CVE-2025 records published in November 2025

This page lists the 2,914 CVE-2025 records published in November 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 10 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.

Critical
36212.4% of these records
Listed in CISA KEV
100.3% of these records
Reported exploited
80.3% of these records
Detection signal
491.7% of these records
Exploit code
832.8% of these records
Actionable vendor fix
2,03369.8% of these records

Figures as of 2026-10-24 13:47 UTC. Records published in November 2025 have had from about 11 months to about 12 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2025 records published in November 2025, newest first: records 1 to 1,000 of 2,914
CVE Summary CVSS EPSS Published Signals
CVE-2025-66433wisc HTCondor incorrect authorization4.2CNA v3.10.1%2025-11-30Fix
CVE-2025-66432Oxide Omicron unprotected alternate channel5.0CNA v3.10.2%2025-11-30Fix
CVE-2025-66424trytond does not enforce access rights for data export6.5CNA v3.10.2%2025-11-30Fix
CVE-2025-66423trytond does not enforce access rights for the route of the HTML editor7.1CNA v3.10.2%2025-11-30Fix
CVE-2025-66422trytond allows remote attackers to obtain sensitive trace-back (server setup) information4.3CNA v3.10.3%2025-11-30Fix
CVE-2025-66421Tryton sao allows XSS because it does not escape completion values5.4CNA v3.10.2%2025-11-30Fix
CVE-2025-66420Tryton sao allows XSS via an HTML attachment5.4CNA v3.10.2%2025-11-30Fix
CVE-2025-35028HexStrike AI MCP server command injection9.1CNA v3.15.3%2025-11-30
CVE-2025-13795codingWithElias School Management System Edit Student Info student-view.php cross-site scripting4.8CNA v4.00.2%2025-11-30
CVE-2025-13793winston-dsouza Ecommerce-Website GET parameter header_menu.php cross-site scripting5.3CNA v4.00.3%2025-11-30
CVE-2025-13792Qualitor getResumo.php eval code injection6.9CNA v4.00.5%2025-11-30
CVE-2025-13791Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal6.5v3.10.5%2025-11-30
CVE-2025-13790Scada-LTS cross-site request forgery8.8v3.10.3%2025-11-30
CVE-2025-13789ZenTao model.php makeRequest server-side request forgery5.3v3.10.3%2025-11-30
CVE-2025-13788Chanjet CRM upgradeattribute.php SQL injection9.8v3.10.4%2025-11-30
CVE-2025-13787ZenTao file control.php delete privileges management9.1v3.10.4%2025-11-30Fix
CVE-2025-13786taosir WTCMS index.php fetch code injection9.8v3.10.6%2025-11-30
CVE-2025-13785yungifez Skuul School Management System Image profile information disclosure6.5v3.10.4%2025-11-30
CVE-2025-13784yungifez Skuul School Management System SVG file edit cross-site scripting4.8v3.10.3%2025-11-30
CVE-2025-13783taosir WTCMS CommentadminController CommentadminController.class.php delete SQL injection9.8v3.10.3%2025-11-30
CVE-2025-13782taosir WTCMS SlideController SlideController.class.php delete SQL injection9.8NVD v3.10.4%2025-11-30
CVE-2025-13615StreamTube Core WordPress plugin unauthenticated arbitrary user password Change9.8CNA v3.10.4%2025-11-30Fix
CVE-2025-66291OrangeHRM interview attachment retrieval improper authorization5.3CNA v4.00.2%2025-11-29Fix
CVE-2025-66290OrangeHRM candidate attachment retrieval improper authorization5.3CNA v4.00.2%2025-11-29Fix
CVE-2025-66289OrangeHRM session management insufficient session expiration8.7CNA v4.00.3%2025-11-29Fix
CVE-2025-66225OrangeHRM is vulnerable to account takeover through Unvalidated Username in Password Reset Workflow8.7CNA v4.00.2%2025-11-29Fix
CVE-2025-66224OrangeHRM is vulnerable to code execution9.0CNA v4.00.6%2025-11-29Exploit codeFix
CVE-2025-66223OpenObserve's Invite Token Lifecycle Misconfiguration8.4CNA v4.00.3%2025-11-29Fix
CVE-2025-66221Werkzeug safe_join allows Windows special device names6.3CNA v4.00.5%2025-11-29Fix
CVE-2025-66219willitmerge has a command injection6.9CNA v4.02.7%2025-11-29
CVE-2025-66217AIS-catcher integer underflow in MQTT Packet Parsing leading to heap buffer overflow8.8CNA v4.00.7%2025-11-29Fix
CVE-2025-66216AIS-catcher has a buffer overflow vulnerability in `AIS::Message` leading to DoS/RCE9.3CNA v4.00.5%2025-11-29Fix
CVE-2025-66201LibreChat is vulnerable to server-side request forgery (SSRF) in Actions Capability8.6CNA v4.00.3%2025-11-29Fix
CVE-2025-66036Retro is vulnerable to XSS vulnerability in input handling component6.1CNA v3.10.2%2025-11-29Fix
CVE-2025-66034fontTools is vulnerable to arbitrary file write and XML injection in fontTools.varLib6.3CNA v3.10.5%2025-11-29Exploit codeFix
CVE-2025-66027lukevella Rallly participant API information disclosure7.1CNA v4.00.4%2025-11-29Fix
CVE-2025-65892Krpano reflected cross-site scripting6.1CISA ADP v3.10.2%2025-11-29Fix
CVE-2025-65540Exrick xmall Multiple cross-site scripting6.1CISA ADP v3.10.2%2025-11-29
CVE-2025-65113ClipBucket v5 Unauthenticated Object Flagging vulnerability6.5CNA v3.10.4%2025-11-29Fix
CVE-2025-65112PubNet critical authentication bypass allows Unauthenticated Package upload and Identity spoofing9.4CNA v3.10.5%2025-11-29Fix
CVE-2025-64715Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic4.0CNA v3.10.2%2025-11-29Fix
CVE-2025-61915OpenPrinting CUPS vulnerable to stack based out-of-bound write6.0CNA v3.10.5%2025-11-29Fix
CVE-2025-58436OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack5.1CNA v3.10.2%2025-11-29Fix
CVE-2025-53939Kiteworks Core is vulnerable to improper input validation6.3CNA v3.10.7%2025-11-29Fix
CVE-2025-53900Kiteworks MFT has a privilege defined with unsafe actions6.5CNA v3.11.1%2025-11-29Fix
CVE-2025-53899Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel7.2CNA v3.10.9%2025-11-29Fix
CVE-2025-53897Kiteworks MFT has a cross-site request forgery (CSRF)6.8CNA v3.10.2%2025-11-29Fix
CVE-2025-53896Kiteworks MFT is vulnerable to insufficient session expiration7.1CNA v3.10.2%2025-11-29Fix
CVE-2025-6666motogadget mo.lock Ignition Lock NFC hard-coded key1.0CNA v4.00.1%2025-11-29
CVE-2025-66386MISP relative path traversal4.1CNA v3.10.3%2025-11-28Fix
CVE-2025-66385Cerebrate web parameter tampering9.4CNA v4.00.4%2025-11-28Fix
CVE-2025-66384MISP incorrect behavior8.2CNA v3.10.4%2025-11-28Fix
CVE-2025-66382libexpat algorithmic complexity5.5NVD v3.10.2%2025-11-28Fix
CVE-2025-66372Mustangproject allows exfiltrating files via XXE attacks2.8CNA v3.10.1%2025-11-28Fix
CVE-2025-66371Peppol-py is vulnerable to XXE attacks due to Saxon configuration5.0CNA v3.10.3%2025-11-28Fix
CVE-2025-66370kivitendo XML external entity injection5.0CNA v3.10.3%2025-11-28Fix
CVE-2025-66361Logpoint SIEM server-side template injection6.5NVD v3.10.3%2025-11-28Fix
CVE-2025-66360Logpoint SIEM incorrect authorization8.8NVD v3.10.3%2025-11-28Fix
CVE-2025-66359Logpoint SIEM cross-site scripting6.1NVD v3.10.2%2025-11-28Fix
CVE-2025-64315Huawei HarmonyOS access control weakness4.4CNA v3.10.1%2025-11-28Fix
CVE-2025-64314Huawei HarmonyOS type confusion9.3CNA v3.10.1%2025-11-28Fix
CVE-2025-64313Huawei HarmonyOS denial of service (DoS) vulnerability in the office service5.3CNA v3.10.1%2025-11-28Fix
CVE-2025-64312Huawei HarmonyOS permission control vulnerability in the file management module4.9CNA v3.10.2%2025-11-28Fix
CVE-2025-64311Huawei HarmonyOS permission control vulnerability in the Notepad module5.1CNA v3.10.1%2025-11-28Fix
CVE-2025-59792Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins5.3CISA ADP v3.10.3%2025-11-28Fix
CVE-2025-59790Apache Kvrocks: RESET command grants admin privileges5.4CISA ADP v3.10.4%2025-11-28Fix
CVE-2025-58316Huawei HarmonyOS DoS vulnerability in the video-related system service module7.3CNA v3.10.1%2025-11-28Fix
CVE-2025-58315Huawei HarmonyOS permission control vulnerability in the Wi-Fi module5.5CNA v3.10.1%2025-11-28Fix
CVE-2025-58314Huawei HarmonyOS vulnerability of accessing invalid memory in the component driver module6.6CNA v3.10.1%2025-11-28Fix
CVE-2025-58312Huawei HarmonyOS Permission control vulnerability in the App Lock module5.1CNA v3.10.1%2025-11-28Fix
CVE-2025-58311Huawei HarmonyOS UAF vulnerability in the USB driver module5.8CNA v3.10.1%2025-11-28Fix
CVE-2025-58310Huawei HarmonyOS permission control vulnerability in the distributed component8.0CNA v3.10.1%2025-11-28Fix
CVE-2025-58309Huawei HarmonyOS permission control vulnerability in the startup recovery module6.8CNA v3.10.1%2025-11-28Fix
CVE-2025-58308Huawei HarmonyOS vulnerability of improper criterion security check in the call module7.3CNA v3.10.1%2025-11-28Fix
CVE-2025-58307Huawei HarmonyOS UAF vulnerability in the screen recording framework module6.4CNA v3.10.1%2025-11-28Fix
CVE-2025-58305Huawei HarmonyOS identity authentication bypass vulnerability in the Gallery app6.2CNA v3.10.1%2025-11-28Fix
CVE-2025-58304Huawei HarmonyOS permission control vulnerability in the file management module4.9CNA v3.10.1%2025-11-28Fix
CVE-2025-58303Huawei HarmonyOS UAF vulnerability in the screen recording framework module8.4CNA v3.10.1%2025-11-28Fix
CVE-2025-58302Huawei HarmonyOS permission control vulnerability in the settings module8.4CNA v3.10.1%2025-11-28Fix
CVE-2025-58294Huawei HarmonyOS permission control vulnerability in the print module6.2CNA v3.10.1%2025-11-28Fix
CVE-2025-51736Hcltech Unica HCL Technologies Ltd file upload6.3CISA ADP v3.10.2%2025-11-28
CVE-2025-51735Hcltech Unica HCL Technologies Ltd CSV injection7.5CISA ADP v3.10.3%2025-11-28
CVE-2025-51734Hcltech Unica HCL Technologies Ltd cross-site scripting5.4CISA ADP v3.10.2%2025-11-28
CVE-2025-51733Hcltech Unica HCL Technologies Ltd cross-site request forgery5.5CISA ADP v3.10.1%2025-11-28
CVE-2025-13771Uniong|WebITR arbitrary file read7.1CNA v4.00.5%2025-11-28Fix
CVE-2025-13770Uniong|WebITR SQL injection7.1CNA v4.00.3%2025-11-28Fix
CVE-2025-13769Uniong|WebITR SQL injection7.1CNA v4.00.3%2025-11-28Fix
CVE-2025-13768Uniong|WebITR authorization bypass8.8NVD v3.10.4%2025-11-28Fix
CVE-2025-13737Nextend Social Login and Register WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-11-28Fix
CVE-2025-13683Devolutions Server information disclosure6.5CISA ADP v3.10.4%2025-11-28Fix
CVE-2025-12638Path traversal vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file8.0CNA v3.00.7%2025-11-28Fix
CVE-2025-12183Org.lz4:lz4-java out-of-bounds memory access8.8CNA v4.00.7%2025-11-28Fix
CVE-2025-12143ABB Terra AC wallbox stack memory corruption6.9CNA v4.00.2%2025-11-28Fix
CVE-2025-11156Improper Service Loading vulnerability in Netskope Endpoint DLP driver5.9CNA v4.00.1%2025-11-28Fix
CVE-2025-66314ZTE ElasticNet UME R32 improper privilege management7.5CNA v3.10.3%2025-11-27
CVE-2025-66040Spotipy has a XSS vulnerability in OAuth callback server3.6CNA v3.10.2%2025-11-27Fix
CVE-2025-59890Eaton Galileo Software path traversal7.3CNA v3.10.1%2025-11-27
CVE-2025-59454Apache CloudStack: Lack of user permission validation leading to data leak for few APIs4.3CISA ADP v3.10.4%2025-11-27Fix
CVE-2025-59302Apache CloudStack: Potential remote code execution on Javascript engine defined rules4.7CISA ADP v3.10.5%2025-11-27Fix
CVE-2025-59026Open-Xchange OX App Suite cross-site scripting5.4CNA v3.10.2%2025-11-27Fix
CVE-2025-59025Open-Xchange OX App Suite cross-site scripting6.1CNA v3.10.2%2025-11-27Fix
CVE-2025-54057Apache SkyWalking: Stored XSS6.1CISA ADP v3.10.8%2025-11-27Fix
CVE-2025-30190Open-Xchange OX App Suite cross-site scripting5.4CNA v3.10.2%2025-11-27Fix
CVE-2025-30186Open-Xchange OX App Suite cross-site scripting5.4CNA v3.10.2%2025-11-27Fix
CVE-2025-13765Devolutions Server information disclosure4.3v3.10.4%2025-11-27Fix
CVE-2025-13762Client-Side denial of service Condition in SWS Extension prior to4.8CNA v4.00.1%2025-11-27Fix
CVE-2025-13758Devolutions Server information disclosure3.5v3.10.3%2025-11-27Fix
CVE-2025-13757Devolutions Server last usage logs SQL injection8.8v3.10.6%2025-11-27Fix
CVE-2025-13742pretix limited HTML injection in emails2.4CNA v4.00.2%2025-11-27Fix
CVE-2025-13692Unlimited Elements For Elementor WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2025-11-27Fix
CVE-2025-13680Tiger WordPress theme authenticated (Subscriber+) privilege escalation8.8CNA v3.10.3%2025-11-27
CVE-2025-13675Tiger WordPress theme unauthenticated privilege escalation9.8CNA v3.10.3%2025-11-27
CVE-2025-13540Tiare Membership WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.3%2025-11-27Fix
CVE-2025-13539FindAll Membership WordPress plugin authentication bypass via Social login9.8CNA v3.10.5%2025-11-27Fix
CVE-2025-13538FindAll Listing WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.3%2025-11-27Fix
CVE-2025-13536Blubrry PowerPress WordPress plugin arbitrary file upload8.8CNA v3.10.6%2025-11-27Fix
CVE-2025-13525WP Directory Kit WordPress plugin reflected cross-site scripting via order_by parameter6.1CNA v3.10.3%2025-11-27Fix
CVE-2025-13441Hide Category by User Role for WooCommerce WordPress plugin missing authorization5.3CNA v3.10.3%2025-11-27Fix
CVE-2025-13381AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin unauthorized access5.3CNA v3.10.3%2025-11-27Fix
CVE-2025-13378AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin server-side request forgery6.5CNA v3.10.3%2025-11-27Fix
CVE-2025-13157QODE Wishlist for WooCommerce WordPress plugin insecure direct object reference5.3CNA v3.10.3%2025-11-27Fix
CVE-2025-13143Poll, Survey and Quiz Maker Plugin by Opinion Stage WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-11-27Fix
CVE-2025-12971Folders WordPress plugin incorrect authorization to authenticated Folder content manipulation4.3CNA v3.10.2%2025-11-27Fix
CVE-2025-12758Validator is vulnerable to incomplete filtering of One or More Instances of Special Elements8.7CNA v4.00.5%2025-11-27Fix
CVE-2025-12713Soundslides WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-27
CVE-2025-12712Shouty WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-27
CVE-2025-12670wp-twitpic WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-27
CVE-2025-12666Google Drive upload and download link WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-27
CVE-2025-12649SortTable Post WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-27
CVE-2025-12584Quick View for WooCommerce WordPress plugin unauthenticated Private Product disclosure5.3CNA v3.10.3%2025-11-27Fix
CVE-2025-12579Reuters Direct WordPress plugin missing authorization to unauthenticated settings reset5.3CNA v3.10.2%2025-11-27
CVE-2025-12578Reuters Direct WordPress plugin cross-site request forgery to settings reset4.3CNA v3.10.1%2025-11-27
CVE-2025-12559Mattermost information disclosure in Common Teams API4.3CNA v3.10.2%2025-11-27Fix
CVE-2025-12421Mattermost account takeover via Code Exchange endpoint9.9CNA v3.10.3%2025-11-27Fix
CVE-2025-12419Mattermost account takeover on OAuth/OpenID-enabled servers9.9CNA v3.10.3%2025-11-27Fix
CVE-2025-12185StaffList WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-11-27Fix
CVE-2025-12151Simple Folio WordPress plugin authenticated (Subscriber+) stored cross-site scripting6.4CNA v3.10.2%2025-11-27Fix
CVE-2025-12140RCE in Wirtualna Uczelnia9.3CNA v4.00.4%2025-11-27Fix
CVE-2025-12123Customer Reviews Collector for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-11-27Fix
CVE-2025-10476WP Fastest Cache WordPress plugin missing authorization authenticated DB Cleanup actions4.3CNA v3.10.2%2025-11-27Fix
CVE-2025-8890Authenticated RCE in SDMC NE6037 router9.3CNA v4.00.9%2025-11-27Fix
CVE-2025-7820SKT PayPal for WooCommerce WordPress plugin unauthenticated Payment bypass7.5CNA v3.10.3%2025-11-27Fix
CVE-2025-3784Information disclosure vulnerability in GX Works25.5CNA v3.10.1%2025-11-27Fix
CVE-2025-0658Automated Logic and Carrier Zone Controllers malformed packets denial of service8.7CNA v4.00.3%2025-11-27Fix
CVE-2025-0657ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range8.8CNA v4.00.3%2025-11-27
CVE-2025-66269Unquoted service path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM7.1CNA v4.00.1%2025-11-26
CVE-2025-66266Insecure SYSTEM Service Permissions in UPSilon2000V6.0 leading to trivial local privilege escalation9.3CNA v4.00.1%2025-11-26
CVE-2025-66265MegaTec Taiwan ClientMate insecure permissions in configuration directory (C:\\usr)6.9CNA v4.00.1%2025-11-26
CVE-2025-66264MegaTec Taiwan ClientMate unquoted service path in UPSilon2000V6.0 SYSTEM privilege service7.2CNA v4.00.1%2025-11-26
CVE-2025-66263DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file read7.5v3.10.4%2025-11-26
CVE-2025-66262DB Electronica Telecomunicazioni Mozart FM Transmitter arbitrary file overwrite9.8v3.11.4%2025-11-26
CVE-2025-66261DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated OS command injection9.8v3.12.3%2025-11-26
CVE-2025-66260DB Electronica Telecomunicazioni Mozart FM Transmitter PostgreSQL SQL injection (status_sql.php)6.5NVD v3.10.3%2025-11-26
CVE-2025-66259DB Electronica Telecomunicazioni Mozart FM Transmitter authenticated Root remote code execution9.8v3.10.7%2025-11-26
CVE-2025-66258DB Electronica Telecomunicazioni Mozart FM Transmitter stored cross-site scripting via XML injection5.4NVD v3.10.2%2025-11-26
CVE-2025-66257DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file deletion9.1v3.10.4%2025-11-26
CVE-2025-66256DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload9.8v3.10.4%2025-11-26
CVE-2025-66255DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload9.8v3.10.4%2025-11-26
CVE-2025-66254DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file deletion9.1v3.10.4%2025-11-26
CVE-2025-66253DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated OS command injection9.8v3.12.3%2025-11-26
CVE-2025-66252DB Electronica Telecomunicazioni Mozart FM Transmitter infinite loop denial of service7.5v3.10.4%2025-11-26
CVE-2025-66251DB Electronica Telecomunicazioni Mozart FM Transmitter Unauthenticated path traversal9.1v3.10.5%2025-11-26
CVE-2025-66250DB Electronica Telecomunicazioni Mozart FM Transmitter unauthenticated arbitrary file upload9.8v3.10.4%2025-11-26
CVE-2025-66035Angular HTTP client has XSRF token leakage via Protocol-Relative URLs7.7CNA v4.00.7%2025-11-26Fix
CVE-2025-66031digitalbazaar forge node-forge ASN.1 Unbounded Recursion8.7CNA v4.00.4%2025-11-26Fix
CVE-2025-66030digitalbazaar forge node-forge ASN.1 OID Integer Truncation6.3CNA v4.00.3%2025-11-26Fix
CVE-2025-66028OneUptime is vulnerable to privilege escalation via Login Response Manipulation6.9CNA v4.00.3%2025-11-26Fix
CVE-2025-66026REDAXO is vulnerable to reflected XSS in Mediapool Info Banner via args[types]6.1CNA v3.10.3%2025-11-26Fix
CVE-2025-66025Caido improperly Handles External Links in Markdown4.3CNA v3.10.2%2025-11-26Fix
CVE-2025-66022FACTION Unauthenticated Custom extension upload leads to RCE9.7CNA v3.10.7%2025-11-26Fix
CVE-2025-66021OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization8.6CNA v4.00.2%2025-11-26Fix
CVE-2025-66020Valibot has a ReDoS vulnerability in `EMOJI_REGEX`7.5CNA v3.10.3%2025-11-26Fix
CVE-2025-66019pypdf manipulated LZWDecode streams can exhaust RAM6.6CNA v4.00.4%2025-11-26Fix
CVE-2025-65966OneUptime Unauthorized User Creation via API8.8CNA v4.00.3%2025-11-26Fix
CVE-2025-65963CFiles Unauthorized Folder/ZIP Access in Public Spaces5.4CNA v3.10.2%2025-11-26Fix
CVE-2025-65957Intercore-Productions Core-Bot information disclosure8.8CNA v4.00.3%2025-11-26
CVE-2025-65956Formwork CMS has a stored cross-site scripting (XSS) vulnerability in Blog Tags6.5CNA v3.10.2%2025-11-26Fix
CVE-2025-65681Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control3.3CISA ADP v3.10.2%2025-11-26Exploit code
CVE-2025-65676ClassroomIO stored cross-site scripting5.4NVD v3.10.2%2025-11-26
CVE-2025-65675ClassroomIO stored cross-site scripting5.4NVD v3.10.2%2025-11-26
CVE-2025-65672ClassroomIO insecure direct object reference7.5CISA ADP v3.10.4%2025-11-26Exploit code
CVE-2025-65670ClassroomIO An insecure direct object reference4.3CISA ADP v3.10.2%2025-11-26
CVE-2025-65669ClassroomIO missing authorization9.1CISA ADP v3.10.5%2025-11-26
CVE-2025-65278Komal97 Grocerymart cleartext storage of sensitive information7.5CISA ADP v3.10.2%2025-11-26
CVE-2025-65276Henzljw Hashtech missing authentication9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-65239Opencode Ussd Gateway improper access control4.3CISA ADP v3.10.3%2025-11-26
CVE-2025-65238Opencode Ussd Gateway information disclosure6.5CISA ADP v3.10.3%2025-11-26
CVE-2025-65237Opencode Ussd Gateway cross-site scripting6.1CISA ADP v3.10.3%2025-11-26
CVE-2025-65236Opencode Ussd Gateway SQL injection9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-65235Opencode Ussd Gateway SQL injection9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-65202TRENDnet TEW-657BRM OS command injection8.0CISA ADP v3.16.7%2025-11-26
CVE-2025-64983SwitchBot Smart Video Doorbell active debug code8.6CNA v4.00.3%2025-11-26
CVE-2025-64657Microsoft Azure Application Gateway elevation of privilege9.8CNA v3.10.6%2025-11-26Fix
CVE-2025-64656Microsoft Azure Application Gateway elevation of privilege9.4CNA v3.10.6%2025-11-26Fix
CVE-2025-64344Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer7.5CNA v3.10.4%2025-11-26Fix
CVE-2025-64335Suricata is vulnerable to a null deref when used with base64_data7.5CNA v3.10.4%2025-11-26Fix
CVE-2025-64334Suricata is vulnerable to unbounded memory growth for decompression7.5CNA v3.10.4%2025-11-26Fix
CVE-2025-64333Suricata is vulnerable to a stack overflow from big content-type7.5CNA v3.10.3%2025-11-26Fix
CVE-2025-64332Suricata is vulnerable to a stack overflow on larger compressed data7.5CNA v3.10.4%2025-11-26Fix
CVE-2025-64331Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable7.5CNA v3.10.3%2025-11-26Fix
CVE-2025-64330Suricata is vulnerable to a heap buffer overflow on verdict7.5CNA v3.10.4%2025-11-26Fix
CVE-2025-64130Zenitel TCIV-3+ cross-site scripting9.3CNA v4.00.9%2025-11-26Fix
CVE-2025-64129Zenitel TCIV-3+ out-of-bounds write7.0CNA v4.00.4%2025-11-26Fix
CVE-2025-64128Zenitel TCIV-3+ OS command injection10.0CNA v4.02.4%2025-11-26Fix
CVE-2025-64127Zenitel TCIV-3+ OS command injection10.0CNA v4.02.4%2025-11-26Fix
CVE-2025-64126Zenitel TCIV-3+ OS command injection10.0CNA v4.02.4%2025-11-26Fix
CVE-2025-63938Tinyproxy integer overflow6.5CISA ADP v3.10.3%2025-11-26Fix
CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests5.4CISA ADP v3.10.4%2025-11-26Fix
CVE-2025-62593Ray-Project Ray code injection9.4CNA v4.062.5%2025-11-26KEVNucleiExploit codeFix
CVE-2025-62354cursor OS command improper neutralization9.8CNA v3.11.4%2025-11-26Fix
CVE-2025-59820KDE Krita improper quantity validation6.7CNA v3.10.2%2025-11-26Fix
CVE-2025-59390Apache Druid’s Kerberos authenticator uses a weak fallback secret9.8CISA ADP v3.10.6%2025-11-26Fix
CVE-2025-56396RuoYi improper access control8.8v3.10.3%2025-11-26
CVE-2025-55471youlai-boot missing authorization7.5CISA ADP v3.10.3%2025-11-26
CVE-2025-55469youlai-boot incorrect authorization9.8v3.10.4%2025-11-26
CVE-2025-55174KDE Skanpage incorrect behavior3.2CNA v3.10.1%2025-11-26Fix
CVE-2025-50433Monnit Imonnit weak password recovery9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-50402Fastcom FAC1200R buffer overflow9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-50399Fastcom FAC1200R buffer overflow9.8CISA ADP v3.10.4%2025-11-26
CVE-2025-46175RuoYi missing authorization7.5v3.10.3%2025-11-26
CVE-2025-46174RuoYi missing authorization7.5v3.10.3%2025-11-26
CVE-2025-45311fail2ban-client v0.11.2 insecure permissions8.8CISA ADP v3.10.4%2025-11-26
CVE-2025-40934XML-Sig for Perl improperly validates XML without signatures9.3CISA ADP v3.10.2%2025-11-26Fix
CVE-2025-26155ncp-e Secure Enterprise Client untrusted search path9.8CISA ADP v3.10.6%2025-11-26
CVE-2025-20373Sensitive information disclosure in “_internal“ index through Splunk Add-on for Palo Alto Networks2.7CNA v3.10.2%2025-11-26Fix
CVE-2025-13735ASR Lapwing_Linux out-of-bounds read in nr flc7.4CNA v3.10.2%2025-11-26Fix
CVE-2025-13674Access of uninitialized pointer in Wireshark5.5CNA v3.10.1%2025-11-26Fix
CVE-2025-13611Insertion of sensitive information into log file in GitLab2.0CNA v3.10.2%2025-11-26Fix
CVE-2025-13601GLib: Integer overflow in in g_escape_uri_string7.7CNA v3.10.3%2025-11-26Fix
CVE-2025-13084Opto 22 groov View exposure of sensitive information through Metadata6.1CNA v4.00.3%2025-11-26Fix
CVE-2025-12848XSS vulnerability when rendering filename in Webform Multiform7.0CNA v4.00.3%2025-11-26Fix
CVE-2025-12653Authentication bypass by spoofing in GitLab6.5CNA v3.10.3%2025-11-26Fix
CVE-2025-12571Allocation of resources without limits or throttling in GitLab7.5CNA v3.10.5%2025-11-26Fix
CVE-2025-12061Tax Service Electronic HDM WordPress plugin unauthenticated arbitrary SQL execution8.6CISA ADP v3.10.2%2025-11-26Fix
CVE-2025-11461Frappe CRM multiple SQL Injections in Dashboard controller8.8v3.10.3%2025-11-26
CVE-2025-9558zephyrproject-rtos Zephyr Bluetooth: Mesh: Out-of-bound write in gen_prov_start7.6CNA v3.10.2%2025-11-26
CVE-2025-9557zephyrproject-rtos Zephyr Bluetooth: Mesh: Out-of-bound write in gen_prov_cont7.6CNA v3.10.2%2025-11-26
CVE-2025-9191Houzez WordPress theme authenticated (Subscriber+) PHP object injection via Saved Search6.3CNA v3.10.3%2025-11-26Fix
CVE-2025-9163Houzez WordPress theme unauthenticated stored cross-site scripting via SVG file upload6.1CNA v3.10.2%2025-11-26Fix
CVE-2025-7449Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.4%2025-11-26Fix
CVE-2025-6195Direct request (forced browsing) in GitLab4.3CNA v3.10.3%2025-11-26Fix
CVE-2025-2486UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu3.7CNA v4.00.1%2025-11-26Fix
CVE-2025-66017CGGMP21 presignatures can be used in the way that significantly reduces security8.2CNA v4.00.2%2025-11-25Fix
CVE-2025-66016CGGMP24 is missing a check in the ZK proof used in CGGMP219.3CNA v4.00.2%2025-11-25Fix
CVE-2025-65965Grype has a credential disclosure vulnerability in Grype JSON output8.2CNA v4.00.1%2025-11-25Fix
CVE-2025-65961Contao is vulnerable to cross-site scripting in templates3.3CNA v3.10.2%2025-11-25Fix
CVE-2025-65960Contao is vulnerable to remote code execution in template closures6.6CNA v3.10.2%2025-11-25Fix
CVE-2025-65953NanoMQ UAF of retain message due to invalid MQTTV5 properties6.0CNA v4.00.2%2025-11-25Fix
CVE-2025-65952Console is vulnerable to path traversal regarding custom assets8.7CNA v4.00.4%2025-11-25Fix
CVE-2025-65951mescuwa Entropy Derby VDF timelock encryption weak cryptographic algorithm8.7CNA v3.10.1%2025-11-25
CVE-2025-65944Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`5.1CNA v4.00.3%2025-11-25Fix
CVE-2025-65942VictoriaMetrics Snappy Decoder DoS vulnerability is causing OOM2.7CNA v3.10.3%2025-11-25Fix
CVE-2025-65647PHPGurukul Online Shopping Portal Track order function insecure direct object reference4.3CISA ADP v3.10.2%2025-11-25
CVE-2025-65085Heap-based buffer overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share9.8v3.10.4%2025-11-25Fix
CVE-2025-65084Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share9.8v3.10.3%2025-11-25Fix
CVE-2025-65018LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered7.1CNA v3.10.3%2025-11-25Exploit codeFix
CVE-2025-64761OpenBao Privileged Operator Identity Group Root Escalation7.5CNA v4.00.4%2025-11-25Fix
CVE-2025-64730Sony SNC-CX600W cross-site scripting6.1v3.10.2%2025-11-25
CVE-2025-64720LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite`7.1CNA v3.10.4%2025-11-25Exploit codeFix
CVE-2025-64713Bytecode Alliance WebAssembly Micro Runtime fast interpreter out-of-bounds access5.1CNA v3.10.3%2025-11-25Fix
CVE-2025-64704WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction4.7CNA v3.10.2%2025-11-25Fix
CVE-2025-64693Intercom Security Point (Windows) of MaLion heap-based buffer overflow9.3CNA v4.00.7%2025-11-25
CVE-2025-64506libpng png_write_image_8bit out-of-bounds read6.1CNA v3.10.1%2025-11-25Fix
CVE-2025-64505LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index6.1CNA v3.10.2%2025-11-25Fix
CVE-2025-64304Fuji Television Network "FOD" App hard-coded cryptographic key5.1CNA v4.00.1%2025-11-25
CVE-2025-64067Primakon Project Contract Management insecure direct object reference5.3CISA ADP v3.10.2%2025-11-25
CVE-2025-64066Primakon Project Contract Management missing authorization8.6CISA ADP v3.10.3%2025-11-25
CVE-2025-64065Primakon Project Contract Management improper authorization8.8CISA ADP v3.10.3%2025-11-25
CVE-2025-64064Primakon Project Contract Management privilege escalation8.8CISA ADP v3.10.3%2025-11-25
CVE-2025-64063Primakon Project Contract Management improper authorization9.8CISA ADP v3.10.4%2025-11-25
CVE-2025-64062Primakon Project Contract Management improper authorization8.8CISA ADP v3.10.3%2025-11-25
CVE-2025-64061Primakon Project Contract Management system information disclosure4.3CISA ADP v3.10.2%2025-11-25
CVE-2025-64050REDAXO CMS is vulnerable to RCE attack through its template management component7.2CISA ADP v3.10.9%2025-11-25Fix
CVE-2025-64049REDAXO CMS is vulnerable to XSS through its module management component4.8CISA ADP v3.10.3%2025-11-25Fix
CVE-2025-63735Ruckus Wireless RUCKUS Unleashed reflected cross-site scripting6.1CISA ADP v3.10.2%2025-11-25Exploit code
CVE-2025-63729SyroTech Sy-gpon-1110-wdont cleartext storage of sensitive information9.0CISA ADP v3.10.1%2025-11-25
CVE-2025-62703Fugue is vulnerable to remote code execution by Pickle deserialization via FlaskRPCServer8.8CNA v3.10.7%2025-11-25
CVE-2025-62691Intercom Security Point (Windows) of MaLion stack-based buffer overflow9.3CNA v4.00.7%2025-11-25
CVE-2025-62497Sony SNC-CX600W cross-site request forgery6.5v3.10.1%2025-11-25Fix
CVE-2025-62155QuantumNous New API has SSRF Bypass8.5CNA v3.10.3%2025-11-25Fix
CVE-2025-61168SIGB PMB deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25Fix
CVE-2025-61167SIGB PMB SQL injection6.5CISA ADP v3.10.2%2025-11-25Fix
CVE-2025-60739Ilevia Eve X1 Server Firmware cross-site request forgery9.6CISA ADP v3.10.3%2025-11-25
CVE-2025-59485Intercom Security Point (Windows) of MaLion incorrect default permissions4.8CNA v4.00.1%2025-11-25
CVE-2025-59373ASUS MyASUS restore mechanism local privilege escalation8.5CNA v4.00.1%2025-11-25Fix
CVE-2025-59372ASUS Router path traversal6.9CNA v4.00.6%2025-11-25Fix
CVE-2025-59371ASUS Router insufficient randomness7.5CNA v4.00.8%2025-11-25Fix
CVE-2025-59370ASUS Router OS command injection7.5CNA v4.01.0%2025-11-25Fix
CVE-2025-59369ASUS Router SQL injection5.9CNA v4.00.5%2025-11-25Fix
CVE-2025-59368ASUS Router integer underflow6.0CNA v4.00.4%2025-11-25Fix
CVE-2025-59366ASUS Router path traversal9.2CNA v4.015.8%2025-11-25Fix
CVE-2025-59365ASUS Router stack-based buffer overflow6.9CNA v4.00.4%2025-11-25Fix
CVE-2025-58360OSGeo GeoServer improper restriction of XML external entity reference8.2CNA v3.160.0%2025-11-25KEVNucleiEmerging ThreatsExploit codeFix
CVE-2025-51746jishenghua jshERP deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25
CVE-2025-51745jishenghua jshERP deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25
CVE-2025-51744jishenghua jshERP deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25
CVE-2025-51743jishenghua jshERP deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25
CVE-2025-51742jishenghua jshERP deserialization of untrusted data9.8CISA ADP v3.10.5%2025-11-25
CVE-2025-51741Interviewx Echo denial of service7.5CISA ADP v3.10.3%2025-11-25
CVE-2025-40890Stored cross-site scripting (XSS) in Dashboards in Guardian/CMC5.8CNA v4.00.2%2025-11-25Fix
CVE-2025-36134IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure3.7CNA v3.10.3%2025-11-25Fix
CVE-2025-34350UnForm Server Doc Flow Unauthenticated File Read8.7CNA v4.01.0%2025-11-25Fix
CVE-2025-33205NVIDIA NeMo Framework inclusion of untrusted functionality7.3CNA v3.10.2%2025-11-25Fix
CVE-2025-33204NVIDIA NeMo Framework code injection7.8CNA v3.10.2%2025-11-25Fix
CVE-2025-33203NVIDIA NeMo Agent ToolKit server-side request forgery7.6CNA v3.10.3%2025-11-25Fix
CVE-2025-33200NVIDIA DGX Spark sensitive information not cleared before reuse2.3CNA v3.10.1%2025-11-25Fix
CVE-2025-33199NVIDIA DGX Spark incorrect control flow3.2CNA v3.10.1%2025-11-25Fix
CVE-2025-33198NVIDIA DGX Spark sensitive information not cleared before reuse3.3CNA v3.10.1%2025-11-25Fix
CVE-2025-33197NVIDIA DGX Spark null pointer dereference4.3CNA v3.10.2%2025-11-25Fix
CVE-2025-33196NVIDIA DGX Spark sensitive information not cleared before reuse4.4CNA v3.10.1%2025-11-25Fix
CVE-2025-33195NVIDIA DGX Spark tampering4.4CNA v3.10.1%2025-11-25Fix
CVE-2025-33194NVIDIA DGX Spark information disclosure5.7CNA v3.10.2%2025-11-25Fix
CVE-2025-33193NVIDIA DGX Spark improper integrity check validation5.7CNA v3.10.1%2025-11-25Fix
CVE-2025-33192NVIDIA DGX Spark null pointer dereference5.7CNA v3.10.1%2025-11-25Fix
CVE-2025-33191NVIDIA DGX Spark denial of service5.7CNA v3.10.2%2025-11-25Fix
CVE-2025-33190NVIDIA DGX Spark out-of-bounds write6.7CNA v3.10.2%2025-11-25Fix
CVE-2025-33189NVIDIA DGX Spark out-of-bounds write7.8CNA v3.10.2%2025-11-25Fix
CVE-2025-33188NVIDIA DGX Spark improper privilege management8.0CNA v3.10.2%2025-11-25Fix
CVE-2025-33187NVIDIA DGX Spark improper privilege management9.3CNA v3.10.2%2025-11-25Fix
CVE-2025-21621GeoServer reflected cross-site scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format6.1CNA v3.10.3%2025-11-25Fix
CVE-2025-13644MongoDB may be susceptible to Invariant Failure due to batched delete7.1CNA v4.00.3%2025-11-25Fix
CVE-2025-13643MongoDB Server may allow queries to be terminated by unauthorized users2.3CNA v4.00.2%2025-11-25Fix
CVE-2025-13597AI Feeds WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.0%2025-11-25Exploit codeFix
CVE-2025-13595CIBELES AI WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.0%2025-11-25Exploit codeFix
CVE-2025-13559EduKart Pro WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.3%2025-11-25
CVE-2025-13558Blog2Social WordPress plugin missing authorization authenticated arbitrary post Trashing5.4CNA v3.10.3%2025-11-25Fix
CVE-2025-13507MongoDB Server time-series operations may cause internal BSON size limit to be exceed7.1CNA v4.00.3%2025-11-25Fix
CVE-2025-13502The WebKitGTK Team webkitgtk out-of-bounds read7.5CNA v3.10.6%2025-11-25Fix
CVE-2025-13483Missing authentication for critical function in SiRcom SMART Alert (SiSA)8.8CNA v4.00.4%2025-11-25
CVE-2025-13467Org.Keycloak.storage.ldap: Keycloak: Deserialization of untrusted data in LDAP user federation5.5CNA v3.10.4%2025-11-25Fix
CVE-2025-13452The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This4.3CNA v3.10.2%2025-11-25Fix
CVE-2025-13414gwendydd Chamber Dashboard Business Directory missing authorization5.3CNA v3.10.3%2025-11-25
CVE-2025-13405buywptemplates Ace Post Type Builder missing authorization5.3CNA v3.10.3%2025-11-25Fix
CVE-2025-13404docjojo atec Duplicate Page and Post missing authorization5.3CNA v3.10.3%2025-11-25Fix
CVE-2025-13389nmedia OrderConvo order lookup endpoint information disclosure5.3CNA v3.10.3%2025-11-25Fix
CVE-2025-13386Social Images Widget WordPress plugin unauthorized access5.3CNA v3.10.3%2025-11-25
CVE-2025-13385Bookme WordPress plugin authenticated (Admin+) SQL injection via filter[status] parameter4.9CNA v3.10.3%2025-11-25
CVE-2025-13383Job Board by BestWebSoft WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.3%2025-11-25Fix
CVE-2025-13382Frontend File Manager WordPress plugin insecure direct object reference4.3CNA v3.10.2%2025-11-25Fix
CVE-2025-13380AI Engine for WordPress: ChatGPT, GPT Content Generator plugin arbitrary file read6.5CNA v3.10.5%2025-11-25Exploit code
CVE-2025-13376ProjectList WordPress plugin authenticated (Editor+) arbitrary file upload7.2CNA v3.10.6%2025-11-25
CVE-2025-13370ProjectList WordPress plugin authenticated (Editor+) SQL injection via id parameter4.9CNA v3.10.3%2025-11-25
CVE-2025-13311Just Highlight WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2025-11-25
CVE-2025-13068Telegram Bot and Channel WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2025-11-25Fix
CVE-2025-12893MongoDB Server improper certificate validation2.3CNA v4.00.1%2025-11-25Fix
CVE-2025-12816node-forge has an interpretation conflict vulnerability via its ASN.1 Validator Desynchronization8.6CISA ADP v3.10.7%2025-11-25Fix
CVE-2025-12742Remote code execution in Looker via Teradata JDBC driver7.5CNA v4.00.2%2025-11-25Fix
CVE-2025-12645Inline frame Iframe WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-25
CVE-2025-12634Refund Request for WooCommerce WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-25
CVE-2025-12587Peer Publish WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-11-25
CVE-2025-12586Conditional Maintenance Mode for WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-11-25Fix
CVE-2025-12525Locker Content WordPress plugin unauthenticated information exposure5.3CNA v3.10.3%2025-11-25Fix
CVE-2025-12043Autochat Automatic Conversation WordPress plugin unauthorized access5.3CNA v3.10.3%2025-11-25
CVE-2025-12040Wishlist for WooCommerce WordPress plugin insecure direct object reference6.5CNA v3.10.2%2025-11-25Fix
CVE-2025-12032ZWeb - Social Mobile WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-11-25
CVE-2025-12025YouTube Subscribe WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2025-11-25
CVE-2025-12003ASUS Router path traversal8.2CNA v4.00.6%2025-11-25Fix
CVE-2025-10646Search Exclude missing authorization to Authenticated Search Settings Modification4.3CNA v3.10.2%2025-11-25Fix
CVE-2025-9803Improper authentication in lunary-ai/Lunary8.8NVD v3.10.5%2025-11-25Fix
CVE-2025-9624OpenSearch Nested Boolean/Disjunction asymmetric DoS7.5v3.10.5%2025-11-25Fix
CVE-2025-6389Sneeit Framework WordPress plugin remote code execution9.8CNA v3.176.1%2025-11-25Reported exploitedNucleiEmerging ThreatsExploit codeFix
CVE-2025-0248HCL iNotes is susceptible to a reflected cross-site scripting (XSS)8.1CNA v3.10.4%2025-11-25Fix
CVE-2025-65998Apache Syncope: Default AES key used for internal password encryption7.5CISA ADP v3.10.5%2025-11-24Fix
CVE-2025-65503Redboltz Async MQTT endpoint destructors use-after-free5.5NVD v3.10.2%2025-11-24
