CVE-2025 list

CVE-2025 records published in December 2025

Page two of five: records 1,001 to 2,000 of the 4,374 published in December 2025, newest first. The first page carries the figures for December 2025.

CVE-2025 records published in December 2025, newest first: records 1,001 to 2,000 of 4,374
CVE Summary CVSS EPSS Published Signals
CVE-2025-14018Unquoted service path in NetBT Consultancy's e-Fatura7.3CNA v3.10.4%2025-12-22Exploit codeFix
CVE-2025-12514Centreon Infra Monitoring A user with elevated privileges is able to introduce a SQL injection7.2CNA v3.10.3%2025-12-22Fix
CVE-2025-12049Sharp Display Solutions Media Player MP-01 missing authentication9.2CNA v4.00.3%2025-12-22Fix
CVE-2025-11545Sharp Display Solutions NP-PA1705UL-W system information disclosure9.5CNA v4.00.3%2025-12-22
CVE-2025-11544Sharp Display Solutions NP-P627UL improper integrity check validation9.5CNA v4.00.3%2025-12-22
CVE-2025-11543Sharp Display Solutions NP-P502HL-2 improper integrity check validation9.5CNA v4.00.2%2025-12-22Fix
CVE-2025-11542Sharp Display Solutions NP-P502HL-2 stack-based buffer overflow8.4CNA v4.00.4%2025-12-22Fix
CVE-2025-11541Sharp Display Solutions NP-P502HL-2 stack-based buffer overflow9.2CNA v4.00.4%2025-12-22Fix
CVE-2025-11540Sharp Display Solutions NP-P502HL-2 path traversal9.1CNA v4.00.4%2025-12-22Fix
CVE-2025-10021Open Design Alliance ODA Drawings SDK uninitialized variable use7.0CNA v4.00.2%2025-12-22Fix
CVE-2025-8460Centreon Infra Monitoring notification rules configuration stored cross-site scripting6.8CNA v3.10.2%2025-12-22Fix
CVE-2025-8305Information disclosure in Identity Agent Debug files6.5CNA v3.10.1%2025-12-22
CVE-2025-8304Information disclosure in Identity Agent Registry Keys6.5CNA v3.10.1%2025-12-22
CVE-2025-68644Yealink RPS authentication bypass by spoofing7.4CNA v3.10.3%2025-12-21Fix
CVE-2025-62955TempTool [Show Current Template Info] WordPress plugin sensitive data exposure4.3CNA v3.10.2%2025-12-21
CVE-2025-62926TempTool [Show Current Template Info] WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-21
CVE-2025-62901WP Microdata WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-21
CVE-2025-15002SeaCMS mysqli.class.php SQL injection9.8NVD v3.10.5%2025-12-21
CVE-2025-14995Tenda FH1201 SetIpBind sprintf stack-based overflow8.7CNA v4.00.7%2025-12-21
CVE-2025-14994Tenda FH1201/FH1206 HTTP request webtypelibrary strcat stack-based overflow8.7CNA v4.00.7%2025-12-21
CVE-2025-14993Tenda AC18 HTTP Request SetDlnaCfg sprintf stack-based overflow8.7CNA v4.00.8%2025-12-21
CVE-2025-14992Tenda AC18 HTTP Request GetParentControlInfo strcpy stack-based overflow8.7CNA v4.00.7%2025-12-21
CVE-2025-14991Campcodes Complete Online Beauty Parlor Management System cross-site scripting4.8v3.10.2%2025-12-21
CVE-2025-14990Campcodes Complete Online Beauty Parlor Management System view-appointment.php SQL injection9.8v3.10.4%2025-12-21
CVE-2025-14989Campcodes Complete Online Beauty Parlor Management System search-invoices.php SQL injection9.8v3.10.4%2025-12-21
CVE-2025-14855SureForms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-12-21Exploit codeFix
CVE-2025-14800ThemeIsle Redirection for Contact Form 7 move_file_to_upload function unrestricted file upload8.1CNA v3.10.4%2025-12-21Fix
CVE-2025-14080Frontend Post Submission Manager Lite WordPress plugin missing authorization5.3CNA v3.10.3%2025-12-21Fix
CVE-2025-14071Live Composer Free WordPress Website Builder plugin PHP object injection7.5CNA v3.10.6%2025-12-21Fix
CVE-2025-14054WC Builder WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2025-12-21Fix
CVE-2025-14043Tainacan WordPress plugin missing authorization unauthenticated arbitrary Metadata Section creation5.3CNA v3.10.3%2025-12-21Fix
CVE-2025-13838WishSuite WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-21Fix
CVE-2025-13693Image Photo Gallery Final Tiles Grid WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-21Fix
CVE-2025-13361Web to SugarCRM Lead WordPress plugin cross-site request forgery to Custom field deletion4.3CNA v3.10.2%2025-12-21Fix
CVE-2025-13220Ultimate Member WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-21Fix
CVE-2025-12980Post Grid Gutenberg Blocks for News WordPress plugin unauthorized access7.5CNA v3.10.3%2025-12-21Fix
CVE-2025-12654wpvividplugins WPvivid Backup and Migration filesystem permissions check path traversal2.7CNA v3.10.4%2025-12-21Fix
CVE-2025-12398Product Table for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-12-21Fix
CVE-2025-11496Five Star Restaurant Reservations WordPress plugin stored cross-site scripting6.1CNA v3.10.2%2025-12-21Fix
CVE-2025-9343ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2025-12-21Fix
CVE-2025-34290Versa SASE Client for Windows arbitrary Folder Deletion leading to local privilege escalation7.8NVD v3.10.1%2025-12-20Fix
CVE-2025-14735Amazon affiliate lite WordPress plugin authenticated (Administrator+) stored cross-site scripting4.4CNA v3.10.2%2025-12-20
CVE-2025-14734Amazon affiliate lite WordPress plugin cross-site request forgery to plugin settings update5.4CNA v3.10.1%2025-12-20
CVE-2025-14721Responsive and Swipe slider WordPress plugin stored cross-site scripting5.5CNA v3.10.2%2025-12-20
CVE-2025-14633F70 Lead Document Download WordPress plugin unauthorized access5.3CNA v3.10.3%2025-12-20
CVE-2025-14591Perforce Delphix Continuous Compliance PII leak due to Change in EOR Handling5.3CNA v4.00.3%2025-12-20Fix
CVE-2025-14300Unauthenticated access to connectAP API endpoint on Tapo C100, C200 and C4258.7CNA v4.00.4%2025-12-20Fix
CVE-2025-14299Improper Content-Length Validation in HTTPS requests on Tapo C2007.1CNA v4.00.2%2025-12-20Fix
CVE-2025-14298FiboSearch Ajax Search for WooCommerce WordPress plugin stored cross-site scripting5.4CNA v3.10.3%2025-12-20Fix
CVE-2025-14168WP DB Booster WordPress plugin cross-site request forgery to Database Cleanup4.3CNA v3.10.2%2025-12-20
CVE-2025-14164Quran Gateway WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2025-12-20
CVE-2025-13624Overstock Affiliate Links WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2025-12-20
CVE-2025-13619Flex Store Users WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.4%2025-12-20
CVE-2025-13365WP Hallo Welt WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.1%2025-12-20
CVE-2025-13329File Uploader for WooCommerce WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.10.7%2025-12-20Fix
CVE-2025-12898Pretty Google Calendar WordPress plugin unauthorized access5.3CNA v3.10.3%2025-12-20Fix
CVE-2025-12820Pure WC Variation Swatches WordPress plugin unauthenticated settings update5.3CISA ADP v3.10.2%2025-12-20
CVE-2025-12581Attachments Handler WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-12-20
CVE-2025-12492Ultimate Member WordPress plugin information disclosure5.3CNA v3.10.5%2025-12-20Fix
CVE-2025-8065TP-Link Tapo C200 and C520WS ONVIF SOAP parser stack-based buffer overflow8.7CNA v4.00.5%2025-12-20Fix
CVE-2025-7782WP JobHunt WordPress plugin missing authorization authenticated stored cross-site scripting7.6CNA v3.10.2%2025-12-20
CVE-2025-7733WP JobHunt WordPress plugin authenticated (Candidate+) insecure direct object reference4.3CNA v3.10.2%2025-12-20
CVE-2025-68613n8n improper control of dynamically-managed code resources10.0CNA v3.199.0%2025-12-19KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2025-68481fastapi-users FastAPI Users vulnerable to 1-click account takeover in Apps using FastAPI SSO5.9CNA v3.10.3%2025-12-19Fix
CVE-2025-68478Langflow vulnerable to external control of file name or path7.1CNA v3.15.8%2025-12-19Fix
CVE-2025-68477Langflow vulnerable to server-side request forgery7.7CNA v3.16.3%2025-12-19Fix
CVE-2025-68457Orejime has executable code in HTML attributes0.6CNA v4.00.2%2025-12-19Fix
CVE-2025-68430Cvat vulnerable to directory traversal via mounted share listing5.3CNA v4.00.3%2025-12-19Fix
CVE-2025-67846Mintlify Platform web parameter tampering6.5v3.10.4%2025-12-19Fix
CVE-2025-67845Mintlify Platform Static Asset Proxy endpoint path traversal5.4v3.10.5%2025-12-19Fix
CVE-2025-67844Mintlify Platform forced browsing4.3v3.10.4%2025-12-19Fix
CVE-2025-67843Mintlify Platform MDX Rendering Engine server-side template injection9.8v3.11.1%2025-12-19Fix
CVE-2025-67842Mintlify Platform inclusion of untrusted functionality5.4v3.10.3%2025-12-19Fix
CVE-2025-67712HTML injection issue in ArcGIS Web App Builder4.7CNA v3.10.3%2025-12-19
CVE-2025-67442EVE-NG path traversal7.6CISA ADP v3.10.6%2025-12-19
CVE-2025-66911Turms-im Turms insecure direct object reference6.5CISA ADP v3.10.3%2025-12-19
CVE-2025-66910Turms-im Turms plaintext password storage6.0CISA ADP v3.10.2%2025-12-19
CVE-2025-66909Turms-im Turms decompression bomb7.5CISA ADP v3.10.5%2025-12-19
CVE-2025-66908Turms-im Turms unrestricted file upload5.3CISA ADP v3.10.4%2025-12-19
CVE-2025-66906Turms-im Turms cross-site request forgery6.1CISA ADP v3.10.1%2025-12-19
CVE-2025-66905Takes Tkfiles path traversal7.5CISA ADP v3.10.6%2025-12-19
CVE-2025-66580Dive has cross-site scripting vulnerability that can escalate to remote code execution9.7CNA v3.10.6%2025-12-19Fix
CVE-2025-66524Apache NiFi: Deserialization of untrusted data in GetAsanaObject Processor7.5CNA v4.00.5%2025-12-19Fix
CVE-2025-66522Foxit pdfonline.Foxit.com stored cross-site scripting in Digital IDs Common Name field6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66521Foxit pdfonline.Foxit.com stored cross-site scripting in Trusted Certificates feature6.3CNA v3.10.1%2025-12-19Fix
CVE-2025-66520Foxit pdfonline.Foxit.com stored cross-site scripting in Portfolio SVG Handling6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66519Foxit pdfonline.Foxit.com stored cross-site scripting in Layer Import Functionality6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66502Foxit pdfonline.Foxit.com stored cross-site scripting in page templates feature6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66501Foxit pdfonline.Foxit.com stored cross-site scripting in eSign Predefined Text feature6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66500Foxit webplugins.Foxit.com stored cross-site scripting via postMessage6.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66499Foxit PDF Reader PDF Parsing heap-based buffer overflow remote code execution7.8CNA v3.10.3%2025-12-19Fix
CVE-2025-66498Foxit PDF Reader 3D Annotation out-of-bounds memory access5.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66497Foxit PDF Reader 3D Annotation out-of-bounds memory access5.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66496Foxit PDF Reader 3D Annotation out-of-bounds memory access5.3CNA v3.10.2%2025-12-19Fix
CVE-2025-66495Foxit PDF Reader Annotation use-after-free remote code execution7.8CNA v3.10.3%2025-12-19Fix
CVE-2025-66494Foxit PDF Reader PDF File Parsing use-after-free remote code execution7.8CNA v3.10.3%2025-12-19Fix
CVE-2025-66493Foxit PDF Reader AcroForm use-after-free remote code execution7.8CNA v3.10.3%2025-12-19Fix
CVE-2025-66174Hikvision DS-7104HGHI-F1 some improper authentication6.5CNA v3.10.4%2025-12-19Fix
CVE-2025-66173Hikvision DS-7104HGHI-F1 some privilege escalation6.2CNA v3.10.2%2025-12-19Fix
CVE-2025-65035pluginsGLPI databaseinventory GLPI Database Inventory plugin vulnerable to stored object injection6.4CNA v3.10.3%2025-12-19Fix
CVE-2025-64675Microsoft Azure Cosmos DB spoofing8.3CNA v3.10.7%2025-12-19Fix
CVE-2025-63665Gt Edge AI code injection9.8CISA ADP v3.10.5%2025-12-19
CVE-2025-58053Galette has a privilege escalation4.9CNA v4.00.3%2025-12-19Fix
CVE-2025-58052Galette has groups managers access control bypass on Members2.1CNA v4.00.3%2025-12-19Fix
CVE-2025-53922Galette has access control bypass1.3CNA v4.00.2%2025-12-19Fix
CVE-2025-52692Linksys E9450-SG bypass authentication8.8CNA v3.16.4%2025-12-19
CVE-2025-50681Pali Igmpproxy buffer overflow7.5CISA ADP v3.10.5%2025-12-19Fix
CVE-2025-34433AVideo unauthenticated RCE via Predictable Installation Salt9.3CNA v4.01.5%2025-12-19MetasploitExploit codeKCVFix
CVE-2025-14968code-projects Simple Stock System update.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14967itsourcecode Student Management System candidates_report.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14966FastAdmin Backend Controller Backend.php selectpage SQL injection7.2NVD v3.10.4%2025-12-19
