | 9.3CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-12535 | SureForms WordPress plugin cross-site request forgery Protection bypass | 5.3CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12484 | Giveaways and Contests by RafflePress WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12472 | Remote code execution in Looker due to improperly Validated Directory Deletion | 7.1CNA v4.0 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12427 | YITH WooCommerce Wishlist WordPress plugin insecure direct object reference | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12426 | Quiz Maker WordPress plugin unauthenticated sensitive information exposure | 7.5v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12359 | Responsive Lightbox and Gallery WordPress plugin authenticated (Author+) server-side request forgery | 5.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12349 | icegram Email Subscribers and Newsletters mailing queue trigger missing authentication | 5.3CNA v3.1 | 0.3% | 2025-11-19 | Fix |
| CVE-2025-12174 | wpWax Directorist listing export and slug update missing authorization | 6.5CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-12057 | WavePlayer WordPress plugin unauthenticated arbitrary file upload | 9.8CISA ADP v3.1 | 0.6% | 2025-11-19 | Fix |
| CVE-2025-12056 | Out-of-bounds read in Shelly Pro 3EM | 8.3CNA v4.0 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-11963 | Reflected XSS in Saysis's StarCities | 5.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-11884 | Cross-site scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB | 2.3CNA v4.0 | 0.2% | 2025-11-19 | |
| CVE-2025-11446 | upKeeper Solutions upKeeper Manager sensitive information in log files | 7.3CNA v4.0 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-11243 | Allocation of resources without limits or throttling in Shelly Pro 4PM | 8.3CNA v4.0 | 0.4% | 2025-11-19 | Fix |
| CVE-2025-11230 | Denial of service vulnerability in HAProxy mjson library | 7.5CNA v3.1 | 0.7% | 2025-11-19 | Fix |
| CVE-2025-11001 | 7-Zip ZIP File Parsing directory traversal remote code execution | 7.8NVD v3.1 | 27.4% | 2025-11-19 | Exploit codeFix |
| CVE-2025-10703 | Progress DataDirect Connect for JDBC for Amazon Redshift code injection | 8.6CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-10702 | Progress DataDirect Connect for JDBC for Amazon Redshift code injection | 8.6CNA v4.0 | 0.3% | 2025-11-19 | |
| CVE-2025-10437 | SQLi in Exagate's Webpack Management System | 9.8CNA v3.1 | 0.3% | 2025-11-19 | |
| CVE-2025-6251 | Royal Elementor Addons and Templates WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-19 | Fix |
| CVE-2025-0421 | IFrame injection in Mikrogrup's Shopside | 4.7CNA v3.1 | 0.2% | 2025-11-19 | |
| CVE-2025-65093 | LibreNMS is vulnerable to SQL injection in hostname parameter in ajax_output.php endpoint | 5.5CNA v3.1 | 3.7% | 2025-11-18 | Fix |
| CVE-2025-65015 | joserfc resource exhaustion | 9.2CNA v4.0 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-65014 | LibreNMS has weak password Policy | 3.7CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-65013 | LibreNMS nodeimage endpoint reflected cross-site scripting | 6.2CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-65012 | Kirby CMS has cross-site scripting (XSS) in the changes dialog | 5.1CNA v4.0 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-64996 | Checkmk mk_inotify plugin incorrect permission assignment | 4.8CNA v4.0 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-64734 | Gallagher T21 Reader missing resource release | 2.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-64515 | open-formulieren open-forms open forms prefill data in read-only components can be tampered | 4.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-64325 | Emby Server is vulnerable to remote code execution through XSS in Admin Dashboard | 8.4CNA v4.0 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-64324 | KubeVirt vulnerable to arbitrary host File Read and Write | 8.5CNA v4.0 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-64076 | cbor2 C extension decoder flaws can cause denial of service | 7.5CNA v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-63955 | PHPGurukul Student Record System manage-students.php component cross-site request forgery | 7.5CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63892 | Remyandrade Student Grades Management System cross-site scripting | 6.8CISA ADP v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-63883 | Bhabishya-123 E-commerce electic-shop v1.0 DOM-based cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-63829 | eProsima Fast-DDS integer overflow | 7.5v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-63828 | Backdrop CMS host header injection | 6.1CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63800 | opensourcepos Open Source Point of Sale weak password requirements | 7.5CISA ADP v3.1 | 0.5% | 2025-11-18 | |
| CVE-2025-63749 | PNETLab command injection | 6.5CISA ADP v3.1 | 1.0% | 2025-11-18 | |
| CVE-2025-63695 | Dzzoffice unrestricted file upload | 9.8CISA ADP v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-63694 | Dzzoffice SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-63693 | Dzzoffice code injection | 5.4CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63604 | Baryhuang AWS Resources MCP Server code injection | 6.5CISA ADP v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-63603 | MCP Server For DATA Exploration MCP Data Science Server's command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-11-18 | |
| CVE-2025-63602 | Awesome Miner buffer over-read | 7.3CISA ADP v3.1 | 0.3% | 2025-11-18 | Exploit code |
