CVE-2025 list

CVE-2025 records published in December 2025

Page four of five: records 3,001 to 4,000 of the 4,374 published in December 2025, newest first. The first page carries the figures for December 2025.

CVE-2025 records published in December 2025, newest first: records 3,001 to 4,000 of 4,374
CVE Summary CVSS EPSS Published Signals
CVE-2025-67487static-web-server static Web Server is vulnerable to symbolic link path traversal5.5CNA v4.00.4%2025-12-09Fix
CVE-2025-67474ForumWP WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-67473CWW Companion WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-67472Online Booking and Scheduling Calendar for WordPress by vcita plugin cross-site request forgery8.8NVD v3.10.1%2025-12-09Fix
CVE-2025-67471Quick Contact Form WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-67470Portfolio and Projects WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-67469PDF Thumbnail Generator WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-67468CRM Perks Integration for Salesforce and Contact Form 7 missing authorization4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-67467GiveWP WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.1%2025-12-09Fix
CVE-2025-67466Trinity Audio WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-67465Simple Link Directory WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-66645NiceGUI path traversal vulnerability in app.add_media_files allows arbitrary file reading7.5CNA v3.11.1%2025-12-09Exploit codeFix
CVE-2025-66631Csla .net is vulnerable to remote code execution via WcfProxy7.2CNA v4.00.7%2025-12-09Fix
CVE-2025-66627Wasmi's Linear Memory has a critical use-after-free8.4CNA v3.10.1%2025-12-09Fix
CVE-2025-66626Argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links8.1CNA v3.10.7%2025-12-09Fix
CVE-2025-66625Umbraco vulnerable to Improper File Access and credential exposure4.9CNA v3.10.4%2025-12-09Fix
CVE-2025-66622matrix-org matrix-rust-sdk matrix-sdk-base is vulnerable to DoS1.3CNA v4.00.4%2025-12-09Fix
CVE-2025-66578robrichards xmlseclibs canonicalization vulnerability6.0CNA v3.10.2%2025-12-09Fix
CVE-2025-66568Ruby-SAML Libxml2 Canonicalization errors can bypass Digest/signature validation9.3CNA v4.00.2%2025-12-09Fix
CVE-2025-66567Ruby-SAML has a SAML authentication bypass due to namespace handling (parser differential)9.3CNA v4.00.4%2025-12-09Fix
CVE-2025-66565Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values9.3CNA v4.00.5%2025-12-09Fix
CVE-2025-66534The Aisle WordPress theme broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-66533GiveWP WordPress plugin arbitrary Shortocde execution vulnerability6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-66532Powerlift WordPress theme broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-66531Salon booking system WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-66530Webba Booking WordPress plugin broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-66529Chartify WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-66528Thank You Page Customizer for WooCommerce WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-66527Lobo WordPress theme broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-66526Tablesome WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-66525Elastic Email Sender WordPress plugin broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-665081Panel IP Access Control Bypass via Untrusted X-Forwarded-For headers6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-665071Panel CAPTCHA Bypass via Client-Controlled Flag7.5CNA v3.10.5%2025-12-09Fix
CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider5.9CNA v3.10.2%2025-12-09Fix
CVE-2025-66490Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules6.9CNA v4.00.4%2025-12-09Fix
CVE-2025-66481DeepChat's Incomplete XSS Fix allows RCE through Mermaid Content9.7CNA v3.10.6%2025-12-09
CVE-2025-66470NiceGUI Stored/reflected XSS in ui.interactive_image via unsanitized SVG content6.1CNA v3.10.3%2025-12-09Fix
CVE-2025-66469NiceGUI reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style injection6.1CNA v3.10.3%2025-12-09Fix
CVE-2025-66457Elysia affected by arbitrary code injection through cookie config7.5CNA v4.00.8%2025-12-09Fix
CVE-2025-66456Elysia vulnerable to prototype pollution with multiple standalone schema validation9.1CNA v4.00.6%2025-12-09Fix
CVE-2025-66271ELECOM Clone unquoted search path8.4CNA v4.00.2%2025-12-09
CVE-2025-66214Ladybug has an XMLDecoder deserialization vulnerability (Java RCE)7.0CNA v3.10.3%2025-12-09Fix
CVE-2025-66204WBCE CMS allows brute-force protection bypass using X-Forwarded-For header6.3CNA v4.00.5%2025-12-09Fix
CVE-2025-66202Astro has an authentication bypass via Double URL Encoding, a bypass for6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-66039Sangoma FreePBX Endpoint Manager webserver authentication mode improper authentication9.3CNA v4.03.3%2025-12-09MetasploitEmerging ThreatsExploit codeKCVFix
CVE-2025-65964n8n vulnerable to remote code execution via Git Node Custom Pre-Commit Hook9.4CNA v4.00.7%2025-12-09Exploit codeFix
CVE-2025-65962Tuleap has missing CSRF protections its in tracker field dependencies4.6CNA v3.10.2%2025-12-09Fix
CVE-2025-65882Openmptcprouter OS command injection9.8CISA ADP v3.10.6%2025-12-09
CVE-2025-65741Sublime Text 3 uncontrolled search path9.8CISA ADP v3.10.5%2025-12-09
CVE-2025-65594OS4ED Opensis improper access control8.1v3.10.3%2025-12-09
CVE-2025-65573Allskyteam Allsky cross-site request forgery8.8CISA ADP v3.10.3%2025-12-09
CVE-2025-65572Allskyteam Allsky cross-site scripting6.1CISA ADP v3.10.4%2025-12-09
CVE-2025-65513Fetch MCP Server has a server-side request forgery (SSRF)7.5CISA ADP v3.10.4%2025-12-09
CVE-2025-65300Coohom A stored cross-site scripting5.4CISA ADP v3.10.2%2025-12-09
CVE-2025-65289Mercurycom MR816 stored cross-site scripting6.1NVD v3.10.3%2025-12-09
CVE-2025-65288Mercurycom MR816 buffer overflow6.5v3.10.4%2025-12-09
CVE-2025-65287Cdpenergy SNMP Web Pro cgi-bin/upload.cgi path traversal4.3NVD v3.10.8%2025-12-09
CVE-2025-64899Adobe Acrobat Reader out-of-bounds read7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-64896Adobe Creative Cloud Desktop Creation of Temporary file in Directory with incorrect permissions5.5CNA v3.10.2%2025-12-09Fix
CVE-2025-64894Adobe DNG SDK integer overflow or wraparound5.5CNA v3.10.2%2025-12-09Fix
CVE-2025-64893Adobe DNG SDK out-of-bounds read7.1CNA v3.10.2%2025-12-09Fix
CVE-2025-64787Adobe Acrobat Reader improper verification of cryptographic signature3.3CNA v3.10.4%2025-12-09Fix
CVE-2025-64786Adobe Acrobat Reader improper verification of cryptographic signature3.3CNA v3.10.4%2025-12-09Fix
CVE-2025-64785Adobe Acrobat Reader untrusted search path7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-64784Adobe DNG SDK heap-based buffer overflow7.1CNA v3.10.2%2025-12-09Fix
CVE-2025-64783Adobe DNG SDK integer overflow or wraparound7.8CNA v3.10.2%2025-12-09Fix
CVE-2025-64696Brother Industries Android App "Brother iPrint&Scan" sensitive information in cache4.8CNA v4.00.1%2025-12-09
CVE-2025-64680Microsoft Windows DWM Core library elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-64679Microsoft Windows DWM Core library elevation of privilege7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-64678Microsoft Windows Routing and Remote Access Service (RRAS) remote code execution8.8CNA v3.11.0%2025-12-09Fix
CVE-2025-64673Microsoft Windows Storage VSP driver elevation of privilege7.8CNA v3.10.4%2025-12-09KCVFix
CVE-2025-64672Microsoft SharePoint server spoofing8.8CNA v3.11.0%2025-12-09Fix
CVE-2025-64671Microsoft GitHub Copilot for Jetbrains remote code execution8.4CNA v3.10.4%2025-12-09Fix
CVE-2025-64670Microsoft Windows DirectX information disclosure6.5CNA v3.11.0%2025-12-09Fix
CVE-2025-64667Microsoft Exchange Server spoofing5.3CNA v3.10.8%2025-12-09Fix
CVE-2025-64666Microsoft Exchange Server elevation of privilege7.5CNA v3.11.0%2025-12-09Fix
CVE-2025-64661Microsoft Windows Shell elevation of privilege7.8CNA v3.10.3%2025-12-09Fix
CVE-2025-64658Microsoft Windows File Explorer elevation of privilege7.5CNA v3.10.3%2025-12-09Fix
CVE-2025-64471A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacke4.4CNA v3.10.3%2025-12-09Fix
CVE-2025-64447Fortinet FortiWeb cookie reliance without validation7.1CNA v3.18.4%2025-12-09Fix
CVE-2025-64257My Tickets WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-64256Simple Folio WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-64255Admin and Site Enhancements (ASE) WordPress plugin broken access control2.7CNA v3.10.3%2025-12-09Fix
CVE-2025-64254Photo Block WordPress plugin broken access control2.7CNA v3.10.2%2025-12-09Fix
CVE-2025-64156Fortinet FortiVoice SQL injection6.8CNA v3.10.3%2025-12-09Fix
CVE-2025-64153Fortinet FortiExtender OS command injection6.7CNA v3.11.7%2025-12-09Fix
CVE-2025-64113Emby Server allows attackers to gain administrative server access without preconditions9.3CNA v4.00.6%2025-12-09Fix
CVE-2025-64086PDF-XChange Editor util.readFileIntoStream component null pointer dereference7.5v3.10.3%2025-12-09
CVE-2025-64085PDF-XChange Editor importDataObject function null pointer dereference7.5v3.10.3%2025-12-09
CVE-2025-63742RockOA SQL injection9.8CISA ADP v3.10.4%2025-12-09
CVE-2025-63740RockOA SQL injection4.3CISA ADP v3.10.2%2025-12-09
CVE-2025-63739RockOA improper access control4.3CISA ADP v3.10.2%2025-12-09
CVE-2025-63738RockOA remote file inclusion4.3CISA ADP v3.10.3%2025-12-09
CVE-2025-63737RockOA cross-site scripting6.1CISA ADP v3.10.3%2025-12-09
CVE-2025-63077Happy Addons for Elementor WordPress plugin broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63076The7 Elements WordPress plugin local file inclusion7.5CNA v3.10.5%2025-12-09Fix
CVE-2025-63075Betheme WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63074The7 WordPress theme local file inclusion7.5CNA v3.10.5%2025-12-09Fix
CVE-2025-63073The7 WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63072Cornerstone WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63071Shortcodes and extra features for Phlox WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63070Download Manager WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63069Ivory Search WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63068Contact Form 7 Dynamic Text Extension WordPress plugin content injection5.3CNA v3.10.3%2025-12-09
CVE-2025-63067Porto Theme WordPress plugin p-themes missing authorization4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-63066Porto Theme WordPress plugin cross-site scripting6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63065Media LIbrary Assistant WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63064EventON WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63063Yandex.Metrica WordPress plugin broken access control5.3CNA v3.10.4%2025-12-09
CVE-2025-63062UDesign Core WordPress plugin local file inclusion7.5CNA v3.10.5%2025-12-09