CVE-2025-149651541492390c yougou-mall ResourceController.java delete path traversal5.1CNA v4.00.3%2025-12-19
CVE-2025-14964TOTOLINK T10 cstecgi.cgi sprintf stack-based overflow9.3CNA v4.01.0%2025-12-19
CVE-2025-14962code-projects Simple Stock System chatuser.php cross-site scripting6.1NVD v3.10.3%2025-12-19
CVE-2025-14961code-projects Simple Blood Donor Management System editedcampaign.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14960code-projects Simple Blood Donor Management System editeddonor.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14959code-projects Simple Stock System signup.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14958floooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflow7.8v3.10.2%2025-12-19
CVE-2025-14957WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference5.5v3.10.2%2025-12-19Fix
CVE-2025-14956WebAssembly Binaryen wasm-binary.cpp readExport heap-based overflow7.1v3.10.2%2025-12-19Fix
CVE-2025-14955Open5GS PFCP handler.c ogs_pfcp_handle_create_pdr initialization6.3CNA v4.00.6%2025-12-19
CVE-2025-14954Open5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertion5.9NVD v3.10.6%2025-12-19
CVE-2025-14953Open5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereference5.3NVD v3.10.5%2025-12-19
CVE-2025-14952Campcodes Supplier Management System add_category.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14951code-projects Scholars Tracking System home.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14950code-projects Scholars Tracking System delete_post.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14946Libnbd: Libnbd: Arbitrary code execution via SSH argument injection through a malicious uri4.8CNA v3.10.1%2025-12-19Fix
CVE-2025-14940code-projects Scholars Tracking System delete_user.php SQL injection9.8v3.10.4%2025-12-19
CVE-2025-14939code-projects Online Appointment Booking System deletemanager.php SQL injection7.2v3.10.3%2025-12-19
CVE-2025-14910Edimax BR-6208AC FTP daemon service handle_retr path traversal6.5v3.10.5%2025-12-19
CVE-2025-14909JeecgBoot SysUserOnlineController.java SysUserOnlineController user session8.1NVD v3.10.5%2025-12-19
CVE-2025-14908JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication8.1NVD v3.10.3%2025-12-19
CVE-2025-14900CodeAstro Real Estate Management System Administrator endpoint userdelete.php SQL injection7.2v3.10.4%2025-12-19
CVE-2025-14899CodeAstro Real Estate Management System Administrator endpoint stateadd.php SQL injection7.2v3.10.4%2025-12-19
CVE-2025-14898CodeAstro Real Estate Management System Administrator endpoint userbuilderdelete.php SQL injection7.2v3.10.4%2025-12-19
CVE-2025-14897CodeAstro Real Estate Management System Administrator endpoint useragentdelete.php SQL injection7.2v3.10.4%2025-12-19
CVE-2025-14882pretix-offlinesales insecure direct object reference3.8CNA v4.00.2%2025-12-19Fix
CVE-2025-14881pretix insecure direct object reference3.8CNA v4.00.2%2025-12-19Fix
CVE-2025-14847MongoDB and MongoDB Server improper handling of length parameter inconsistency8.7CNA v4.083.2%2025-12-19KEVNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2025-14812The Browser Company of New York ArcSearch address bar spoofing risk in Arc Search on iOS7.5CNA v3.10.3%2025-12-19Fix
CVE-2025-14809Address bar spoofing risk in ArcSearch on Android7.4CNA v3.10.2%2025-12-19Fix
CVE-2025-14733WatchGuard Firebox out-of-bounds write9.3CNA v4.026.5%2025-12-19KEVFix
CVE-2025-14546fastapi-sso FastAPI SSP is vulnerable to cross-site request forgery6.9CNA v4.00.4%2025-12-19Fix
CVE-2025-14455Image Photo Gallery Final Tiles Grid WordPress plugin authorization bypass5.4CNA v3.10.3%2025-12-19Fix
CVE-2025-14449BA Book Everything WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-19Fix
CVE-2025-14267M-Files Server information disclosure5.6CNA v4.00.4%2025-12-19Fix
CVE-2025-14151SlimStat Analytics WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-12-19Fix
CVE-2025-13999HTML5 Audio Player WordPress plugin server-side request forgery7.2CNA v3.10.2%2025-12-19Fix
CVE-2025-13941Foxit PDF Reader Update service incorrect permission assignment local privilege escalation8.8CNA v3.10.2%2025-12-19Fix
CVE-2025-13754Appointment Booking Calendar WordPress plugin information disclosure5.3CNA v3.10.3%2025-12-19Fix
CVE-2025-13307Ocean Modal Window WordPress plugin Editor+ remote code execution via Modal Conditions7.2CISA ADP v3.10.6%2025-12-19Fix
CVE-2025-13008Session token disclosure in M-Files Web8.6CNA v4.00.5%2025-12-19Fix
CVE-2025-12874HTTP request smuggling in Quest Coexistence Manager for Notes6.3CNA v4.00.5%2025-12-19
CVE-2025-12361myCred WordPress plugin missing authorization4.3CNA v3.10.2%2025-12-19Fix
CVE-2025-11774Mitsubishi Electric GENESIS64 OS command improper neutralization8.2CNA v3.10.6%2025-12-19Fix
CVE-2025-11747Colibri Page Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-12-19Fix
CVE-2025-1928Improper authentication in Restajet's Online Food Delivery System9.1CNA v3.10.4%2025-12-19
CVE-2025-1927CSRF in Restajet's Online Food Delivery System7.1CNA v3.10.1%2025-12-19
CVE-2025-1885Open redirect in Restajet's Online Food Delivery System5.4CNA v3.10.2%2025-12-19
CVE-2025-68469ImageMagick TIFF file parser heap-based buffer overflow2.0CNA v4.00.2%2025-12-18Fix
CVE-2025-68463Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez4.9CNA v3.10.3%2025-12-18Fix
CVE-2025-68462Debian FreedomBox incorrect permission assignment3.2CNA v3.10.1%2025-12-18Fix
CVE-2025-68461RoundCube Webmail cross-site scripting6.1NVD v3.126.8%2025-12-18KEVFix
CVE-2025-68460Roundcube Webmail information disclosure7.5v3.10.3%2025-12-18Fix
CVE-2025-68459Ruijie Networks AP180-PE V3.xx OS command injection8.6CNA v4.01.4%2025-12-18
CVE-2025-68422Kibana improper authorization4.3CNA v3.10.2%2025-12-18Fix
CVE-2025-68398Weblate has git config file overwrite vulnerability that leads to remote code execution9.1CNA v3.10.8%2025-12-18Fix
CVE-2025-68390Elasticsearch allocation of resources without limits or throttling4.9CNA v3.10.4%2025-12-18Fix
CVE-2025-68389Kibana allocation of resources without limits or throttling6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-68388Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments5.3CNA v3.10.4%2025-12-18Fix
CVE-2025-68387Kibana improper neutralization of input during web page generation (cross-site scripting)6.1CNA v3.10.2%2025-12-18Fix
CVE-2025-68386Kibana improper authorization4.3CNA v3.10.2%2025-12-18Fix
CVE-2025-68385Kibana improper neutralization of input during web page generation (cross-site scripting)7.2CNA v3.10.3%2025-12-18Fix
CVE-2025-68384Elasticsearch allocation of resources without limits or throttling6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-68383Filebeat improper validation of specified index, position, or offset in input6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-68382Packetbeat out-of-bounds read6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-68381Packetbeat Improper Bounds Check6.5CNA v3.10.5%2025-12-18Fix
CVE-2025-68325Linux kernel sch_cake null pointer dereference–0.2%2025-12-18Exploit codeFix
CVE-2025-68324Linux kernel imm SCSI driver use-after-free–0.2%2025-12-18Fix
CVE-2025-68323Linux kernel UCSI USB Type-C driver use-after-free–0.2%2025-12-18Fix
CVE-2025-68279Weblate has an arbitrary file read via symbolic links7.7CNA v3.10.4%2025-12-18Fix
CVE-2025-68278tinacms vulnerable to arbitrary code execution7.3CNA v4.00.5%2025-12-18Fix
CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appender6.3CNA v4.00.8%2025-12-18Fix
CVE-2025-67745Myhoard logs backup encryption key in plain text7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-67653Advantech WebAccess/SCADA path traversal7.5v3.10.7%2025-12-18Fix
CVE-2025-67546WP ERP WordPress plugin sensitive data exposure6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-67163Simple Machines Forum stored cross-site scripting6.1CISA ADP v3.10.3%2025-12-18
CVE-2025-66119Hostel WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-66118Sprout Clients WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-66117Easy Form WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-66116Ultimate Member Widgets for Elementor WordPress plugin sensitive data exposure7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-66104Offload, AI and Optimize with Cloudflare Images WordPress plugin broken access control6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-66102FV Antispam WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-66100RestroPress WordPress plugin broken access control6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-66088PropertyHive WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-66078Hotel Booking Lite WordPress plugin remote code execution (RCE)9.1CNA v3.10.4%2025-12-18Fix
CVE-2025-66074WP Webhooks WordPress plugin arbitrary file upload9.0CNA v3.10.3%2025-12-18Fix
CVE-2025-66070wpForo Forum WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-66068InstaWP Connect WordPress plugin broken access control6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-66058Post Grid and Gutenberg Blocks WordPress plugin broken access control6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-66054LearnPress WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-65568Opennetworking UPF omec-project denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65567Opennetworking UPF omec-project denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65566Linux Foundation UPF omec-project denial of service7.5CISA ADP v3.10.3%2025-12-18
CVE-2025-65565Opennetworking UPF omec-project denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65564Opennetworking UPF omec- denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65563Opennetworking UPF omec-project denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65562free5gc improper array index validation7.5CISA ADP v3.10.6%2025-12-18
CVE-2025-65561free5gc denial of service7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65559Open5GS reachable assertion7.5CISA ADP v3.10.4%2025-12-18
CVE-2025-65046Microsoft Edge (Chromium-based) spoofing3.1CNA v3.10.3%2025-12-18Fix
CVE-2025-65041Microsoft Partner Center elevation of privilege10.0CNA v3.10.8%2025-12-18Fix
CVE-2025-65037Microsoft Azure Container Apps remote code execution10.0CNA v3.11.0%2025-12-18Fix
CVE-2025-65011Unauthorized access to files in WODESYS WD-R608U router7.1CNA v4.00.2%2025-12-18
CVE-2025-65010Missing authorizations for admin panel password change in WODESYS WD-R608U router7.1CNA v4.00.2%2025-12-18
CVE-2025-65009Insecure Password Storage in WODESYS WD-R608U router7.1CNA v4.00.2%2025-12-18
CVE-2025-65008OS command injection in WODESYS WD-R608U router9.4CNA v4.02.7%2025-12-18
CVE-2025-65007Missing authentication for critical function in WODESYS WD-R608U router8.7CNA v4.00.3%2025-12-18
CVE-2025-65000Checkmk Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule2.3CNA v4.00.2%2025-12-18Fix
CVE-2025-64997Checkmk insufficient permission validation when showing agent information6.3CNA v4.00.2%2025-12-18Fix
CVE-2025-64724Arduino IDE for macOS has insecure file permissions4.8CNA v4.00.1%2025-12-18Fix
CVE-2025-64723Arduino IDE for macOS has TCC Bypass via Dynamic library injection4.8CNA v4.00.1%2025-12-18Fix
CVE-2025-64677Microsoft Office Out-of-Box Experience spoofing8.2CNA v3.10.5%2025-12-18Fix
CVE-2025-64676Microsoft Purview eDiscovery remote code execution7.2CNA v3.11.0%2025-12-18Fix
CVE-2025-64663Microsoft Azure Cognitive Service for Language Custom Question Answering elevation of privilege9.9CNA v3.10.7%2025-12-18Fix
CVE-2025-64469Stack-based buffer overflow in LVResource::DetachResource in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64468NI LabVIEW sentry!sentry_span_set_data use-after-free8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64467Out-of-bounds read in LVResFile::FindRsrcListEntry in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64466Out-of-bounds read in lvre!ExecPostedProcRecPost in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64465Out-of-bounds read in lvre!DataSizeTDR in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64464Out-of-bounds read in lvre!VisaWriteFromFile in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64463Out-of-bounds read in LVResource::DetachResource in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64462Out-of-bounds read in LVResFile::RGetMemFileHandle in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64461Out-of-bounds write in mgocre_SH_25_3!RevBL in NI LabVIEW8.5CNA v4.00.2%2025-12-18Fix