| CVE-2025-63514 | kishan0725 Hospital-Management-System cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63513 | kishan0725 Hospital-Management-System insecure direct object reference | 6.5CISA ADP v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-63512 | kishan0725 Hospital-Management-System SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63408 | Ispyconnect Agent Dvr path traversal | 7.8v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-63258 | H3C ERG3, ERG5 and XiaoBei series routers sessionid parameter command injection | 6.5CISA ADP v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-63229 | Dbbroadcast Mozart DDS Next 1000 cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-63228 | Dbbroadcast Mozart DDS Next 1000 unrestricted file upload | 9.8CISA ADP v3.1 | 0.8% | 2025-11-18 | |
| CVE-2025-63227 | Dbbroadcast Mozart DDS Next 1000 unrestricted file upload | 7.2CISA ADP v3.1 | 0.6% | 2025-11-18 | |
| CVE-2025-63226 | Sencore SMP100 insufficient session expiration | 5.7CISA ADP v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-63225 | Eurolab-srl Elts 100 missing authorization | 9.8CISA ADP v3.1 | 0.6% | 2025-11-18 | |
| CVE-2025-63217 | Itel ID Mux authentication bypass | 9.8CISA ADP v3.1 | 0.6% | 2025-11-18 | |
| CVE-2025-63216 | Itel Idgateway improper authentication | 10.0CISA ADP v3.1 | 0.7% | 2025-11-18 | |
| CVE-2025-63215 | SOUND4 Impact download without integrity check | 7.2CISA ADP v3.1 | 0.5% | 2025-11-18 | |
| CVE-2025-62406 | Piwigo is vulnerable to one-click account takeover by modifying the password-reset link | 8.1CNA v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-61713 | Fortinet FortiPAM cleartext storage of sensitive information in memory | 3.8CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-61664 | GRUB2: Missing unregister call for normal_exit command may lead to use-after-free | 4.9CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-61663 | GRUB2: Missing unregister call for normal commands may lead to use-after-free | 4.9CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-61662 | GRUB2: Missing unregister call for gettext command may lead to use-after-free | 7.8NVD v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-61661 | GRUB2: GRUB2: Out-of-bounds write via malicious usb device | 4.8CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-60455 | Modular Max Serve has unsafe deserialization | 8.4CISA ADP v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-59669 | Fortinet FortiWeb hard-coded credentials | 4.8CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-59117 | Multiple stored XSS in Windu CMS | 4.8v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-59116 | JCD Windu CMS login vulnerability | 5.3v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-59115 | Stored XSS in Windu CMS | 5.4v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-59114 | Cross-site request forgery in Windu CMS | 6.5v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-59113 | Bruteforce Protection Bypass in Windu CMS | 7.5v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-59112 | Cross-site request forgery in Windu CMS | 6.5v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-59111 | Broken access control in Windu CMS | 6.5v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-59110 | Cross-site request forgery in Windu CMS | 6.5v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-58692 | Fortinet FortiVoice SQL injection | 7.7CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-58413 | Fortinet FortiOS A stack-based buffer overflow | 6.9CNA v3.1 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-58122 | Checkmk insufficient permission validation when configuring notification parameters | 5.3CNA v4.0 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-58121 | Checkmk insufficient permission validation on multiple REST API endpoints | 5.3CNA v4.0 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-58034 | Fortinet FortiWeb OS command injection | 6.7CNA v3.1 | 55.6% | 2025-11-18 | KEVMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-56643 | Requarks Wiki.js insufficient session expiration | 9.1CISA ADP v3.1 | 0.4% | 2025-11-18 | Exploit code |
| CVE-2025-56527 | Cinnamon kotaemon plaintext password storage | 7.5CISA ADP v3.1 | 0.4% | 2025-11-18 | KCV |
| CVE-2025-56526 | Cinnamon kotaemon cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-11-18 | Exploit codeKCV |
| CVE-2025-56499 | Metacubex Mihomo arbitrary file read | 6.5CISA ADP v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-55796 | Openml Frontend missing brute-force protection | 7.5CISA ADP v3.1 | 0.6% | 2025-11-18 | |
| CVE-2025-55179 | WhatsApp rich response message handling vulnerability | 5.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-55074 | Mattermost channel member objects leak read status | 3.0CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54990 | XWiki AdminTools application SpammedPages page incorrect default permissions | 5.3CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54972 | Fortinet FortiMail CRLF injection | 3.9CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54971 | Fortinet FortiADC information disclosure | 3.9CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54821 | Fortinet FortiOS improper privilege management | 1.7CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54771 | GNU GRUB2 file-closing process use-after-free | 4.9CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-54770 | GNU GRUB2 network module use-after-free | 4.9CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-54660 | Fortinet FortiClientWindows active debug code | 4.9CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-54321 | Ascertia Signinghub improper interaction frequency control | 9.8CISA ADP v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-54320 | Ascertia Signinghub resource exhaustion | 4.3CISA ADP v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-53843 | Fortinet FortiOS A stack-based buffer overflow | 6.9CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-53360 | PluginsGLPI's Database Inventory plugin allows any authenticated user to send agent requests | 4.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-52639 | HCL Connections is vulnerable to sensitive information disclosure | 3.5CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-52578 | Gallagher High Sec End of Line Module improper seeding | 5.7CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-52457 | Gallagher HBUS Devices timing side channel | 5.7CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-48839 | Fortinet FortiADC out-of-bounds write | 6.3CNA v3.1 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-48593 | Google Android bta_hf_client_main.cc remote code execution | 8.0CISA ADP v3.1 | 0.9% | 2025-11-18 | Exploit codeFix |