CVE-2025-63061KALLYAS WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63060KALLYAS WordPress theme cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-63059Ninja Popups WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63058Custom Field Template WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63057Wp Ultimate Review WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63056Contact Form by BestWebSoft WordPress plugin broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63055Master Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63054Quiz And Survey Master WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63052SimpLy Gallery WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63050REHub Framework WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-63049ListingPro Lead Form WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-63048ListingPro Lead Form WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63047ListingPro WordPress theme broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-63046ListingPro WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-12-09
CVE-2025-63045Master Slider Pro WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-12-09
CVE-2025-63044Xpro Elementor Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-63042Tutor LMS Elementor Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-63037Ronneby Theme Core WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63036Ronneby Theme Core WordPress plugin local file inclusion7.5CNA v3.10.5%2025-12-09
CVE-2025-63035WPLMS WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-12-09
CVE-2025-63034Page View Count WordPress plugin settings Change vulnerability5.4CNA v3.10.2%2025-12-09Fix
CVE-2025-63033Riyadh Ahmed Make Section and Column Clickable for Elementor stored cross-site scripting5.9CNA v3.10.2%2025-12-09Fix
CVE-2025-63030New User Approve WordPress plugin cross-site request forgery (CSRF)7.1CISA ADP v3.10.1%2025-12-09Fix
CVE-2025-63028Traveler WordPress theme broken access control5.3CNA v3.10.2%2025-12-09
CVE-2025-63025Xagio SEO WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-63024Order Delivery Date for WooCommerce WordPress plugin broken access control5.4CNA v3.10.2%2025-12-09Fix
CVE-2025-63023Payment Gateway for PayPal on WooCommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63015WooCommerce Payment Gateway Paysera WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-63013WP Hotel Booking WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63012WP Hotel Booking WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-63011WP Hotel Booking WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-12-09Fix
CVE-2025-63010Hercules Core WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.2%2025-12-09
CVE-2025-63009WP Google Analytics Events WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09
CVE-2025-63008WP ERP WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63007EventPrime WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-63006EventPrime WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-63003North - Required WordPress plugin local file inclusion7.5CNA v3.10.5%2025-12-09
CVE-2025-62999Litho Addons WordPress plugin broken access control5.4CNA v3.10.2%2025-12-09
CVE-2025-62997WP EasyCart WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62996Custom Layouts Post + Product grids made easy WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-62995MultiParcels Shipping For WooCommerce WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-62994WP AI CoPilot WordPress plugin sensitive data exposure4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62993Notification for Telegram WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-62873WP Flashy Marketing Automation WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62872Social Photo Fetcher WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09
CVE-2025-62871Just TinyMCE Custom Styles WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09
CVE-2025-62870Eupago Gateway For Woocommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62869Gravitec.net Web Push Notifications WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-62867Ergonet Cache WordPress plugin broken access control4.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62866Auto Alt Text WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62865Post Cloner WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-62762SMTP Mail WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09
CVE-2025-62740WP-CRM System WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62739SaifuMak Add Custom Codes cross-site request forgery6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-62738Formstack Online Forms WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-62737Image Cleanup WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09
CVE-2025-62736Image Cleanup WordPress plugin broken access control4.3CNA v3.10.2%2025-12-09
CVE-2025-62735User Spam Remover WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09
CVE-2025-62734Media Library Downloader WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62733Custom Sidebars by ProteusThemes WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62631Fortinet FortiOS insufficient session expiration5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62573Microsoft Windows DirectX Graphics Kernel elevation of privilege7.0CNA v3.10.2%2025-12-09Fix
CVE-2025-62572Microsoft Windows application Information service elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62571Microsoft Windows Installer elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62570Microsoft Windows Camera Frame Server Monitor information disclosure7.1CNA v3.10.4%2025-12-09Fix
CVE-2025-62569Microsoft Brokering File System elevation of privilege7.0CNA v3.10.3%2025-12-09Fix
CVE-2025-62567Microsoft Windows Hyper-V denial of service5.3CNA v3.11.0%2025-12-09Fix
CVE-2025-62565Microsoft Windows File Explorer elevation of privilege7.3CNA v3.10.6%2025-12-09Fix
CVE-2025-62564Microsoft Excel remote code execution7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-62563Microsoft Excel remote code execution7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-62562Microsoft Outlook remote code execution7.8CNA v3.10.8%2025-12-09Fix
CVE-2025-62561Microsoft Excel remote code execution7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-62560Microsoft Excel remote code execution7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-62559Microsoft Word remote code execution7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-62558Microsoft Word remote code execution7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-62557Microsoft Office remote code execution8.4CNA v3.10.4%2025-12-09Fix
CVE-2025-62556Microsoft Excel remote code execution7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-62555Microsoft Word remote code execution7.0CNA v3.10.5%2025-12-09Fix
CVE-2025-62554Microsoft Office remote code execution8.4CNA v3.10.4%2025-12-09Fix
CVE-2025-62553Microsoft Excel remote code execution7.8CNA v3.10.7%2025-12-09Fix
CVE-2025-62552Microsoft Access remote code execution7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-62550Microsoft Azure Monitor Agent remote code execution8.8CNA v3.10.7%2025-12-09Fix
CVE-2025-62549Microsoft Windows Routing and Remote Access Service (RRAS) remote code execution8.8CNA v3.11.3%2025-12-09Fix
CVE-2025-62474Microsoft Windows Remote Access Connection Manager elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62473Microsoft Windows Routing and Remote Access Service (RRAS) information disclosure6.5CNA v3.11.1%2025-12-09Fix
CVE-2025-62472Microsoft Windows Remote Access Connection Manager elevation of privilege7.8CNA v3.12.2%2025-12-09Fix
CVE-2025-62470Microsoft Windows Common Log File System driver elevation of privilege7.8CNA v3.10.5%2025-12-09Exploit codeFix
CVE-2025-62469Microsoft Brokering File System elevation of privilege7.0CNA v3.10.2%2025-12-09Fix
CVE-2025-62468Microsoft Windows Defender Firewall service information disclosure5.5CNA v3.10.5%2025-12-09Fix
CVE-2025-62467Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62466Microsoft Windows Client-Side Caching elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62465Microsoft Windows DirectX Graphics Kernel denial of service6.5CNA v3.10.5%2025-12-09Fix
CVE-2025-62464Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62463Microsoft Windows DirectX Graphics Kernel denial of service6.5CNA v3.10.5%2025-12-09Fix
CVE-2025-62462Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62461Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62458Microsoft Windows win32k elevation of privilege7.8CNA v3.10.7%2025-12-09Fix
CVE-2025-62457Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-62456Microsoft Windows Resilient File System (ReFS) remote code execution8.8CNA v3.11.1%2025-12-09Fix
CVE-2025-62455Microsoft Message Queuing (MSMQ) elevation of privilege7.8CNA v3.10.5%2025-12-09Fix
CVE-2025-62454Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.12.3%2025-12-09Exploit codeFix
CVE-2025-62221Microsoft Windows use-after-free7.8CNA v3.12.5%2025-12-09KEVExploit codeFix
CVE-2025-62153Quick Interest Slider WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-62152ConveyThis WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62151Virtuaria PagBank / PagSeguro para Woocommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62109Geo Controller WordPress plugin sensitive data exposure5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-62103Media Library File Download WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62102DoFollow Case by Case WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2025-12-09Fix
CVE-2025-62100ThemeRain Core WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-62093Image&Video FullScreen Background WordPress plugin SQL injection8.5CNA v3.10.3%2025-12-09
CVE-2025-62090Gutenverse News WordPress plugin Jegstudio missing authorization6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-62086Яндекс Доставка (Boxberry) WordPress plugin broken access control5.4CNA v3.10.3%2025-12-09
CVE-2025-62085BERTHA AI WordPress plugin broken access control5.3CNA v3.10.3%2025-12-09
CVE-2025-62082Generic Elements WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-12-09
CVE-2025-61813Adobe ColdFusion improper restriction of XML external entity reference (XXE)7.4CNA v3.10.5%2025-12-09Fix
CVE-2025-61258OutSystems platform-server HTTP request smuggling7.5CISA ADP v3.10.6%2025-12-09
CVE-2025-61078phpipam Request IP form cross-site scripting6.1v3.10.3%2025-12-09
CVE-2025-61075Adata Mitarbeiter Portal insecure direct object reference8.1CISA ADP v3.10.5%2025-12-09
CVE-2025-61074Adata Mitarbeiter Portal bulletin board stored cross-site scripting4.6CISA ADP v3.10.3%2025-12-09
CVE-2025-60024Fortinet FortiVoice path traversal7.7CNA v3.10.5%2025-12-09Fix
CVE-2025-59923Fortinet FortiAuthenticator improper access control2.6CNA v3.10.2%2025-12-09Fix
CVE-2025-59810Fortinet FortiSOAR PaaS improper access control6.2CNA v3.10.3%2025-12-09Fix
CVE-2025-59808Fortinet FortiSOAR on-premise unverified password change6.5CNA v3.10.2%2025-12-09Fix
CVE-2025-59719Fortinet FortiWeb improper signature verification9.1CNA v3.129.2%2025-12-09Reported exploitedFix
CVE-2025-59718Fortinet Multiple Products improper verification of cryptographic signature9.1CNA v3.168.3%2025-12-09KEVExploit codeFix
CVE-2025-59517Microsoft Windows Storage VSP driver elevation of privilege7.8CNA v3.12.5%2025-12-09KCVFix
CVE-2025-59516Microsoft Windows Storage VSP driver elevation of privilege7.8CNA v3.12.3%2025-12-09Fix
CVE-2025-59132Duplicate Content Cure WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-12-09
CVE-2025-59030Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor7.5CNA v3.10.6%2025-12-09Fix
CVE-2025-59029Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor5.3CNA v3.10.4%2025-12-09Fix
CVE-2025-57823Fortinet FortiAuthenticator forced browsing2.6CNA v3.10.2%2025-12-09Fix
CVE-2025-56704Leptoncms unrestricted file upload8.8NVD v3.10.8%2025-12-09
CVE-2025-55233Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.4%2025-12-09Fix
CVE-2025-54838Fortinet FortiPortal incorrect authorization6.4CNA v3.10.3%2025-12-09Fix
CVE-2025-54353Fortinet FortiSandbox cross-site scripting5.3CNA v3.16.3%2025-12-09Fix
CVE-2025-54100Microsoft Windows PowerShell remote code execution7.8CNA v3.12.2%2025-12-09Exploit codeFix
CVE-2025-53949Fortinet FortiSandbox OS command injection7.0CNA v3.117.2%2025-12-09Fix
CVE-2025-53679Fortinet FortiSandbox OS command injection6.9CNA v3.112.2%2025-12-09Fix
CVE-2025-49351Create Posts and Terms WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-12-09
CVE-2025-49350Actionwear products sync WordPress plugin broken access control4.3CNA v3.10.4%2025-12-09
CVE-2025-49348Hype WordPress plugin broken access control5.3CNA v3.10.4%2025-12-09
CVE-2025-49347WP sIFR WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-12-09
CVE-2025-49341PDF Creator Lite WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-12-09
CVE-2025-46637Dell Encryption link following7.3CNA v3.10.1%2025-12-09Fix
CVE-2025-46636Dell Encryption link following6.6CNA v3.10.1%2025-12-09Fix
CVE-2025-42928Deserialization vulnerability in SAP jConnect SDK for ASE9.1CNA v3.19.5%2025-12-09Fix
CVE-2025-42904Information disclosure vulnerability in Application Server ABAP6.5CNA v3.10.3%2025-12-09Fix
CVE-2025-42896Server-side request forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform5.4CNA v3.10.3%2025-12-09Fix
CVE-2025-42891Missing authorization check in SAP Enterprise Search for ABAP5.5CNA v3.10.3%2025-12-09Fix
CVE-2025-42880Code injection vulnerability in SAP Solution Manager9.9CNA v3.14.5%2025-12-09Fix
CVE-2025-42878Sensitive data exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)8.2CNA v3.10.4%2025-12-09Fix
CVE-2025-42877SAP Web Dispatcher, Internet Communication Manager and Content Server memory corruption7.5CNA v3.10.5%2025-12-09Fix
CVE-2025-42876Missing authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)7.1CNA v3.10.3%2025-12-09Fix
CVE-2025-42875Missing authentication check in SAP NetWeaver Internet Communication Framework6.6CNA v3.10.3%2025-12-09Fix
CVE-2025-42874Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)7.9CNA v3.10.5%2025-12-09Fix
CVE-2025-42873Denial of service (DoS) in SAPUI5 framework (Markdown-it component)5.9CNA v3.10.4%2025-12-09Fix
CVE-2025-42872Cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal6.1CNA v3.10.3%2025-12-09Fix
CVE-2025-41752Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_portSfp.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41751Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_portCntr.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41750Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_PortCfg.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41749Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in port_util.php7.1CNA v3.10.7%2025-12-09Emerging ThreatsFix
CVE-2025-41748Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_Dot1xCfg.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41747Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_vlanIntfCfg.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41746Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_portSecCfg.php7.1CNA v3.19.8%2025-12-09Emerging ThreatsFix
CVE-2025-41745Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in pxc_portCntr2.php7.1CNA v3.10.7%2025-12-09Emerging ThreatsFix
CVE-2025-41697Phoenix Contact FL SWITCH 2005 shell access to UART console6.8CNA v3.10.2%2025-12-09Fix
CVE-2025-41696Phoenix Contact FL SWITCH 2005 Hard-coded User Password4.6CNA v3.10.2%2025-12-09Fix
CVE-2025-41695Phoenix Contact FL SWITCH 2005 reflected XSS vulnerability in dyn_conn.php7.1CNA v3.10.7%2025-12-09Emerging ThreatsFix
CVE-2025-41694Phoenix Contact FL SWITCH 2005 authenticated denial of service via Webshell6.5CNA v3.10.5%2025-12-09Fix
CVE-2025-41693Phoenix Contact FL SWITCH 2005 authenticated denial of service via SSH4.3CNA v3.10.5%2025-12-09Fix
CVE-2025-41692Phoenix Contact FL SWITCH 2005 Weak/Predictable root Password6.8CNA v3.10.3%2025-12-09Fix
CVE-2025-40941Siemens SIMATIC CN 4100 information disclosure5.3CNA v4.00.3%2025-12-09Fix
CVE-2025-40940Siemens SIMATIC CN 4100 information disclosure6.9CNA v4.00.4%2025-12-09Fix
CVE-2025-40939Siemens SIMATIC CN 4100 denial of service5.1CNA v4.00.2%2025-12-09Fix
CVE-2025-40938Siemens SIMATIC CN 4100 hard-coded credentials9.2CNA v4.00.4%2025-12-09Fix
CVE-2025-40937Siemens SIMATIC CN 4100 command injection8.7CNA v4.00.6%2025-12-09Fix
CVE-2025-40935Siemens RUGGEDCOM RMC8388 V5.X improper input validation5.3CNA v4.00.2%2025-12-09Fix
CVE-2025-40831Siemens SINEC Security Monitor denial of service7.1CNA v4.00.4%2025-12-09Fix
CVE-2025-40830Siemens SINEC Security Monitor improper authorization8.4CNA v4.00.2%2025-12-09Fix
CVE-2025-40820Siemens SIDOOR ATD430W improper verification of communication source8.7CNA v4.00.5%2025-12-09Fix
CVE-2025-40819Siemens SINEMA Remote Connect Server incorrect authorization4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-40818Siemens SINEMA Remote Connect Server incorrect permission assignment3.3CNA v3.10.1%2025-12-09Fix
CVE-2025-40807Siemens Gridscale X Prepay authentication bypass by replay5.3CNA v4.00.3%2025-12-09Fix
CVE-2025-40806Siemens Gridscale X Prepay response discrepancy6.9CNA v4.00.5%2025-12-09Fix
CVE-2025-40801Siemens COMOS improper certificate validation9.2CNA v4.00.3%2025-12-09Fix
CVE-2025-40800Siemens COMOS improper certificate validation9.1CNA v4.00.2%2025-12-09Fix
CVE-2025-40344Linux kernel Intel AVS audio driver use-after-free7.8CNA v3.10.2%2025-12-09Fix
CVE-2025-40343In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions9.8CNA v3.10.7%2025-12-09Fix
CVE-2025-40342In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because8.8CNA v3.10.4%2025-12-09Fix
CVE-2025-40341Linux kernel futex robust list information disclosure–0.2%2025-12-09Fix
CVE-2025-40340Linux kernel Xe GPU driver vulnerability–0.2%2025-12-09Fix
CVE-2025-40339Linux kernel amdgpu driver vulnerability–0.2%2025-12-09Fix
CVE-2025-40338Linux kernel Intel AVS audio driver use-after-free–0.2%2025-12-09Fix
CVE-2025-40337Linux kernel stmmac Ethernet driver vulnerability8.2CNA v3.10.5%2025-12-09Fix
CVE-2025-40336In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and8.8CNA v3.10.2%2025-12-09Fix
CVE-2025-40335In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq input args This will help on validating the userq input args, and rejecting for the invalid userq request at the IOCTLs first place.–0.2%2025-12-09Fix
CVE-2025-40334In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq buffer virtual address and size It needs to validate the userq object virtual address to determine whether it is residented in a valid vm mapping.7.3CNA v3.10.2%2025-12-09Fix
CVE-2025-40333Linux kernel f2fs extent tree denial of service–0.2%2025-12-09Fix
CVE-2025-40332Linux kernel amdkfd driver deadlock–0.2%2025-12-09Fix
CVE-2025-40331Linux kernel SCTP diagnostics out-of-bounds write7.8CNA v3.10.2%2025-12-09Fix
CVE-2025-40330Linux kernel bnxt_en Ethernet driver vulnerability–0.2%2025-12-09Fix
CVE-2025-40329Linux kernel DRM scheduler job cleanup deadlock–0.2%2025-12-09Fix
CVE-2025-40328Linux kernel SMB client cached directory handle use-after-free8.8CNA v3.10.5%2025-12-09Fix
CVE-2025-40327Linux kernel perf cpu-clock event deadlock–0.2%2025-12-09Fix
CVE-2025-36437IBM Planning Analytics Local is vulnerable to disclosing sensitive information4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-34425MailEnable reflected XSS in WindowContext parameter of MAI/compose.aspx6.1v3.10.4%2025-12-09Fix
CVE-2025-34414Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE9.3CNA v4.01.0%2025-12-09Fix
CVE-2025-34413Legality WHISTLEBLOWING Missing Critical HTTP Security headers7.1CNA v4.00.4%2025-12-09
CVE-2025-34409MailEnable reflected XSS in Failed parameter of MAI/AddRecipientsResult.aspx6.1NVD v3.10.5%2025-12-09Fix
CVE-2025-34408MailEnable reflected XSS in Added parameter of MAI/AddRecipientsResult.aspx6.1NVD v3.10.5%2025-12-09Fix
CVE-2025-34407MailEnable reflected XSS in theme parameter of Statistics.aspx6.1NVD v3.10.5%2025-12-09Fix
CVE-2025-34406MailEnable reflected XSS in Id parameter of Mobile/ContactDetails.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34404MailEnable reflected XSS in InstanceScope parameter of CAL/compose.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34403MailEnable reflected XSS in FieldTo parameter of AddressBook.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34402MailEnable reflected XSS in FieldCc parameter of AddressBook.aspx6.1v3.10.4%2025-12-09Fix
CVE-2025-34401MailEnable reflected XSS in FieldBcc parameter of AddressBook.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34400MailEnable reflected XSS in AddressesTo parameter of AddressBook.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34399MailEnable reflected XSS in AddressesCc parameter of AddressBook.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34398MailEnable reflected XSS in AddressesBcc parameter of AddressBook.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34397MailEnable reflected XSS in message parameter of Mobile/Compose.aspx6.1NVD v3.10.4%2025-12-09Fix
CVE-2025-34396MailEnable DLL hijacking via Unsafe Loading of MEAINFY.DLL7.3NVD v3.10.2%2025-12-09Fix
CVE-2025-33214NVIDIA NVTabular deserialization of untrusted data8.8CNA v3.10.7%2025-12-09Fix
CVE-2025-33213NVIDIA Merlin Transformers4Rec deserialization of untrusted data8.8CNA v3.10.7%2025-12-09Fix
CVE-2025-14345Cross-Shard Failovers may lead to Partial Transaction Commit in MongoDB Server2.3CNA v4.00.2%2025-12-09Fix
CVE-2025-14337itsourcecode Student Management System new_grade.php SQL injection9.8NVD v3.10.4%2025-12-09
CVE-2025-14336itsourcecode Student Management System promote.php SQL injection9.8NVD v3.10.4%2025-12-09
CVE-2025-14335itsourcecode Student Management System new_school_year.php SQL injection9.8NVD v3.10.4%2025-12-09
CVE-2025-14334itsourcecode Student Management System new_adviser.php SQL injection9.8NVD v3.10.4%2025-12-09
CVE-2025-14333Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox 146 and Thunderbird 1468.1NVD v3.10.4%2025-12-09Fix
CVE-2025-14332Mozilla memory safety bugs fixed in Firefox 146 and Thunderbird 1467.3NVD v3.10.3%2025-12-09Fix
CVE-2025-14331Mozilla Firefox same-origin policy bypass in the Request Handling component6.5NVD v3.10.2%2025-12-09Fix
CVE-2025-14330Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component9.8NVD v3.10.5%2025-12-09Fix
CVE-2025-14329Mozilla Firefox privilege escalation in the Netmonitor component8.8CISA ADP v3.10.4%2025-12-09Fix
CVE-2025-14328Mozilla Firefox privilege escalation in the Netmonitor component8.8CISA ADP v3.10.4%2025-12-09Fix
CVE-2025-14327Mozilla Firefox spoofing issue in the Downloads Panel component7.5NVD v3.10.4%2025-12-09Fix
CVE-2025-14326Mozilla Firefox use-after-free in the Audio/Video: GMP component9.8NVD v3.10.5%2025-12-09Fix
CVE-2025-14325Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component7.3CISA ADP v3.10.3%2025-12-09Fix
CVE-2025-14324Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component9.8NVD v3.10.6%2025-12-09Fix
CVE-2025-14323Mozilla Firefox privilege escalation in the DOM: Notifications component8.8CISA ADP v3.10.4%2025-12-09Fix
CVE-2025-14322Mozilla Firefox and Thunderbird CanvasWebGL sandbox escape8.0CISA ADP v3.10.3%2025-12-09Fix
CVE-2025-14321Mozilla Firefox use-after-free in the WebRTC: Signaling component9.8NVD v3.10.6%2025-12-09Exploit codeFix
CVE-2025-14311JMRI path traversal6.8CNA v4.00.2%2025-12-09
CVE-2025-14310rethinkdb buffer overflow9.3CNA v4.00.4%2025-12-09
CVE-2025-14309ravynsoft ravynos null pointer dereference7.5CNA v3.10.4%2025-12-09
CVE-2025-14308Integer overflow in Robocode's Buffer Write method9.8NVD v3.10.6%2025-12-09Fix
CVE-2025-14307Insecure temporary file Creation in Robocode's AutoExtract component8.1NVD v3.10.3%2025-12-09Fix
CVE-2025-14306Directory traversal in Robocode's CacheCleaner component9.1NVD v3.11.1%2025-12-09Fix
CVE-2025-14286Tenda AC9 Configuration File DownloadCfg.jpg information disclosure7.5NVD v3.10.7%2025-12-09
CVE-2025-14285code-projects Employee Profile Management System edit_personnel.php SQL injection9.8NVD v3.10.4%2025-12-09
CVE-2025-14284@Tiptap/extension-link vulnerable to cross-site scripting (XSS)5.1CNA v4.00.4%2025-12-09Fix
CVE-2025-13924Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-12-09Fix
CVE-2025-13743Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs2.4CNA v4.00.2%2025-12-09Fix
CVE-2025-13662Ivanti Endpoint Manager improper signature verification7.8CNA v3.10.6%2025-12-09Fix
CVE-2025-13661Ivanti Endpoint Manager path traversal7.1CNA v3.11.4%2025-12-09Fix
CVE-2025-13659Ivanti Endpoint Manager improper control of dynamic code8.8CNA v3.12.0%2025-12-09Fix
CVE-2025-13642properfraction ProfilePress form preview vulnerability5.4CNA v3.10.5%2025-12-09Fix
CVE-2025-13604Login Security WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2025-12-09Fix
CVE-2025-13428RCE in SecOps SOAR server via user-provided Python packages8.6CNA v4.00.3%2025-12-09Fix
CVE-2025-13071Custom Admin Menu WordPress plugin reflected XSS7.1CISA ADP v3.10.2%2025-12-09
CVE-2025-13070CSV to SortTable WordPress plugin Contributor+ LFI6.6CISA ADP v3.10.4%2025-12-09
CVE-2025-13031WPeMatico RSS Feed Fetcher WordPress plugin Contributor+ stored XSS5.9CISA ADP v3.10.2%2025-12-09Fix
CVE-2025-12946Improper input validation in NETGEAR Nighthawk routers4.4CNA v4.00.3%2025-12-09Fix
CVE-2025-12945Improper input validation in NETGEAR Nighthawk router R7000P1.1CNA v4.01.1%2025-12-09Fix
CVE-2025-12941Denial of service vulnerability in NETGEAR C6220 and C62305.0CNA v4.00.2%2025-12-09
CVE-2025-12807FactoryTalk® DataMosaix™ Private Cloud SQL injection8.7CNA v4.00.4%2025-12-09Fix
CVE-2025-12705Social Reviews and Recommendations WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-12-09Fix
CVE-2025-12558Beaver Builder WordPress Page Builder plugin sensitive information exposure4.3NVD v3.10.4%2025-12-09Fix
CVE-2025-12504SQLi in Talent Software's UNIS9.8CNA v3.10.6%2025-12-09Fix
CVE-2025-12381Privilege escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer6.1CNA v4.00.2%2025-12-09Fix
CVE-2025-11531HP System Event Utility and OMEN Gaming Hub potential arbitrary code execution4.8CNA v4.00.4%2025-12-09Fix
CVE-2025-11022Personal Project Panilux cross-site request forgery9.6CNA v3.10.6%2025-12-09Fix
CVE-2025-10876XSS in Talent Software's e-Bap5.3CNA v3.10.3%2025-12-09Fix
CVE-2025-10655Frappe HelpDesk SQL injection in dashboard get_dashboard_data8.8NVD v3.10.6%2025-12-09
CVE-2025-10573Ivanti Endpoint Manager stored cross-site scripting9.6CNA v3.133.5%2025-12-09Emerging ThreatsFix
CVE-2025-9638i-Educar stored cross-site scripting (XSS) in admin panel4.8NVD v3.10.2%2025-12-09
CVE-2025-9614PCI-SIG PCIe IDE specification re-keying vulnerability6.5CISA ADP v3.10.1%2025-12-09Fix
CVE-2025-9613PCI-SIG PCIe IDE specification tag reuse vulnerability6.5CISA ADP v3.10.2%2025-12-09Fix
CVE-2025-9612PCI-SIG PCIe IDE specification TLP ordering vulnerability5.1CISA ADP v3.10.1%2025-12-09Fix
CVE-2025-9368432ES-IG3 Series A denial of service8.7CNA v4.00.4%2025-12-09Fix
CVE-2025-6924Reflected XSS in Talent Software's e-BAP5.4CNA v3.10.2%2025-12-09Fix
CVE-2025-6923Reflected XSS in Talent Software's UNIS5.4CNA v3.10.2%2025-12-09Fix
CVE-2025-5471Yandex Telemost uncontrolled search path7.3CNA v4.00.2%2025-12-09Fix
CVE-2025-5470Yandex Disk uncontrolled search path7.3CNA v4.00.2%2025-12-09Fix
CVE-2025-5469Yandex Messenger uncontrolled search path7.3CNA v4.00.2%2025-12-09Fix
CVE-2025-2296TianoCore edk2 un-verified kernel bypass Secure Boot mechanism in direct boot mode8.4CNA v4.00.8%2025-12-09Fix
CVE-2025-66461GS Yuasa International FULLBACK Manager Pro unquoted search path8.4CNA v4.00.2%2025-12-08
CVE-2025-66334Huawei HarmonyOS denial of service (DoS) vulnerability in the office service3.3CNA v3.10.1%2025-12-08Fix
CVE-2025-66333Huawei HarmonyOS denial of service (DoS) vulnerability in the office service3.3CNA v3.10.1%2025-12-08Fix
CVE-2025-66332Huawei HarmonyOS denial of service (DoS) vulnerability in the office service3.3CNA v3.10.1%2025-12-08Fix
CVE-2025-66331Huawei HarmonyOS denial of service (DoS) vulnerability in the office service3.3CNA v3.10.1%2025-12-08Fix
CVE-2025-66330Huawei HarmonyOS app lock verification bypass vulnerability in the file management app4.9CNA v3.10.1%2025-12-08Fix
CVE-2025-66329Huawei HarmonyOS permission control vulnerability in the window management module4.0CNA v3.10.1%2025-12-08Fix
CVE-2025-66328Huawei HarmonyOS multi-thread race condition vulnerability in the network management module8.4CNA v3.10.1%2025-12-08Fix
CVE-2025-66327Huawei HarmonyOS race condition vulnerability in the network module7.1CNA v3.10.1%2025-12-08Fix
CVE-2025-66326Huawei HarmonyOS race condition vulnerability in the audio module6.7CNA v3.10.1%2025-12-08Fix
CVE-2025-66325Huawei HarmonyOS permission control vulnerability in the package management module6.2CNA v3.10.1%2025-12-08Fix
CVE-2025-66324Huawei HarmonyOS input verification vulnerability in the compression and decompression module8.4CNA v3.10.1%2025-12-08Fix