CVE-2025-64400Palantir Control Panel user pre-enrollment API improper access control4.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64378ListingPro WordPress theme broken access control7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64377ListingPro WordPress theme local file inclusion8.1CNA v3.10.4%2025-12-18Fix
CVE-2025-64376ListingPro WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64375WP Social Ninja WordPress plugin broken access control6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-64374Motors WordPress theme arbitrary file upload9.9CNA v3.10.4%2025-12-18Fix
CVE-2025-64373Traveler WordPress theme local file inclusion8.1CNA v3.10.4%2025-12-18Fix
CVE-2025-64372Traveler WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64371Traveler WordPress theme SQL injection8.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64355JetElements For Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-64295All In One SEO Pack WordPress plugin sensitive data exposure6.5CISA ADP v3.10.3%2025-12-18Fix
CVE-2025-64282Radius Blocks WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.2%2025-12-18
CVE-2025-64273Email marketing for WordPress by GetResponse Official plugin broken access control6.5CNA v3.10.2%2025-12-18Fix
CVE-2025-64272Email marketing for WordPress by GetResponse Official plugin sensitive data exposure6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64270Masteriyo - LMS WordPress plugin sensitive data exposure6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64268Timetics WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64266Booking and Rental Manager WordPress plugin PHP object injection8.8CNA v3.10.4%2025-12-18Fix
CVE-2025-64260ANAC XML Bandi di Gara WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64258Follow My Blog Post WordPress plugin sensitive data exposure7.5CNA v3.10.4%2025-12-18Fix
CVE-2025-64236Tuturn WordPress plugin broken authentication9.8CNA v3.10.4%2025-12-18Fix
CVE-2025-64235Tuturn WordPress plugin arbitrary file download6.5CNA v3.10.4%2025-12-18Fix
CVE-2025-64233Codiqa WordPress theme PHP object injection9.8CNA v3.10.4%2025-12-18Fix
CVE-2025-64231WordPress Contact Form 7 PDF, Google Sheet and Database plugin arbitrary file upload9.9CNA v3.10.3%2025-12-18Fix
CVE-2025-64230Filr WordPress plugin arbitrary file deletion7.7CNA v3.10.4%2025-12-18Fix
CVE-2025-64227Client Invoicing by Sprout Invoices WordPress plugin PHP object injection9.8CNA v3.10.4%2025-12-18Fix
CVE-2025-64225Stockie Extra WordPress plugin content injection6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64223PenNews WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18Fix
CVE-2025-64222WooCommerce Recover Abandoned Cart WordPress plugin arbitrary content deletion vulnerability7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64221Reservation WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64218Passster WordPress plugin sensitive data exposure7.5CISA ADP v3.10.3%2025-12-18Fix
CVE-2025-64217Photography WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64214MasterStudy LMS Pro WordPress plugin arbitrary content deletion vulnerability7.5CNA v3.10.4%2025-12-18Fix
CVE-2025-64213MasterStudy LMS Pro WordPress plugin sensitive data exposure7.5CNA v3.10.4%2025-12-18Fix
CVE-2025-64209Masterstudy WordPress theme broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-64207Jannah WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64206Jannah WordPress theme PHP object injection9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-64205Jannah WordPress theme local file inclusion8.1CNA v3.10.4%2025-12-18Fix
CVE-2025-64203Mailster WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64193XStore WordPress theme local file inclusion7.5CNA v3.10.5%2025-12-18Fix
CVE-2025-64192XStore WordPress theme broken access control6.3CNA v3.10.2%2025-12-18Fix
CVE-2025-64191XStore WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64189XStore Core WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-64188Soledad WordPress theme privilege escalation9.8CNA v3.10.4%2025-12-18Fix
CVE-2025-63951Sourcefabric Phoniebox An deserialization of untrusted data7.5CISA ADP v3.10.5%2025-12-18
CVE-2025-63950Tomaszdunia Twittodon download.php script of the to3k deserialization of untrusted data7.5CISA ADP v3.10.5%2025-12-18
CVE-2025-63949Yohanawi Hotel Management System reflected cross-site scripting6.1CISA ADP v3.10.3%2025-12-18
CVE-2025-63948Craigtaub Phpmsadmin SQL injection5.4CISA ADP v3.10.2%2025-12-18
CVE-2025-63947Craigtaub Phpmsadmin reflected cross-site scripting5.4CISA ADP v3.10.2%2025-12-18
CVE-2025-63757FFmpeg integer overflow7.5CISA ADP v3.10.4%2025-12-18Fix
CVE-2025-63390mintplex-labs anything-llm AnythingLLM v1.8.5 in authentication bypass5.3CISA ADP v3.10.6%2025-12-18
CVE-2025-63389Ollama Platform has missing authentication enabling attackers to perform model management operations9.8CISA ADP v3.10.7%2025-12-18
CVE-2025-63388langgenius dify origin validation error9.1NVD v3.10.2%2025-12-18
CVE-2025-63387langgenius dify insecure permissions7.5CISA ADP v3.129.9%2025-12-18Nuclei
CVE-2025-63386langgenius dify origin validation error9.1NVD v3.10.2%2025-12-18
CVE-2025-63043Post Grid and Gutenberg Blocks WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.2%2025-12-18
CVE-2025-63039ListingPro WordPress theme broken access control6.5CNA v3.10.3%2025-12-18
CVE-2025-63002Sermon Manager WordPress plugin broken access control5.3CNA v3.10.2%2025-12-18
CVE-2025-62998WP AI CoPilot WordPress plugin sensitive data exposure5.0CNA v3.10.2%2025-12-18Fix
CVE-2025-62961Sparkle FSE WordPress theme broken access control5.4CNA v3.10.2%2025-12-18
CVE-2025-62960Construction Light WordPress theme broken access control5.4CNA v3.10.2%2025-12-18
CVE-2025-62004BullWall Server Intrusion Protection (SIP) initialization race condition7.7CNA v4.00.3%2025-12-18
CVE-2025-62003BullWall Server Intrusion Protection RDP MFA connection delay7.7CNA v4.00.3%2025-12-18
CVE-2025-62002BullWall Ransomware Containment file count detection bypass8.1v3.10.3%2025-12-18
CVE-2025-62001BullWall Ransomware Containment hard-coded folder exclusions8.7CNA v4.00.4%2025-12-18Fix
CVE-2025-62000BullWall Ransomware Containment incomplete file inspection6.9CNA v4.00.2%2025-12-18
CVE-2025-60182Support Board WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-60180WP Gravity Forms Salesforce WordPress plugin PHP object injection9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60178WP Gravity Forms HubSpot WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60174WP Gravity Forms Constant Contact WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60091WP Gravity Forms Zoho CRM and Bigin WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60090WP Gravity Forms Insightly WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60089WP Gravity Forms FreshDesk WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-60088WebinarIgnition WordPress plugin broken access control6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-60086WP Voting Contest WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18
CVE-2025-60084PDF for Elementor Forms + Drag And Drop Template Builder WordPress plugin PHP object injection8.8CNA v3.10.4%2025-12-18Fix
CVE-2025-60083PDF Invoice Builder for WooCommerce WordPress plugin deserialization of untrusted data8.8CNA v3.10.4%2025-12-18Fix
CVE-2025-60082PDF for WPForms WordPress plugin deserialization of untrusted data8.8CNA v3.10.4%2025-12-18Fix
CVE-2025-60081PDF for Contact Form 7 WordPress plugin deserialization of untrusted data8.8CNA v3.10.4%2025-12-18Fix
CVE-2025-60080PDF for Gravity Forms + Drag And Drop Template Builder WordPress plugin PHP object injection7.5CNA v3.10.4%2025-12-18Fix
CVE-2025-60079Parallax Section block WordPress plugin broken authentication7.1CNA v3.10.3%2025-12-18Fix
CVE-2025-60078Task Manager WordPress plugin local file inclusion7.5CNA v3.10.5%2025-12-18
CVE-2025-60077YayPricing WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-60076Ray Enterprise Translation WordPress plugin local file inclusion7.5CNA v3.10.4%2025-12-18Fix
CVE-2025-60072Anchor smooth scroll WordPress plugin local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60071Riode Multi-Purpose WooCommerce WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60070Molla - Multipurpose Responsive Shopify WordPress theme arbitrary code execution6.5CNA v3.10.2%2025-12-18
CVE-2025-60069MinimogWP WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60068Javo Core WordPress plugin arbitrary code execution6.5CNA v3.10.2%2025-12-18
CVE-2025-60067Giardino WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60066Katelyn WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60065Pinevale WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60064Renewal WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60063Rosalinda WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60062tPlayer WordPress plugin SQL injection9.3CNA v3.10.3%2025-12-18
CVE-2025-60061Kicker WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60060Pubzinne WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60059smart SEO WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60058DetailX WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60057DJ Rainflow WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60056Winger WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60055Fabrica WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60054OnLeash WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60053MaxCube WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60052AncoraThemes WordPress W&D theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60051Rare Radio WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60050Panda WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60049Soleil WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60048Tripster WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60047IPharm WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60046HeartStar WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60045IDonatePro WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18
CVE-2025-60044Fribbo WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60043Wanderic WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-60042Chinchilla WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-59949FreshRSS logout feature cross-site request forgery5.3CNA v3.10.4%2025-12-18Fix
CVE-2025-59529Avahi: Simple protocol server ignores accepts unlimited connections and logs failures without limit5.5CNA v3.10.2%2025-12-18Fix
CVE-2025-59134Sale! Immigration law WordPress theme Jthemes incorrect privilege assignment8.8CNA v3.10.4%2025-12-18
CVE-2025-58951Advance Seat Reservation Management for WooCommerce WordPress plugin SQL injection9.3CNA v3.10.3%2025-12-18
CVE-2025-58950Lione WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58949Spock WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58948Aromatica WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58947Athos WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58946Vocal WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58945EcoGrow WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58944Manufactory WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58943Agricola WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58942Dwell WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58941Fabric WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58940Basil WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58938IDonatePro WordPress plugin broken access control7.5CNA v3.10.3%2025-12-18
CVE-2025-58937Tacticool WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58936Catamaran WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58935Lunna WordPress theme local file inclusion9.8v3.10.5%2025-12-18
CVE-2025-58934The Gig WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58933Anubis WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58932Prisma WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58931Palatio WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58930FitFlex WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58929Pantry WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58928Heart WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58927Stallion WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58926Cerebrum WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58925Neptunus WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58923Critique WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58901Takeout WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58900UniTravel WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58899Frame WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58898HealthHub WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58896Otaku WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58895Integro WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58894Good Mood WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58893Alright WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58892Tourimo WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58891Sanger WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58890Playful WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58889Towny WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58888The Flash WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58885Pathfinder WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58879Festy WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58877Javo Core WordPress plugin arbitrary content deletion vulnerability7.5CNA v3.10.4%2025-12-18
CVE-2025-58803Algenix WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58710Hotel Listing WordPress plugin privilege escalation8.8CNA v3.10.4%2025-12-18
CVE-2025-58709Legacy WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58708Axiomthemes 777 theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58706Woo Hoo WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-58225Paragon WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-57897Logtik WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-56157langgenius dify default credentials9.8CISA ADP v3.10.9%2025-12-18
CVE-2025-55707PostX WordPress plugin privilege escalation7.2CNA v3.10.4%2025-12-18Fix
CVE-2025-54751PostX WordPress plugin broken access control7.1CNA v3.10.3%2025-12-18Fix
CVE-2025-54748MapSVG WordPress plugin arbitrary file download6.5CNA v3.10.4%2025-12-18Fix
CVE-2025-54745miniOrange's Google Authenticator WordPress plugin broken access control6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-54743Download After Email WordPress plugin mkscripts missing authorization5.3CISA ADP v3.10.3%2025-12-18Fix
CVE-2025-54741Super Blank WordPress plugin arbitrary content deletion vulnerability6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-54723DentiCare WordPress theme PHP object injection9.8CNA v3.10.5%2025-12-18Fix
CVE-2025-53710Palantir com.palantir.compute:compute-service improper isolation7.5CNA v3.10.3%2025-12-18
CVE-2025-53453Hygia WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53449Convex WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53448Rally WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53447Assembly WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53446Beautique WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53445Catwalk WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53443Smash WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53442Rentic WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53441Greeny WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53439Harper WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53438FitLine WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53437Greenorganic WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53436Monki WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18Fix
CVE-2025-53435Plan My Day WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53434ChildHope WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53433EasyEat WordPress theme local file inclusion9.8CNA v3.10.5%2025-12-18
CVE-2025-53432Echo WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53431Emberlyn WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53430Etta WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-53429Exit Game WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-52768Faith and Hope WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-52745Farm Agrico WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49943Femme WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49942Gardis WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49941GlamChic WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49919eRoom WordPress plugin sensitive data exposure5.8CISA ADP v3.10.2%2025-12-18Fix
CVE-2025-49918VikBooking Hotel Booking Engine and PMS WordPress plugin sensitive data exposure5.9CNA v3.10.3%2025-12-18Fix
CVE-2025-49914Restaurant Menu by MotoPress WordPress plugin sensitive data exposure6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-49902Login Page Customizer WordPress plugin WP Life missing authorization6.5CNA v3.10.3%2025-12-18Fix
CVE-2025-49379Custom Fields Account Registration For Woocommerce WordPress plugin privilege escalation7.2CNA v3.10.4%2025-12-18Fix
CVE-2025-49371Strux WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49370Lymcoin WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49369Lettuce WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49368Palladio WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49367Monyxi WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49366Hanani WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49365Jack Well WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49364Ludos Paradise WordPress theme local file inclusion8.1CNA v3.10.5%2025-12-18
CVE-2025-49363Kings and Queens WordPress theme local file inclusion8.1CNA v3.10.7%2025-12-18
CVE-2025-49362Gracioza WordPress theme local file inclusion8.1CNA v3.10.7%2025-12-18
CVE-2025-49361Mamita WordPress theme local file inclusion8.1CNA v3.10.6%2025-12-18
CVE-2025-49360Militarology WordPress theme local file inclusion8.1CNA v3.10.6%2025-12-18
CVE-2025-49359ShieldGroup WordPress theme local file inclusion8.1CNA v3.10.6%2025-12-18
CVE-2025-49041Get Cash WordPress plugin broken access control6.5CNA v3.10.4%2025-12-18Fix
CVE-2025-47387Qualcomm Snapdragon untrusted pointer dereference in Camera7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47382Qualcomm Snapdragon incorrect authorization in Boot7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47372Qualcomm Snapdragon buffer copy without checking size of input in Boot9.0CNA v3.10.1%2025-12-18Fix
CVE-2025-47350Qualcomm Snapdragon use-after-free in DSP service7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47325Qualcomm Snapdragon untrusted pointer dereference in TZ firmware6.5CNA v3.10.1%2025-12-18Fix
CVE-2025-47323Qualcomm Snapdragon integer overflow or wraparound in Audio7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47322Qualcomm Snapdragon use-after-free in Automotive Linux OS7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47321Qualcomm Snapdragon buffer copy without checking size of input in Core services7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47320Qualcomm Snapdragon out-of-bounds write in Audio7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-47319Qualcomm Snapdragon TA-to-TA communication interface information disclosure6.7CNA v3.10.1%2025-12-18Fix
CVE-2025-46268Advantech WebAccess/SCADA SQL injection8.8v3.10.3%2025-12-18Fix
CVE-2025-40898Path traversal in Import Arc data archive functionality in Guardian/CMC7.2CNA v4.00.4%2025-12-18Fix
CVE-2025-40893HTML injection in Asset List in Guardian/CMC5.3CNA v4.00.2%2025-12-18Fix
CVE-2025-40892Stored cross-site scripting (XSS) in Reports in Guardian/CMC7.1CNA v4.00.3%2025-12-18Fix
CVE-2025-40891HTML injection in in Time Machine functionality in Guardian/CMC2.3CNA v4.00.2%2025-12-18Fix
CVE-2025-40602SonicWall SMA1000 missing authorization6.6CISA ADP v3.12.8%2025-12-18KEVExploit codeKCVFix
CVE-2025-34452Streama Subtitle Download path traversal and SSRF leading to arbitrary file write8.7CNA v4.05.4%2025-12-18
CVE-2025-34451Rofl0r/proxychains-ng stack-based buffer overflow7.8v3.10.3%2025-12-18Fix
CVE-2025-34450Merbanan/rtl_433 stack-based buffer overflow7.8v3.10.2%2025-12-18Fix
CVE-2025-34449Genymobile/scrcpy global buffer overflow9.1NVD v3.10.4%2025-12-18
CVE-2025-27063Qualcomm Snapdragon use-after-free in Video7.8CNA v3.10.1%2025-12-18Fix
CVE-2025-14896yuzutech kroki files accessible to external parties8.7CNA v4.00.3%2025-12-18
CVE-2025-14889Campcodes Advanced Voting Management System Password voters_edit.php improper authorization6.3v3.10.3%2025-12-18
CVE-2025-14885SourceCodester Client Database Management System leads Generation user_leads.php unrestricted upload8.8v3.10.3%2025-12-18
CVE-2025-14884D-Link DIR-605 Firmware update service command injection8.6CNA v4.011.0%2025-12-18
CVE-2025-14879Tenda WH450 HTTP request onSSIDChange stack-based overflow9.3CNA v4.06.7%2025-12-18Emerging Threats
CVE-2025-14878Tenda WH450 HTTP request wirelessRestart stack-based overflow9.3CNA v4.01.0%2025-12-18
CVE-2025-14877Campcodes Supplier Management System add_retailer.php SQL injection9.8v3.10.4%2025-12-18
CVE-2025-14874Nodemailer: Nodemailer: Denial of service via crafted email address header7.5NVD v3.10.6%2025-12-18Fix
CVE-2025-14861Mozilla memory safety bugs fixed in Firefox8.8CISA ADP v3.10.3%2025-12-18Fix
CVE-2025-14860Mozilla Firefox use-after-free in the Disability Access APIs component9.8CISA ADP v3.10.3%2025-12-18Fix
CVE-2025-14856y_project RuoYi getnames code injection8.8v3.10.4%2025-12-18
CVE-2025-14850Advantech WebAccess/SCADA improper limitation of a pathname to a restricted directory9.1v3.10.9%2025-12-18Fix
CVE-2025-14849Advantech WebAccess/SCADA unrestricted upload of file with dangerous type9.8NVD v3.10.6%2025-12-18Fix
CVE-2025-14848Advantech WebAccess/SCADA absolute path traversal5.3v3.10.7%2025-12-18Fix
CVE-2025-14841OFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereference4.8CNA v4.00.1%2025-12-18Fix
CVE-2025-14837ZZCMS Backend Website settings siteconfig.php stripfxg code injection7.2NVD v3.10.5%2025-12-18
CVE-2025-14823ConnectWise ScreenConnect Certificate Signing Extension Returns Encrypted Values5.3CNA v3.10.2%2025-12-18Fix
CVE-2025-14744Mozilla Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS6.5CISA ADP v3.10.2%2025-12-18Fix
CVE-2025-14739Uninitialized pointer vulnerability in TP-Link WR940N and WR941ND6.8CNA v4.00.2%2025-12-18Fix
CVE-2025-14738TP-Link Systems WA850RE improper authentication5.7CNA v4.00.4%2025-12-18Fix
CVE-2025-14737Command injection vulnerability in TP-Link WA850RE7.1CNA v4.00.9%2025-12-18Fix
CVE-2025-14618Sweet Energy Efficiency WordPress plugin unauthorized access4.3CNA v3.10.2%2025-12-18Fix
CVE-2025-14437Hummingbird WordPress plugin unauthenticated sensitive information exposure via Log file7.5CNA v3.11.9%2025-12-18NucleiFix
CVE-2025-14364Demo Importer Plus WordPress plugin unauthorized access8.8CNA v3.10.4%2025-12-18Exploit codeFix
CVE-2025-14318Improper access validation in M-Files Server5.3CNA v4.00.3%2025-12-18Fix
CVE-2025-14314PopupKit WordPress plugin SQL injection8.5CNA v3.10.4%2025-12-18Fix
CVE-2025-14277Prime Slider Addons for Elementor WordPress plugin server-side request forgery4.3CNA v3.10.3%2025-12-18Fix
CVE-2025-14202LinkDing cross-site request forgery (CSRF) leading to account takeover via SVG file upload8.2CNA v4.00.3%2025-12-18
CVE-2025-13911Inductive Automation Ignition execution with unnecessary privileges7.3CNA v4.00.3%2025-12-18
CVE-2025-13730OpenID Connect Generic Client WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-18Fix
CVE-2025-13641Photo Gallery, Sliders, Proofing and Themes NextGEN Gallery WordPress plugin local file inclusion8.8CNA v3.10.8%2025-12-18Fix
CVE-2025-13498Download Manager WordPress plugin unauthorized access4.3CNA v3.10.4%2025-12-18Fix
CVE-2025-13427Authentication bypass in Dialogflow CX Messenger6.9CNA v4.00.5%2025-12-18Fix
CVE-2025-13110HUSKY Products Filter Professional for WooCommerce WordPress plugin insecure direct object reference4.3CNA v3.10.3%2025-12-18Fix
CVE-2025-12976Events Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2025-12-18Fix
CVE-2025-12885Embed Any Document WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2025-12-18Fix
CVE-2025-10910Gaining remote control over Govee devices9.3CNA v4.00.4%2025-12-18
CVE-2025-10019Contact Form Email WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.4%2025-12-18Fix
CVE-2025-9787Zoho ManageEngine Applications Manager stored XSS6.1CNA v3.11.1%2025-12-18Fix
CVE-2025-7358Utarit Informatics Services SoliClub hard-coded credentials9.8v3.10.4%2025-12-18Fix
CVE-2025-7047Missing authorization in Utarit Informatics' SoliClub5.4v3.10.2%2025-12-18Fix
CVE-2025-6326Inset WordPress theme local file inclusion8.1CNA v3.10.4%2025-12-18
CVE-2025-6324Easy Invoice WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-12-18Fix
CVE-2025-1031IDOR in Utarit Informatics' SoliClub7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-1030Sensitive data exposure in Utarit Informatics' SoliClub7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-1029Hard-coded credentials in Utarit Informatics' SoliClub7.5CNA v3.10.3%2025-12-18Fix
CVE-2025-68435Zerobyte has authentication bypass by primary weakness9.1CNA v3.10.4%2025-12-17Fix
CVE-2025-68434Open Source Point of Sale cross-site request forgery8.8CNA v3.10.3%2025-12-17Exploit codeFix
CVE-2025-68433Zed IDE MCP Context Server Configuration arbitrary code execution7.8CNA v3.10.3%2025-12-17Fix
CVE-2025-68432Zed IDE LSP Binary Configuration arbitrary code execution7.8CNA v3.10.3%2025-12-17Fix
CVE-2025-68429Storybook manager bundle may expose environment variables during build7.3CNA v3.10.3%2025-12-17Fix
CVE-2025-68401ChurchCRM stored cross-site scripting6.2CNA v4.00.2%2025-12-17Fix
CVE-2025-68400ChurchCRM vulnerable to time-based blind SQL injection in ConfirmReportEmail.php9.3CNA v4.00.4%2025-12-17Exploit codeFix
CVE-2025-68399ChurchCRM has stored cross-site scripting (XSS) in GroupEditor.php2.0CNA v4.00.2%2025-12-17Fix
CVE-2025-68275ChurchCRM group name field stored cross-site scripting9.2CNA v4.00.2%2025-12-17Fix
CVE-2025-68147opensourcepos has a cross-site scripting8.1CNA v3.10.4%2025-12-17Exploit codeFix
CVE-2025-68145modelcontextprotocol servers mcp-server-git has missing path validation when using --repository flag6.4CNA v4.07.0%2025-12-17KCVFix
CVE-2025-68144Model Context Protocol Servers git_diff and git_checkout functions argument injection6.3CNA v4.07.2%2025-12-17KCVFix
CVE-2025-68143LF Projects Model Context Protocol Servers mcp-server-git git_init tool path traversal6.5CNA v4.08.1%2025-12-17KCVFix
CVE-2025-68129Auth0-PHP SDK has Improper Audience Validation6.8CNA v3.10.4%2025-12-17Fix
CVE-2025-68118FreeRDP Potential Heap out-of-bounds read in freerdp_certificate_data_hash_6.6CNA v4.00.2%2025-12-17Fix
CVE-2025-68114Capstone SStream_concat function vulnerability4.8CNA v3.10.2%2025-12-17Fix
CVE-2025-68112ChurchCRM has SQL injection in EditEventAttendees.php9.6CNA v3.10.4%2025-12-17Fix
CVE-2025-68111ChurchCRM has SQL injection in eGive Import feature7.2CNA v3.10.4%2025-12-17Fix
CVE-2025-68110ChurchCRM discloses database information on error message10.0CNA v3.10.4%2025-12-17Fix
CVE-2025-68109ChurchCRM vulnerable to RCE with database restore functionality9.1CNA v3.11.5%2025-12-17MetasploitExploit codeFix
CVE-2025-67895Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 29.8CISA ADP v3.11.0%2025-12-17Fix
CVE-2025-67877ChurchCRM SQL injection7.4CNA v4.00.4%2025-12-17Fix
CVE-2025-67876ChurchCRM has stored XSS in Group Role Name leading to admin session hijacking9.3CNA v4.00.2%2025-12-17
CVE-2025-67875ChurchCRM has stored XSS via Person Property Assignment leading to admin session hijacking8.5CNA v4.00.2%2025-12-17Exploit codeFix
CVE-2025-67873Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow4.8CNA v3.10.2%2025-12-17Fix
CVE-2025-67794DriveLock incorrect permission assignment6.1NVD v3.10.1%2025-12-17Fix
CVE-2025-67793DriveLock improper privilege management9.8CISA ADP v3.10.3%2025-12-17Fix
CVE-2025-67792DriveLock improper privilege management7.8NVD v3.10.1%2025-12-17Fix
CVE-2025-67791DriveLock improper authentication9.8v3.10.4%2025-12-17Fix
CVE-2025-67790DriveLock improper null termination7.5NVD v3.10.3%2025-12-17Fix
CVE-2025-67789DriveLock improper access control5.3CISA ADP v3.10.2%2025-12-17Fix
CVE-2025-67787DriveLock cross-site scripting9.6CISA ADP v3.10.3%2025-12-17Fix
CVE-2025-67781DriveLock improper privilege management9.9CISA ADP v3.10.3%2025-12-17
CVE-2025-67493Homarr: Missing input sanitization and possible privilege escalation7.5CNA v3.10.3%2025-12-17Fix
CVE-2025-67285Angeljudesuarez Covid Tracking System Using Qr-code SQL injection7.3CISA ADP v3.10.2%2025-12-17
CVE-2025-67174Ritecms A local file inclusion7.5v3.11.3%2025-12-17
CVE-2025-67173Ritecms page creation/editing function cross-site request forgery6.8CISA ADP v3.10.2%2025-12-17
CVE-2025-67172Ritecms OS command injection7.2CISA ADP v3.10.9%2025-12-17
CVE-2025-67171Ritecms path traversal7.5CISA ADP v3.10.8%2025-12-17
CVE-2025-67170Ritecms A reflected cross-site scripting6.1CISA ADP v3.10.3%2025-12-17
CVE-2025-67168Ritecms weak password hash5.3CISA ADP v3.10.1%2025-12-17
CVE-2025-67165Pagekit CMS has an insecure direct object reference (IDOR) in its User Role component9.8CISA ADP v3.10.5%2025-12-17
CVE-2025-67164Pagekit CMS is vulnerable to OS command injection via Storage component9.9CISA ADP v3.10.5%2025-12-17
CVE-2025-67074Tenda AC10 function fromAdvSetMacMtuWan of bin httpd buffer overflow6.5CISA ADP v3.10.4%2025-12-17
CVE-2025-67073Tenda AC10 function fromAdvSetMacMtuWan of bin httpd buffer overflow9.8CISA ADP v3.10.7%2025-12-17
CVE-2025-66953Nardamiteq UPC2 narda miteq Uplink Power Contril Unit cross-site request forgery8.8CISA ADP v3.10.3%2025-12-17
CVE-2025-66924opensourcepos Open Source Point of Sale Create/Update Item Kit(s) cross-site scripting6.1CISA ADP v3.10.3%2025-12-17
CVE-2025-66923opensourcepos Open Source Point of Sale Create/Update Customer(s) cross-site scripting7.2CISA ADP v3.10.6%2025-12-17
CVE-2025-66921opensourcepos Open Source Point of Sale Create/Update Item(s) module cross-site scripting7.2CISA ADP v3.10.6%2025-12-17
CVE-2025-66647RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass1.7CNA v4.01.0%2025-12-17Fix
CVE-2025-66646RIOT-OS has null pointer dereference in gnrc_ipv6_ext_frag_reass1.7CNA v4.00.7%2025-12-17Fix
CVE-2025-66397ChurchCRM's Kiosk Manager functions are vulnerable to broken access control8.3CNA v3.10.3%2025-12-17Fix
CVE-2025-66396ChurchCRM has SQL injection in User Editor via `type` Parameter Key7.2CNA v3.10.4%2025-12-17Fix
CVE-2025-66395ChurchCRM CRM SQL injection in Event List via `WhichType` parameter8.8CNA v3.10.4%2025-12-17Fix
CVE-2025-66029Open OnDemand affected by Apache proxy passing sensitive headers7.6CNA v3.10.2%2025-12-17Fix
CVE-2025-65855Netun Helpflash Iot Firmware cleartext transmission of sensitive information6.6CISA ADP v3.10.1%2025-12-17
CVE-2025-65233SLiMS reflected cross-site scripting6.1CISA ADP v3.10.2%2025-12-17
CVE-2025-65203Keepassxc-browser cross-site request forgery7.1CISA ADP v3.10.1%2025-12-17
CVE-2025-65185Entrinsik Informer observable discrepancy2.8CISA ADP v3.10.2%2025-12-17
CVE-2025-64700GROWI cross-site request forgery5.1CNA v4.00.1%2025-12-17
CVE-2025-62690Mattermost open redirect in error page when link opened in new tab3.1CNA v3.10.1%2025-12-17Fix
CVE-2025-62521ChurchCRM has unauthenticated RCE in its Install Wizard10.0CNA v3.14.5%2025-12-17MetasploitExploit codeFix
CVE-2025-62190Mattermost CSRF allows Call Initiation and Message Delivery4.3CNA v3.10.1%2025-12-17Fix
CVE-2025-61736Johnson Controls iSTAReX iSTAR- improper validation of Certificate Expiration7.1CNA v4.00.1%2025-12-17Fix
CVE-2025-59849HCL BigFix Remote Control is vulnerable to an insecure CSP configuration4.7CNA v3.10.2%2025-12-17Fix
CVE-2025-59374ASUS Live Update embedded malicious code9.3CNA v4.01.2%2025-12-17KEVFix
CVE-2025-55254HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)3.7CNA v3.10.2%2025-12-17Fix
CVE-2025-53919Portrait Dell Color Management incorrect default permissions7.8CISA ADP v3.10.1%2025-12-17Fix
CVE-2025-53524Fuji Electric Monitouch V-SFT-6 out-of-bounds write8.4CNA v4.00.3%2025-12-17Fix
CVE-2025-53398Portrait Dell Color Management incorrect default permissions7.8CISA ADP v3.10.1%2025-12-17Fix
CVE-2025-53000nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows8.5CNA v4.00.3%2025-12-17Fix
CVE-2025-46292Apple iOS and iPadOS improper access control5.5v3.10.1%2025-12-17Fix
CVE-2025-46291Apple macOS logic flaw7.8v3.10.2%2025-12-17Fix
CVE-2025-46288Apple macOS insecure permissions5.5NVD v3.10.2%2025-12-17Fix
CVE-2025-46283Apple macOS logic flaw5.5v3.10.2%2025-12-17Fix
CVE-2025-46282Apple Safari information disclosure5.5v3.10.2%2025-12-17Fix
CVE-2025-46281Apple macOS logic flaw8.8v3.10.2%2025-12-17Fix
CVE-2025-46279Apple macOS insecure permissions3.3NVD v3.10.4%2025-12-17Fix
CVE-2025-46278Apple macOS information disclosure5.5v3.10.2%2025-12-17Fix
CVE-2025-46277Apple macOS sensitive information in log files3.3NVD v3.10.2%2025-12-17Fix
CVE-2025-44005smallstep Step-CA step CA has authorization bypass in ACME and SCEP Provisioners10.0CNA v3.19.1%2025-12-17Fix
CVE-2025-43873Johnson Controls iSTAR Ultra fault debounce settings OS command injection8.7CNA v4.00.3%2025-12-17Fix
CVE-2025-43541Apple Safari type confusion4.3CISA ADP v3.134.1%2025-12-17Exploit codeFix
CVE-2025-43536Apple Safari use-after-free4.3CISA ADP v3.10.6%2025-12-17Fix
CVE-2025-43535Apple Safari denial of service4.3CISA ADP v3.10.8%2025-12-17Fix
CVE-2025-43533Apple macOS crash5.7CISA ADP v3.10.3%2025-12-17Fix
CVE-2025-43531Apple Safari race condition3.1CISA ADP v3.10.5%2025-12-17Fix
CVE-2025-43529Apple Multiple Products use-after-free WebKit8.8CISA ADP v3.18.8%2025-12-17KEVExploit codeKCVFix
CVE-2025-43526Apple Safari open redirect9.8CISA ADP v3.10.5%2025-12-17Fix
CVE-2025-43514Apple macOS information disclosure5.5v3.10.2%2025-12-17Fix
CVE-2025-43501Apple Safari buffer overflow4.3CISA ADP v3.10.8%2025-12-17Fix
CVE-2025-43475Apple iOS and iPadOS sensitive information in log files5.5v3.10.1%2025-12-17Fix
CVE-2025-43428Apple macOS missing authentication9.8CISA ADP v3.10.7%2025-12-17Fix
CVE-2025-34442AVideo System path disclosure via Public API7.5v3.10.9%2025-12-17MetasploitExploit codeKCVFix
CVE-2025-34441AVideo user information disclosure via Public API7.5v3.10.9%2025-12-17MetasploitExploit codeKCVFix
CVE-2025-34440AVideo open redirect via siteRedirectUri parameter6.1v3.10.2%2025-12-17Fix
CVE-2025-34439AVideo open redirect via cancelUri parameter6.1v3.10.2%2025-12-17Fix
CVE-2025-34438AVideo IDOR arbitrary Video Rotation8.1v3.10.3%2025-12-17Fix
CVE-2025-34437AVideo IDOR arbitrary Comment Image upload8.8NVD v3.10.4%2025-12-17Fix
CVE-2025-34436AVideo IDOR arbitrary file upload8.8v3.10.4%2025-12-17Fix
CVE-2025-34435AVideo IDOR arbitrary file deletion6.5NVD v3.10.3%2025-12-17Fix
CVE-2025-34434AVideo ImageGallery plugin unauthenticated file upload and Deletion9.1v3.10.5%2025-12-17Fix
CVE-2025-26381OpenBlue Mobile Web application configuration issue for optional for OpenBlue Workplace6.5CNA v4.00.3%2025-12-17
CVE-2025-20393Cisco Multiple Products improper input validation10.0CNA v3.132.4%2025-12-17KEVExploit codeFix
CVE-2025-14836ZZCMS User Data Storage user_save.php cleartext storage in file5.1CNA v4.00.2%2025-12-17
CVE-2025-14834code-projects Simple Stock System checkuser.php SQL injection8.8v3.10.4%2025-12-17
CVE-2025-14833code-projects Online Appointment Booking System deletemanagerclinic.php SQL injection9.8v3.10.4%2025-12-17
CVE-2025-14832itsourcecode Online Cake Ordering System updateproduct.php SQL injection9.8v3.10.4%2025-12-17
CVE-2025-14817Transsion HiOS Factory Mode app missing authorization6.5CISA ADP v3.10.2%2025-12-17Fix
CVE-2025-14801xiweicheng TMS create createComment cross-site scripting4.8v3.10.3%2025-12-17
CVE-2025-14764Amazon S3 Encryption Client has a Key Commitment issue6.0CNA v4.00.1%2025-12-17Fix
CVE-2025-14763Amazon S3 Encryption Client for Java has a Key Commitment issue6.0CNA v4.00.1%2025-12-17Fix
CVE-2025-14762AWS SDK for Ruby's S3 Encryption client has a Key Commitment issue6.0CNA v4.00.2%2025-12-17Fix
CVE-2025-14761AWS SDK for PHP's S3 Encryption client has a Key Commitment issue6.0CNA v4.00.2%2025-12-17Fix
CVE-2025-14760AWS SDK for C++ weak cryptographic algorithm6.0CNA v4.00.2%2025-12-17Fix
CVE-2025-14759Amazon S3 Encryption Client for .NET has a Key Commitment issue6.0CNA v4.00.1%2025-12-17Fix
CVE-2025-14727F5 NGINX Ingress Controller rewrite-target annotation validation path traversal8.7CNA v4.00.4%2025-12-17Fix
CVE-2025-14701Improper neutralization of input during web page generation in Crafty Controller7.1CNA v3.10.3%2025-12-17Fix
CVE-2025-14700Improper neutralization of special elements used in a template engine in Crafty Controller9.9CNA v3.16.6%2025-12-17Exploit code
CVE-2025-14399Download Plugins and Themes in ZIP from Dashboard WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-12-17Fix
CVE-2025-14385WP Recipe Maker WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-12-17Fix
CVE-2025-14347Reflected XSS in Proliz's OBS6.3CNA v3.10.2%2025-12-17Fix
CVE-2025-14305Acer｜ListCheck.exe local privilege escalation8.5CNA v4.00.1%2025-12-17
CVE-2025-14304ASRock, ASRockRack, ASRockInd｜Motherboard protection mechanism failure7.0CNA v4.00.4%2025-12-17Fix
CVE-2025-14303MSI｜Motherboard protection mechanism failure7.0CNA v4.00.3%2025-12-17Fix
CVE-2025-14302GIGABYTE｜Motherboard protection mechanism failure7.0CNA v4.00.3%2025-12-17Fix
CVE-2025-14266CSRF in Ercom Cryptobox administration console0.6CNA v4.00.2%2025-12-17Fix
CVE-2025-14154Better Messages WordPress plugin stored cross-site scripting6.1CNA v3.10.2%2025-12-17Fix
CVE-2025-14101IDOR in GG Soft's PaperWork7.1CNA v3.10.2%2025-12-17Fix
CVE-2025-14097Remote code execution vulnerability in Radiometer Products7.2CNA v3.10.5%2025-12-17Fix
CVE-2025-14096Credential disclosure vulnerability in Radiometer Products8.4CNA v3.10.1%2025-12-17
CVE-2025-14095Privilege boundary violation in Radiometer Products6.8CNA v3.10.2%2025-12-17Fix
CVE-2025-14081Ultimate Member WordPress plugin authenticated (Subscriber+) Profile Privacy setting bypass4.3CNA v3.10.3%2025-12-17Fix
CVE-2025-14061Cookie Banner WordPress plugin unauthorized data modification5.3CNA v3.10.3%2025-12-17Fix
CVE-2025-13977Essential Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-12-17Fix
CVE-2025-13880WP Social Ninja WordPress plugin unauthorized access6.5CNA v3.10.3%2025-12-17Fix
CVE-2025-13861HTML Forms Simple WordPress Forms plugin unauthenticated stored cross-site scripting6.1CNA v3.10.3%2025-12-17Fix
CVE-2025-13750Converter for Media WordPress plugin missing authorization authenticated Optimized Image deletion4.3CNA v3.10.3%2025-12-17Fix
CVE-2025-13537Live Composer Free WordPress Website Builder plugin DOM-based stored cross-site scripting6.4CNA v3.10.2%2025-12-17Fix
CVE-2025-13352Mattermost GitHub plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0CNA v3.10.2%2025-12-17Fix
CVE-2025-13326Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store3.9CNA v3.10.1%2025-12-17Fix
CVE-2025-13324Mattermost Lack of Invalidation of Legacy Remote Cluster Invite Tokens after Confirmation3.7CNA v3.10.2%2025-12-17Fix
CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletion3.3CNA v3.10.1%2025-12-17Fix
CVE-2025-13217Ultimate Member WordPress plugin authenticated (Subscriber+) stored cross-site scripting via value6.4CNA v3.10.3%2025-12-17Fix
CVE-2025-12689Mattermost DoS in Calls plugin via malformed UTF-8 in WebSocket request6.5CNA v3.10.3%2025-12-17Fix
CVE-2025-12496Zephyr Project Manager WordPress plugin arbitrary file read and server-side request forgery4.9CNA v3.10.7%2025-12-17Fix
CVE-2025-11924Ninja Forms WordPress plugin insecure direct object reference7.5CNA v3.10.4%2025-12-17Fix
CVE-2025-11901ASUS W680 series resource exhaustion7.0CNA v4.00.2%2025-12-17Fix
CVE-2025-11775ASUS Armoury Crate out-of-bounds read4.8CNA v4.00.1%2025-12-17
CVE-2025-11369Essential Blocks WordPress plugin missing authorization authenticated information disclosure4.3CNA v3.10.3%2025-12-17Fix
CVE-2025-11009Information disclosure vulnerability in GT Designer35.1CNA v3.10.1%2025-12-17
CVE-2025-68322Linux kernel parisc stack unwinder vulnerability–0.2%2025-12-16Fix
CVE-2025-68321Linux kernel page pool allocator vulnerability7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68320Linux kernel lan966x driver improper locking7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68319Linux kernel netconsole configfs race condition–0.2%2025-12-16Fix
CVE-2025-68318Linux kernel TH1520 AXI clock gating denial of service–0.2%2025-12-16Fix
CVE-2025-68317Linux kernel io_uring zero-copy notifications vulnerability7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68316Linux kernel UFS core probe vulnerability–0.2%2025-12-16Fix
CVE-2025-68315Linux kernel f2fs free nid list vulnerability9.8CNA v3.10.4%2025-12-16Fix
CVE-2025-68314Linux kernel MSM GPU driver vulnerability8.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68313In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Add RDSEED fix for Zen5 There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (C7.1CNA v3.10.1%2025-12-16Fix
CVE-2025-68312Linux kernel usbnet driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68311Linux kernel ip22zilog serial driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68310Linux kernel s390 PCI error recovery deadlock–0.2%2025-12-16Fix
CVE-2025-68309Linux kernel PCI AER null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68308Linux kernel Kvaser USB leaf driver infinite loop–0.2%2025-12-16Fix
CVE-2025-68307Linux kernel gs_usb CAN driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68306Linux kernel Bluetooth MediaTek USB driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68305Linux kernel Bluetooth HCI socket use-after-free–0.2%2025-12-16Fix
CVE-2025-68304Linux kernel Bluetooth HCI connection handling use-after-free8.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68303Linux kernel Intel Punit IPC driver vulnerability7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68302Linux kernel sxgbe null pointer dereference7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68301Linux kernel atlantic out-of-bounds write9.8CNA v3.10.5%2025-12-16Fix
CVE-2025-68300Linux kernel mount namespace lookup vulnerability–0.2%2025-12-16Fix
CVE-2025-68299Linux kernel AFS cell key setup vulnerability–0.3%2025-12-16Fix
CVE-2025-68298Linux kernel btusb MediaTek driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68297Linux kernel Ceph client sparse read denial of service–0.2%2025-12-16Fix
CVE-2025-68296Linux kernel fbcon vga switcheroo race condition–0.2%2025-12-16Fix
CVE-2025-68295Linux kernel SMB client mount setup memory leak–0.2%2025-12-16Fix
CVE-2025-68294In the Linux kernel, the following vulnerability has been resolved: io_uring/net: ensure vectored buffer node import is tied to notification When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored i7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68293Linux kernel huge page splitting null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68292Linux kernel hugetlb memfd allocation information disclosure–0.2%2025-12-16Fix
CVE-2025-68291Linux kernel MPTCP fastclose handling denial of service–0.2%2025-12-16Fix
CVE-2025-68290Linux kernel MOST USB driver use-after-free–0.2%2025-12-16Fix
CVE-2025-68289Linux kernel USB gadget EEM function driver memory leak–0.2%2025-12-16Fix
CVE-2025-68288Linux kernel USB storage bulk transport information disclosure–0.2%2025-12-16Fix
CVE-2025-68287Linux kernel dwc3 USB controller driver race condition–0.2%2025-12-16Fix
CVE-2025-68286Linux kernel AMD display driver null pointer dereference7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68285Linux kernel Ceph client use-after-free9.8CNA v3.10.6%2025-12-16Fix
CVE-2025-68284In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the co9.8CNA v3.10.6%2025-12-16Fix
CVE-2025-68283Linux kernel Ceph OSD map parsing vulnerability7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68282Linux kernel USB gadget UDC teardown use-after-free–0.2%2025-12-16Fix
CVE-2025-68281Linux kernel ASoC SDCA control parser vulnerability–0.2%2025-12-16Fix
CVE-2025-68274SIPGO library has response DoS vulnerability via nil pointer dereference8.7CNA v4.00.5%2025-12-16Fix
CVE-2025-68270openedx edx-platform CourseLimitedStaff Role allows Studio Access9.9CNA v3.10.3%2025-12-16
CVE-2025-68269JetBrains IntelliJ IDEA acceptance of untrusted data5.4CNA v3.10.1%2025-12-16Fix
CVE-2025-68268JetBrains TeamCity cross-site scripting5.4CNA v3.10.2%2025-12-16Fix
CVE-2025-68267JetBrains TeamCity least privilege violation6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68266Linux kernel BFS filesystem inode loading vulnerability–0.2%2025-12-16Fix
CVE-2025-68265Linux kernel NVMe admin request queue use-after-free7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68264Linux kernel ext4 inline data handling race condition–0.2%2025-12-16Fix
CVE-2025-68263Linux kernel ksmbd IPC messaging use-after-free9.8CNA v3.10.4%2025-12-16Fix
CVE-2025-68262Linux kernel zstd crypto driver double free–0.2%2025-12-16Fix
CVE-2025-68261Linux kernel ext4 inline data handling race condition7.5CNA v3.10.6%2025-12-16Fix
CVE-2025-68260Linux kernel Rust Binder death notification list race condition7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68259Linux kernel KVM SVM soft interrupt injection vulnerability–0.2%2025-12-16Fix
CVE-2025-68258Linux kernel comedi multiq3 driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68257Linux kernel comedi compat ioctl handling vulnerability–0.2%2025-12-16Fix
CVE-2025-68256Linux kernel rtl8723bs Wi-Fi driver out-of-bounds read8.8CNA v3.10.3%2025-12-16Fix
CVE-2025-68255Linux kernel rtl8723bs Wi-Fi driver out-of-bounds write8.8CNA v3.10.4%2025-12-16Fix
CVE-2025-68254Linux kernel rtl8723bs Wi-Fi driver out-of-bounds read7.1CNA v3.10.3%2025-12-16Fix
CVE-2025-68253Linux kernel page owner stack tracking vulnerability–0.2%2025-12-16Fix
CVE-2025-68252Linux kernel fastrpc driver memory leak–0.2%2025-12-16Fix
CVE-2025-68251Linux kernel EROFS compressed index parsing denial of service–0.2%2025-12-16Fix
CVE-2025-68250Linux kernel hung task detector vulnerability8.2CNA v3.10.3%2025-12-16Fix
CVE-2025-68249Linux kernel MOST USB driver probe improper initialization–0.2%2025-12-16Fix
CVE-2025-68248Linux kernel vmw_balloon page migration vulnerability–0.2%2025-12-16Fix
CVE-2025-68247Linux kernel posix timer creation memory leak–0.2%2025-12-16Fix
CVE-2025-68246Linux kernel ksmbd connection limiting denial of service7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68245Linux kernel netpoll cleanup memory leak–0.2%2025-12-16Fix
CVE-2025-68244Linux kernel i915 GGTT pinning deadlock–0.2%2025-12-16Fix
CVE-2025-68243Linux kernel NFS client TLS certificate check vulnerability7.0CNA v3.10.1%2025-12-16Fix
CVE-2025-68242Linux kernel NFS delegated timestamp handling vulnerability–0.2%2025-12-16Fix
CVE-2025-68241Linux kernel IPv4 route exception cache race condition7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68240In the Linux kernel, the following vulnerability has been resolved: nilfs2: avoid having an active sc_timer before freeing sci Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when fr–0.2%2025-12-16Fix
CVE-2025-68239Linux kernel binfmt_misc executable registration vulnerability–0.2%2025-12-16Fix
CVE-2025-68238Linux kernel cadence null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68237Linux kernel mtdchar integer overflow–0.2%2025-12-16Fix
CVE-2025-68236In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Ass–0.2%2025-12-16Fix
CVE-2025-68235Linux kernel Nouveau firmware loading memory leak–0.2%2025-12-16Fix
CVE-2025-68234In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd_net: fix wrong argument types for skb_queue_splice() If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the socket queue. However, the arguments for7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68233Linux kernel Tegra DRM memory context allocation vulnerability–0.2%2025-12-16Fix
CVE-2025-68232Linux kernel veth transmit queue handling race condition7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68231Linux kernel mempool page poisoning vulnerability–0.2%2025-12-16Fix
CVE-2025-68230Linux kernel AMDGPU compute partition switching out-of-bounds access–0.2%2025-12-16Fix
CVE-2025-68229Linux kernel tcm_loop SCSI target driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68228Linux kernel DRM plane format blob creation vulnerability–0.2%2025-12-16Fix
CVE-2025-68227Linux kernel MPTCP protocol fallback detection vulnerability–0.2%2025-12-16Fix
CVE-2025-68226Linux kernel SMB client cached file ID handling use-after-free8.8CNA v3.10.4%2025-12-16Fix
CVE-2025-68225Linux kernel KHO self-test module vulnerability–0.2%2025-12-16Fix
CVE-2025-68223Linux kernel Radeon GPU fence handling deadlock5.5NVD v3.10.1%2025-12-16Fix
CVE-2025-68222Linux kernel S32CC pin controller uninitialized memory–0.2%2025-12-16Fix
CVE-2025-68221Linux kernel MPTCP path manager address removal vulnerability–0.2%2025-12-16Fix
CVE-2025-68220Linux kernel TI Keystone NetCP driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68219Linux kernel CIFS mount context parsing memory leak–0.2%2025-12-16Fix
CVE-2025-68218Linux kernel NVMe multipath partition scan deadlock7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68217Linux kernel Pegasus Notetaker input driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68216Linux kernel LoongArch BPF trampoline denial of service–0.2%2025-12-16Fix
CVE-2025-68215In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in7.0CNA v3.10.1%2025-12-16Fix
CVE-2025-68214Linux kernel timer_shutdown_sync race condition4.7NVD v3.10.1%2025-12-16Fix
CVE-2025-68213Linux kernel idpf null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68212In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized 'offp' in statmount_string() In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68211Linux kernel KSM (kernel samepage merging) vulnerability5.5NVD v3.10.1%2025-12-16Fix
CVE-2025-68210Linux kernel erofs zstd decompression denial of service–0.2%2025-12-16Fix
CVE-2025-68209In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intende–0.2%2025-12-16Fix
CVE-2025-68208Linux kernel BPF verifier state pruning vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68207Linux kernel Xe GPU driver GuC CT worker vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68206Linux kernel netfilter FTP connection tracking vulnerability7.5CNA v3.10.7%2025-12-16Fix
CVE-2025-68205Linux kernel ALSA HDMI nvhdmi-mcp codec driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68204Linux kernel Arm SCMI power domain driver memory leak–0.2%2025-12-16Fix
CVE-2025-68202Linux kernel sched_ext scheduler debug dump improper locking–0.2%2025-12-16Fix
CVE-2025-68201In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: remove two invalid BUG_ON()s Those can be triggered trivially by userspace.–0.2%2025-12-16Fix
CVE-2025-68200In the Linux kernel, the following vulnerability has been resolved: bpf: Add bpf_prog_run_data_pointers() syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop(). WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_r–0.2%2025-12-16Fix
CVE-2025-68199Linux kernel slab object extension debug tagging vulnerability–0.2%2025-12-16Fix
CVE-2025-68198Linux kernel crashkernel resource management vulnerability–0.2%2025-12-16Fix
CVE-2025-68197Linux kernel bnxt_en firmware trace handling null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68196Linux kernel AMD Display link training automation vulnerability–0.2%2025-12-16Fix
CVE-2025-68194Linux kernel iMon USB receiver driver denial of service–0.2%2025-12-16Fix
CVE-2025-68193Linux kernel Xe GPU driver GuC CT teardown vulnerability–0.2%2025-12-16Fix
CVE-2025-68192Linux kernel qmi_wwan USB driver vulnerability9.8CNA v3.10.6%2025-12-16Fix
CVE-2025-68191Linux kernel UDP tunnel NIC registration vulnerability–0.2%2025-12-16Fix
CVE-2025-68190Linux kernel drm/amdgpu/atom null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68189Linux kernel MSM GEM dma-buf import vulnerability7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68188Linux kernel tcp use-after-free–0.2%2025-12-16Fix
CVE-2025-68187Linux kernel Airoha MDIO driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68186Linux kernel ring buffer memory-mapped reader vulnerability–0.2%2025-12-16Fix
CVE-2025-68185In the Linux kernel, the following vulnerability has been resolved: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't–0.2%2025-12-16Fix
CVE-2025-68184Linux kernel Mediatek DRM AFBC support vulnerability7.1CNA v3.10.2%2025-12-16Fix
CVE-2025-68183Linux kernel IMA xattr handling vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68182Linux kernel iwlwifi MLD link removal use-after-free7.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68181Linux kernel radeon graphics driver use-after-free7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-68180Linux kernel AMD display driver debugfs null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68179Linux kernel s390 HugeTLB vmemmap optimization denial of service7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68178Linux kernel block cgroup policy configuration deadlock–0.2%2025-12-16Fix
CVE-2025-68177Linux kernel longhaul cpufreq driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68176Linux kernel Cadence PCIe driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-68175Linux kernel i.MX8 ISI capture driver vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68174Linux kernel amdgpu KFD partition switch race condition7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68173Linux kernel ftrace module enable path denial of service–0.2%2025-12-16Fix
CVE-2025-68172Linux kernel Aspeed crypto driver vulnerability–0.2%2025-12-16Fix
CVE-2025-68171Linux kernel FPU state signal delivery vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68170Linux kernel radeon graphics driver vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68169Linux kernel netpoll packet buffer pool deadlock–0.2%2025-12-16Fix
CVE-2025-68168Linux kernel JFS transaction manager denial of service7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68167In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix invalid pointer access in debugfs If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->priva7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-68166JetBrains TeamCity cross-site scripting5.4CNA v3.10.2%2025-12-16Fix
CVE-2025-68165JetBrains TeamCity cross-site scripting5.4CNA v3.14.2%2025-12-16Fix
CVE-2025-68164JetBrains TeamCity observable discrepancy2.7CNA v3.10.2%2025-12-16Fix
CVE-2025-68163JetBrains TeamCity cross-site scripting3.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68162JetBrains TeamCity inclusion of untrusted functionality2.7CNA v3.10.2%2025-12-16Fix
CVE-2025-68156Expr has denial of service via Unbounded Recursion in Builtin functions7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68155@vitejs/plugin-rsc has arbitrary file read7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68154sebhildebrandt systeminformation command injection in fsSize on Windows8.1CNA v3.113.0%2025-12-16Fix
CVE-2025-68150parse-community parse-server parse Server has server-side request forgery in Instagram OAuth Adapter8.3CNA v4.00.3%2025-12-16Fix
CVE-2025-68146filelock has TOCTOU race condition that allows symlink attacks during lock file creation6.3CNA v3.10.2%2025-12-16Fix
CVE-2025-68142facelessuser pymdown-extensions PyMdown extensions has ReDOS bug in Figure Capture extension2.7CNA v4.00.5%2025-12-16Fix
CVE-2025-68130tRPC has possible prototype pollution in `experimental_nextAppDirCaller`8.5CNA v4.00.4%2025-12-16Fix
CVE-2025-68116FileRise vulnerable to cross-site scripting (XSS) in SVG File Handling8.9CNA v3.10.3%2025-12-16Fix
CVE-2025-68115parse-community parse-server parse Server vulnerable to cross-site scripting5.3CNA v4.00.2%2025-12-16Fix
CVE-2025-68113altcha-org altcha-lib ALTCHA Proof-of-Work vulnerable to Challenge Splicing and Replay6.5CNA v3.10.5%2025-12-16Fix
CVE-2025-68088Huger for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-68087Modalier for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-68086Reformer for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-68085Buttoner for Elementor WordPress plugin settings Change vulnerability5.4CNA v3.10.2%2025-12-16
CVE-2025-68084Ultimate Auction WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-68083Meks Quick Plugin Disabler WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.1%2025-12-16
CVE-2025-68082Semrush Content Toolkit WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.1%2025-12-16Fix
CVE-2025-68080User Avatar - Reloaded WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16
CVE-2025-68079Salient Shortcodes WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68078Salient Portfolio WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68077Stockholm WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16
CVE-2025-68076Stockholm Core WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16
CVE-2025-68071Essential Real Estate WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.3%2025-12-16
CVE-2025-68070VK Google Job Posting Manager WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-68068Stockholm WordPress theme local file inclusion7.5CNA v3.10.4%2025-12-16
CVE-2025-68067Stockholm Core WordPress plugin local file inclusion7.5CNA v3.10.4%2025-12-16
CVE-2025-68066Soledad WordPress theme local file inclusion7.5CNA v3.10.4%2025-12-16
CVE-2025-68065Hub Core WordPress plugin local file inclusion7.5CNA v3.10.4%2025-12-16Fix
CVE-2025-68062MinimogWP WordPress theme local file inclusion7.5CNA v3.10.4%2025-12-16
CVE-2025-68061EduMall WordPress theme local file inclusion7.5CNA v3.10.4%2025-12-16
CVE-2025-68056LBG Zoominoutslider WordPress plugin SQL injection8.5CNA v3.10.3%2025-12-16Fix
CVE-2025-68055Hydra Booking WordPress plugin SQL injection8.5CNA v3.10.3%2025-12-16Exploit codeFix
CVE-2025-68054CountDown With Image or Video Background WordPress plugin SQL injection8.5CNA v3.10.2%2025-12-16
CVE-2025-68053xPromoter WordPress plugin SQL injection8.5CNA v3.10.2%2025-12-16Fix
CVE-2025-67999Newsletter WordPress plugin SQL injection7.6CNA v3.10.4%2025-12-16Fix
CVE-2025-67989Kerge WordPress theme server side request forgery (SSRF)5.4CNA v3.10.2%2025-12-16Fix
CVE-2025-67986Document Library Lite WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-12-16Fix
CVE-2025-67985Document Library Lite WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-67983WP Visitor Statistics (Real Time Traffic) WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-67976Watu Quiz WordPress plugin broken access control6.5CNA v3.10.3%2025-12-16Fix
CVE-2025-67965Homey Core WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-67962Broken Link Checker WordPress plugin SQL injection7.6CNA v3.10.4%2025-12-16Fix
CVE-2025-67951WPZOOM Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-67950All In One SEO Pack WordPress plugin SQL injection8.5CNA v3.10.3%2025-12-16Fix
CVE-2025-67948SendPulse Email Marketing Newsletter WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-16Fix
CVE-2025-67929TI WooCommerce Wishlist WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-67912Stars Testimonials WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-67874ChurchCRM has plaintext password return in response6.9CNA v4.00.4%2025-12-16Fix
CVE-2025-67751ChurchCRM has SQL injection in Event Editor via `EN_tyid` parameter caused by an Incomplete Fix7.2CNA v3.10.4%2025-12-16Fix
CVE-2025-67748Fickling has code injection vulnerability via pty.spawn7.1CNA v4.00.3%2025-12-16Fix
CVE-2025-67747Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list7.1CNA v4.00.3%2025-12-16Fix
CVE-2025-67744ThinkInAIXYZ deepchat mermaid XSS vulnerability leads to remote code execution9.7CNA v3.10.6%2025-12-16Fix
CVE-2025-67736Authenticated SQL injection in FreePBX tts (Text to Speech) module8.6CNA v4.06.4%2025-12-16Fix
CVE-2025-67735Netty has a CRLF injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder6.5CNA v3.10.3%2025-12-16Fix
CVE-2025-67722FreePBX framework amportal script privilege escalation5.7CNA v4.00.1%2025-12-16Fix
CVE-2025-67715Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)4.3CNA v3.10.3%2025-12-16Fix
CVE-2025-67492Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66635SEIKO EPSON Web Config stack-based buffer overflow8.6CNA v4.00.5%2025-12-16
CVE-2025-66482Misskey has a login rate limit bypass via spoofed X-Forwarded-For header6.9CNA v4.00.3%2025-12-16Fix
CVE-2025-66449ConvertX has path traversal that leads to arbitrary file write and arbitrary code execution8.8CNA v3.10.8%2025-12-16Fix
CVE-2025-66407Weblate has server-side request forgery5.0CNA v3.10.2%2025-12-16Fix
CVE-2025-66402misskey misskey.js's export data contains private post data7.1CNA v4.00.3%2025-12-16Fix
CVE-2025-66357Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) improper check for exceptional conditions6.9CNA v4.00.3%2025-12-16Fix
CVE-2025-66167Lottier WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66166Lottier for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66165Lottier for WPBakery WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66164Laser WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66163Masker for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66162Spoter for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66161Grider for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66147Coder for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16
CVE-2025-66134FileBird Pro WordPress plugin broken access control5.4CNA v3.10.2%2025-12-16Fix
CVE-2025-66133WP Cookie Notice for GDPR, CCPA and ePrivacy Consent WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66132FAPI Member WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.3%2025-12-16
CVE-2025-66131Yaad Sarig Payment Gateway For WC WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66130WP Views Counter WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66129Pochipp WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66128Sendinblue for WooCommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66127Essential Real Estate WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16
CVE-2025-66126wowpress.host Fix Media Library information disclosure5.3CNA v3.10.3%2025-12-16
CVE-2025-66125Ultimate Auction WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66124Leaky Paywall WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66122Stylish Price List WordPress plugin broken access control5.3CNA v3.10.4%2025-12-16Fix
CVE-2025-66121SiteGround Security WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-66120CatFolders WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-65834Meltytech Shotcut buffer overflow9.8CISA ADP v3.10.4%2025-12-16Fix
CVE-2025-65593nopCommerce cross-site request forgery8.8CISA ADP v3.10.3%2025-12-16
CVE-2025-65592nopCommerce cross-site scripting6.1CISA ADP v3.10.3%2025-12-16
CVE-2025-65591nopCommerce cross-site scripting5.4CISA ADP v3.10.2%2025-12-16
CVE-2025-65590nopCommerce cross-site scripting5.4CISA ADP v3.10.2%2025-12-16
CVE-2025-65589nopCommerce cross-site scripting6.1CISA ADP v3.10.4%2025-12-16
CVE-2025-65581ABP Account module has an open redirect through improper validation in its register function5.3NVD v3.10.3%2025-12-16Fix
CVE-2025-65427Dbitnet Dbit N300 T1 Pro missing brute-force protection6.5CISA ADP v3.10.3%2025-12-16Exploit code
CVE-2025-65319Blixhq Bluemail protection mechanism failure9.1CISA ADP v3.10.6%2025-12-16
CVE-2025-65318Canary Mail protection mechanism failure9.1CISA ADP v3.10.6%2025-12-16Exploit code
CVE-2025-65076Arbitrary file read and Delete via path traversal in WaveStore Server6.1NVD v3.10.3%2025-12-16Fix
CVE-2025-65075Arbitrary file read and Delete via path traversal in WaveStore Server6.5v3.10.4%2025-12-16Fix
CVE-2025-65074OS command injection via path traversal in WaveStore Server7.2v3.10.5%2025-12-16Fix
CVE-2025-64639WP Compress for MainWP WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16
CVE-2025-64638OnPay.io for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64635Feeds for YouTube WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-64634Avada WordPress theme broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-64633Norebro Extra WordPress plugin content injection5.3CNA v3.10.3%2025-12-16
CVE-2025-64632Google XML Sitemaps WordPress plugin broken access control5.3CNA v3.10.3%2025-12-16Fix
CVE-2025-64631WCFM Marketplace WordPress plugin broken access control4.9CNA v3.10.3%2025-12-16Fix
CVE-2025-64630Business Directory WordPress plugin broken access control4.9CNA v3.10.3%2025-12-16Fix
CVE-2025-64520GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API6.5CNA v3.10.2%2025-12-16Fix
CVE-2025-64253Health Check and Troubleshooting WordPress plugin path traversal4.9CNA v3.10.5%2025-12-16
CVE-2025-64251Ultimate Learning Pro WordPress plugin arbitrary content deletion vulnerability4.9CNA v3.10.3%2025-12-16
CVE-2025-64250Directorist WordPress plugin open redirection4.7CNA v3.10.2%2025-12-16Fix
CVE-2025-64249WP-EXPERTS.IN Protect WP Admin missing authorization4.3CNA v3.10.3%2025-12-16Fix
CVE-2025-64248Request a Quote WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64247Read More and Accordion WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64246Accessibility by AudioEye WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64245Import external attachments WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16
CVE-2025-64244Codexpert Restrict Elementor Widgets, Columns and Sections missing authorization4.3CNA v3.10.2%2025-12-16
CVE-2025-64243Directory Pro WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16
CVE-2025-64242Easy Property Listings WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64241WP Coupons and Deals WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64240Freshchat WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-16
CVE-2025-64239RTL Tester WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-16
CVE-2025-64238WPS Bidouille WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-64237Quick Interest Slider WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-16Fix
CVE-2025-64012InvoicePlane insecure direct object reference4.3CISA ADP v3.10.3%2025-12-16
CVE-2025-63414Allskyteam Allsky path traversal10.0CISA ADP v3.11.8%2025-12-16
CVE-2025-62864Amperecomputing Ampereone A128-34x out-of-bounds write9.8CISA ADP v3.10.4%2025-12-16Fix
CVE-2025-62863Amperecomputing Ampereone A128-34x out-of-bounds write9.8CISA ADP v3.10.4%2025-12-16Fix
CVE-2025-62862Amperecomputing Ampereone A128-34x out-of-bounds read4.6CISA ADP v3.10.1%2025-12-16Fix
CVE-2025-62849QNAP QTS and QuTS hero SQL injection5.2CNA v4.01.0%2025-12-16Fix
CVE-2025-62848QNAP QTS and QuTS hero null pointer dereference8.1CNA v4.00.9%2025-12-16Fix
CVE-2025-62847QNAP QTS and QuTS hero argument injection6.6CNA v4.00.8%2025-12-16Fix
CVE-2025-62330HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information5.9CNA v3.10.2%2025-12-16Fix
CVE-2025-62329HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration5.0CNA v3.10.2%2025-12-16Fix
CVE-2025-61976Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) improper check for exceptional conditions8.7CNA v4.00.4%2025-12-16Fix
CVE-2025-59935GLPI vulnerable to unauthenticated stored XSS on the Inventory page6.5CNA v3.10.3%2025-12-16Fix
CVE-2025-59479Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) clickjacking6.1NVD v3.10.2%2025-12-16Fix
CVE-2025-59385QNAP QTS and QuTS hero authentication bypass8.1CNA v4.00.6%2025-12-16Fix
CVE-2025-59009Listify WordPress theme cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-16
CVE-2025-59001Salient Core WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-58999WP Attractive Donations System WordPress plugin loopus cross-site request forgery4.3CNA v3.10.1%2025-12-16
CVE-2025-58173FreshRSS vulnerable to authenticated RCE via path traversal inside include7.4CNA v4.00.7%2025-12-16Fix
CVE-2025-54045CM On Demand Search And Replace WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-54005SKT Page Builder WordPress plugin broken access control4.3CNA v3.10.2%2025-12-16Fix
CVE-2025-54004WCFM Frontend Manager for WooCommerce WordPress plugin broken access control2.7CNA v3.10.3%2025-12-16Fix
CVE-2025-53619Grassroot DICOM JPEGBITSCodec::InternalCode functionality out-of-bounds read9.1NVD v3.10.3%2025-12-16Fix
CVE-2025-53618Grassroot DICOM JPEGBITSCodec::InternalCode functionality out-of-bounds read9.1NVD v3.10.3%2025-12-16Fix
CVE-2025-52582Grassroot DICOM out-of-bounds read7.5NVD v3.10.4%2025-12-16Fix
CVE-2025-52196Ctera server-side request forgery7.5CISA ADP v3.10.3%2025-12-16Fix
CVE-2025-50401Mercurycom D196G buffer overflow9.8CISA ADP v3.10.4%2025-12-16
CVE-2025-50398Mercurycom D196G buffer overflow9.8CISA ADP v3.10.4%2025-12-16
CVE-2025-49300Traveler Option Tree WordPress plugin sensitive data exposure2.7CNA v3.10.3%2025-12-16Fix
CVE-2025-48429Grassroot DICOM RLECodec::DecodeByStreams functionality out-of-bounds read9.1NVD v3.10.4%2025-12-16Fix
CVE-2025-46296Claris FileMaker Server An authorization bypass5.4CISA ADP v3.10.2%2025-12-16Fix
CVE-2025-46295Claris FileMaker Server code injection9.8CISA ADP v3.11.0%2025-12-16Exploit codeFix
CVE-2025-46294Claris FileMaker Server information disclosure5.3CISA ADP v3.10.2%2025-12-16Fix
CVE-2025-40363In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix field-spanning memcpy warning in AH output Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings–0.2%2025-12-16Fix
CVE-2025-40362Linux kernel Ceph client vulnerability8.8CNA v3.10.2%2025-12-16Fix
CVE-2025-40360Linux kernel sysfb display driver null pointer dereference–0.2%2025-12-16Fix
CVE-2025-40359Linux kernel Intel performance monitoring driver vulnerability–0.2%2025-12-16Fix
CVE-2025-40358Linux kernel RISC-V stack unwinder vulnerability7.1CNA v3.10.2%2025-12-16Fix
CVE-2025-40357Linux kernel SMC netlink diagnostics vulnerability–0.2%2025-12-16Fix
CVE-2025-40356Linux kernel Rockchip SFC SPI driver vulnerability7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-40355Linux kernel sysfs attribute ownership handling denial of service–0.2%2025-12-16Fix
CVE-2025-40354Linux kernel AMD display driver null pointer dereference7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-40353Linux kernel arm64 memory tagging extension vulnerability–0.2%2025-12-16Fix
CVE-2025-40352Linux kernel mlxbf-pmc performance counter driver vulnerability–0.2%2025-12-16Fix
CVE-2025-40351In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() The syzbot reported issue in hfsplus_delete_cat(): [ 70.682285][ T9333] ===================================================== [ 70.682943][ T9333] BUG: KMSAN: unin–0.2%2025-12-16Fix
CVE-2025-40350Linux kernel mlx5e Ethernet driver vulnerability9.8CNA v3.10.5%2025-12-16Fix
CVE-2025-40349Linux kernel HFS+ bitmap allocation vulnerability7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-40348Linux kernel slab allocator race condition–0.2%2025-12-16Fix
CVE-2025-40347Linux kernel enetc MDIO driver deadlock7.5CNA v3.10.5%2025-12-16Fix
CVE-2025-40346Linux kernel CPU topology parsing null pointer dereference–0.2%2025-12-16Fix
CVE-2025-37164Hewlett Packard Enterprise (HPE) OneView code injection10.0CNA v3.190.2%2025-12-16KEVNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2025-34288Nagios XI privilege escalation via Writable PHP Include Executed with Sudo6.7NVD v3.11.9%2025-12-16Fix
CVE-2025-33235NVIDIA Resiliency Extension race condition7.8CNA v3.10.1%2025-12-16Fix
CVE-2025-33226NVIDIA NeMo Framework deserialization of untrusted data7.8CNA v3.10.2%2025-12-16Fix
CVE-2025-33225NVIDIA Resiliency Extension symlink following8.4CNA v3.10.3%2025-12-16Fix
CVE-2025-33212NVIDIA NeMo Framework deserialization of untrusted data7.3CNA v3.10.2%2025-12-16Fix
CVE-2025-33210NVIDIA Isaac Lab deserialization of untrusted data9.0CNA v3.10.7%2025-12-16Fix