| CVE-2025-47761 | Fortinet FortiClientWindows exposed IOCTL without access control | 7.1CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-46776 | Fortinet FortiExtender buffer overflow | 6.3CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-46775 | Fortinet FortiExtender debug log commands information disclosure | 5.2CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-46373 | Fortinet FortiClientWindows heap-based buffer overflow | 7.1CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-46215 | Fortinet FortiSandbox improper isolation | 5.0CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-41737 | METZ CONNECT Energy-Controlling EWIO2-M improper access control via PHP endpoint | 7.5CNA v3.1 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-41736 | METZ CONNECT Energy-Controlling EWIO2-M possible arbitrary code execution | 8.8CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-41735 | METZ CONNECT Energy-Controlling EWIO2-M possible arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-11-18 | Fix |
| CVE-2025-41734 | METZ CONNECT Energy-Controlling EWIO2-M unauthenticated local file inclusion in PHP module | 9.8CNA v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-41733 | METZ CONNECT Energy-Controlling EWIO2-M possible malfunction credential injection | 9.8CNA v3.1 | 0.6% | 2025-11-18 | Fix |
| CVE-2025-41350 | Stored cross-site scripting (XSS) in WinPlus by Informática del Este | 5.4v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-41349 | Stored cross-site scripting (XSS) in WinPlus by Informática del Este | 5.4v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-41348 | Stored cross-site scripting (XSS) in WinPlus by Informática del Este | 9.8v3.1 | 0.5% | 2025-11-18 | |
| CVE-2025-41347 | Stored cross-site scripting (XSS) in WinPlus by Informática del Este | 9.8v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-41346 | Stored cross-site scripting (XSS) in WinPlus by Informática del Este | 9.8v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-40549 | SolarWinds Serv-U Path Restriction Bypass vulnerability | 9.1CNA v3.1 | 1.1% | 2025-11-18 | Fix |
| CVE-2025-40548 | SolarWinds Serv-U broken access control remote code execution | 9.1CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-40547 | SolarWinds Serv-U Logic Abuse remote code execution | 9.1CNA v3.1 | 0.9% | 2025-11-18 | Fix |
| CVE-2025-40545 | SolarWinds Observability Self-Hosted open redirection | 4.8CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-37163 | Authenticated command injection vulnerability in HPE Aruba Networking Management Software CLI | 7.2CNA v3.1 | 1.0% | 2025-11-18 | Fix |
| CVE-2025-37162 | HPE Aruba 100 Series Cellular Bridge command line interface command injection | 6.5CNA v3.1 | 0.9% | 2025-11-18 | Fix |
| CVE-2025-37161 | HPE Aruba 100 Series Cellular Bridge web management interface denial of service | 7.5CNA v3.1 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-37160 | HPE Aruba Networking AOS-CX authenticated broken access control in REST API Configuration service | 5.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-37159 | HPE Aruba AOS-CX web management interface session fixation | 5.8CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-37158 | Authenticated command injection allows unauthorized command execution in AOS-CX | 6.7CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-37157 | Authenticated command injection allows unauthorized command execution in AOS-CX | 6.7CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-37156 | ArubaOS-CX Platform-Level denial of service | 6.8CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-37155 | HPE Aruba AOS-CX SSH restricted shell interface privilege escalation | 7.8CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-34324 | GoSign Desktop Insecure Update Mechanism RCE | 7.8v3.1 | 0.1% | 2025-11-18 | Exploit codeFix |
| CVE-2025-33184 | NVIDIA Isaac-GR00T N1.5 code injection | 7.8CNA v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-33183 | NVIDIA Isaac-GR00T N1.5 code injection | 7.8CNA v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-26391 | SolarWinds Observability Self-Hosted XSS | 5.4CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-13349 | SourceCodester Student Grades Management System Add New Grade grades.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-13347 | SourceCodester Train Station Ticketing System ajax.php SQL injection | 8.8v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-13346 | SourceCodester Train Station Ticketing System ajax.php SQL injection | 8.8v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-13345 | SourceCodester Train Station Ticketing System ajax.php SQL injection | 8.8v3.1 | 0.5% | 2025-11-18 | |
| CVE-2025-13344 | SourceCodester Train Station Ticketing System ajax.php SQL injection | 9.8v3.1 | 0.6% | 2025-11-18 | |
| CVE-2025-13343 | SourceCodester Interview Management System editQuestion.php cross-site scripting | 5.4v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-13325 | itsourcecode Student Information System enrollment_edit1.php SQL injection | 8.8v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-13323 | code-projects Simple Pizza Ordering System listorder.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-13306 | D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection | 8.8v3.1 | 8.3% | 2025-11-18 | Fix |
| CVE-2025-13230 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13229 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13228 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |