CVE-2025 records published in November 2025
Page two of three: records 1,001 to 2,000 of the 2,914 published in November 2025, newest first. The first page carries the figures for November 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-13227 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13226 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13196 | Element Pack Addons for Elementor WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13133 | Simple User Import Export WordPress plugin authenticated (Admin+) CSV injection | 6.6CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-13088 | Category and Product Woocommerce Tabs WordPress plugin local file inclusion | 8.8CNA v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-13083 | Drupal core Moderately critical information disclosure SA-CORE-2025-008 | 3.7CISA ADP v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-13082 | Drupal core Moderately critical Defacement SA-CORE-2025-007 | 4.3CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-13081 | Drupal core Moderately critical Gadget chain SA-CORE-2025-006 | 5.9CISA ADP v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-13080 | Drupal core Moderately critical denial of service SA-CORE-2025-005 | 5.3CISA ADP v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-13069 | Enable SVG, WebP, and ICO Upload WordPress plugin arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-11-18 | Fix |
| CVE-2025-12974 | Gravity Forms WordPress plugin unauthenticated arbitrary file upload via Legacy Chunked upload | 8.1CNA v3.1 | 0.7% | 2025-11-18 | Fix |
| CVE-2025-12962 | Local Syndication WordPress plugin server-side request forgery | 6.4CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-12961 | Download Panel settings AJAX action missing authorization | 4.3CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-12955 | Live sales notification for WooCommerce WordPress plugin missing authorization | 7.5CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12937 | ACF Flexible Layouts Manager WordPress plugin unauthorized access | 6.5CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-12827 | Top Friends WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.1% | 2025-11-18 | |
| CVE-2025-12823 | CSV to SortTable WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-12792 | Canva incorrect default permissions | 3.2CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-12775 | WP Dropzone WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-11-18 | Fix |
| CVE-2025-12761 | Simple multi step form Moderately critical cross-site scripting SA-CONTRIB-2025-116 | 3.5CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12760 | Email TFA Moderately critical Access bypass SA-CONTRIB-2025-115 | 5.4CISA ADP v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12691 | sayontan Photonic Gallery and Lightbox caption attribute stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12639 | wModes WordPress plugin authorization bypass | 4.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12545 | Pixel Manager for WooCommerce WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12528 | Pie Forms for WP WordPress plugin unauthenticated arbitrary file upload | 8.1CNA v3.1 | 0.7% | 2025-11-18 | |
| CVE-2025-12524 | Post Type Switcher WordPress plugin insecure direct object reference | 5.4CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12481 | WP Duplicate Page WordPress plugin missing authorization | 4.3CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12457 | Enable SVG, WebP, and ICO Upload WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12411 | Premmerce Wholesale Pricing for WooCommerce WordPress plugin SQL injection | 7.1CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12406 | Project Honey Pot Spam Trap WordPress plugin cross-site request forgery | 6.1CNA v3.1 | 0.1% | 2025-11-18 | |
| CVE-2025-12404 | Like-it WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.1% | 2025-11-18 | |
| CVE-2025-12392 | Cryptocurrency Payment Gateway for WooCommerce WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12391 | Restrictions for BuddyPress WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12383 | Eclipse Foundation Jersey race condition allows Bypass of Trust Restrictions | 9.4CNA v4.0 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-12376 | Icon List Block Add Icon-Based Lists with Custom Styles WordPress plugin server-side request forgery | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12372 | The Permalinks Cascade WordPress plugin missing authorization authenticated plugin settings update | 4.3CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-12173 | WP Admin Microblog WordPress plugin cross-site request forgery to Message creation | 4.3CNA v3.1 | 0.1% | 2025-11-18 | |
| CVE-2025-12119 | MongoDB C Driver bulk write with options may read invalid memory | 6.9CNA v4.0 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12088 | Meta Display Block WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12079 | WP Twitter Auto Publish WordPress plugin reflected cross-site scripting via PostMessage | 6.1CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-12078 | ArtiBot Free Chat Bot for WebSites WordPress plugin reflected cross-site scripting via PostMessage | 6.1CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-11868 | everviz WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-11734 | AIOSEO Broken Link Checker REST API endpoint missing authorization | 5.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-11620 | Multiple Roles per User WordPress plugin missing authorization authenticated privilege escalation | 7.2CNA v3.1 | 0.4% | 2025-11-18 | |
| CVE-2025-11427 | WP Migrate Lite WordPress plugin unauthenticated blind server-side request forgery | 5.8CNA v3.1 | 0.5% | 2025-11-18 | Fix |
| CVE-2025-11267 | VK All in One Expansion Unit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-11265 | VK All in One Expansion Unit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-10158 | Rsync: Out-of-bounds array access via negative index | 4.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-10089 | Mitsubishi Electric MILCO.S Setting Application uncontrolled search path | 7.7CNA v3.1 | 0.1% | 2025-11-18 | Fix |
| CVE-2025-9977 | Improper neutralization of input in Times Software E-Payroll | 5.3CNA v4.0 | 1.9% | 2025-11-18 | |
| CVE-2025-9625 | Coil Web Monetization WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-9312 | Improper Certificate-Based Authentication Enforcement in multiple WSO2 Products | 9.8CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-8727 | SMCI X13SEDW-F A stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL) | 7.2CNA v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-8693 | Zyxel DX3300-T0 firmware "priv" parameter command injection | 8.8CNA v3.1 | 1.1% | 2025-11-18 | Fix |
| CVE-2025-8609 | RTMKit Addons WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-8605 | Gutenify WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-18 | |
| CVE-2025-8404 | SMCI MBD-X13SEDW-F stack buffer overflow vulnerability exists in the Supermicro BMC Shared library | 5.5CNA v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-8084 | AI Engine WordPress plugin authenticated (Editor+) server-side request forgery | 6.8CNA v3.1 | 0.4% | 2025-11-18 | Fix |
| CVE-2025-8076 | SMCI MBD-X13SEDW-F A stack buffer overflow vulnerability exists in the Supermicro BMC Web function | 7.2CNA v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-7623 | SMCI MBD-X13SEDW-F supermicro BMC SMASH services has a stack-based buffer overflow | 5.4CNA v3.1 | 0.3% | 2025-11-18 | |
| CVE-2025-6670 | Cross-site request forgery (CSRF) in multiple WSO2 Products via HTTP GET in Admin services | 8.8CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-6599 | Zyxel DX3301-T0 firmware web server resource exhaustion | 5.3CNA v3.1 | 0.3% | 2025-11-18 | Fix |
| CVE-2025-4212 | Checkout Files Upload for WooCommerce WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2025-11-18 | Fix |
| CVE-2025-65083 | Tinexta InfoCert GoSign Desktop improper certificate validation | 3.2CNA v3.1 | 0.1% | 2025-11-17 | |
| CVE-2025-65073 | OpenStack Keystone incorrect authorization | 7.5CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-64766 | NixOS has hard-coded credentials in Onlyoffice module | 5.3CNA v3.1 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-64758 | @DependencyTrack/frontend vulnerable to persistent cross-site-scripting via Welcome message | 4.8CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-64756 | Glob CLI: Command injection via -c/--cmd executes matches with shell:true | 7.5CNA v3.1 | 3.1% | 2025-11-17 | Fix |
| CVE-2025-64342 | espressif esp-idf ESF-IDF's ESP32 Bluetooth controller has an Invalid Access Address vulnerability | 6.9CNA v4.0 | 0.4% | 2025-11-17 | Fix |
| CVE-2025-64046 | OpenRapid RapidCMS cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-17 | |
| CVE-2025-63918 | Cnblogs Pdfpatcher path traversal | 6.2CISA ADP v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-63917 | Cnblogs Pdfpatcher XML external entity injection | 7.1CISA ADP v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-63916 | Luotengyuan Myscreentools OS command injection | 8.1CISA ADP v3.1 | 1.6% | 2025-11-17 | |
| CVE-2025-63748 | Testmanagement Qatraq unrestricted file upload | 8.8CISA ADP v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-63747 | Testmanagement Qatraq weak password requirements | 9.8CISA ADP v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-63708 | Remyandrade AI Font Matcher SourceCodester cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-63292 | Freebox V5 Crystal Firmware cleartext transmission of sensitive information | 3.5CISA ADP v3.1 | 0.1% | 2025-11-17 | |
| CVE-2025-62519 | phpMyFAQ has authenticated SQL injection in Configuration Update Functionality | 7.2CNA v3.1 | 0.7% | 2025-11-17 | Fix |
| CVE-2025-60022 | KDDI 'デジラアプリ' App improper certificate validation | 2.3CNA v4.0 | 0.1% | 2025-11-17 | |
| CVE-2025-58410 | Imagination Technologies Graphics DDK GPU memory export handling vulnerability | 7.5CISA ADP v3.1 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-58407 | Imagination Technologies Graphics DDK GPU firmware memory context race condition | 7.4CISA ADP v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-55059 | Rumpus FTP Server cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-11-17 | |
| CVE-2025-55058 | Rumpus FTP Server improper input validation | 9.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-55057 | Rumpus FTP Server cross-site request forgery | 8.8NVD v3.1 | 0.2% | 2025-11-17 | |
| CVE-2025-55056 | Rumpus FTP Server cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-11-17 | |
| CVE-2025-55055 | Rumpus FTP Server OS command injection | 9.8NVD v3.1 | 0.8% | 2025-11-17 | |
| CVE-2025-40936 | Siemens PS/IGES Parasolid Translator Component out-of-bounds read | 7.3CNA v4.0 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-40834 | Siemens Mendix RichText cross-site scripting | 6.8CNA v4.0 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-36553 | Dell ControlVault3 CvManager buffer overflow | 8.8CNA v3.1 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-36463 | Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write | 7.3CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-36462 | Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write | 7.3CNA v3.1 | 0.1% | 2025-11-17 | Fix |
| CVE-2025-36461 | Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write | 7.3CNA v3.1 | 0.1% | 2025-11-17 | Fix |
| CVE-2025-36460 | Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write | 7.3CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-36357 | IBM Planning Analytics Local directory traversal | 8.0CNA v3.1 | 0.8% | 2025-11-17 | Fix |
| CVE-2025-36299 | IBM Planning Analytics information disclosure | 4.3CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-36118 | IBM Storage Virtualize information disclosure | 7.5CNA v3.1 | 0.4% | 2025-11-17 | Fix |
| CVE-2025-34323 | Nagios Log Server local privilege escalation via Writable scripts and Sudo Rules | 7.8NVD v3.1 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-34322 | Nagios Log Server Authenticated command injection via Natural Language Queries | 7.2NVD v3.1 | 9.5% | 2025-11-17 | Exploit codeFix |
| CVE-2025-32089 | Dell ControlVault3 CvManager_SBI buffer overflow | 8.8CNA v3.1 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-31649 | Dell ControlVault3 ControlVault WBDI driver hard-coded password | 8.7CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-31361 | Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation | 8.7CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-13319 | Authenticated SQL injection in API Digi On-Prem Manager | 8.8CNA v3.1 | 0.4% | 2025-11-17 | Fix |
| CVE-2025-13305 | D-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow | 9.8v3.1 | 3.6% | 2025-11-17 | Fix |
| CVE-2025-13304 | D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-11-17 | Fix |
| CVE-2025-13303 | code-projects Courier Management System search-edit.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13302 | code-projects Courier Management System add-new-officer.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13301 | itsourcecode Web-Based Internet Laboratory Management System controller.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13300 | itsourcecode Web-Based Internet Laboratory Management System controller.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13299 | itsourcecode Web-Based Internet Laboratory Management System controller.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13298 | itsourcecode Web-Based Internet Laboratory Management System controller.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13297 | itsourcecode Web-Based Internet Laboratory Management System controller.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13291 | Campcodes Supplier Management System confirm_order.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13290 | code-projects Simple Food Ordering System saveorder.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13289 | 1000 Projects Design and Development of Student Database Management System SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13288 | Tenda CH22 PPTPUserSetting fromPptpUserSetting buffer overflow | 8.7CNA v4.0 | 0.9% | 2025-11-17 | Emerging Threats |
| CVE-2025-13287 | itsourcecode Online Voting System index.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13286 | itsourcecode Online Voting System ajax.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13285 | itsourcecode Online Voting System login.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13284 | ThinPLUS｜ThinPLUS OS command injection | 9.3CNA v4.0 | 1.8% | 2025-11-17 | Fix |
| CVE-2025-13283 | Chunghwa Telecom｜TenderDocTransfer arbitrary File Copy and Paste | 7.0CNA v4.0 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-13282 | Chunghwa Telecom｜TenderDocTransfer arbitrary file delete | 7.0CNA v4.0 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-13280 | CodeAstro Simple Inventory System Login index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13279 | code-projects Nero Social Networking Site profilefriends.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13278 | Projectworlds Advanced Library Management System borrowed_book_search.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13277 | code-projects Nero Social Networking Site friendsphoto.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13276 | g33kyrash Online-Banking-System index.php SQL injection | 6.9CNA v4.0 | 0.3% | 2025-11-17 | |
| CVE-2025-13275 | Iqbolshoh php-business-website about.php unrestricted upload | 5.1CNA v4.0 | 0.3% | 2025-11-17 | |
| CVE-2025-13274 | Campcodes School Fees Payment Management System ajax.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13273 | Campcodes School Fees Payment Management System ajax.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13272 | Campcodes School Fees Payment Management System manage_course.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13271 | Campcodes School Fees Payment Management System ajax.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13270 | Campcodes School Fees Payment Management System ajax.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13269 | Campcodes School Fees Payment Management System ajax.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13268 | Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection | 5.3CNA v4.0 | 0.3% | 2025-11-17 | |
| CVE-2025-13267 | SourceCodester Dental Clinic Appointment Reservation System success.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13266 | wwwlike vlife VLifeApi SysFileApi.java create path traversal | 6.9CNA v4.0 | 0.6% | 2025-11-17 | |
| CVE-2025-13265 | Lsfusion Platform ZipUtils.java unpackFile path traversal | 9.1NVD v3.1 | 0.6% | 2025-11-17 | |
| CVE-2025-13264 | SourceCodester Online Magazine Management System view_magazine.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13263 | SourceCodester Online Magazine Management System categories.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13262 | Lsfusion Platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal | 9.8NVD v3.1 | 0.6% | 2025-11-17 | |
| CVE-2025-13261 | Lsfusion Platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal | 5.3NVD v3.1 | 0.7% | 2025-11-17 | |
| CVE-2025-13260 | Campcodes Supplier Management System edit_product.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13259 | Campcodes Supplier Management System edit_unit.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-17 | |
| CVE-2025-13258 | Tenda AC20 WifiExtraSet buffer overflow | 8.7CNA v4.0 | 0.7% | 2025-11-17 | |
| CVE-2025-13257 | itsourcecode Inventory Management System index.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13256 | Projectworlds Advanced Library Management System borrow.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13255 | Projectworlds Advanced Library Management System book_search.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13254 | Projectworlds Advanced Library Management System add_member.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13253 | Projectworlds Advanced Library Management System add_librarian.php SQL injection | 8.8NVD v3.1 | 0.4% | 2025-11-17 | |
| CVE-2025-13224 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.5% | 2025-11-17 | Fix |
| CVE-2025-13223 | Google Chromium V8 type confusion | 8.8CISA ADP v3.1 | 5.0% | 2025-11-17 | KEVFix |
| CVE-2025-13193 | Red Hat Enterprise Linux 10 libvirt: Information disclosure via world-readable vm snapshots | 5.5CNA v3.1 | 0.1% | 2025-11-17 | Fix |
| CVE-2025-13165 | Digiwin｜EasyFlow GP denial of service | 8.7CNA v4.0 | 0.4% | 2025-11-17 | Fix |
| CVE-2025-13164 | Digiwin｜EasyFlow GP insufficiently protected credentials | 6.9CNA v4.0 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-13163 | Digiwin｜EasyFlow GP insufficiently protected credentials | 6.9CNA v4.0 | 0.3% | 2025-11-17 | Fix |
| CVE-2025-11681 | Denial of service condition in M-Files Server | 7.1CNA v4.0 | 0.4% | 2025-11-17 | Fix |
| CVE-2025-10460 | BEIMS Contractor Web unsanitized parameter input leading to SQL injection | 9.4CNA v4.0 | 0.3% | 2025-11-17 | |
| CVE-2025-9501 | W3 Total Cache WordPress plugin unauthenticated command injection | 9.0CISA ADP v3.1 | 22.6% | 2025-11-17 | Reported exploitedEmerging ThreatsExploit codeFix |
| CVE-2025-7711 | techlabpro1 Classified Listing listing description shortcode execution code injection | 5.4CNA v3.1 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-4321 | silabs.com RS9116W DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets | 7.1CNA v4.0 | 0.2% | 2025-11-17 | Fix |
| CVE-2025-13252 | shsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentials | 6.9CNA v4.0 | 0.3% | 2025-11-16 | |
| CVE-2025-13251 | WeiYe-Jing datax-web SQL injection | 8.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13250 | WeiYe-Jing datax-web Job triggerJob access control | 8.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13249 | Jiusi OA OfficeServer unrestricted upload | 5.3CNA v4.0 | 0.2% | 2025-11-16 | |
| CVE-2025-13248 | SourceCodester Patients Waiting Area Queue Management System api_patient_schedule.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13247 | PHPGurukul Tourism Management System user-bookings.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13246 | shsuishang ShopSuite ModulithShop JWT authentication filter path traversal | 5.3CNA v4.0 | 0.4% | 2025-11-16 | |
| CVE-2025-13245 | code-projects Student Information System editprofile.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-11-16 | |
| CVE-2025-13244 | code-projects Student Information System register.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13243 | code-projects Student Information System editprofile.php SQL injection | 8.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13242 | code-projects Student Information System register.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13241 | code-projects Student Information System index.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13240 | code-projects Student Information System searchquery.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13239 | Bdtask Isshue Multi Store eCommerce Shopping Cart Solution improper workflow enforcement | 7.5v3.1 | 0.3% | 2025-11-16 | |
| CVE-2025-13238 | Bdtask Flight Booking Software Edit Profile edit unrestricted upload | 8.8v3.1 | 0.3% | 2025-11-16 | |
| CVE-2025-13237 | itsourcecode Inventory Management System LogSignModal.PHP SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13236 | itsourcecode Inventory Management System index.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-16 | |
| CVE-2025-13235 | itsourcecode Inventory Management System login.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13234 | itsourcecode Inventory Management System index.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-16 | |
| CVE-2025-13233 | itsourcecode Inventory Management System index.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-16 | |
| CVE-2025-13232 | projectsend File Editor/Custom Download Aliases cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-11-16 | Fix |
| CVE-2025-12482 | Booking for Appointments and Events Calendar Amelia WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.3% | 2025-11-16 | Fix |
| CVE-2025-64309 | Brightpick Mission Control / Internal Logic Control unprotected transport of credentials | 6.0CNA v4.0 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-64308 | Brightpick Mission Control / Internal Logic Control unprotected transport of credentials | 7.1CNA v4.0 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-64307 | Brightpick Mission Control / Internal Logic Control missing authentication for critical function | 7.1CNA v4.0 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-62765 | General Industrial Controls Lynx+ Gateway cleartext transmission of sensitive information | 8.7CNA v4.0 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-59780 | General Industrial Controls Lynx+ Gateway missing authentication for critical function | 8.7CNA v4.0 | 0.4% | 2025-11-15 | Fix |
| CVE-2025-58083 | General Industrial Controls Lynx+ Gateway missing authentication for critical function | 9.2CNA v4.0 | 0.6% | 2025-11-15 | Fix |
| CVE-2025-55034 | General Industrial Controls Lynx+ Gateway weak password requirements | 8.8CNA v4.0 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-13221 | Intelbras UnniTI usuarios.xml credentials storage | 6.9CNA v4.0 | 0.4% | 2025-11-15 | |
| CVE-2025-13210 | itsourcecode Inventory Management System index.php SQL injection | 9.8NVD v3.1 | 0.3% | 2025-11-15 | |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack XML external entity reference | 5.3CNA v4.0 | 0.3% | 2025-11-15 | |
| CVE-2025-13208 | FantasticLBP Hotels Server hotelList.php SQL injection | 5.3CNA v4.0 | 0.2% | 2025-11-15 | |
| CVE-2025-13203 | code-projects Simple Cafe Ordering System addmem.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-15 | |
| CVE-2025-13202 | code-projects Simple Cafe Ordering System add_to_cart cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-11-15 | |
| CVE-2025-13201 | code-projects Simple Cafe Ordering System login.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-11-15 | |
| CVE-2025-13200 | SourceCodester Farm Management System exposure of information through directory listing | 6.9CNA v4.0 | 0.4% | 2025-11-15 | |
| CVE-2025-13199 | code-projects Email Logging Interface signup.cpp path traversal | 5.5NVD v3.1 | 0.3% | 2025-11-15 | |
| CVE-2025-13198 | DouPHP file.class.php unrestricted upload | 5.1CNA v4.0 | 0.3% | 2025-11-15 | |
| CVE-2025-13191 | D-Link DIR-816L soap.cgi soapcgi_main stack-based overflow | 9.8v3.1 | 0.9% | 2025-11-15 | |
| CVE-2025-13190 | D-Link DIR-816L __ajax_exporer.sgi scandir_main stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-11-15 | |
| CVE-2025-13189 | D-Link DIR-816L gena.cgi genacgi_main stack-based overflow | 9.8v3.1 | 0.9% | 2025-11-15 | |
| CVE-2025-12983 | Memory allocation with excessive size value in GitLab | 3.5CNA v3.1 | 0.4% | 2025-11-15 | Fix |
| CVE-2025-12849 | Contest Gallery WordPress plugin missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-12847 | All in One SEO AI image generator REST endpoint missing authorization | 4.3CNA v3.1 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-12494 | Image Gallery WordPress plugin arbitrary file deletion | 4.3CNA v3.1 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-12182 | Qi Blocks WordPress plugin missing authorization to arbitrary Attachment Resize | 4.3CNA v3.1 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-11990 | Improper Handling of URL Encoding (Hex Encoding) in GitLab | 3.1CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-11865 | Incorrect authorization in GitLab | 4.3CNA v3.1 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-9317 | AVEVA Edge use of a broken or risky cryptographic algorithm | 8.3CNA v4.0 | 0.1% | 2025-11-15 | Fix |
| CVE-2025-8994 | Project Management WordPress plugin SQL injection | 6.5CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-8386 | AVEVA Application Server IDE Basic cross-site scripting | 7.2CNA v4.0 | 0.2% | 2025-11-15 | Fix |
| CVE-2025-7736 | Incorrect authorization in GitLab | 3.1CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-7000 | Insertion of sensitive information into sent data in GitLab | 4.3CNA v3.1 | 0.4% | 2025-11-15 | Fix |
| CVE-2025-6945 | Improper neutralization of special elements used in a command (command injection) in GitLab | 3.5CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-6171 | Missing authorization in GitLab | 5.3CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-2615 | Insertion of sensitive information into sent data in GitLab | 4.3CNA v3.1 | 0.3% | 2025-11-15 | Fix |
| CVE-2025-64446 | Fortinet FortiWeb path traversal | 9.4CNA v3.1 | 92.0% | 2025-11-14 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-64444 | Sony Network Communications NCP-HG100/Cellular model OS command improper neutralization | 8.6CNA v4.0 | 1.2% | 2025-11-14 | |
| CVE-2025-64084 | Magicbug Cloudlog authenticated SQL injection | 5.4CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-63891 | oretnom23 Simple Online Book Store System information disclosure | 7.5CISA ADP v3.1 | 0.5% | 2025-11-14 | |
| CVE-2025-63830 | CKSource CKFinder cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-14 | Exploit code |
| CVE-2025-63745 | radare2 null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-63744 | radare2 null pointer dereference | 4.3CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-63725 | Radioinorr SVXportal reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-63724 | Radioinorr SVXportal SQL injection | 6.0CISA ADP v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-63701 | Advantech Tp 3250 heap-based buffer overflow | 6.8CISA ADP v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-63680 | Nero Backitup path traversal | 8.6CISA ADP v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-63291 | Alteryx Server insecure direct object reference | 5.4CISA ADP v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-55073 | Mattermost MS Teams plugin OAuth allows editing arbitrary posts | 5.4CNA v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-55070 | Mattermost lack of MFA enforcement in WebSocket connections | 6.5CNA v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-54562 | Desktopalert Pingalert Application Server information disclosure through error messages | 4.3CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-54561 | Desktopalert Pingalert Application Server Incorrect improper access control | 4.3CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-54560 | Desktopalert Pingalert Application Server server-side request forgery | 3.8CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-54559 | Desktopalert Pingalert Application Server path traversal | 3.7CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-54348 | Desktopalert Pingalert Application Server cross-site scripting | 6.5CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-54346 | Desktopalert Pingalert Application Server cross-site scripting | 7.6CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-54345 | Desktopalert Pingalert Application Server information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-54343 | Desktopalert Pingalert Application Server Incorrect improper access control | 9.6CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-54342 | Desktopalert Pingalert Application Server cleartext storage of sensitive information | 3.3CISA ADP v3.1 | 0.1% | 2025-11-14 | Fix |
| CVE-2025-54340 | Desktopalert Pingalert Application Server weak cryptographic algorithm | 4.1CISA ADP v3.1 | 0.1% | 2025-11-14 | Fix |
| CVE-2025-54339 | Desktopalert Pingalert Application Server Incorrect improper access control | 10.0CISA ADP v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-41436 | Mattermost unauthorized access to archived channel content via threads interface | 3.1CNA v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-13204 | expr-eval vulnerable to prototype pollution | 7.3CISA ADP v3.1 | 0.5% | 2025-11-14 | Fix |
| CVE-2025-13188 | D-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow | 9.3CNA v4.0 | 2.4% | 2025-11-14 | Emerging Threats |
| CVE-2025-13187 | Intelbras ICIP acessodeusuario.xml credentials storage | 7.5NVD v3.1 | 0.5% | 2025-11-14 | |
| CVE-2025-13186 | Bdtask Isshue Multi Store eCommerce Shopping Cart Solution cross-site scripting | 5.4v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-13185 | Bdtask/CodeCanyon News365 profile unrestricted upload | 7.2v3.1 | 0.4% | 2025-11-14 | |
| CVE-2025-13182 | pojoin H3BLOG addtitle cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-13181 | pojoin H3BLOG add cross-site scripting | 4.8NVD v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-13180 | Bdtask Wholesale Inventory Control and Inventory Management System cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-13179 | Bdtask Wholesale Inventory Control and Inventory Management System cross-site request forgery | 6.5v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-13178 | Bdtask/CodeCanyon SalesERP User Profile edit_profile cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-13177 | Bdtask/CodeCanyon SalesERP cross-site request forgery | 8.8v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | 5.3CNA v4.0 | 0.3% | 2025-11-14 | |
| CVE-2025-13172 | CodeAstro Gym Management System view-member-report.php SQL injection | 8.8NVD v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-13171 | ZZCMS wangkan_list.php SQL injection | 8.8v3.1 | 0.4% | 2025-11-14 | |
| CVE-2025-13170 | code-projects Simple Online Hotel Reservation System edit_account.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-14 | |
| CVE-2025-13169 | code-projects Simple Online Hotel Reservation System add_query_reserve.php SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-14 | |
| CVE-2025-13168 | ury-erp Ury pos_extend.py overrided_past_order_list SQL injection | 9.8v3.1 | 0.4% | 2025-11-14 | Fix |
| CVE-2025-13161 | IQ Service International｜IQ-Support arbitrary file read | 8.7CNA v4.0 | 0.5% | 2025-11-14 | Fix |
| CVE-2025-13160 | IQ Service International｜IQ-Support exposure of sensitive information | 6.9CNA v4.0 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-13107 | Google Chrome Compositing inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-13102 | Google Chrome WebApp Installs inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-13097 | Google Chrome DevTools inappropriate implementation | 5.4CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-13033 | Nodemailer: Nodemailer: Email to an unintended domain can occur due to interpretation conflict | 7.5CNA v3.1 | 0.5% | 2025-11-14 | Fix |
| CVE-2025-12904 | SNORDIAN's H5PxAPIkatchu WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-12149 | floragunn Search Guard FLX Signals watch document-level security information disclosure | 6.0CNA v4.0 | 0.3% | 2025-11-14 | |
| CVE-2025-11981 | School Management System WPSchoolPress WordPress plugin authenticated (Administrator+) SQL injection | 4.9CNA v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-11918 | Rockwell Automation Arena® Simulation stack-based buffer overflow | 7.1CNA v4.0 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-11794 | Mattermost password hash and MFA secret returned in user email verification endpoint | 4.9CNA v3.1 | 0.3% | 2025-11-14 | Fix |
| CVE-2025-11776 | Mattermost guest user can discover archived public channels | 4.3CNA v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-10686 | Creta Testimonial Showcase WordPress plugin Editor+ local file inclusion | 7.2CISA ADP v3.1 | 0.5% | 2025-11-14 | Fix |
| CVE-2025-10018 | Multiple stored XSS in QuickCMS | 4.8NVD v3.1 | 0.2% | 2025-11-14 | |
| CVE-2025-9982 | OpenSolution QuickCMS hard-coded admin credentials in Quick.CMS | 7.5NVD v3.1 | 0.3% | 2025-11-14 | |
| CVE-2025-9479 | Google Chrome V8 out-of-bounds read | 4.3CISA ADP v3.1 | 0.2% | 2025-11-14 | Fix |
| CVE-2025-8870 | Arista EOS serial console input handler vulnerability | 5.6CNA v4.0 | 0.2% | 2025-11-14 | |
| CVE-2025-8855 | 2FA Expiry Bypass in Optimus Software's Brokerage Automation | 8.1CNA v3.1 | 0.4% | 2025-11-14 | Fix |
| CVE-2025-4618 | Prisma Browser: Sensitive information disclosure vulnerability in Prisma Browser | 4.4CNA v4.0 | 0.1% | 2025-11-14 | Fix |
| CVE-2025-4617 | Prisma Browser: Insufficient policy enforcement vulnerability in Prisma Browser | 1.1CNA v4.0 | 0.1% | 2025-11-14 | Fix |
| CVE-2025-4616 | Prisma Browser: Insufficient Validation of Untrusted Input vulnerability in Prisma Browser | 1.1CNA v4.0 | 0.1% | 2025-11-14 | Fix |
| CVE-2025-64754 | Jitsi Meet has DOM Redirect on Microsoft OAuth Flow | 2.7CNA v4.0 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-64753 | grist-core compare endpoint incorrect authorization | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64752 | grist-core has path to server-side requests via websocket | 6.8CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64749 | Directus vulnerable to information leakage in Existing Collections | 4.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64748 | Directus's conceal fields are searchable if read permissions enabled | 6.5CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64747 | Directus vulnerable to stored cross-site scripting | 5.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64746 | Directus has improper permission Handling on Deleted fields | 4.6CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64745 | Astro development server error page vulnerable to reflected cross-site scripting | 2.7CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64744 | OpenObserve vulnerable to HTML injection in Organization Invitation Emails | 3.5CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-64741 | Zoom Workplace for Android improper authorization Handling | 8.1CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-64740 | Zoom Workplace VDI Client for Windows improper verification of cryptographic signature | 7.5CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-64739 | Zoom Clients external control of file name or path | 4.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64738 | Zoom Workplace for macOS external control of file name or path | 5.0CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64726 | Firewall arbitrary code execution | 7.3CNA v4.0 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-64718 | js-yaml merge operator prototype pollution | 5.3CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-64717 | ZITADEL vulnerable to account takeover with deactivated Instance IdP | 7.4CNA v4.0 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-64716 | Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode | 5.1CNA v4.0 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-64714 | PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal | 5.8CNA v3.1 | 0.5% | 2025-11-13 | Exploit codeFix |
| CVE-2025-64711 | PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users | 3.9CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-64710 | Bitplatform Boilerplate has cross-site scripting | 5.3CNA v4.0 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64709 | Typebot may Expose AWS EKS Credentials via server side request forgery in Webhook block | 9.6CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-64706 | Typebot IDOR vulnerability: Unauthorized API Token Deletion and Exposure | 5.0CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64703 | MaxKB has information leak in sandbox | 6.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64530 | Apollo GraphQL Federation composition logic vulnerability | 7.5CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-64525 | Astro vulnerable to URL manipulation via headers, leading to middleware and bypass | 6.5CNA v3.1 | 1.2% | 2025-11-13 | NucleiFix |
| CVE-2025-64511 | MaxKB has SSRF in sandbox | 7.4CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64384 | JetFormBuilder WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64383 | Qi Blocks WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64382 | Order Export and Order Import for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64381 | Booking Calendar WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64380 | Booster for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64379 | Booster for WooCommerce WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64370 | YOP Poll WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64369 | Contact Form Email WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64292 | Analytics Germanized for Google Analytics WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64277 | ChatBot WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-64276 | Survey Maker WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64275 | Booking Manager WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64274 | WPKoi Templates for Elementor WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64271 | WP Plugin Manager WordPress plugin cross-site request forgery (CSRF) | 6.5NVD v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-64269 | WooCommerce PDF Invoice Builder WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64267 | WooCommerce Ultimate Points And Rewards WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64265 | Frontend File Manager WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64264 | Popup addon for Ninja Forms WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64263 | WP Content Pilot WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64262 | Auto Prune Posts WordPress plugin cross-site request forgery (CSRF) | 6.5CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-64261 | Appointment Booking Calendar WordPress plugin broken access control | 5.4CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-64259 | Theater for WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-63406 | groupoffice command injection | 8.8CISA ADP v3.1 | 0.7% | 2025-11-13 | Exploit code |
| CVE-2025-62484 | Zoom Workplace Clients inefficient regular expression complexity | 8.1CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-62483 | Zoom Clients improper removal of sensitive information | 5.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-62482 | Zoom Workplace for Windows cross-site scripting | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-60702 | TOTOLINK A950RG command injection | 6.5CISA ADP v3.1 | 2.5% | 2025-11-13 | |
| CVE-2025-60701 | D-Link DIR-882 command injection | 6.5CISA ADP v3.1 | 3.2% | 2025-11-13 | |
| CVE-2025-60700 | D-Link DIR-882 command injection | 6.5CISA ADP v3.1 | 3.2% | 2025-11-13 | |
| CVE-2025-60699 | TOTOLINK A950RG buffer overflow | 6.5CISA ADP v3.1 | 0.8% | 2025-11-13 | |
| CVE-2025-60698 | D-Link DIR-882 command injection | 7.3CISA ADP v3.1 | 3.9% | 2025-11-13 | |
| CVE-2025-60697 | D-Link DIR-882 command injection | 7.3CISA ADP v3.1 | 3.8% | 2025-11-13 | |
| CVE-2025-60696 | Linksys RE7000 makeRequest.cgi binary stack-based buffer overflow | 8.4CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-60695 | Linksys E7350 mtk_dut binary stack-based buffer overflow | 5.9CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-60694 | Linksys E1200 stack-based buffer overflow | 7.5CISA ADP v3.1 | 1.1% | 2025-11-13 | Emerging Threats |
| CVE-2025-60693 | Linksys E1200 get_merge_mac function of the httpd binary stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.8% | 2025-11-13 | |
| CVE-2025-60692 | Linksys E1200 libshared.so library of Cisco stack-based buffer overflow | 8.4CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-60691 | Linksys E1200 httpd binary stack-based buffer overflow | 8.8CISA ADP v3.1 | 0.7% | 2025-11-13 | |
| CVE-2025-60690 | Linksys E1200 get_merge_ipaddr function of the httpd binary stack-based buffer overflow | 8.8CISA ADP v3.1 | 3.9% | 2025-11-13 | Exploit code |
| CVE-2025-60689 | Linksys E1200 Start_EPI function of the httpd binary command injection | 5.4CISA ADP v3.1 | 18.3% | 2025-11-13 | Exploit code |
| CVE-2025-60688 | TOTOLINK LR1200GB stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.5% | 2025-11-13 | |
| CVE-2025-60687 | TOTOLINK LR1200GB command injection | 6.5CISA ADP v3.1 | 6.6% | 2025-11-13 | |
| CVE-2025-60686 | TOTOLINK LR1200GB infostat.cgi and cstecgi.cgi binaries stack-based buffer overflow | 5.1CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-60685 | TOTOLINK A720R stack-based buffer overflow | 5.1CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-60684 | TOTOLINK LR1200GB stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.5% | 2025-11-13 | |
| CVE-2025-60683 | TOTOLINK A720R command injection | 6.5CISA ADP v3.1 | 1.0% | 2025-11-13 | |
| CVE-2025-60682 | TOTOLINK A720R command injection | 6.5CISA ADP v3.1 | 1.5% | 2025-11-13 | |
| CVE-2025-60679 | D-Link DIR-816 stack-based buffer overflow | 8.8CISA ADP v3.1 | 0.7% | 2025-11-13 | |
| CVE-2025-60676 | D-Link DIR-878 command injection | 6.5CISA ADP v3.1 | 3.5% | 2025-11-13 | |
| CVE-2025-60675 | D-Link DIR-823G command injection | 5.4CISA ADP v3.1 | 1.5% | 2025-11-13 | |
| CVE-2025-60674 | D-Link DIR-878 stack-based buffer overflow | 6.8CISA ADP v3.1 | 0.6% | 2025-11-13 | |
| CVE-2025-60673 | D-Link DIR-878 command injection | 6.5CISA ADP v3.1 | 3.5% | 2025-11-13 | |
| CVE-2025-60672 | D-Link DIR-878 command injection | 6.5CISA ADP v3.1 | 3.6% | 2025-11-13 | |
| CVE-2025-60671 | D-Link DIR-823G command injection | 5.4CISA ADP v3.1 | 1.4% | 2025-11-13 | |
| CVE-2025-59840 | Vega cross-site scripting | 8.1CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-59480 | Mattermost inadequate validation of SSO redirect credentials permits credential theft | 6.1CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-59367 | ASUS DSL-AC51 authentication bypass | 9.3CNA v4.0 | 0.9% | 2025-11-13 | |
| CVE-2025-55810 | Alagaai S-cw2503c-h unrestricted file upload | 6.8CISA ADP v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-52186 | Lichess Lila server-side request forgery | 6.5CISA ADP v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-47913 | Potential denial of service in golang.org/x/crypto/SSH/agent | 7.5CISA ADP v3.1 | 0.6% | 2025-11-13 | Fix |
| CVE-2025-47222 | Keyfactor Signserver improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-47221 | Keyfactor Signserver arbitrary file write | 5.3CISA ADP v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-47220 | Keyfactor Signserver improper access control | 5.3CISA ADP v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-46370 | Dell Alienware Command Center 6.x (AWCC) information disclosure | 3.3CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-46369 | Dell Alienware Command Center 6.x (AWCC) insecure temporary file | 7.8CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-46368 | Dell Alienware Command Center 6.x (AWCC) insecure temporary file | 6.6CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-46367 | Dell Alienware Command Center arbitrary code execution | 7.8CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-46362 | Dell Alienware Command Center 6.x (AWCC) improper access control | 6.6CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-43515 | Apple Compressor arbitrary code execution | 8.8CISA ADP v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-41069 | Insecure direct object references (IDOR) in DeporSite of T-Innova DeporSite | 5.3CNA v4.0 | 0.2% | 2025-11-13 | |
| CVE-2025-40681 | Cross-site scripting (XSS) in xCally Omnichannel | 5.1CNA v4.0 | 0.3% | 2025-11-13 | |
| CVE-2025-36251 | IBM AIX command execution | 9.6CNA v3.1 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-36250 | IBM AIX code execution | 10.0CNA v3.1 | 0.7% | 2025-11-13 | Fix |
| CVE-2025-36236 | IBM AIX path traversal | 8.2CNA v3.1 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-36096 | IBM AIX insufficiently protected credentials | 9.0CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-30669 | Zoom Workplace Clients improper certificate validation | 4.8CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-30662 | Zoom Workplace VDI Plugin macOS Universal Installer symlink following | 6.6CNA v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-20355 | Cisco Catalyst Center Software HTTP open redirect | 4.7CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-20353 | Cisco Catalyst Center cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-20349 | Cisco DNA Center API command injection | 6.3CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-20346 | Cisco Catalyst Center privilege escalation | 4.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-20341 | Cisco Catalyst Center privilege escalation | 8.8CNA v3.1 | 0.5% | 2025-11-13 | Fix |
| CVE-2025-13131 | Sonarr Service Sonarr.Console.exe default permission | 8.5CNA v4.0 | 0.1% | 2025-11-13 | |
| CVE-2025-13130 | Radarr Service Radarr.Console.exe default permission | 8.5CNA v4.0 | 0.1% | 2025-11-13 | |
| CVE-2025-13123 | AMTT Hotel Broadband Operation System get_firstdate.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-13122 | SourceCodester Patients Waiting Area Queue Management System patient check-in API SQL injection | 9.8NVD v3.1 | 0.4% | 2025-11-13 | |
| CVE-2025-13121 | cameasy Liketea API Endpoint StoreController.php list SQL injection | 6.9CNA v4.0 | 0.4% | 2025-11-13 | |
| CVE-2025-13120 | mruby array.c sort_cmp use-after-free | 5.5v3.1 | 0.1% | 2025-11-13 | Fix |
| CVE-2025-13119 | Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery | 6.5v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-13118 | macrozheng mall-swarm paySuccess improper authorization | 4.3v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-13117 | macrozheng mall-swarm/mall cancelOrder improper authorization | 5.3v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-13116 | macrozheng mall-swarm/mall cancelUserOrder improper authorization | 5.3v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-13115 | macrozheng mall-swarm/mall Order Details detail improper authorization | 5.3v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-13114 | macrozheng mall-swarm attr updateAttr improper authorization | 5.3NVD v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-12979 | Welcart e-Commerce WordPress plugin missing authorization to unauthenticated information exposure | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12892 | Survey Maker WordPress plugin missing authorization to unauthenticated limited option update | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12891 | Survey Maker WordPress plugin missing authorization to unauthenticated information exposure | 5.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12844 | AI Engine WordPress plugin authenticated (Subscriber+) PHP object injection via PHAR deserialization | 7.1CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-12818 | PostgreSQL libpq undersizes allocations, via integer wraparound | 5.9CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12817 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege | 3.1CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12785 | Certain HP LaserJet Pro Printers potential information disclosure | 6.9CNA v4.0 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12784 | Certain HP LaserJet Pro Printers potential information disclosure | 6.9CNA v4.0 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12765 | pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass | 7.5CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12764 | pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow | 7.5CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-12763 | pgAdmin 4 has command injection vulnerability on Windows systems | 6.8CNA v3.1 | 0.9% | 2025-11-13 | Fix |
| CVE-2025-12762 | Remote code execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) | 9.1CNA v3.1 | 12.7% | 2025-11-13 | Exploit codeFix |
| CVE-2025-12733 | Import any XML, CSV or Excel File to WordPress (WP All Import) plugin remote code execution | 8.8CNA v3.1 | 0.6% | 2025-11-13 | Fix |
| CVE-2025-12681 | Comment Edit Core WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12620 | Poll Maker Versus Polls, Anonymous Polls, Image Polls WordPress plugin SQL injection | 4.9CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12536 | SureForms WordPress plugin missing authorization to unauthenticated sensitive information exposure | 5.3CNA v3.1 | 0.8% | 2025-11-13 | NucleiFix |
| CVE-2025-12377 | Gallery Plugin for WordPress WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-12366 | Page Builder: Pagelayer WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-12089 | Data Tables Generator by Supsystic WordPress plugin authenticated (Admin+) arbitrary file deletion | 6.5CNA v3.1 | 0.6% | 2025-11-13 | Fix |
| CVE-2025-12015 | sanderkah Convert WebP and AVIF Afosto disconnect endpoint missing authorization | 4.3CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-11923 | LifterLMS WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-11-13 | Fix |
| CVE-2025-11777 | Mattermost cross-team channel membership access | 3.1CNA v3.1 | 0.2% | 2025-11-13 | Fix |
| CVE-2025-11769 | WordPress Content Flipper plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-11538 | keycloak keycloak-server: Debug default bind address | 6.8CNA v3.1 | 0.4% | 2025-11-13 | Fix |
| CVE-2025-11260 | WP Headless CMS Framework WordPress plugin unauthenticated Protection Mechanism bypass | 5.3CNA v3.1 | 0.3% | 2025-11-13 | |
| CVE-2025-10295 | Angel Fashion Model Agency WordPress CMS theme stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-8397 | Save as PDF Button WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-7704 | SMCI SYS-111C-NR supermicro BMC SMASH services has a stack-based buffer overflow | 5.4CNA v3.1 | 0.2% | 2025-11-13 | |
| CVE-2025-4619 | PAN-OS: Firewall denial of service (DoS) using Specially Crafted Packets | 6.6CNA v4.0 | 0.6% | 2025-11-13 | Fix |
| CVE-2025-65002 | Fujitsu / Fsas Technologies iRMC incorrect authorization | 7.5CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-65001 | Fujitsu fbiosdrv.sys out-of-bounds write | 8.2CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64707 | Frappe LMS revoking access did not show immediate effect as roles were cached | 1.2CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-64705 | Frappe user was able to access the submission of other students | 1.3CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-64523 | FileBrowser has insecure direct object reference (IDOR) in Share Deletion function | 7.2CNA v4.0 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-64517 | sudo-rs doesn't record authenticating user properly in timestamp | 4.4CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-64503 | OpenPrinting cups-filters pdftoraster out-of-bounds write | 4.0CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-64500 | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass | 7.3CNA v3.1 | 1.3% | 2025-11-12 | NucleiFix |
| CVE-2025-64482 | Tuleap missing CSRF protections in the File Release System | 4.6CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64429 | DuckDB Encryption Crypto implementation is vulnerable | 6.9CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64407 | Apache OpenOffice external link loading information disclosure | 5.3v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-64406 | Apache OpenOffice: Possible memory corruption during CSV import | 4.3CISA ADP v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-64405 | Apache OpenOffice: Remote documents loaded without prompt via DDE function | 7.5v3.1 | 1.4% | 2025-11-12 | Fix |
| CVE-2025-64404 | Apache OpenOffice: Remote documents loaded without prompt via background and bullet images | 7.5v3.1 | 1.2% | 2025-11-12 | Fix |
| CVE-2025-64403 | Apache OpenOffice: Remote documents loaded without prompt via external data sources in Calc | 8.1CISA ADP v3.1 | 1.2% | 2025-11-12 | Fix |
| CVE-2025-64402 | Apache OpenOffice: Remote documents loaded without prompt via OLE objects | 6.5CISA ADP v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-64401 | Apache OpenOffice: Remote documents loaded without prompt via IFrame | 7.5CISA ADP v3.1 | 0.9% | 2025-11-12 | Fix |
| CVE-2025-64345 | Wasmtime provides unsound API access to a WebAssembly shared linear memory | 1.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64293 | 0 Day Analytics WordPress plugin SQL injection | 7.6CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-64281 | CentralSquare Community Development authentication bypass | 9.8CISA ADP v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-64280 | CentralSquare Community Development SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-64186 | Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves | 8.7CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64170 | trifectatechfoundation sudo-rs password prompt timeout information disclosure | 3.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64117 | Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags | 4.6CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-64099 | OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info | 8.1CNA v4.0 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-63929 | Airpig2011 IEC104 null pointer dereference | 7.5CISA ADP v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-63927 | Airpig2011 IEC104 heap- use-after-free | 4.0CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-63811 | JOSE2GO is vulnerable to a JWT bomb attack through its decode function | 7.5CISA ADP v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-63679 | free5gc buffer overflow | 7.5NVD v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-63667 | Asecam, Keview and Simicam IP cameras API endpoints improper access control | 7.5CISA ADP v3.1 | 0.5% | 2025-11-12 | Exploit code |
| CVE-2025-63666 | Tenda AC15 improper access control | 9.8CISA ADP v3.1 | 0.5% | 2025-11-12 | Exploit code |
| CVE-2025-63645 | PH7BUILDER PH7 Social Dating Builder pH7Software pH7-Social-Dating-CMS stored cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-63419 | CrushFTP cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-63396 | Linux Foundation PyTorch improper locking | 3.3CISA ADP v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-63353 | FiberHome HG6145F1 default credentials | 9.8CISA ADP v3.1 | 1.3% | 2025-11-12 | Exploit code |
| CVE-2025-63289 | Sogexia hard-coded cryptographic key | 9.1CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-62876 | SUSE openSUSE lightdm-kde-greeter execution with unnecessary privileges | 5.3CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-61667 | Datadog Agent pycache directory permissions privilege escalation | 7.0CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-61623 | Apache OFBiz: Reflected cross-site scripting | 6.5CISA ADP v3.1 | 0.8% | 2025-11-12 | Fix |
| CVE-2025-60646 | Xuxueli Xxl-api Business Line Management module stored cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-60645 | Xuxueli Xxl-api cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-59491 | CentralSquare Community Development cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-59118 | Apache OFBiz: Critical remote command execution via unrestricted file upload | 7.3CISA ADP v3.1 | 1.6% | 2025-11-12 | Fix |
| CVE-2025-59089 | latchset kdcproxy python-kdcproxy: Remote DoS via unbounded tcp upstream buffering | 5.9CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-59088 | latchset kdcproxy python-kdcproxy: Unauthenticated SSRF via realm‑controlled DNS srv | 8.6CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-57812 | CUPS-Filters has heap-buffer-overflow write in `cfImageLut` | 3.7CNA v3.1 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-57310 | Salmen Simple Faucet Script cross-site request forgery | 8.8CISA ADP v3.1 | 0.3% | 2025-11-12 | Exploit code |
| CVE-2025-56385 | Wellsky Harmony login functionality SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-54983 | Zscaler Client Connector health check port on ZCC allows tunnel bypass | 5.2CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-52331 | RARLAB WinRAR generate report functionality cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-46608 | Dell Data Lakehouse improper access control | 9.1CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-46428 | Dell SmartFabric OS10 Software command injection | 8.8CNA v3.1 | 1.2% | 2025-11-12 | Fix |
| CVE-2025-46427 | Dell SmartFabric OS10 Software command injection | 8.8CNA v3.1 | 1.2% | 2025-11-12 | Fix |
| CVE-2025-43205 | Apple iPadOS out-of-bounds read | 4.0CISA ADP v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40208 | Linux kernel iris video codec driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40207 | Linux kernel V4L2 subdev state allocation vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40206 | Linux kernel netfilter objref expressions denial of service | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40205 | Linux kernel btrfs file handle encoding out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40204 | Linux kernel SCTP MAC verification vulnerability | 8.1CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-40203 | Linux kernel listmount namespace release vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40202 | Linux kernel IPMI user message limit handling use-after-free | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40201 | Linux kernel prlimit64 task locking race condition | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40200 | Linux kernel Squashfs inode reading vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40199 | Linux kernel page pool memory tagging denial of service | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40198 | Linux kernel ext4 mount options parsing out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40197 | Linux kernel media controller device release vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40196 | Linux kernel quota release workqueue denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40195 | Linux kernel listmount namespace release null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40194 | Linux kernel intel_pstate QoS request handling vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40193 | Linux kernel xtensa simdisk driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40192 | Linux kernel IPMI message handling denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40191 | Linux kernel AMDKFD userptr unmapping vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40190 | Linux kernel ext4 extended attribute inode refcount integer underflow | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40189 | Linux kernel lan78xx EEPROM read vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40188 | Linux kernel Berlin PWM driver suspend and resume denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40187 | Linux kernel net/sctp null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-40186 | In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue | 8.1CNA v3.1 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-40185 | Linux kernel ice_adapter null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40184 | Linux kernel KVM nVHE guest page mapping denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40183 | Linux kernel BPF neighbor redirect helper memory leak | 7.5CNA v3.1 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-40182 | Linux kernel skcipher request size handling memory corruption | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40181 | Linux kernel TDX/SNP guest MTRR configuration information disclosure | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40180 | Linux kernel ZynqMP IPI mailbox driver out-of-bounds access | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40179 | Linux kernel ext4 orphan file handling vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40178 | Linux kernel pid kernel panic | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40177 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40176 | Linux kernel TLS async decryption use-after-free | 9.8CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-40175 | Linux kernel idpf driver PTP timestamping vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40174 | Linux kernel x86 TLB flush handling vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40173 | Linux kernel IPv6 tunnel driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40172 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DM | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40171 | In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work | 7.5CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-40170 | In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hop | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40169 | Linux kernel BPF verifier vulnerability | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40168 | Linux kernel SMC protocol use-after-free | 8.1CNA v3.1 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-40167 | Linux kernel ext4 filesystem denial of service | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40166 | Linux kernel Xe GPU GuC exec queue vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40165 | Linux kernel i.MX8 ISI memory-to-memory driver vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40164 | Linux kernel usbnet driver vulnerability | 5.5v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40163 | Linux kernel deadline scheduler vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40162 | Linux kernel amd/sdw_utils null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40161 | Linux kernel ZynqMP IPI mailbox driver denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40160 | Linux kernel Xen event channel VIRQ binding denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40159 | Linux kernel xsk integer overflow | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40158 | Linux kernel IPv6 output path use-after-free | 8.1CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-40157 | Linux kernel i10nm EDAC driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40156 | Linux kernel mtk-cci devfreq driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40155 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, pro | 7.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40154 | Linux kernel bytcr_rt5640 audio driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40153 | Linux kernel hugetlb memory protection denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40152 | Linux kernel MSM GPU driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40151 | Linux kernel LoongArch BPF trampoline denial of service | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40150 | Linux kernel f2fs garbage collection race condition | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40149 | Linux kernel TLS socket lookup use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40148 | Linux kernel AMD display cursor attributes null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40147 | Linux kernel block I/O throttling null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40146 | Linux kernel block multiqueue scheduler tags deadlock | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40145 | In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto err_regulator_fr | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40143 | Linux kernel BPF verifier vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40142 | Linux kernel ALSA PCM group lock deadlock | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40141 | Linux kernel Bluetooth ISO connection handling use-after-free | 8.0CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-40140 | Linux kernel rtl8150 USB Ethernet driver vulnerability | 8.8CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-40139 | Linux kernel SMC connection setup use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40138 | Linux kernel f2fs quota consistency check null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40137 | Linux kernel f2fs truncate error handling vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40136 | Linux kernel HiSilicon QM crypto driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40135 | Linux kernel ipv6 use-after-free | 8.1CNA v3.1 | 0.7% | 2025-11-12 | Fix |
| CVE-2025-40134 | Linux kernel device mapper suspend handling null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40133 | Linux kernel MPTCP active enable use-after-free | 8.1CNA v3.1 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-40132 | Linux kernel Intel sof_sdw audio driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40131 | Linux kernel ath12k Wi-Fi driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40130 | Linux kernel UFS PM QoS handling race condition | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40129 | Linux kernel SunRPC GSS authentication null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-40127 | Linux kernel ks-sa hardware RNG driver denial of service | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40126 | Linux kernel UltraSPARC user copy functions vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40125 | Linux kernel blk-mq hardware queue sysfs handling vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40124 | Linux kernel UltraSPARC III user copy functions vulnerability | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40123 | Linux kernel BPF tailcall verification null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40122 | Linux kernel Intel PMC MSR configuration vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40121 | Linux kernel bytcr_rt5651 audio driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40120 | Linux kernel asix deadlock | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40119 | Linux kernel ext4 null pointer dereference | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40118 | Linux kernel pm80xx SAS driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40117 | Linux kernel pci_endpoint_test ioctl handling vulnerability | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40116 | Linux kernel max3421 USB host controller driver vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40115 | Linux kernel mpt3sas transport port removal vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40113 | Linux kernel pas crash | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40112 | Linux kernel Niagara user memory copy functions vulnerability | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-40111 | Linux kernel vmwgfx resource validation use-after-free | 7.8CNA v3.1 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-40110 | Linux kernel vmwgfx cursor snooping vulnerability | – | 0.2% | 2025-11-12 | Fix |
| CVE-2025-37734 | Kibana origin validation error | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-36223 | IBM OpenPages host header injection | 5.4CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-33119 | IBM QRadar SIEM information disclosure | 6.5CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-27368 | IBM OpenPages information disclosure | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-25236 | Omnissa Workspace ONE UEM response discrepancy | 5.3CNA v3.1 | 0.2% | 2025-11-12 | |
| CVE-2025-20379 | Splunk Enterprise streams search endpoint vulnerability | 3.5CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-20378 | Open redirect on Web Login endpoint in Splunk Enterprise | 3.1CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-13076 | code-projects Responsive Hotel Site usersetting.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-13075 | code-projects Responsive Hotel Site usersettingdel.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-13063 | DinukaNavaratna Dee Store missing authorization | 6.9CNA v4.0 | 0.3% | 2025-11-12 | |
| CVE-2025-13061 | itsourcecode Online Voting System index.php unrestricted upload | 8.8v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-13060 | SourceCodester Survey Application System view_survey.php SQL injection | 9.8v3.1 | 0.4% | 2025-11-12 | |
| CVE-2025-13059 | SourceCodester Alumni Management System manage_career.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-13058 | soerennb eXtplorer Filename cross-site scripting | 5.4v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-13057 | Campcodes School Fees Payment Management System ajax.php SQL injection | 9.8v3.1 | 0.3% | 2025-11-12 | |
| CVE-2025-13042 | Google Chrome V8 inappropriate implementation | 8.8CISA ADP v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-12998 | Broken authentication in extension modules (modules) | 8.2CNA v4.0 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-12903 | Payment Plugins Braintree For WooCommerce WordPress plugin authorization bypass | 7.5CNA v3.1 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-12901 | Asgaros Forum WordPress plugin cross-site request forgery to Subscription settings update | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12872 | AEnrich｜eHRD stored cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12871 | AEnrich｜a+HRD Authentication Abuse | 9.3CNA v4.0 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-12870 | AEnrich｜eHRD Authentication Abuse | 9.3CNA v4.0 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-12869 | AEnrich｜eHRD stored cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12833 | GeoDirectory WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12732 | WP Import WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-12633 | Booking Calendar WordPress plugin unauthorized access | 7.5CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-12382 | Path traversal allows remote code execution in AlgoSec Firewall Analyzer | 7.3CNA v4.0 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-12113 | WebToffee Alt Text Generator AI API key deletion function missing authorization | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12087 | Wishlist and Save for later for Woocommerce WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12048 | Lenovo Scanner Pro unrestricted file upload | 7.7CNA v4.0 | 0.2% | 2025-11-12 | |
| CVE-2025-12047 | Lenovo Scanner Pro improper certificate validation | 6.0CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-12018 | MembershipWorks WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-11994 | Easy Email Subscription WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2025-11-12 | Fix |
| CVE-2025-11962 | Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse | 7.3CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-11797 | Autodesk 3ds Max DWG File Parsing use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-11795 | Autodesk 3ds Max JPG File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-11700 | N-central multiple XXE injection | 8.4CNA v4.0 | 30.7% | 2025-11-12 | Reported exploitedNucleiEmerging ThreatsKCVFix |
| CVE-2025-11567 | Schneider Electric PowerChute™ Serial Shutdown incorrect default permissions | 7.3CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-11566 | Schneider Electric PowerChute™ Serial Shutdown missing brute-force protection | 6.9CNA v4.0 | 0.5% | 2025-11-12 | Fix |
| CVE-2025-11565 | Schneider Electric PowerChute™ Serial Shutdown path traversal | 7.3CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-11560 | Team Members Showcase WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-11454 | Specific Content For Mobile WordPress plugin SQL injection | 6.5CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-11367 | N-central windows software probe remote code execution | 10.0CNA v4.0 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-11366 | N-central authentication bypass via path traversal | 9.4CNA v4.0 | 0.6% | 2025-11-12 | Fix |
| CVE-2025-10495 | Lenovo App Store improper certificate validation | 7.7CNA v4.0 | 0.2% | 2025-11-12 | Fix |
| CVE-2025-9316 | N-central unauthenticated sessionID generation | 6.9CNA v4.0 | 37.4% | 2025-11-12 | Reported exploitedNucleiEmerging ThreatsExploit codeKCVFix |
| CVE-2025-8485 | Lenovo App Store incorrect default permissions | 7.0CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-8421 | Lenovo Dock Manager incorrect default permissions | 5.2CNA v4.0 | 0.1% | 2025-11-12 | Fix |
| CVE-2025-2843 | Observability-operator: Observability operator privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-11-12 | Fix |
| CVE-2025-64773 | JetBrains YouTrack race condition | 2.7CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-64531 | Adobe Substance3D Stager use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-62453 | Microsoft GitHub Copilot and Visual Studio Code security feature bypass | 5.0CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-62452 | Microsoft Windows Routing and Remote Access Service (RRAS) remote code execution | 8.0CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-62449 | Microsoft Visual Studio Code CoPilot Chat Extension security feature bypass | 6.8CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62222 | Agentic AI and Visual Studio Code remote code execution | 8.8CNA v3.1 | 0.7% | 2025-11-11 | Exploit codeFix |
| CVE-2025-62220 | Microsoft Windows Subsystem for Linux GUI remote code execution | 8.8CNA v3.1 | 0.7% | 2025-11-11 | Fix |
| CVE-2025-62219 | Microsoft Wireless Provisioning System elevation of privilege | 7.0CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-62218 | Microsoft Wireless Provisioning System elevation of privilege | 7.0CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-62217 | Microsoft Windows Ancillary function driver for WinSock elevation of privilege | 7.0CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-62216 | Microsoft Office remote code execution | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-62215 | Microsoft Windows race condition | 7.0CNA v3.1 | 4.5% | 2025-11-11 | KEVExploit codeFix |
| CVE-2025-62214 | Visual Studio remote code execution | 6.7CNA v3.1 | 1.0% | 2025-11-11 | Fix |
| CVE-2025-62213 | Microsoft Windows Ancillary function driver for WinSock elevation of privilege | 7.0CNA v3.1 | 1.6% | 2025-11-11 | Fix |
| CVE-2025-62211 | Microsoft Dynamics 365 Field Service (online) spoofing | 8.7CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-62210 | Microsoft Dynamics 365 Field Service (online) spoofing | 8.7CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-62209 | Microsoft Windows License Manager information disclosure | 5.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62208 | Microsoft Windows License Manager information disclosure | 5.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62206 | Microsoft Dynamics 365 (on-premises) information disclosure | 6.5CNA v3.1 | 0.9% | 2025-11-11 | Fix |
| CVE-2025-62205 | Microsoft Office remote code execution | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-62204 | Microsoft SharePoint remote code execution | 8.0CNA v3.1 | 2.1% | 2025-11-11 | Fix |
| CVE-2025-62203 | Microsoft Excel remote code execution | 7.8CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62202 | Microsoft Excel information disclosure | 7.1CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62201 | Microsoft Excel remote code execution | 7.8CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62200 | Microsoft Excel remote code execution | 7.8CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-62199 | Microsoft Office remote code execution | 7.8CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-61845 | Adobe Format Plugins out-of-bounds read | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61844 | Adobe Format Plugins out-of-bounds read | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61843 | Adobe Format Plugins out-of-bounds read | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61842 | Adobe Format Plugins use-after-free | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61841 | Adobe Format Plugins out-of-bounds read | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61840 | Adobe Format Plugins out-of-bounds read | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61839 | Adobe Format Plugins out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61838 | Adobe Format Plugins heap-based buffer overflow | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61837 | Adobe Format Plugins heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61836 | Adobe Illustrator on iPad integer underflow (wrap or wraparound) | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61835 | Adobe Substance3D Stager integer underflow (wrap or wraparound) | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61834 | Adobe Substance3D Stager use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61833 | Adobe Substance3D Stager out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61832 | Adobe InDesign Desktop heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61831 | Adobe Illustrator out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61830 | Adobe Pass incorrect authorization | 7.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61829 | Adobe Illustrator on iPad heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61828 | Adobe Illustrator on iPad out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61827 | Adobe Illustrator on iPad heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61826 | Adobe Illustrator on iPad integer underflow (wrap or wraparound) | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61824 | Adobe InDesign Desktop heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61820 | Adobe Illustrator heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61819 | Adobe Photoshop Desktop heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61818 | Adobe InCopy use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61817 | Adobe InCopy use-after-free | 7.8CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-61816 | Adobe InCopy heap-based buffer overflow | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61815 | Adobe InDesign Desktop use-after-free | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-61814 | Adobe InDesign Desktop use-after-free | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-60728 | Microsoft Excel information disclosure | 4.3CNA v3.1 | 0.7% | 2025-11-11 | Fix |
| CVE-2025-60727 | Microsoft Excel remote code execution | 7.8CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-60726 | Microsoft Excel information disclosure | 7.1CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-60724 | Microsoft Office GDI+ remote code execution | 9.8CNA v3.1 | 5.9% | 2025-11-11 | Fix |
| CVE-2025-60723 | Microsoft Windows DirectX Graphics Kernel denial of service | 6.3CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-60722 | Microsoft OneDrive for Android elevation of privilege | 6.5CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-60721 | Microsoft Windows Administrator Protection elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-60720 | Microsoft Windows Transport driver Interface (TDI) Translation driver elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-60719 | Microsoft Windows Ancillary function driver for WinSock elevation of privilege | 7.0CNA v3.1 | 1.8% | 2025-11-11 | Exploit codeFix |
| CVE-2025-60718 | Microsoft Windows Administrator Protection elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-60717 | Microsoft Windows Broadcast DVR user service elevation of privilege | 7.0CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-60716 | Microsoft Windows DirectX Graphics Kernel elevation of privilege | 7.0CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-60715 | Microsoft Windows Routing and Remote Access Service (RRAS) remote code execution | 8.0CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-60714 | Microsoft Windows OLE remote code execution | 7.8CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-60713 | Microsoft Windows Routing and Remote Access Service (RRAS) elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-60710 | Microsoft Windows link following | 7.8CNA v3.1 | 4.6% | 2025-11-11 | KEVExploit codeFix |
| CVE-2025-60709 | Microsoft Windows Common Log File System driver elevation of privilege | 7.8CNA v3.1 | 0.5% | 2025-11-11 | Exploit codeFix |
| CVE-2025-60708 | Microsoft Windows storvsp.sys driver denial of service | 6.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-60707 | Microsoft Windows multimedia Class Scheduler Service (MMCSS) driver elevation of privilege | 7.8CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-60706 | Microsoft Windows Hyper-V information disclosure | 5.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-60705 | Microsoft Windows Client-Side Caching elevation of privilege | 7.8CNA v3.1 | 2.4% | 2025-11-11 | Fix |
| CVE-2025-60704 | Microsoft Windows Kerberos elevation of privilege | 7.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-60703 | Microsoft Windows Remote Desktop services elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-59515 | Microsoft Windows Broadcast DVR user service elevation of privilege | 7.0CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-59514 | Microsoft Streaming Service Proxy elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-59513 | Microsoft Windows Bluetooth RFCOM protocol driver information disclosure | 5.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-59512 | Microsoft Windows Customer Experience Improvement Program improper access control | 7.8CNA v3.1 | 2.9% | 2025-11-11 | Fix |
| CVE-2025-59511 | Microsoft Windows WLAN service elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-59510 | Microsoft Windows Routing and Remote Access Service (RRAS) denial of service | 5.5CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-59509 | Microsoft Windows Speech Recognition information disclosure | 5.5CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-59508 | Microsoft Windows Speech Recognition elevation of privilege | 7.0CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-59507 | Microsoft Windows Speech Runtime elevation of privilege | 7.0CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-59506 | Microsoft Windows DirectX Graphics Kernel elevation of privilege | 7.0CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-59505 | Microsoft Windows Smart Card Reader elevation of privilege | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-59504 | Microsoft Azure Monitor Agent remote code execution | 7.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-59499 | Microsoft SQL server elevation of privilege | 8.8CNA v3.1 | 1.1% | 2025-11-11 | Fix |
| CVE-2025-59240 | Microsoft Excel information disclosure | 5.5CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-47179 | Configuration Manager elevation of privilege | 6.7CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-42940 | Memory corruption vulnerability in SAP CommonCryptoLib | 7.5CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-42924 | Open redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) | 6.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42919 | Information disclosure vulnerability in SAP NetWeaver Application Server Java | 5.3CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-42899 | Missing authorization check in SAP S4CORE (Manage Journal Entries) | 4.3CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42897 | Information disclosure vulnerability in SAP Business One (SLD) | 5.3CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42895 | Code injection vulnerability in SAP HANA JDBC Client | 6.9CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42894 | Path traversal vulnerability in SAP Business Connector | 6.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-42893 | Open redirect vulnerability in SAP Business Connector | 6.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42892 | OS command injection vulnerability in SAP Business Connector | 6.8CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-42890 | Insecure key and Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) | 10.0CNA v3.1 | 0.7% | 2025-11-11 | Fix |
| CVE-2025-42889 | SQL injection vulnerability in SAP Starter Solution (PL SAFT) | 5.4CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42888 | Information disclosure vulnerability in SAP GUI for Windows | 5.5CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-42887 | Code injection vulnerability in SAP Solution Manager | 9.9CNA v3.1 | 0.6% | 2025-11-11 | Fix |
| CVE-2025-42886 | Reflected cross-site scripting (XSS) vulnerability in SAP Business Connector | 6.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-42885 | Missing authentication in SAP HANA (hdbrss) | 5.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-42884 | JNDI injection vulnerability in SAP NetWeaver Enterprise Portal | 6.5CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-42883 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP | 2.7CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-42882 | Missing authorization check in SAP NetWeaver Application Server for ABAP | 4.3CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41116 | Incorrect oauth passthrough in Grafana Databricks Datasource | 2.1CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-41106 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41105 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41104 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41103 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41102 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-41101 | Fairsketch RISE CRM Framework Fairsketch's HTML injection | 5.4v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-40827 | Siemens Software Center uncontrolled search path | 8.5CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-40817 | Siemens LOGO! 12/24RCE missing authentication | 7.1CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-40816 | Siemens LOGO! 12/24RCE missing authentication | 7.2CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-40815 | Siemens LOGO! 12/24RCE buffer overflow | 8.6CNA v4.0 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-40763 | Siemens Altair Grid Engine uncontrolled search path | 8.5CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-40760 | Siemens Altair Grid Engine information disclosure through error messages | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-40744 | Siemens Solid Edge SE2025 improper certificate validation | 8.7CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-35972 | Intel MPI Library uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-35971 | Intel(R) PROSet/Wireless WiFi Software out-of-bounds write | 8.3CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-35968 | Slim Bootloader UEFI firmware for the protection mechanism failure | 7.1CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-35967 | Intel(R) PROSet/Wireless WiFi Software out-of-bounds read | 7.0CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-35963 | Intel(R) PROSet/Wireless WiFi Software insufficient control flow management | 8.3CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-33202 | NVIDIA Triton Inference Server stack-based buffer overflow | 6.5CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-33186 | NVIDIA AuthN component of NVIDIA AIStore hard-coded credentials | 8.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-33185 | NVIDIA AuthN component of NVIDIA AIStore missing authorization | 5.3CNA v3.1 | 0.9% | 2025-11-11 | Fix |
| CVE-2025-33178 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-33029 | Intel(R) PROSet/Wireless WiFi Software out-of-bounds write | 8.3CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-33000 | Intel QuickAssist Technology improper input validation | 7.3CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32732 | Intel(R) QAT Windows software buffer overflow | 5.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32449 | PRI Driver software unquoted search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32446 | Intel QuickAssist Technology software untrusted pointer dereference | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32091 | Intel(R) Arc(TM) B-series GPUs some firmware for the incorrect default permissions | 8.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32088 | Intel(R) QAT Windows software improper check for exceptional conditions | 4.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32038 | Intel oneAPI DPC++C++ Compiler software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | |
| CVE-2025-32037 | Intel(R) PresentMon improper access control | 2.0CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-32001 | Intel(R) Processor Identification Utility uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31948 | Intel(R) oneAPI Math Kernel Library improper input validation | 4.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31940 | Intel(R) Thread Director Visualizer software incorrect default permissions | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31937 | Intel(R) QAT Windows software out-of-bounds read | 5.7CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31931 | Instrumentation and Tracing Technology API (ITT API) software uncontrolled search path | 5.4CNA v4.0 | 0.2% | 2025-11-11 | Exploit codeFix |
| CVE-2025-31719 | UNISOC chipsets TEE EcDSA algorithm vulnerability | 5.1CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31647 | Intel(R) Graphics software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-31645 | System Event Log Viewer Utility software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | |
| CVE-2025-31146 | Intel Ethernet Adapter Complete Driver Pack software time-of-check time-of-use race condition | 5.1CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-30518 | Intel(R) PresentMon incorrect default permissions | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-30509 | Intel QuickAssist Technology software improper input validation | 4.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-30506 | Intel Driver and Support Assistant uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-30398 | Microsoft Nuance PowerScribe 360 information disclosure | 8.1CNA v3.1 | 0.8% | 2025-11-11 | Fix |
| CVE-2025-30255 | Intel(R) PROSet/Wireless WiFi Software out-of-bounds write | 8.3CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-30185 | Intel UEFI reference platforms active debug code | 8.3CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-30182 | Intel(R) Distribution for Python software installers uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27725 | ACAT time-of-check time-of-use race condition | 4.1CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27713 | Intel(R) QAT Windows software out-of-bounds write | 7.3CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27712 | Intel(R) Neural Compressor software improper neutralization | 2.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27711 | Intel(R) One Boot Flash Update (Intel(R) OFU) software incorrect default permissions | 5.4CNA v4.0 | 0.1% | 2025-11-11 | |
| CVE-2025-27710 | Intel(R) QAT Windows software untrusted pointer dereference | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27249 | Gaudi software resource exhaustion | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-27246 | Intel(R) Processor Identification Utility incorrect default permissions | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-26694 | Intel(R) QAT Windows software null pointer dereference | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-26405 | Intel(R) NPU Drivers improper control of dynamic code | 5.1CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-26402 | Intel(R) NPU Drivers protection mechanism failure | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-25216 | Intel(R) Graphics Drivers and Intel LTS kernels some firmware for some improper input validation | 2.0CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-25059 | Intel(R) One Boot Flash Update (Intel(R) OFU) software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | |
| CVE-2025-24918 | Intel Server Configuration Utility and Server Firmware Update Utility privilege escalation | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24863 | Intel(R) CIP software improper privilege management | 6.0CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-24862 | Intel(R) CIP software unrestricted file upload | 2.0CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-24848 | Intel(R) CIP software protection mechanism failure | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24847 | Intel(R) CIP software improper input validation | 5.7CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-24842 | Intel(R) System Support Utility uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24838 | Intel(R) CIP software improper privilege management | 7.7CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-24834 | Intel(R) CIP software protection mechanism failure | 6.0CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-24519 | Intel(R) QAT Windows software buffer overflow | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24516 | Intel(R) CIP software improper access control | 6.8CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-24512 | Intel(R) PROSet/Wireless WiFi Software improper input validation | 5.7CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24491 | Intel(R) Killer(TM) Performance Suite software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24327 | Intel(R) Rapid Storage Technology Application insecure inherited permissions | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-24314 | Intel(R) CIP software improper access control | 2.1CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-24307 | Intel(R) CIP software improper privilege management | 2.3CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-24299 | Intel(R) CIP software improper input validation | 8.7CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-23361 | NVIDIA NeMo Framework code injection | 7.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-23357 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-22391 | SigTest improper access control | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20622 | Intel(R) NPU Drivers sensitive information not cleared before reuse | 2.0CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20614 | Intel(R) CIP software external control of a file path | 5.6CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20065 | Display Virtualization uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20056 | Intel VTune Profiler improper input validation | 4.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20050 | Intel(R) CIP software uncontrolled search path | 5.4CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-20010 | Intel(R) Processor Identification Utility privilege escalation | 8.5CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-13032 | Avast (Free/Premiium/Ultimeat) Antivirus time-of-check time-of-use race condition | 7.8NVD v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-13027 | Mozilla memory safety bugs fixed in Firefox 145 and Thunderbird 145 | 8.1CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13026 | Mozilla Firefox and Thunderbird WebGPU sandbox escape | 9.8CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13025 | Mozilla Firefox incorrect boundary conditions in the Graphics: WebGPU component | 7.5CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13024 | Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component | 9.8CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13023 | Mozilla Firefox and Thunderbird WebGPU sandbox escape | 9.8CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13022 | Mozilla Firefox incorrect boundary conditions in the Graphics: WebGPU component | 9.8CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13021 | Mozilla Firefox incorrect boundary conditions in the Graphics: WebGPU component | 9.8CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13020 | Mozilla Firefox use-after-free in the WebRTC: Audio/Video component | 8.8CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13019 | Mozilla Firefox same-origin policy bypass in the DOM: Workers component | 8.1CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13018 | Mozilla Firefox mitigation bypass in the DOM: Security component | 8.1CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13017 | Mozilla Firefox same-origin policy bypass in the DOM: Notifications component | 8.1CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13016 | Mozilla Firefox incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5CISA ADP v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-13015 | Mozilla spoofing issue in Firefox | 3.4CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13014 | Mozilla Firefox use-after-free in the Audio/Video component | 8.8CISA ADP v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-13013 | Mozilla Firefox mitigation bypass in the DOM: Core and HTML component | 6.1CISA ADP v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-13012 | Mozilla Firefox race condition in the Graphics component | 7.5CISA ADP v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12953 | Classified Listing WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12944 | Improper input validation in NETGEAR DGN2200v4 | 6.8CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-12943 | Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300 | 5.2CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12942 | Improper input validation in NETGEAR R6260 and R6850 | 4.8CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-12940 | Credentials recorded in logs in NETGEAR WAX610 and WAX610Y | 0.5CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-12880 | Progress Bar Blocks for Gutenberg WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12846 | Blocksy Companion WordPress plugin arbitrary file upload | 8.8CNA v3.1 | 0.7% | 2025-11-11 | Fix |
| CVE-2025-12813 | Holiday class post calendar WordPress plugin unauthenticated remote code execution via contents | 9.8CNA v3.1 | 0.9% | 2025-11-11 | Fix |
| CVE-2025-12788 | Themefic Hydra Booking PayPal payment confirmation vulnerability | 5.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-12787 | Themefic Hydra Booking cancellation token generation insufficient randomness | 5.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-12754 | Geopost WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12753 | Chart Expert WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12748 | Red Hat Enterprise Linux 10 libvirt: Denial of service in XML parsing | 5.5CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12711 | Share to Google Classroom WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12672 | Flickr Show WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12671 | WP-Iconics WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12668 | WP Count Down Timer WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12667 | GitHub Gist Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12665 | Ninja Countdown WordPress plugin missing authorization authenticated arbitrary Countdown deletion | 4.3CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12663 | Jeba Cute forkit WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12662 | Coon Google Maps WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12658 | Preload Current Images WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12652 | Ungapped Widgets WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12651 | Live Photos on WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12644 | Nonaki WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12637 | Elastic Theme Editor WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-11-11 | |
| CVE-2025-12632 | RandomQuotr WordPress plugin authenticated (Admin+) stored cross-site scripting | 5.5CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12631 | Squirrels Auto Inventory WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12590 | YSlider WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12589 | WP-Walla WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12588 | USB Qr Code Scanner For Woocommerce WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-12539 | TNC Toolbox: Web Performance WordPress plugin information disclosure | 10.0CNA v3.1 | 1.1% | 2025-11-11 | Exploit codeFix |
| CVE-2025-12538 | Fleet Manager WordPress plugin authenticated (Editor+) stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12526 | Private Google Calendars WordPress plugin missing authorization authenticated settings reset | 4.3CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12132 | WP Custom Admin Login Page Logo WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.1% | 2025-11-11 | |
| CVE-2025-12126 | The Total Book Project WordPress plugin insecure direct object reference | 5.4CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12101 | NetScaler ADC cross-site scripting (XSS) | 5.9CNA v4.0 | 26.3% | 2025-11-11 | NucleiEmerging Threats |
| CVE-2025-12021 | WP-OAuth WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-11-11 | |
| CVE-2025-12020 | Double the Donation WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.9CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-12019 | Featured Image WordPress plugin authenticated (Admin+) stored cross-site scripting | 5.5NVD v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-12010 | Authors List WordPress plugin sensitive information exposure | 6.5CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-11999 | krishaweb Multi Location Marker missing authorization | 5.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11997 | Document Pro Elementor WordPress plugin information disclosure | 5.3CNA v3.1 | 0.4% | 2025-11-11 | |
| CVE-2025-11996 | toastwebsites Find Unused Images attachment deletion missing authorization | 5.3CNA v3.1 | 0.4% | 2025-11-11 | |
| CVE-2025-11988 | Crypto Tool WordPress plugin missing authentication to unauthenticated limited file deletion | 5.3CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-11986 | Crypto Tool WordPress plugin unauthenticated information exposure via Global authentication State | 5.3CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-11960 | Reflected XSS in Aryom's KVKNET | 6.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-11959 | Improper access control in Premierturk's Excavation Management Information System | 8.1CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11894 | Shelf Planner WordPress plugin missing authorization to unauthenticated settings update | 5.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11891 | Shelf Planner WordPress plugin unauthenticated information exposure via Log files | 5.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11886 | CTL Arcade Lite WordPress plugin cross-site request forgery to plugin activation and deactivation | 4.3CNA v3.1 | 0.1% | 2025-11-11 | |
| CVE-2025-11882 | Simple Donate WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11874 | Slippy Slider Responsive Touch Navigation Slider WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11873 | WP BBCode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11869 | Precise Columns WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11863 | My Geo Posts Free WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11862 | Verve Asset Manager access control vulnerability | 8.4CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11860 | Twitter Feed WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11859 | Paypal Donation Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11856 | Eventbee Ticketing Widget WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11855 | Age Restriction remote support function privilege escalation | 7.5CISA ADP v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11829 | Five9 Live Chat WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11828 | Magazine Companion WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-11822 | WP Bootstrap Tabs WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-11-11 | |
| CVE-2025-11821 | Woocommerce Products By Custom Tax WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11805 | doytch Skip to Timestamp skipto shortcode stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-11-11 | |
| CVE-2025-11697 | Studio 5000 ® Simulation Interface Local code execution | 8.9CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-11696 | Studio 5000 ® Simulation Interface SSRF | 8.9CNA v4.0 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-11532 | Wisly WordPress plugin insecure direct object reference to unauthenticated Wishlist manipulation | 5.3CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11521 | Astra Security Suite arbitrary file upload | 8.1CNA v3.1 | 0.5% | 2025-11-11 | |
| CVE-2025-11457 | EasyCommerce WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-11451 | Auto Amazon Links Amazon Associates Affiliate WordPress plugin unauthenticated arbitrary file read | 7.5CNA v3.1 | 0.5% | 2025-11-11 | |
| CVE-2025-11307 | WP Google Maps WordPress plugin unauthenticated stored XSS | 8.8CISA ADP v3.1 | 1.8% | 2025-11-11 | NucleiFix |
| CVE-2025-11237 | The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options. | 5.3CISA ADP v3.1 | 0.3% | 2025-11-11 | |
| CVE-2025-11170 | WP移行専用プラグイン for CPI WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 0.8% | 2025-11-11 | Exploit code |
| CVE-2025-11168 | Mementor Core WordPress plugin authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11129 | Include fussball.de Widgets WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-11-11 | |
| CVE-2025-11085 | FactoryTalk® DataMosaix™ Private Cloud persistent XSS | 8.6CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-11084 | FactoryTalk® DataMosaix™ Private Cloud authentication bypass | 7.6CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-10918 | Ivanti Endpoint Manager agent insecure default configuration | 7.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-10905 | Collision in minifilter driver of Avast Free Antivirus results in disabling of real-time protection | 4.4CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-10714 | Axis Communications AXIS Optimizer unquoted search path | 8.4CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-10161 | Authentication bypass in Turkguven's Perfektive | 7.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-9524 | Axis Communications AXIS OS improper type validation | 4.3CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-9408 | zephyrproject-rtos Zephyr userspace privilege escalation vulnerability on Cortex M | 8.2CNA v3.1 | 0.1% | 2025-11-11 | |
| CVE-2025-9227 | Zoho ManageEngine OpManager stored XSS | 6.5CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-9223 | Zoho ManageEngine Applications Manager command injection | 8.8CNA v3.1 | 4.2% | 2025-11-11 | Exploit codeFix |
| CVE-2025-9055 | Axis Communications AXIS OS execution with unnecessary privileges | 6.4CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-8998 | Axis Communications AXIS OS external control of a file path | 3.1CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-8324 | Zoho ManageEngine Analytics Plus SQL injection | 9.8CNA v3.1 | 1.7% | 2025-11-11 | Fix |
| CVE-2025-8108 | Axis Communications AXIS OS incorrect permission assignment | 6.7CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-7633 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 7.3CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-7632 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 7.3CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-7430 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 7.3CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-7429 | Zoho ManageEngine Exchange Reporter Plus stored XSS | 7.3CNA v3.1 | 0.5% | 2025-11-11 | Fix |
| CVE-2025-6779 | Axis Communications AXIS OS incorrect permission assignment | 6.7CNA v3.1 | 1.1% | 2025-11-11 | Fix |
| CVE-2025-6571 | Axis Communications AXIS OS insufficiently protected credentials | 6.0CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-6298 | Axis Communications AXIS OS improper type validation | 6.7CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-5718 | Axis Communications AXIS OS link following | 6.8CNA v3.1 | 0.4% | 2025-11-11 | Fix |
| CVE-2025-5454 | Axis Communications AXIS OS path traversal | 6.4CNA v3.1 | 0.2% | 2025-11-11 | Fix |
| CVE-2025-5452 | Axis Communications AXIS OS privilege escalation | 6.6CNA v3.1 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-5317 | Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac | 6.8CNA v4.0 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-4645 | Axis Communications AXIS OS improper type validation | 6.7CNA v3.1 | 0.1% | 2025-11-11 | Fix |
| CVE-2025-3717 | Incorrect oauth passthrough in Grafana Snowflake Datasource | 2.1CNA v4.0 | 0.3% | 2025-11-11 | Fix |
| CVE-2025-64685 | JetBrains YouTrack improper certificate validation | 8.1CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64684 | JetBrains YouTrack missing authorization | 4.5CNA v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-64683 | JetBrains Hub race condition | 5.3CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64682 | JetBrains Hub race condition | 2.7CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64681 | JetBrains Hub missing authorization | 2.7CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64529 | SpiceDB's WriteRelationships fails silently if payload is too big | 2.7CNA v4.0 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64522 | charmbracelet soft-serve Soft Serve is vulnerable to SSRF through its Webhooks | 9.1CNA v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-64519 | TorrentPier is vulnerable to authenticated SQL injection | 8.8CNA v3.1 | 0.4% | 2025-11-10 | Fix |
| CVE-2025-64518 | CycloneDX Core (Java): BOM validation is vulnerable to XML external entity injection | 7.5CNA v3.1 | 0.4% | 2025-11-10 | Fix |
| CVE-2025-64513 | Milvus Proxy has critical authentication bypass | 9.3CNA v4.0 | 0.9% | 2025-11-10 | Exploit codeFix |
| CVE-2025-64512 | pdfminer.six vulnerable to arbitrary code execution via Crafted PDF Input | 8.6CNA v3.1 | 0.3% | 2025-11-10 | Exploit codeFix |
| CVE-2025-64509 | Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) | 7.5CNA v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-64508 | Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input | 7.5CNA v3.1 | 0.5% | 2025-11-10 | Fix |
| CVE-2025-64507 | Incus vulnerable to local privilege escalation through custom storage volumes | 8.6CNA v4.0 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64504 | Langfuse project membership APIs information disclosure | 5.0CNA v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-64502 | Parse Server explain queries information disclosure | 6.9CNA v4.0 | 0.4% | 2025-11-10 | Fix |
| CVE-2025-64501 | etaminstudio prosemirror_to_html ProsemirrorToHtml: Cross-site scripting vulnerability | 7.6CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64484 | OAuth2-Proxy HTTP header injection | 8.5CNA v3.1 | 0.6% | 2025-11-10 | Fix |
| CVE-2025-64457 | JetBrains ReSharper, Rider and dotTrace time-of-check time-of-use race condition | 4.2CNA v3.1 | 0.1% | 2025-11-10 | Fix |
| CVE-2025-64456 | JetBrains ReSharper improper signature verification | 8.4CNA v3.1 | 0.1% | 2025-11-10 | Fix |
| CVE-2025-64183 | OpenEXR has use-after-free in PyObject_StealAttrString | 5.5CNA v4.0 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-64182 | OpenEXR has buffer overflow in PyOpenEXR_old's channels and channel | 5.5CNA v4.0 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-64181 | OpenEXR Makes Use of uninitialized memory | 2.0CNA v4.0 | 0.4% | 2025-11-10 | Fix |
| CVE-2025-64167 | Combodo iTop vulnerable to reflected XSS in webservices/export.php | 7.1CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-63835 | Tenda AC18 stack-based buffer overflow | 8.8v3.1 | 0.6% | 2025-11-10 | |
| CVE-2025-63834 | Tenda AC18 cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-10 | |
| CVE-2025-63712 | Senior-walter Web-based Pharmacy Product Management System cross-site request forgery | 8.8v3.1 | 0.2% | 2025-11-10 | |
| CVE-2025-63711 | Lerouxyxchire Client Database Management System SourceCodester cross-site request forgery | 7.1CISA ADP v3.1 | 0.2% | 2025-11-10 | |
| CVE-2025-63710 | Pijey Simple Public Chat Room cross-site request forgery | 6.5CISA ADP v3.1 | 0.1% | 2025-11-10 | |
| CVE-2025-63709 | Chuck24 Simple To-Do List System SourceCodester cross-site scripting | 5.4v3.1 | 0.2% | 2025-11-10 | |
| CVE-2025-63678 | CMS Made Simple File Manager /uploads/ endpoint arbitrary file upload | 7.2v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63617 | Kutangguo Ktg-mes deserialization of untrusted data | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | |
| CVE-2025-63497 | rickxy Hospital Management System SQL injection | 7.1CISA ADP v3.1 | 0.2% | 2025-11-10 | |
| CVE-2025-63457 | Tenda AX1803 stack-based buffer overflow | 7.5v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63456 | Tenda AX1803 stack-based buffer overflow | 7.5v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63455 | Tenda AX3 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63397 | Oneflow improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | |
| CVE-2025-63384 | Chipsalliance Rocketchip incorrect privilege assignment | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | |
| CVE-2025-63296 | Keruistore Kerui K259 command injection | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | Exploit code |
| CVE-2025-63288 | Open5GS AMF denial of service | 7.5CISA ADP v3.1 | 0.3% | 2025-11-10 | |
| CVE-2025-63154 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63153 | TOTOLINK A7000R stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63152 | Tenda AX3 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63149 | Tenda AX3 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-63147 | Tenda AX3 stack-based buffer overflow | 7.5v3.1 | 0.4% | 2025-11-10 | |
| CVE-2025-62780 | Changedetection.io vulnerable to stored XSS in Watch update via API | 3.5CNA v3.1 | 0.4% | 2025-11-10 | NucleiFix |
| CVE-2025-62689 | GNU libmicrohttpd null pointer dereference | 8.7CNA v4.0 | 0.5% | 2025-11-10 | Fix |
| CVE-2025-60876 | BusyBox improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-59777 | GNU libmicrohttpd null pointer dereference | 8.7CNA v4.0 | 0.5% | 2025-11-10 | Fix |
| CVE-2025-56503 | An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replacing the uninstall file with a crafted binary in the installation folder. NOTE: this is disputed by the Supplier because replacing the uninstal | 6.5CISA ADP v3.1 | 0.3% | 2025-11-10 | Exploit code |
| CVE-2025-49145 | iTop admin can drop iTop database using webhooks | 8.7CNA v3.1 | 0.3% | 2025-11-10 | Fix |
| CVE-2025-48878 | Combodo iTop vulnerable to IDOR with ModuleInstallation object | 4.3CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-48065 | Combodo iTop vulnerable to reflected XSS via objection edition form error | 8.8CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-48055 | Combodo iTop has stored XSS in user portal's browse brick | 8.5CNA v3.1 | 0.2% | 2025-11-10 | Fix |
| CVE-2025-47932 | Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard | 8.8CNA v3.1 | 0.2% | 2025-11-10 | Fix |