CVE-2025-65502Cesanta Mongoose add_ca_certs null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65501libcoap coap_dtls_info_callback in OISM null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65500libcoap null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65499libcoap improper array index validation4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65498libcoap null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65497libcoap null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65496libcoap null pointer dereference4.3CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-65495libcoap denial of service7.5CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-65494libcoap null pointer dereference7.5CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-65493libcoap src/coap_openssl.c in OISM null pointer dereference7.5CISA ADP v3.10.4%2025-11-24Fix
CVE-2025-64048Yccms cross-site scripting6.1CISA ADP v3.10.2%2025-11-24
CVE-2025-64047OpenRapid RapidCMS cross-site scripting6.1CISA ADP v3.10.2%2025-11-24
CVE-2025-63958Millensys Vision Tools Workspace missing authentication9.8CISA ADP v3.10.5%2025-11-24
CVE-2025-63953Magewell Ultra Encode Aio /usapi?method=add-user component cross-site request forgery6.5CISA ADP v3.10.2%2025-11-24
CVE-2025-63952Magewell Pro Convert 12G Sdi 4K Plus /mwapi?method=add-user component cross-site request forgery5.7CISA ADP v3.10.2%2025-11-24
CVE-2025-63914Cinnamon kotaemon decompression bomb6.5CISA ADP v3.10.4%2025-11-24
CVE-2025-63674Blurams A31C command injection6.8v3.10.3%2025-11-24
CVE-2025-63498Alinto SOGo cross-site scripting6.1CISA ADP v3.10.3%2025-11-24Exploit codeFix
CVE-2025-63435Xtooltech Xtool Anyscan missing authentication4.3CISA ADP v3.10.4%2025-11-24
CVE-2025-63434Xtooltech Xtool Anyscan download without integrity check8.8CISA ADP v3.10.3%2025-11-24
CVE-2025-63433Xtooltech Xtool Anyscan hard-coded credentials4.6CISA ADP v3.10.2%2025-11-24
CVE-2025-63432Xtooltech Xtool Anyscan man-in-the-middle4.6CISA ADP v3.10.2%2025-11-24
CVE-2025-60917Craws OpenAtlas reflected cross-site scripting4.6CISA ADP v3.10.2%2025-11-24
CVE-2025-60916Craws OpenAtlas reflected cross-site scripting5.4CISA ADP v3.10.2%2025-11-24
CVE-2025-60915Craws OpenAtlas path traversal8.1CISA ADP v3.10.4%2025-11-24
CVE-2025-60914Craws OpenAtlas cross-site scripting4.6CISA ADP v3.10.2%2025-11-24
CVE-2025-60638free5gc denial of service7.5CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-60633Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API6.5CISA ADP v3.10.4%2025-11-24Fix
CVE-2025-60632Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API6.5CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-56423Craws OpenAtlas observable discrepancy5.3CISA ADP v3.10.3%2025-11-24
CVE-2025-56401Ziragroup Wbrm SQL injection7.6CISA ADP v3.10.3%2025-11-24
CVE-2025-56400Tuya SmartLife OAuth implementation of the cross-site request forgery8.8CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-54563Desktopalert Pingalert Application Server Incorrect improper access control7.5CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-54347Desktopalert Pingalert Application Server path traversal9.9CISA ADP v3.10.7%2025-11-24Fix
CVE-2025-54341Desktopalert Pingalert Application Server hard-coded credentials5.3CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-54338Desktopalert Pingalert Application Server Incorrect improper access control7.5CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-52539AMD Xilinx Run Time (XRT) stack-based buffer overflow7.3CNA v3.10.1%2025-11-24
CVE-2025-52538AMD Xilinx Run Time (XRT) integer overflow8.0CNA v3.10.1%2025-11-24
CVE-2025-48511AMD μProf improper index validation5.5CNA v3.10.1%2025-11-24Fix
CVE-2025-48510Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.7.1CNA v3.10.1%2025-11-24Fix
CVE-2025-44018GL.iNet GL-AXT1800 improper certificate validation8.3CNA v3.10.3%2025-11-24
CVE-2025-41729Janitza UMG 96-PA DoS via Modbus Read command7.5CNA v3.10.4%2025-11-24Fix
CVE-2025-41087Cross-site scripting (XSS) stored in Taclia's web application5.1CNA v4.00.3%2025-11-24
CVE-2025-41017Davantis DFUSION camera perspective settings endpoint missing authorization6.9CNA v4.00.3%2025-11-24
CVE-2025-41016Davantis DFUSION alarm media endpoint missing authorization8.7CNA v4.00.3%2025-11-24
CVE-2025-40213Linux kernel Bluetooth mesh management commands vulnerability7.8CNA v3.10.1%2025-11-24Fix
CVE-2025-40212Linux kernel NFSD file handle lookup use-after-free9.8CNA v3.10.4%2025-11-24Fix
CVE-2025-36150IBM Concert information disclosure5.9CNA v3.10.2%2025-11-24Fix
CVE-2025-36112IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure5.3CNA v3.10.2%2025-11-24Fix
CVE-2025-29933AMD μProf out-of-bounds write5.5CNA v3.10.1%2025-11-24Fix
CVE-2025-13609Keylime: Keylime: Registrar allows identity takeover via duplicate uuid registration8.2CNA v3.10.4%2025-11-24Fix
CVE-2025-13596Improper error handling leading to sensitive information disclosure in CIGES2.7CNA v4.00.4%2025-11-24Fix
CVE-2025-13589Otsuka Information Technology|FMS reflected cross-site scripting5.1CNA v4.00.4%2025-11-24
CVE-2025-13588lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery5.3CNA v4.00.2%2025-11-24Fix
CVE-2025-13586SourceCodester Online Student Clearance System changepassword.php SQL injection7.2NVD v3.10.3%2025-11-24
CVE-2025-13585itsourcecode COVID Tracking System login.php SQL injection9.8NVD v3.10.4%2025-11-24
CVE-2025-13584Eigenfocus Description cross-site scripting5.1CNA v4.00.2%2025-11-24Fix
CVE-2025-13583code-projects Question Paper Generator POST parameter signupscript.php SQL injection9.8NVD v3.10.4%2025-11-24
CVE-2025-13582code-projects Jonnys Liquor GET parameter detail.php SQL injection9.8NVD v3.10.4%2025-11-24
CVE-2025-13581itsourcecode Student Information System schedule_edit1.php SQL injection8.8NVD v3.10.3%2025-11-24
CVE-2025-13580code-projects Library System mail.php SQL injection8.8NVD v3.10.3%2025-11-24
CVE-2025-13579code-projects Library System return.php SQL injection8.8NVD v3.10.3%2025-11-24
CVE-2025-13578code-projects Library System Login index.php SQL injection9.8NVD v3.10.4%2025-11-24
CVE-2025-13577PHPGurukul Hostel Management System register-complaint.php cross-site scripting5.4NVD v3.10.2%2025-11-24
CVE-2025-13576code-projects Blog Site admin.php improper authorization8.8NVD v3.10.3%2025-11-24
CVE-2025-13575code-projects Blog Site Category blog.php category_exists SQL injection8.8NVD v3.10.3%2025-11-24
CVE-2025-13574code-projects Online Bidding System addcategory.php categoryadd unrestricted upload7.2NVD v3.10.4%2025-11-24
CVE-2025-13573Projectworlds can pass malicious payloads add_book.php unrestricted upload8.8NVD v3.10.3%2025-11-24
CVE-2025-13466body-parser vulnerable to denial of service when URL encoding is used5.5CNA v4.00.4%2025-11-24Fix
CVE-2025-12978Fluent Bit input plugins tag key matching vulnerability5.4CISA ADP v3.10.4%2025-11-24Fix
CVE-2025-12977Fluent Bit input plugins tag key handling improper input validation9.1CISA ADP v3.10.7%2025-11-24Fix
CVE-2025-12972Fluent Bit out_file output plugin path traversal5.3CISA ADP v3.10.9%2025-11-24Fix
CVE-2025-12970Fluent Bit in_docker input plugin buffer overflow8.8CISA ADP v3.11.0%2025-11-24Fix
CVE-2025-12969Fluent Bit in_forward input plugin missing authentication6.5CISA ADP v3.10.6%2025-11-24Fix
CVE-2025-12741Arbitrary file write in Denodo dialect of Looker allows remote code execution7.7CNA v4.00.2%2025-11-24Fix
CVE-2025-12740Remote command execution in Looker via IBM DB2 JDBC drive7.7CNA v4.00.2%2025-11-24Fix
CVE-2025-12739Cross-site scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise7.3CNA v4.00.3%2025-11-24Fix
CVE-2025-12629Broken Link Manager WordPress plugin reflected XSS7.1CISA ADP v3.10.2%2025-11-24
CVE-2025-12628WP 2FA WordPress plugin Second Factor bypass6.3CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-12569WP Front User Submit WordPress plugin open redirect4.7CISA ADP v3.10.2%2025-11-24Fix
CVE-2025-12394Backup Migration WordPress plugin unauthenticated Backup download5.9CISA ADP v3.10.3%2025-11-24Fix
CVE-2025-11921Bjango iStats iStat Menus local privilege escalation8.5CNA v4.00.6%2025-11-24Fix
CVE-2025-10555Dassault Systèmes DELMIA Service Process Engineer stored cross-site scripting8.7CNA v3.10.2%2025-11-24
CVE-2025-10554Dassault Systèmes ENOVIA Product Manager Requirements stored cross-site scripting8.7CNA v3.10.2%2025-11-24Fix
CVE-2025-10144Perfect Brands for WooCommerce WordPress plugin authenticated (Contributor+) SQL injection6.5CNA v3.10.3%2025-11-24Fix
CVE-2025-7402Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager unauthenticated SQL injection7.5CNA v3.10.3%2025-11-24
CVE-2025-0007AMD Xilinx Run Time (XRT) privilege escalation5.7CNA v3.10.1%2025-11-24
CVE-2025-0005AMD Xilinx Run Time (XRT) integer overflow7.3CNA v3.10.1%2025-11-24
CVE-2025-0003AMD Xilinx Run Time (XRT) use-after-free7.3CNA v3.10.2%2025-11-24
CVE-2025-54515AMD Versal Adaptive SoC Devices improper quantity validation1.0CNA v4.00.1%2025-11-23
CVE-2025-48507AMD Kria™ SOM improper quantity validation8.6CNA v4.00.2%2025-11-23Exploit code
CVE-2025-13572Projectworlds Advanced Library Management System delete_admin.php SQL injection9.8NVD v3.10.4%2025-11-23
CVE-2025-13571code-projects Simple Food Ordering System listorder.php SQL injection8.8NVD v3.10.3%2025-11-23
CVE-2025-13570itsourcecode COVID Tracking System page SQL injection8.8NVD v3.10.3%2025-11-23
CVE-2025-13569itsourcecode COVID Tracking System page SQL injection8.8NVD v3.10.3%2025-11-23
CVE-2025-13568itsourcecode COVID Tracking System page SQL injection8.8NVD v3.10.3%2025-11-23
CVE-2025-13567itsourcecode COVID Tracking System page SQL injection8.8NVD v3.10.3%2025-11-23
CVE-2025-13566jarun nnn nnn.c run_cmd_as_plugin double free4.8CNA v4.00.1%2025-11-23
CVE-2025-13565SourceCodester Inventory Management System resetPassword.php password recovery9.1NVD v3.10.5%2025-11-23
CVE-2025-13564SourceCodester Pre-School Management System FilehelperController.php removefile denial of service7.1NVD v3.10.4%2025-11-23
CVE-2025-13562D-Link DIR-852 gena.cgi command injection9.8NVD v3.16.2%2025-11-23Emerging Threats
CVE-2025-13561SourceCodester Company Website CMS index.php SQL injection9.8NVD v3.10.4%2025-11-23
CVE-2025-13560SourceCodester Company Website CMS reset-password.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13557Campcodes Online Polling System registeracc.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13556Campcodes Online Polling System checklogin.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13555Campcodes School File Management System Login index.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13554Campcodes Supplier Management System Login index.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13553D-Link DWR-M920 formPinManageSetup sub_41C7FC buffer overflow8.7CNA v4.00.7%2025-11-23Fix
CVE-2025-13552D-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflow8.7CNA v4.00.8%2025-11-23Fix
CVE-2025-13551D-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflow8.7CNA v4.00.8%2025-11-23Fix
CVE-2025-13550D-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflow8.7CNA v4.00.8%2025-11-23Fix
CVE-2025-13549D-Link DIR-822K formNtp sub_455524 buffer overflow8.7CNA v4.00.7%2025-11-23Fix
CVE-2025-13548D-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflow8.7CNA v4.00.8%2025-11-23Fix
CVE-2025-13547D-Link DIR-822K/DWR-M920 formDdns memory corruption8.7CNA v4.00.7%2025-11-23Fix
CVE-2025-13546ashraf-kabir travel-agency Search results.php SQL injection9.8v3.10.4%2025-11-23
CVE-2025-13545ashraf-kabir travel-agency index.php SQL injection7.2v3.10.4%2025-11-23
CVE-2025-13544ashraf-kabir travel-agency customer_register.php unrestricted upload9.8v3.10.4%2025-11-23
CVE-2025-12800WP Shortcodes Plugin Shortcodes Ultimate WordPress plugin server-side request forgery6.4CNA v3.10.2%2025-11-23Fix
CVE-2025-13526OneClick Chat to Order WordPress plugin insecure direct object reference7.5CNA v3.10.4%2025-11-22Fix
CVE-2025-13384CP Contact Form with PayPal WordPress plugin missing authorization7.5CNA v3.10.4%2025-11-22Fix
CVE-2025-13318Booking Calendar Contact Form WordPress plugin missing authorization5.3CNA v3.10.3%2025-11-22Fix
CVE-2025-13317Appointment Booking Calendar WordPress plugin missing authorization arbitrary Booking Confirmation5.3CNA v3.10.3%2025-11-22Fix
CVE-2025-13136GSheetConnector For Ninja Forms WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-22Fix
CVE-2025-12889wolfSSL TLS 1.2 client can Downgrade Digest Used2.3CNA v4.00.1%2025-11-22Fix
CVE-2025-12877IDonate WordPress plugin unauthorized access5.3CNA v3.10.3%2025-11-22Fix
CVE-2025-12752Subscriptions and Memberships for PayPal WordPress plugin unauthenticated Fake Payment creation5.3CNA v3.10.2%2025-11-22Fix
CVE-2025-11186Cookie Notice and Compliance for GDPR / CCPA WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-22Fix
CVE-2025-66115Easy Invoice WordPress plugin local file inclusion6.6CNA v3.10.4%2025-11-21Fix
CVE-2025-66114Show Variations as Single Products Woocommerce WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66113Better Chat Support for Messenger WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66112Accessibility Toolkit by WebYes WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66111Nelio Popups WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66110Tiktok Feed WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66109Cart Weight for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66108TNC Toolbox: Web Performance WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66107Subscriptions and Memberships for PayPal WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66106Featured Post Creative WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66101CBX Bookmark and Favorite WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66099Chat Help WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66098Travelers' Map WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66097I Order Terms WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-11-21Fix
CVE-2025-66096Table Block by Tableberg WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66095KiviCare WordPress plugin SQL injection8.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66093Extensions for Leaflet Map WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66092Accordion Slider WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66091Stylish Cost Calculator WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66090SKT Skill Bar WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66089Product Feed for WooCommerce WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66087PropertyHive WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66086SMS Alert Order Notifications WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66085Arconix Shortcodes WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66084FluentCommunity WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66083WpEvently WordPress plugin broken access control5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66082WpEvently WordPress plugin broken access control5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66081Head Meta Data WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-11-21Fix
CVE-2025-66079Gutenverse Form WordPress plugin broken access control6.5CNA v3.10.3%2025-11-21Fix
CVE-2025-66077Legal Pages WordPress plugin broken access control5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66075WP Cookie Notice for GDPR, CCPA and ePrivacy Consent WordPress plugin broken access control4.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66073WP Webhooks WordPress plugin PHP object injection7.2CNA v3.10.4%2025-11-21Fix
CVE-2025-66072UsersWP WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66071Custom Order Numbers for WooCommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66069PPOM for WooCommerce WordPress plugin broken access control4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66067Funnel Builder by FunnelKit WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66066Envo Extra WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66065Gutenverse WordPress plugin broken access control6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66064Giveaways and Contests by RafflePress WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-11-21Fix
CVE-2025-66063WP Google Review Slider WordPress plugin broken access control5.4CNA v3.10.2%2025-11-21Fix
CVE-2025-66062WP YouTube Lyte WordPress plugin open redirection3.4CNA v3.10.2%2025-11-21Fix
CVE-2025-66061Seriously Simple Podcasting WordPress plugin cross-site request forgery (CSRF)4.3v3.10.1%2025-11-21Fix
CVE-2025-66060Seriously Simple Podcasting WordPress plugin broken access control5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-66059Seriously Simple Podcasting WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66057Bold Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-66056Uncanny Automator WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-11-21Fix
CVE-2025-66055Email Subscribers and Newsletters WordPress plugin PHP object injection7.2CNA v3.10.4%2025-11-21Fix
CVE-2025-66053Enfold WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-65947thread-amount is vulnerable to resource exhaustion (Memory and Handle leaks) on Windows and macOS8.7CNA v4.00.3%2025-11-21Fix
CVE-2025-65946RooCodeInc Roo-Code roo Code is vulnerable to potential remote code execution8.1CNA v3.10.7%2025-11-21Fix
CVE-2025-65111authzed SpiceDB LookupResources API insecure inherited permissions2.9CNA v4.00.2%2025-11-21Fix
CVE-2025-65109Minder does not sandbox http.send in Rego programs8.5CNA v4.00.3%2025-11-21Fix
CVE-2025-65108md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter10.0CNA v3.10.9%2025-11-21Fix
CVE-2025-65107Langfuse SSO account takeover via CSRF or phishing attack6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-65106LangChain vulnerable to template injection via Attribute Access in Prompt templates8.3CNA v4.00.5%2025-11-21Fix
CVE-2025-65102PJSIP is vulnerable to buffer overflow in Opus PLC8.7CNA v4.00.3%2025-11-21Fix
CVE-2025-65092espressif esp-idf ESP32-P4 JPEG Decoder Header Parsing vulnerability6.9CNA v4.00.4%2025-11-21
CVE-2025-64767hpke-js reuses AEAD nonces9.1CNA v3.10.2%2025-11-21Fix
CVE-2025-64762authkit-nextjs may let session cookies be cached in CDNs8.0CNA v4.00.4%2025-11-21Fix
CVE-2025-64755@anthropic-ai/claude-code has Sed Command Validation Bypass that allows arbitrary File Writes8.7CNA v4.00.6%2025-11-21Fix
CVE-2025-64751OpenFGA Improper Policy Enforcement5.8CNA v4.00.3%2025-11-21Fix
CVE-2025-64695LogStare Installer of LogStare Collector uncontrolled search path8.4CNA v4.00.2%2025-11-21Fix
CVE-2025-64483Wazuh API Agent Configuration has improper access control in Agent Enrollment endpoint5.3CNA v4.00.3%2025-11-21Fix
CVE-2025-64310SEIKO EPSON Epson Web Control for SEIKO EPSON Projector Products missing brute-force protection9.3CNA v4.00.5%2025-11-21
CVE-2025-64299LogStare Collector information disclosure2.7NVD v3.10.3%2025-11-21Fix
CVE-2025-64169Wazuh null pointer dereference in fim_alert line 6665.1CNA v4.00.4%2025-11-21Fix
CVE-2025-62687LogStare Collector cross-site request forgery6.9CNA v4.00.1%2025-11-21Fix
CVE-2025-62626AMD Ryzen™ 9000HX Series Processors Improper handling of insufficient entropy7.2CNA v4.00.2%2025-11-21Fix
CVE-2025-62609MLX has Wild Pointer Dereference in load_gguf5.5CNA v4.00.4%2025-11-21Fix
CVE-2025-62608ml-explore MLX NumPy file loader heap-based buffer overflow5.5CNA v4.00.5%2025-11-21Fix
CVE-2025-62426vLLM vulnerable to DoS6.5CNA v3.10.4%2025-11-21Fix
CVE-2025-62372vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs8.3CNA v4.00.4%2025-11-21Fix
CVE-2025-62189LogStare Collector incorrect authorization5.3CNA v4.00.2%2025-11-21Fix
CVE-2025-62164vLLM deserialization vulnerability leading to DoS and potential RCE8.8CNA v3.10.9%2025-11-21Fix
CVE-2025-61949LogStare Collector cross-site scripting4.8CNA v4.00.2%2025-11-21Fix
CVE-2025-58097LogStare Collector incorrect default permissions7.8v3.10.1%2025-11-21Fix
CVE-2025-54866Wazuh installation fails to protected authd.pass on Windows1.8CNA v4.00.2%2025-11-21Fix
CVE-2025-48502AMD μProf improper index validation5.5CNA v3.10.1%2025-11-21Fix
CVE-2025-43374Apple iPadOS stack-based buffer overflow4.3CISA ADP v3.10.2%2025-11-21Fix
CVE-2025-41115Grafana Enterprise incorrect privilege assignment10.0CNA v3.116.9%2025-11-21Emerging ThreatsExploit codeFix
CVE-2025-40211Linux kernel ACPI video backlight switching use-after-free–0.2%2025-11-21Fix
CVE-2025-40210Linux kernel NFSv4 COMPOUND processing denial of service7.5CNA v3.10.3%2025-11-21Fix
CVE-2025-40209Linux kernel btrfs qgroup relation handling memory leak–0.2%2025-11-21Fix
CVE-2025-36149IBM Concert Software clickjacking6.3CNA v3.10.2%2025-11-21Fix
CVE-2025-31266Apple Safari UI misrepresentation4.3CISA ADP v3.10.2%2025-11-21Fix
CVE-2025-31248Apple macOS path traversal5.5CISA ADP v3.10.2%2025-11-21Fix
CVE-2025-31216Apple iPadOS improper access control2.4CISA ADP v3.10.2%2025-11-21Fix
CVE-2025-30201Wazuh NetNTLMv2 Hash Theft in multiple Centralized Configuration Capabilities7.7CNA v3.10.8%2025-11-21Fix
CVE-2025-29934AMD EPYC™ 9004 Series Processors incomplete cleanup5.3CNA v3.10.1%2025-11-21
CVE-2025-13524AWS Wickr call termination process improper resource release6.8CNA v4.00.2%2025-11-21Fix
CVE-2025-13499Access of uninitialized pointer in Wireshark7.8CNA v3.10.1%2025-11-21Fix
CVE-2025-13485itsourcecode Online File Management System ajax.php SQL injection9.8NVD v3.10.4%2025-11-21
CVE-2025-13470RNP Vulnerable PKESK session keys7.7CNA v4.00.3%2025-11-21Fix
CVE-2025-13432HashiCorp Terraform Enterprise state versions incorrect authorization4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-13357Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth method7.4CNA v3.10.5%2025-11-21Fix
CVE-2025-13322WP AUDIO GALLERY WordPress plugin arbitrary file deletion8.1CNA v3.10.6%2025-11-21
CVE-2025-13159Flo Forms WordPress plugin stored cross-site scripting7.1CNA v3.10.3%2025-11-21
CVE-2025-13156appsbd Vitepos category image unrestricted file upload8.8CNA v3.10.7%2025-11-21Fix
CVE-2025-13149Schedule Post Changes With PublishPress Future: Unpublish WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-13142Custom Post Type WordPress plugin cross-site request forgery to Custom post type deletion4.3CNA v3.10.1%2025-11-21
CVE-2025-13141HT Mega Absolute Addons For Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21Fix
CVE-2025-13138WP Directory Kit WordPress plugin unauthenticated SQL injection via select_2_ajax function7.5CNA v3.11.5%2025-11-21NucleiFix
CVE-2025-13135HotelRunner Booking Widget WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-13134AuthorSure WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.1%2025-11-21
CVE-2025-13132Dia: Increased Spoof Risk; Missing full screen toast7.4CNA v3.10.2%2025-11-21Fix
CVE-2025-12973S2B AI Assistant file upload function unrestricted file upload7.2CNA v3.10.9%2025-11-21Exploit codeFix
CVE-2025-12964Magical Products Display WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21Fix
CVE-2025-12935FluentCRM - Marketing Automation For WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-11-21Fix
CVE-2025-12894Import WP WordPress plugin information disclosure5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-12888wolfSSL Constant Time issue with Xtensa-based ESP32 and X225191.0CNA v4.00.3%2025-11-21Fix
CVE-2025-12881WP Swings Return Refund and Exchange for WooCommerce order messages insecure direct object reference5.4CNA v3.10.2%2025-11-21Fix
CVE-2025-12750Groundhogg WordPress plugin authenticated (Admin+) SQL injection4.9CNA v3.10.3%2025-11-21Fix
CVE-2025-12747Tainacan WordPress plugin unauthenticated information exposure5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-12746Tainacan WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2025-11-21Fix
CVE-2025-12661Pollcaster Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-12660Padlet Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-12170Checkbox WordPress plugin missing authorization to unauthenticated Log Clearing5.3CNA v3.10.2%2025-11-21Fix
CVE-2025-12169ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-12160Simple User Registration WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2025-11-21Fix
CVE-2025-12138URL Image Importer WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.10.7%2025-11-21Fix
CVE-2025-12135WPBookit WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2025-11-21Exploit codeFix
CVE-2025-12086WP Swings Return Refund and Exchange For WooCommerce insecure direct object reference4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-12085ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-12066WP Delete Post Copies WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-11-21Fix
CVE-2025-12039BigBuy Dropshipping Connector for WooCommerce WordPress plugin spoofing5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-12023ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-12022ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-11985Realty Portal WordPress plugin missing authorization authenticated arbitrary options update8.8CNA v3.10.4%2025-11-21
CVE-2025-11973简数采集器 WordPress plugin authenticated (Admin+) arbitrary file read4.9CNA v3.10.3%2025-11-21Fix
CVE-2025-11936wolfSSL potential DoS vulnerability6.3CNA v4.00.4%2025-11-21Fix
CVE-2025-11935Forward Secrecy Violation in WolfSSL TLS 1.36.3CNA v4.00.2%2025-11-21Fix
CVE-2025-11934wolfSSL improper validation of Signature Algorithm Used in TLS 1.3 CertificateVerify2.1CNA v4.00.2%2025-11-21Fix
CVE-2025-11933DoS vulnerability in wolfSSL TLS 1.3 CKS extension2.3CNA v4.00.4%2025-11-21Fix
CVE-2025-11932wolfSSL timing side-channel in PSK Binder Verification2.3CNA v4.00.3%2025-11-21Fix
CVE-2025-11931wolfSSL integer underflow leads to out-of-bounds access in XChaCha20-Poly1305 Decrypt2.1CNA v4.00.3%2025-11-21Fix
CVE-2025-11885EchBay Admin Security WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-11-21Fix
CVE-2025-11826WP Company Info WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11815UiPress lite WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-11808Shortcode for Google Street View WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11803WPSite Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11802Bulma Shortcodes WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11801AudioTube WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11800Surbma MiniCRM Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21Fix
CVE-2025-11799Affiliate AI Lite WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21Fix
CVE-2025-11773Cryptocurrency (Token) WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-21Fix
CVE-2025-11771Cryptocurrency (Token) WordPress plugin unauthorized access5.3CNA v3.10.3%2025-11-21Fix
CVE-2025-11770BrightTALK WordPress Shortcode plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11768Islamic Phrases WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11767Tips Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11765Stock Tools WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11764Shortcodes Bootstrap WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11763Display Pages Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-11-21
CVE-2025-11456ELEX WordPress HelpDesk and Customer Ticketing System plugin unauthenticated arbitrary file upload9.8CNA v3.10.7%2025-11-21Fix
CVE-2025-11368LearnPress WordPress plugin information disclosure5.3CNA v3.11.0%2025-11-21NucleiFix
CVE-2025-11127Mstoreapp Mobile App login AJAX action privilege escalation9.8CISA ADP v3.10.3%2025-11-21
CVE-2025-11087Zegen Core WordPress plugin cross-site request forgery to arbitrary file upload8.8CNA v3.10.2%2025-11-21Fix
CVE-2025-11003UiPress lite WordPress plugin missing authorization authenticated stored cross-site scripting6.4CNA v3.10.2%2025-11-21Fix
CVE-2025-10938UiPress lite WordPress plugin missing authorization authenticated sensitive information exposure6.5CNA v3.10.2%2025-11-21Fix
CVE-2025-10054ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin unauthorized access4.3NVD v3.10.3%2025-11-21Fix
CVE-2025-10039ELEX WordPress HelpDesk and Customer Ticketing System plugin insecure direct object reference4.3CNA v3.10.3%2025-11-21Fix
CVE-2025-9825Missing authorization in GitLab5.0CNA v3.10.4%2025-11-21Fix
CVE-2025-0504Black Duck SCA Project privilege escalation5.3CNA v4.00.2%2025-11-21Fix
CVE-2025-65226Tenda AC21 buffer overflow4.3CISA ADP v3.10.2%2025-11-20
CVE-2025-65223Tenda AC21 stack-based buffer overflow4.3CISA ADP v3.10.3%2025-11-20Emerging Threats
CVE-2025-65222Tenda AC21 stack-based buffer overflow4.3CISA ADP v3.12.4%2025-11-20Emerging Threats
CVE-2025-65221Tenda AC21 stack-based buffer overflow4.3CISA ADP v3.10.3%2025-11-20Emerging Threats
CVE-2025-65220Tenda AC21 stack-based buffer overflow4.3CISA ADP v3.10.2%2025-11-20Emerging Threats
CVE-2025-64984Kaspersky Endpoint Security cross-site scripting5.1CNA v4.00.2%2025-11-20Fix
CVE-2025-64770iCam365 P201 missing authentication for ONVIF in iCam Cameras7.0CNA v4.00.2%2025-11-20
CVE-2025-64660Microsoft GitHub Copilot and Visual Studio Code remote code execution8.0CNA v3.10.6%2025-11-20Fix
CVE-2025-64655Microsoft Dynamics OmniChannel SDK Storage Containers elevation of privilege8.8CNA v3.10.5%2025-11-20Fix
CVE-2025-64524OpenPrinting cups-filters rastertopclx filter heap-based buffer overflow3.3CNA v3.10.2%2025-11-20Fix
CVE-2025-64428dataease injection8.9CNA v4.00.6%2025-11-20Fix
CVE-2025-64185Open OnDemand RPM packages create world writable locations6.9CNA v4.00.3%2025-11-20Fix
CVE-2025-64027Snipe-IT has cross-site scripting vulnerability in CSV import workflow6.1CISA ADP v3.10.3%2025-11-20
CVE-2025-63889ThinkPHP out-of-bounds read7.5CISA ADP v3.10.3%2025-11-20
CVE-2025-63888ThinkPHP remote file inclusion9.8CISA ADP v3.10.6%2025-11-20Exploit code
CVE-2025-63848Swi-prolog Swish stored cross-site scripting6.1CISA ADP v3.10.2%2025-11-20Exploit code
CVE-2025-638072dogz Blogin weak authentication9.8CISA ADP v3.10.5%2025-11-20
CVE-2025-63685Quark Cloud Drive DLL hijacking9.8CISA ADP v3.10.4%2025-11-20
CVE-2025-62875Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock6.9CNA v4.00.2%2025-11-20Fix
CVE-2025-62731Stored XSS in SOPlanning4.8v3.10.2%2025-11-20Fix
CVE-2025-62730Privilege escalation via incorrect authorization in SOPlanning8.8v3.10.3%2025-11-20Fix
CVE-2025-62729Stored XSS in SOPlanning5.4v3.10.2%2025-11-20Fix
CVE-2025-62724Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)4.3CNA v3.10.2%2025-11-20Fix
CVE-2025-62709ClipBucket v5 is vulnerable to password reset link manipulation6.8CNA v3.10.4%2025-11-20Fix
CVE-2025-62674iCam365 P201 missing authentication for RTSP in iCam Cameras7.0CNA v4.00.2%2025-11-20
CVE-2025-62459Microsoft Defender Portal spoofing8.3CNA v3.10.3%2025-11-20Fix
CVE-2025-62346HCL Glovius Cloud is susceptible to a cross-site request forgery (CSRF)6.8CNA v3.10.1%2025-11-20
CVE-2025-62297Stored XSS in SOPlanning5.4v3.10.2%2025-11-20Fix
CVE-2025-62296Stored XSS in SOPlanning5.4v3.10.2%2025-11-20Fix
CVE-2025-62295Stored XSS in SOPlanning5.4v3.10.2%2025-11-20Fix
CVE-2025-62294SOPlanning Predictable Generation of Password Recovery Token7.5v3.10.3%2025-11-20Fix
CVE-2025-62293Broken access control in SOPlanning5.4v3.10.2%2025-11-20Fix
CVE-2025-62207Microsoft Azure Monitor elevation of privilege8.6CNA v3.10.7%2025-11-20Fix
CVE-2025-61138Qlik Sense sensitive information in an accessible file7.5CISA ADP v3.10.3%2025-11-20
CVE-2025-60799phppgadmin contains an incorrect access control vulnerability6.1CISA ADP v3.10.2%2025-11-20
CVE-2025-60798phppgadmin contains a SQL injection6.5CISA ADP v3.10.3%2025-11-20
CVE-2025-60797phppgadmin contains a SQL injection6.5CISA ADP v3.10.3%2025-11-20
CVE-2025-60796phppgadmin vulnerable to cross-site scripting6.1CISA ADP v3.10.2%2025-11-20
CVE-2025-60794@Perfood/couch-auth may expose session tokens, passwords6.5CISA ADP v3.10.2%2025-11-20
CVE-2025-60738Ilevia Eve X1 Server Firmware OS command injection9.8CISA ADP v3.11.0%2025-11-20Emerging Threats
CVE-2025-60737Ilevia Eve X1 Server Firmware cross-site scripting6.1CISA ADP v3.10.3%2025-11-20
CVE-2025-59245Microsoft SharePoint Online elevation of privilege9.8CNA v3.11.1%2025-11-20Fix
CVE-2025-55128Revive Adserver resource exhaustion6.5CNA v3.00.4%2025-11-20Fix
CVE-2025-55127Revive Adserver improper neutralization5.4CISA ADP v3.10.2%2025-11-20Fix
CVE-2025-55126Revive Adserver cross-site scripting6.5CNA v3.00.2%2025-11-20Fix
CVE-2025-55124Revive Adserver improper neutralization6.1CNA v3.00.4%2025-11-20Fix
CVE-2025-55123Revive Adserver improper neutralization5.4v3.10.5%2025-11-20Fix
CVE-2025-52671Revive Adserver SQL error message to information disclosure4.3CNA v3.00.4%2025-11-20Fix
CVE-2025-52670Revive Adserver missing authorization6.5NVD v3.10.3%2025-11-20Fix
CVE-2025-52669Revive Adserver information disclosure4.3CNA v3.00.3%2025-11-20Fix
CVE-2025-52668Revive Adserver cross-site scripting5.4NVD v3.10.5%2025-11-20Fix
CVE-2025-52667Revive Adserver cross-site scripting5.4v3.10.4%2025-11-20Fix
CVE-2025-52666Revive Adserver settings improper neutralization2.7CNA v3.00.4%2025-11-20Fix
CVE-2025-52410Vishalmathur Institute-of-current-students SQL injection9.8CISA ADP v3.10.3%2025-11-20
CVE-2025-49752Microsoft Azure Bastion elevation of privilege10.0CNA v3.10.9%2025-11-20Fix
CVE-2025-48987Revive Adserver improper neutralization6.1v3.10.5%2025-11-20Fix
CVE-2025-48986Revive Adserver authorization bypass8.8CNA v3.00.6%2025-11-20Fix
CVE-2025-41076LimeSurvey session handling information disclosure6.5v3.10.3%2025-11-20Fix
CVE-2025-41075LimeSurvey opt-in endpoint denial of service7.5v3.10.3%2025-11-20Fix
CVE-2025-41074LimeSurvey opt-out endpoint denial of service7.5v3.10.3%2025-11-20Fix
CVE-2025-40605SonicWall Email Security relative path traversal5.3CISA ADP v3.10.3%2025-11-20Fix
CVE-2025-40604SonicWall Email Security download without integrity check9.8v3.10.2%2025-11-20Fix
CVE-2025-40601SonicWall SonicOS stack-based buffer overflow7.5CISA ADP v3.11.2%2025-11-20Fix
CVE-2025-36161IBM Concert software information disclosure5.9CNA v3.10.2%2025-11-20Fix
CVE-2025-36160IBM Concert information disclosure5.3CNA v3.10.3%2025-11-20Fix
CVE-2025-36159IBM Concert Improper Log Neutralization6.2CNA v3.10.1%2025-11-20Fix
CVE-2025-36158IBM Concert information disclosure5.1CNA v3.10.1%2025-11-20Fix
CVE-2025-36153IBM Concert cross-site scripting6.1CNA v3.10.2%2025-11-20Fix
CVE-2025-36072IBM webMethods Integration deserialization8.8CNA v3.10.5%2025-11-20Fix
CVE-2025-35029Medical Informatics Engineering Enterprise Health stored cross-site scripting5.4v3.10.2%2025-11-20Fix
CVE-2025-34320BASIS BBj unauthenticated arbitrary file read RCE9.3CNA v4.00.8%2025-11-20Fix
CVE-2025-25613Fs S3150-8t2f cleartext storage of sensitive information7.5CISA ADP v3.10.2%2025-11-20
CVE-2025-13484Campcodes Complete Online Beauty Parlor Management System customer-list.php cross-site scripting6.1v3.10.2%2025-11-20
CVE-2025-13469Public Knowledge Project omp/ojs Payment Instructions setting paymentForm.tpl cross-site scripting4.8CNA v4.00.3%2025-11-20
CVE-2025-13468SourceCodester Alumni Management System Delete admin_class.php delete_event authorization8.1v3.10.4%2025-11-20
CVE-2025-13451SourceCodester Online Shop Project action.php SQL injection9.8v3.10.4%2025-11-20
CVE-2025-13450SourceCodester Online Shop Project register.php cross-site scripting5.4v3.10.2%2025-11-20
CVE-2025-13449code-projects Online Shop Project login.php SQL injection9.8v3.10.4%2025-11-20
CVE-2025-13446Tenda AC21 SetSysTimeCfg stack-based overflow9.8v3.13.9%2025-11-20
CVE-2025-13445Tenda AC21 SetIpMacBind stack-based overflow9.8v3.13.9%2025-11-20
CVE-2025-13443macrozheng mall delete access control6.5v3.10.2%2025-11-20
CVE-2025-13442UTT 进取 750W formPdbUpConfig system command injection9.8v3.119.5%2025-11-20Emerging Threats
CVE-2025-13437Arbitrary node_modules Directory Deletion in Google zx5.6CNA v4.00.1%2025-11-20Fix
CVE-2025-13435Dreampie Resty HttpClient HttpClient.java request path traversal8.1v3.10.7%2025-11-20
CVE-2025-13434jameschz Hush Framework HTTP host Header Util.php HTTP headers for scripting syntax7.5v3.10.5%2025-11-20
CVE-2025-13433Muse Group MuseHub Windows Service Muse.Updater.exe unquoted search path7.3CNA v4.00.1%2025-11-20
CVE-2025-13425Google denial of service in OSV-SCALIBR1.9CNA v4.00.1%2025-11-20Exploit codeFix
CVE-2025-13424Campcodes Supplier Management System add_product.php SQL injection9.8v3.10.4%2025-11-20
CVE-2025-13423Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload7.2v3.10.3%2025-11-20
CVE-2025-13422freeprojectscodes Sports Club Management System change_s_pwd.php SQL injection9.8v3.10.4%2025-11-20
CVE-2025-13087Command injection in Opto22 Groov REST API7.5CNA v4.07.0%2025-11-20Emerging ThreatsFix
CVE-2025-12778Ultimate Member Widgets for Elementor WordPress plugin unauthorized access5.3CNA v3.10.2%2025-11-20Fix
CVE-2025-12502Attention Bar SQL injection6.8CISA ADP v3.10.3%2025-11-20
CVE-2025-12414Looker account compromise via punycode homograph attack9.2CNA v4.00.5%2025-11-20Fix
CVE-2025-12121Lite XL system.exec function OS command injection7.3CISA ADP v3.10.4%2025-11-20
CVE-2025-12120Lite XL project file loader code injection7.3CISA ADP v3.10.3%2025-11-20
CVE-2025-11676UPnP DOS in TL-WR940N V67.1CNA v4.00.2%2025-11-20Fix
CVE-2025-10571ABB Ability Edgenius authentication bypass9.4CNA v4.00.3%2025-11-20Fix
CVE-2025-5092LightGallery WP WordPress plugin cross-site scripting6.4CNA v3.10.2%2025-11-20Fix
CVE-2025-0645Arbitrary file upload in Narkom Communication Technologies' Pyxis Signage7.2CNA v3.10.4%2025-11-20
CVE-2025-0643XSS in Narkom Communication Technologies' Pyxis Signage7.2CNA v3.10.4%2025-11-20
CVE-2025-65103OpenSTAManager has an authenticated SQL injection vulnerability in API via display parameter8.8CNA v3.10.3%2025-11-19Fix
CVE-2025-65100ilbers isar Security Snapshot may Use Unintended Timestamp when Only ISAR_APT_SNAPSHOT_DATE is Set6.9CNA v4.00.3%2025-11-19
CVE-2025-65099anthropics claude-code claude Code vulnerable to command execution prior to startup trust dialog7.7CNA v4.00.5%2025-11-19Fix
CVE-2025-65095Lookyloo is vulnerable due to improper user input sanitization9.4CNA v4.00.4%2025-11-19Fix
CVE-2025-65094WBCE CMS is vulnerable to privilege escalation via Group ID Manipulation (IDOR)8.7CNA v4.00.4%2025-11-19Exploit codeFix
CVE-2025-65089XWiki view file macro: User can view content of office file without view rights on the attachment6.8CNA v3.10.3%2025-11-19Fix
CVE-2025-65034Rallly improper authorization allows Reopening of any Finalized Poll via Public pollId8.1CNA v3.10.3%2025-11-19Fix
CVE-2025-65033Rallly Broken Authorization: Any User can Pause or Resume any Poll via Poll ID Manipulation8.1CNA v3.10.3%2025-11-19Fix
CVE-2025-65032lukevella Rallly participant rename function insecure direct object reference6.5CNA v3.10.3%2025-11-19Fix
CVE-2025-65031Rallly improper authorization in Comment endpoint allows User Impersonation6.5CNA v3.10.3%2025-11-19Fix
CVE-2025-65030Rallly improper authorization in Comment Deletion endpoint allows Unauthorized Comment Removal7.1CNA v3.10.3%2025-11-19Fix
CVE-2025-65029lukevella Rallly participant deletion endpoint insecure direct object reference8.1CNA v3.10.3%2025-11-19Fix
CVE-2025-65028Rallly vote update endpoint insecure direct object reference6.5CNA v3.10.3%2025-11-19Fix
CVE-2025-65026Esm.sh CDN service has JS Template Literal injection in CSS-to-JavaScript6.1CNA v3.10.5%2025-11-19Fix
CVE-2025-65025Esm.sh CDN service has arbitrary file write via tarslip8.2CNA v3.10.5%2025-11-19Fix
CVE-2025-65024i-Educar Authenticated Time-based SQL injection in `agenda_admin_cad.php`7.2CNA v3.10.4%2025-11-19
CVE-2025-65023i-Educar Authenticated Time-based SQL injection in `funcionario_vinculo_cad.php`7.2CNA v3.10.4%2025-11-19
CVE-2025-65022i-Educar Authenticated Time-based SQL injection in `agenda.php`7.2CNA v3.10.3%2025-11-19
CVE-2025-65021Rallly has Unauthorized Poll Finalization via insecure direct object reference (IDOR)9.1CNA v3.10.4%2025-11-19Fix
CVE-2025-65020Rallly has Unauthorized Poll Duplication via insecure direct object reference (IDOR)6.5CNA v3.10.2%2025-11-19Fix
CVE-2025-65019Astro Cloudflare adapter has a stored cross-site scripting vulnerability in /_image endpoint5.4CNA v3.10.3%2025-11-19Fix
CVE-2025-64765Astro middleware authentication checks based on url.pathname can be bypassed via URL encoded values6.9CNA v4.00.5%2025-11-19Fix
CVE-2025-64764Astro is vulnerable to reflected XSS via the server islands feature7.1CNA v3.10.5%2025-11-19NucleiFix
CVE-2025-64759Homarr is vulnerable to stored cross-site scripting and possible privilege escalation8.1CNA v3.10.3%2025-11-19Fix
CVE-2025-64757Astro Development Server is vulnerable to arbitrary Local File Read3.5CNA v3.10.4%2025-11-19Fix
CVE-2025-64708authentik invitation expiry is delayed by at least 5 minutes5.8CNA v3.10.2%2025-11-19Fix
CVE-2025-64521authentik deactivated service accounts can authenticate to OAuth4.8CNA v3.10.2%2025-11-19Fix
CVE-2025-64408Apache Causeway: Java deserialization vulnerability to authenticated attackers6.3CISA ADP v3.110.8%2025-11-19Fix
CVE-2025-63932D-Link DIR-868L OS command injection7.3v3.17.6%2025-11-19Emerging Threats
CVE-2025-63879Learnwithfair Php-ecommerce-project cross-site scripting6.1CISA ADP v3.10.2%2025-11-19
CVE-2025-63878Hackerwhale Restaurant Website Restoran SQL injection6.5CISA ADP v3.10.2%2025-11-19
CVE-2025-63719Campcodes Online Hospital Management System SQL injection7.3CISA ADP v3.10.2%2025-11-19
CVE-2025-63371Onecommander path traversal7.5CISA ADP v3.10.7%2025-11-19
CVE-2025-63243Pixeon Weblaudos password change functionality reflected cross-site scripting4.6v3.10.2%2025-11-19
CVE-2025-63224Itel Idenc improper authentication10.0CISA ADP v3.10.7%2025-11-19
CVE-2025-63223Axeltechnology Streamermax Mk Ii missing authorization9.8CISA ADP v3.10.8%2025-11-19
CVE-2025-63221Axeltechnology puma missing authorization9.1CISA ADP v3.10.5%2025-11-19
CVE-2025-63220SOUND4 FIRST download without integrity check7.2CISA ADP v3.10.5%2025-11-19
CVE-2025-63219Itel Iso-fm session hijacking7.5CISA ADP v3.10.4%2025-11-19
CVE-2025-63218Axeltechnology WOLF1MS improper authorization9.8CISA ADP v3.10.6%2025-11-19
CVE-2025-63214Bridgetech Vbc Server improper access control6.5CISA ADP v3.10.3%2025-11-19
CVE-2025-63213QVidium Opera11 improper input validation9.8CISA ADP v3.10.9%2025-11-19
CVE-2025-63212Gatesair Flexiva LX1000 information disclosure6.5CISA ADP v3.10.4%2025-11-19
CVE-2025-63211Bridgetech Vbc Server stored cross-site scripting6.1CISA ADP v3.10.3%2025-11-19
CVE-2025-63210Newtec Celoxa504 improper authentication9.8CISA ADP v3.10.5%2025-11-19
CVE-2025-63209Elcaradio STAR1000 information disclosure7.5CISA ADP v3.10.4%2025-11-19
CVE-2025-63208Bridgetech VB288 cleartext storage of sensitive information7.5CISA ADP v3.10.2%2025-11-19
CVE-2025-63207Rvr TEX1002LCD improper authentication9.8CISA ADP v3.17.4%2025-11-19Emerging Threats
CVE-2025-63206Dasan Networks DS2924 Dasan Switch authentication bypass9.8CISA ADP v3.10.5%2025-11-19
CVE-2025-63205Bridgetech VB120 information disclosure7.5CISA ADP v3.10.4%2025-11-19
CVE-2025-58412Fortinet FortiADC cross-site scripting4.2CNA v3.10.2%2025-11-19Fix
CVE-2025-58181Unbounded memory consumption in golang.org/x/Crypto/ssh5.3CISA ADP v3.10.6%2025-11-19Fix
CVE-2025-51663Lanol FileCodeBox authentication bypass7.5CISA ADP v3.10.4%2025-11-19
CVE-2025-51662Lanol FileCodeBox cross-site scripting5.4CISA ADP v3.10.2%2025-11-19
CVE-2025-51661Lanol FileCodeBox path traversal7.5CISA ADP v3.10.5%2025-11-19
CVE-2025-47914Malformed constraint may cause denial of service in golang.org/x/Crypto/ssh/agent5.3CISA ADP v3.10.5%2025-11-19Fix
CVE-2025-36371IBM i information disclosure6.5CNA v3.10.3%2025-11-19Fix
CVE-2025-34337eGovFramework Unauthenticated Encryption Oracle via Web Editor Image upload endpoints8.7CNA v4.00.3%2025-11-19
CVE-2025-34336eGovFramework unauthenticated file upload via Web Editor Image upload endpoints6.9CNA v4.00.6%2025-11-19
CVE-2025-34335AudioCodes Fax/IVR Appliance Authenticated command injection via ActivateLicense.php8.8v3.12.8%2025-11-19
CVE-2025-34334AudioCodes Fax/IVR Appliance Authenticated command injection via TestFax.php and LPE8.8v3.13.4%2025-11-19
CVE-2025-34333AudioCodes Fax/IVR Appliance World-Writable Webroot LPE7.8v3.10.2%2025-11-19
CVE-2025-34332AudioCodes Fax/IVR Appliance Insecure Service Control Scripts LPE7.8v3.10.2%2025-11-19
CVE-2025-34331AudioCodes Fax/IVR Appliance Unauthenticated File Read via download.php7.5v3.10.5%2025-11-19
CVE-2025-34330AudioCodes Fax/IVR Appliance Unauthenticated Prompt file upload via ajaxPromptUploadFile.php5.3v3.10.5%2025-11-19
CVE-2025-34329AudioCodes Fax/IVR Appliance Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php9.8v3.11.1%2025-11-19
CVE-2025-34328AudioCodes Fax/IVR Appliance Unauthenticated file upload RCE via ajaxScript.php9.8v3.10.7%2025-11-19
CVE-2025-13421itsourcecode Human Resource Management System NoticeStore.php SQL injection9.8v3.10.4%2025-11-19
CVE-2025-13420itsourcecode Human Resource Management System EventStore.php SQL injection9.8v3.10.4%2025-11-19
CVE-2025-13415icret EasyImages SVG Image upload.php cross-site scripting5.4v3.10.2%2025-11-19
CVE-2025-13412Campcodes Retro Basketball Shoes Online Store admin_running.php cross-site scripting6.1v3.10.2%2025-11-19
CVE-2025-13411Campcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload9.8v3.10.4%2025-11-19
CVE-2025-13410Campcodes Retro Basketball Shoes Online Store receipt.php SQL injection9.8v3.10.4%2025-11-19
CVE-2025-13400Tenda CH22 WrlExtraGet formWrlExtraGet buffer overflow9.8v3.10.7%2025-11-19
CVE-2025-13397mrubyc alloc.c mrbc_raw_realloc null pointer dereference5.5v3.10.1%2025-11-19
CVE-2025-13396code-projects Courier Management System add-office.php SQL injection9.8v3.10.3%2025-11-19
CVE-2025-13395codehub666 94list function.php login SQL injection6.9CNA v4.00.3%2025-11-19
CVE-2025-13316Hard-coded encryption keys in Twonky Server8.1NVD v3.12.7%2025-11-19KCV
CVE-2025-13315Unauthenticated log access in Twonky Server9.8NVD v3.131.2%2025-11-19Reported exploitedNucleiExploit codeKCV
CVE-2025-13225Tanium addressed an arbitrary file deletion vulnerability in TanOS5.6CNA v3.10.2%2025-11-19Fix
CVE-2025-13206GiveWP WordPress plugin stored cross-site scripting6.1NVD v3.10.3%2025-11-19Fix
CVE-2025-13147Progress MOVEit Transfer External Service Interaction (DNS)5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-13145WP Import Ultimate CSV XML Importer for WordPress plugin PHP object injection7.2CNA v3.10.5%2025-11-19Fix
CVE-2025-13085SiteSEO WordPress plugin improper authorization4.3CNA v3.10.2%2025-11-19Fix
CVE-2025-13054User Profile Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-19Fix
CVE-2025-13051ASUSTOR ABP and AES uncontrolled search path9.3CNA v4.00.2%2025-11-19Fix
CVE-2025-13035Code Snippets WordPress plugin PHP code injection8.0CNA v3.10.4%2025-11-19Fix
CVE-2025-12878FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-19Fix
CVE-2025-12852NEC RakurakuMusen Start EX uncontrolled search path8.4CNA v4.00.1%2025-11-19
CVE-2025-12842Booking Plugin for WordPress Appointments Time Slot unauthenticated arbitrary email Sending5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12822WP Login and Register using JWT WordPress plugin unauthorized access4.3CNA v3.10.2%2025-11-19Fix
CVE-2025-12814SiteSEO SEO Simplified WordPress plugin improper authorization to authenticated settings reset5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12777YITH WooCommerce Wishlist WordPress plugin authorization bypass5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12770New User Approve WordPress plugin unauthenticated sensitive information disclosure via type Juggling5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12766BlackBerry® AtHoc® (OnPrem) Management console insecure direct object reference5.0CNA v3.10.2%2025-11-19Fix
CVE-2025-12751WSChat WordPress Live Chat plugin missing authorization authenticated settings reset4.3CNA v3.10.2%2025-11-19Fix
CVE-2025-12743SQL injection in Looker Project Generation endpoint allows Access to Internal MySQL Database6.0CNA v4.00.3%2025-11-19Fix
CVE-2025-12710Pet-Manager Petfinder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-19Fix
CVE-2025-12646Community Events WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2025-11-19Fix
CVE-2025-12592Vivotek Affected device model numbers are FD7131-VVTK default credentials9.3CNA v4.00.3%2025-11-19
CVE-2025-12535SureForms WordPress plugin cross-site request forgery Protection bypass5.3CNA v3.10.2%2025-11-19Fix
CVE-2025-12484Giveaways and Contests by RafflePress WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2025-11-19Fix
CVE-2025-12472Remote code execution in Looker due to improperly Validated Directory Deletion7.1CNA v4.00.3%2025-11-19Fix
CVE-2025-12427YITH WooCommerce Wishlist WordPress plugin insecure direct object reference5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12426Quiz Maker WordPress plugin unauthenticated sensitive information exposure7.5v3.10.3%2025-11-19Fix
CVE-2025-12359Responsive Lightbox and Gallery WordPress plugin authenticated (Author+) server-side request forgery5.4CNA v3.10.2%2025-11-19Fix
CVE-2025-12349icegram Email Subscribers and Newsletters mailing queue trigger missing authentication5.3CNA v3.10.3%2025-11-19Fix
CVE-2025-12174wpWax Directorist listing export and slug update missing authorization6.5CNA v3.10.2%2025-11-19Fix
CVE-2025-12057WavePlayer WordPress plugin unauthenticated arbitrary file upload9.8CISA ADP v3.10.6%2025-11-19Fix
CVE-2025-12056Out-of-bounds read in Shelly Pro 3EM8.3CNA v4.00.2%2025-11-19Fix
CVE-2025-11963Reflected XSS in Saysis's StarCities5.4CNA v3.10.2%2025-11-19Fix
CVE-2025-11884Cross-site scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB2.3CNA v4.00.2%2025-11-19
CVE-2025-11446upKeeper Solutions upKeeper Manager sensitive information in log files7.3CNA v4.00.2%2025-11-19Fix
CVE-2025-11243Allocation of resources without limits or throttling in Shelly Pro 4PM8.3CNA v4.00.4%2025-11-19Fix
CVE-2025-11230Denial of service vulnerability in HAProxy mjson library7.5CNA v3.10.7%2025-11-19Fix
CVE-2025-110017-Zip ZIP File Parsing directory traversal remote code execution7.8NVD v3.127.4%2025-11-19Exploit codeFix
CVE-2025-10703Progress DataDirect Connect for JDBC for Amazon Redshift code injection8.6CNA v4.00.3%2025-11-19
CVE-2025-10702Progress DataDirect Connect for JDBC for Amazon Redshift code injection8.6CNA v4.00.3%2025-11-19
CVE-2025-10437SQLi in Exagate's Webpack Management System9.8CNA v3.10.3%2025-11-19
CVE-2025-6251Royal Elementor Addons and Templates WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-11-19Fix
CVE-2025-0421IFrame injection in Mikrogrup's Shopside4.7CNA v3.10.2%2025-11-19
CVE-2025-65093LibreNMS is vulnerable to SQL injection in hostname parameter in ajax_output.php endpoint5.5CNA v3.13.7%2025-11-18Fix
CVE-2025-65015joserfc resource exhaustion9.2CNA v4.00.4%2025-11-18Fix
CVE-2025-65014LibreNMS has weak password Policy3.7CNA v3.10.3%2025-11-18Fix
CVE-2025-65013LibreNMS nodeimage endpoint reflected cross-site scripting6.2CNA v3.10.3%2025-11-18Fix
CVE-2025-65012Kirby CMS has cross-site scripting (XSS) in the changes dialog5.1CNA v4.00.2%2025-11-18Fix
CVE-2025-64996Checkmk mk_inotify plugin incorrect permission assignment4.8CNA v4.00.1%2025-11-18Fix
CVE-2025-64734Gallagher T21 Reader missing resource release2.4CNA v3.10.2%2025-11-18Fix
CVE-2025-64515open-formulieren open-forms open forms prefill data in read-only components can be tampered4.3CNA v3.10.3%2025-11-18Fix
CVE-2025-64325Emby Server is vulnerable to remote code execution through XSS in Admin Dashboard8.4CNA v4.00.4%2025-11-18Fix
CVE-2025-64324KubeVirt vulnerable to arbitrary host File Read and Write8.5CNA v4.00.2%2025-11-18Fix
CVE-2025-64076cbor2 C extension decoder flaws can cause denial of service7.5CNA v3.10.5%2025-11-18Fix
CVE-2025-63955PHPGurukul Student Record System manage-students.php component cross-site request forgery7.5CISA ADP v3.10.2%2025-11-18
CVE-2025-63892Remyandrade Student Grades Management System cross-site scripting6.8CISA ADP v3.10.4%2025-11-18
CVE-2025-63883Bhabishya-123 E-commerce electic-shop v1.0 DOM-based cross-site scripting5.4CISA ADP v3.10.3%2025-11-18
CVE-2025-63829eProsima Fast-DDS integer overflow7.5v3.10.3%2025-11-18
CVE-2025-63828Backdrop CMS host header injection6.1CISA ADP v3.10.2%2025-11-18
CVE-2025-63800opensourcepos Open Source Point of Sale weak password requirements7.5CISA ADP v3.10.5%2025-11-18
CVE-2025-63749PNETLab command injection6.5CISA ADP v3.11.0%2025-11-18
CVE-2025-63695Dzzoffice unrestricted file upload9.8CISA ADP v3.10.4%2025-11-18
CVE-2025-63694Dzzoffice SQL injection9.8CISA ADP v3.10.4%2025-11-18
CVE-2025-63693Dzzoffice code injection5.4CISA ADP v3.10.2%2025-11-18
CVE-2025-63604Baryhuang AWS Resources MCP Server code injection6.5CISA ADP v3.10.4%2025-11-18
CVE-2025-63603MCP Server For DATA Exploration MCP Data Science Server's command injection6.5CISA ADP v3.10.9%2025-11-18
CVE-2025-63602Awesome Miner buffer over-read7.3CISA ADP v3.10.3%2025-11-18Exploit code
CVE-2025-63514kishan0725 Hospital-Management-System cross-site scripting6.1CISA ADP v3.10.2%2025-11-18
CVE-2025-63513kishan0725 Hospital-Management-System insecure direct object reference6.5CISA ADP v3.10.3%2025-11-18
CVE-2025-63512kishan0725 Hospital-Management-System SQL injection6.5CISA ADP v3.10.2%2025-11-18
CVE-2025-63408Ispyconnect Agent Dvr path traversal7.8v3.10.4%2025-11-18
CVE-2025-63258H3C ERG3, ERG5 and XiaoBei series routers sessionid parameter command injection6.5CISA ADP v3.10.3%2025-11-18
CVE-2025-63229Dbbroadcast Mozart DDS Next 1000 cross-site scripting5.4CISA ADP v3.10.3%2025-11-18
CVE-2025-63228Dbbroadcast Mozart DDS Next 1000 unrestricted file upload9.8CISA ADP v3.10.8%2025-11-18
CVE-2025-63227Dbbroadcast Mozart DDS Next 1000 unrestricted file upload7.2CISA ADP v3.10.6%2025-11-18
CVE-2025-63226Sencore SMP100 insufficient session expiration5.7CISA ADP v3.10.2%2025-11-18
CVE-2025-63225Eurolab-srl Elts 100 missing authorization9.8CISA ADP v3.10.6%2025-11-18
CVE-2025-63217Itel ID Mux authentication bypass9.8CISA ADP v3.10.6%2025-11-18
CVE-2025-63216Itel Idgateway improper authentication10.0CISA ADP v3.10.7%2025-11-18
CVE-2025-63215SOUND4 Impact download without integrity check7.2CISA ADP v3.10.5%2025-11-18
CVE-2025-62406Piwigo is vulnerable to one-click account takeover by modifying the password-reset link8.1CNA v3.10.4%2025-11-18
CVE-2025-61713Fortinet FortiPAM cleartext storage of sensitive information in memory3.8CNA v3.10.1%2025-11-18Fix
CVE-2025-61664GRUB2: Missing unregister call for normal_exit command may lead to use-after-free4.9CNA v3.10.1%2025-11-18Fix
CVE-2025-61663GRUB2: Missing unregister call for normal commands may lead to use-after-free4.9CNA v3.10.1%2025-11-18Fix
CVE-2025-61662GRUB2: Missing unregister call for gettext command may lead to use-after-free7.8NVD v3.10.2%2025-11-18Fix
CVE-2025-61661GRUB2: GRUB2: Out-of-bounds write via malicious usb device4.8CNA v3.10.2%2025-11-18Fix
CVE-2025-60455Modular Max Serve has unsafe deserialization8.4CISA ADP v3.10.3%2025-11-18Fix
CVE-2025-59669Fortinet FortiWeb hard-coded credentials4.8CNA v3.10.1%2025-11-18Fix
CVE-2025-59117Multiple stored XSS in Windu CMS4.8v3.10.2%2025-11-18Fix
CVE-2025-59116JCD Windu CMS login vulnerability5.3v3.10.2%2025-11-18Fix
CVE-2025-59115Stored XSS in Windu CMS5.4v3.10.2%2025-11-18Fix
CVE-2025-59114Cross-site request forgery in Windu CMS6.5v3.10.1%2025-11-18Fix
CVE-2025-59113Bruteforce Protection Bypass in Windu CMS7.5v3.10.3%2025-11-18Fix
CVE-2025-59112Cross-site request forgery in Windu CMS6.5v3.10.1%2025-11-18Fix
CVE-2025-59111Broken access control in Windu CMS6.5v3.10.3%2025-11-18Fix
CVE-2025-59110Cross-site request forgery in Windu CMS6.5v3.10.2%2025-11-18Fix
CVE-2025-58692Fortinet FortiVoice SQL injection7.7CNA v3.10.3%2025-11-18Fix
CVE-2025-58413Fortinet FortiOS A stack-based buffer overflow6.9CNA v3.10.4%2025-11-18Fix
CVE-2025-58122Checkmk insufficient permission validation when configuring notification parameters5.3CNA v4.00.2%2025-11-18Fix
CVE-2025-58121Checkmk insufficient permission validation on multiple REST API endpoints5.3CNA v4.00.2%2025-11-18Fix
CVE-2025-58034Fortinet FortiWeb OS command injection6.7CNA v3.155.6%2025-11-18KEVMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2025-56643Requarks Wiki.js insufficient session expiration9.1CISA ADP v3.10.4%2025-11-18Exploit code
CVE-2025-56527Cinnamon kotaemon plaintext password storage7.5CISA ADP v3.10.4%2025-11-18KCV
CVE-2025-56526Cinnamon kotaemon cross-site scripting6.1CISA ADP v3.10.4%2025-11-18Exploit codeKCV
CVE-2025-56499Metacubex Mihomo arbitrary file read6.5CISA ADP v3.10.3%2025-11-18
CVE-2025-55796Openml Frontend missing brute-force protection7.5CISA ADP v3.10.6%2025-11-18
CVE-2025-55179WhatsApp rich response message handling vulnerability5.4CNA v3.10.2%2025-11-18Fix
CVE-2025-55074Mattermost channel member objects leak read status3.0CNA v3.10.2%2025-11-18Fix
CVE-2025-54990XWiki AdminTools application SpammedPages page incorrect default permissions5.3CNA v3.10.2%2025-11-18Fix
CVE-2025-54972Fortinet FortiMail CRLF injection3.9CNA v3.10.2%2025-11-18Fix
CVE-2025-54971Fortinet FortiADC information disclosure3.9CNA v3.10.2%2025-11-18Fix
CVE-2025-54821Fortinet FortiOS improper privilege management1.7CNA v3.10.2%2025-11-18Fix
CVE-2025-54771GNU GRUB2 file-closing process use-after-free4.9CNA v3.10.1%2025-11-18Fix
CVE-2025-54770GNU GRUB2 network module use-after-free4.9CNA v3.10.1%2025-11-18Fix
CVE-2025-54660Fortinet FortiClientWindows active debug code4.9CNA v3.10.2%2025-11-18Fix
CVE-2025-54321Ascertia Signinghub improper interaction frequency control9.8CISA ADP v3.10.5%2025-11-18Fix
CVE-2025-54320Ascertia Signinghub resource exhaustion4.3CISA ADP v3.10.3%2025-11-18Fix
CVE-2025-53843Fortinet FortiOS A stack-based buffer overflow6.9CNA v3.10.7%2025-11-18Fix
CVE-2025-53360PluginsGLPI's Database Inventory plugin allows any authenticated user to send agent requests4.3CNA v3.10.3%2025-11-18Fix
CVE-2025-52639HCL Connections is vulnerable to sensitive information disclosure3.5CNA v3.10.2%2025-11-18Fix
CVE-2025-52578Gallagher High Sec End of Line Module improper seeding5.7CNA v3.10.1%2025-11-18Fix
CVE-2025-52457Gallagher HBUS Devices timing side channel5.7CNA v3.10.1%2025-11-18Fix
CVE-2025-48839Fortinet FortiADC out-of-bounds write6.3CNA v3.10.4%2025-11-18Fix
CVE-2025-48593Google Android bta_hf_client_main.cc remote code execution8.0CISA ADP v3.10.9%2025-11-18Exploit codeFix
CVE-2025-47761Fortinet FortiClientWindows exposed IOCTL without access control7.1CNA v3.10.2%2025-11-18Fix
CVE-2025-46776Fortinet FortiExtender buffer overflow6.3CNA v3.10.2%2025-11-18Fix
CVE-2025-46775Fortinet FortiExtender debug log commands information disclosure5.2CNA v3.10.2%2025-11-18Fix
CVE-2025-46373Fortinet FortiClientWindows heap-based buffer overflow7.1CNA v3.10.2%2025-11-18Fix
CVE-2025-46215Fortinet FortiSandbox improper isolation5.0CNA v3.10.3%2025-11-18Fix
CVE-2025-41737METZ CONNECT Energy-Controlling EWIO2-M improper access control via PHP endpoint7.5CNA v3.10.4%2025-11-18Fix
CVE-2025-41736METZ CONNECT Energy-Controlling EWIO2-M possible arbitrary code execution8.8CNA v3.10.7%2025-11-18Fix
CVE-2025-41735METZ CONNECT Energy-Controlling EWIO2-M possible arbitrary file upload8.8CNA v3.10.6%2025-11-18Fix
CVE-2025-41734METZ CONNECT Energy-Controlling EWIO2-M unauthenticated local file inclusion in PHP module9.8CNA v3.10.5%2025-11-18Fix
CVE-2025-41733METZ CONNECT Energy-Controlling EWIO2-M possible malfunction credential injection9.8CNA v3.10.6%2025-11-18Fix
CVE-2025-41350Stored cross-site scripting (XSS) in WinPlus by Informática del Este5.4v3.10.3%2025-11-18
CVE-2025-41349Stored cross-site scripting (XSS) in WinPlus by Informática del Este5.4v3.10.3%2025-11-18
CVE-2025-41348Stored cross-site scripting (XSS) in WinPlus by Informática del Este9.8v3.10.5%2025-11-18
CVE-2025-41347Stored cross-site scripting (XSS) in WinPlus by Informática del Este9.8v3.10.3%2025-11-18
CVE-2025-41346Stored cross-site scripting (XSS) in WinPlus by Informática del Este9.8v3.10.3%2025-11-18
CVE-2025-40549SolarWinds Serv-U Path Restriction Bypass vulnerability9.1CNA v3.11.1%2025-11-18Fix
CVE-2025-40548SolarWinds Serv-U broken access control remote code execution9.1CNA v3.10.7%2025-11-18Fix
CVE-2025-40547SolarWinds Serv-U Logic Abuse remote code execution9.1CNA v3.10.9%2025-11-18Fix
CVE-2025-40545SolarWinds Observability Self-Hosted open redirection4.8CNA v3.10.2%2025-11-18Fix
CVE-2025-37163Authenticated command injection vulnerability in HPE Aruba Networking Management Software CLI7.2CNA v3.11.0%2025-11-18Fix
CVE-2025-37162HPE Aruba 100 Series Cellular Bridge command line interface command injection6.5CNA v3.10.9%2025-11-18Fix
CVE-2025-37161HPE Aruba 100 Series Cellular Bridge web management interface denial of service7.5CNA v3.10.4%2025-11-18Fix
CVE-2025-37160HPE Aruba Networking AOS-CX authenticated broken access control in REST API Configuration service5.3CNA v3.10.3%2025-11-18Fix
CVE-2025-37159HPE Aruba AOS-CX web management interface session fixation5.8CNA v3.10.3%2025-11-18Fix
CVE-2025-37158Authenticated command injection allows unauthorized command execution in AOS-CX6.7CNA v3.10.7%2025-11-18Fix
CVE-2025-37157Authenticated command injection allows unauthorized command execution in AOS-CX6.7CNA v3.10.7%2025-11-18Fix
CVE-2025-37156ArubaOS-CX Platform-Level denial of service6.8CNA v3.10.3%2025-11-18Fix
CVE-2025-37155HPE Aruba AOS-CX SSH restricted shell interface privilege escalation7.8CNA v3.10.1%2025-11-18Fix
CVE-2025-34324GoSign Desktop Insecure Update Mechanism RCE7.8v3.10.1%2025-11-18Exploit codeFix
CVE-2025-33184NVIDIA Isaac-GR00T N1.5 code injection7.8CNA v3.10.5%2025-11-18Fix
CVE-2025-33183NVIDIA Isaac-GR00T N1.5 code injection7.8CNA v3.10.5%2025-11-18Fix
CVE-2025-26391SolarWinds Observability Self-Hosted XSS5.4CNA v3.10.3%2025-11-18Fix
CVE-2025-13349SourceCodester Student Grades Management System Add New Grade grades.php cross-site scripting5.4v3.10.3%2025-11-18
CVE-2025-13347SourceCodester Train Station Ticketing System ajax.php SQL injection8.8v3.10.3%2025-11-18
CVE-2025-13346SourceCodester Train Station Ticketing System ajax.php SQL injection8.8v3.10.3%2025-11-18
CVE-2025-13345SourceCodester Train Station Ticketing System ajax.php SQL injection8.8v3.10.5%2025-11-18
CVE-2025-13344SourceCodester Train Station Ticketing System ajax.php SQL injection9.8v3.10.6%2025-11-18
CVE-2025-13343SourceCodester Interview Management System editQuestion.php cross-site scripting5.4v3.10.4%2025-11-18
CVE-2025-13325itsourcecode Student Information System enrollment_edit1.php SQL injection8.8v3.10.3%2025-11-18
CVE-2025-13323code-projects Simple Pizza Ordering System listorder.php SQL injection9.8v3.10.4%2025-11-18
CVE-2025-13306D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection8.8v3.18.3%2025-11-18Fix
CVE-2025-13230Google Chrome V8 type confusion8.8CISA ADP v3.10.2%2025-11-18Fix
CVE-2025-13229Google Chrome V8 type confusion8.8CISA ADP v3.10.2%2025-11-18Fix
CVE-2025-13228Google Chrome V8 type confusion8.8CISA ADP v3.10.2%2025-11-18Fix