CVE-2025-66323Huawei HarmonyOS vulnerability of improper criterion security check in the card module5.3CNA v3.10.1%2025-12-08Fix
CVE-2025-66322Huawei HarmonyOS multi-thread race condition vulnerability in the camera framework module5.1CNA v3.10.1%2025-12-08Fix
CVE-2025-66321Huawei HarmonyOS multi-thread race condition vulnerability in the camera framework module5.1CNA v3.10.1%2025-12-08Fix
CVE-2025-66320Huawei HarmonyOS multi-thread race condition vulnerability in the camera framework module5.1CNA v3.10.1%2025-12-08Fix
CVE-2025-65849Altcha Proof-of-Work obfuscation mode cryptanalytic break9.1CISA ADP v3.10.2%2025-12-08
CVE-2025-65804Tenda AX3 stack-based buffer overflow6.5CISA ADP v3.10.5%2025-12-08Emerging Threats
CVE-2025-65799memos lacks file name validation or verification4.3CISA ADP v3.10.2%2025-12-08Fix
CVE-2025-65798memos vulnerability allows arbitrarily modification or deletion of attachments5.4CISA ADP v3.10.2%2025-12-08Fix
CVE-2025-65797memos vulnerability allows arbitrarily modification or deletion registered identity providers6.5CISA ADP v3.10.3%2025-12-08Fix
CVE-2025-65796memos vulnerability allows arbitrarily reactions deletion4.3CISA ADP v3.10.2%2025-12-08Fix
CVE-2025-65795usememos memos improper access control7.5CISA ADP v3.10.3%2025-12-08Fix
CVE-2025-65548Cashu Nutshell improper quantity validation9.1CISA ADP v3.10.4%2025-12-08Fix
CVE-2025-65363Ruijie Rg-ap720-l command injection7.2CISA ADP v3.16.7%2025-12-08Emerging Threats
CVE-2025-65271Azuriom Client-side server-side template injection8.8CISA ADP v3.10.4%2025-12-08Exploit code
CVE-2025-65231Barix Instreamer cross-site scripting6.1CISA ADP v3.10.2%2025-12-08
CVE-2025-65230Barix Instreamer cross-site scripting5.4CISA ADP v3.10.2%2025-12-08
CVE-2025-65229Lyrion Music Server web interface stored cross-site scripting4.6CISA ADP v3.10.2%2025-12-08
CVE-2025-65228Rvr TLK302T A stored cross-site scripting3.5CISA ADP v3.10.2%2025-12-08
CVE-2025-64760Tuleap has missing CSRF protections in its tracker trigger management system4.6CNA v3.10.1%2025-12-08Fix
CVE-2025-64650IBM Storage Defender Resiliency service information disclosure6.5CNA v3.10.3%2025-12-08Fix
CVE-2025-64499Tuleap is missing CSRF protections for its planning management API4.6CNA v3.10.1%2025-12-08Fix
CVE-2025-64498Tuleap has a cross-site request forgery (CSRF)4.6CNA v3.10.1%2025-12-08Fix
CVE-2025-64497Tuleap exposes releases for all projects to File Release System project administrators6.5CNA v3.10.3%2025-12-08Fix
CVE-2025-64081Pamzey Patients Waiting Area Queue Management System SQL injection9.8v3.10.4%2025-12-08
CVE-2025-63721HummerRisk deserialization of untrusted data8.8NVD v3.10.5%2025-12-08
CVE-2025-62408c-ares has a use-after-free vulnerability when connection is cleaned up after error5.9CNA v3.10.4%2025-12-08Fix
CVE-2025-61318emlog path traversal9.1NVD v3.10.7%2025-12-08
CVE-2025-60912phpipam cross-site request forgery3.3CISA ADP v3.10.2%2025-12-08
CVE-2025-59391libcoap out-of-bounds read6.5CISA ADP v3.10.3%2025-12-08Fix
CVE-2025-58279Huawei HarmonyOS permission control vulnerability in the media library module4.4CNA v3.10.1%2025-12-08Fix
CVE-2025-48639Google Android DefaultTransitionHandler.java privilege escalation7.3NVD v3.10.1%2025-12-08Fix
CVE-2025-48638Google Android trace.c out-of-bounds write7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48637Google Android mem_protect.c out-of-bounds write7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48633Android Framework information disclosure5.5NVD v3.10.3%2025-12-08KEVKCVFix
CVE-2025-48632Google Android AssociationRequest.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48631Google Android LocalImageResolver.java denial of service6.5NVD v3.10.5%2025-12-08Fix
CVE-2025-48629Google Android VoiceInteractionManagerService.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48628Google Android PrintManagerService.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48627Google Android ActivityTaskManagerService.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48626Google Android multiple locations privilege escalation9.8NVD v3.10.4%2025-12-08Fix
CVE-2025-48625Google Android UsbDataAdvancedProtectionHook.java privilege escalation7.0NVD v3.10.1%2025-12-08Fix
CVE-2025-48624Google Android arm-smmu-v3.c out-of-bounds write7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48623Google Android pkvm.c out-of-bounds write7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48622Google Android dng_misc_opcodes.cpp out-of-bounds read5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48621Google Android DefaultTransitionHandler.java privilege escalation7.3NVD v3.10.1%2025-12-08Fix
CVE-2025-48620Google Android VoiceInteractionManagerService.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48618Google Android CommandParamsFactory.java privilege escalation6.8NVD v3.10.2%2025-12-08Fix
CVE-2025-48615Google Android MediaButtonReceiverHolder.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48614Google Android RecoverySystem.java denial of service4.6NVD v3.10.1%2025-12-08Fix
CVE-2025-48612Google Android DefaultPaymentSettings.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48610Google Android mem_protect.c information disclosure5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48608Google Android SettingsProvider.java information disclosure5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48607Google Android multiple locations denial of service5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48606Google Android InstallPackageHelper.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48604Google Android multiple locations information disclosure5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48603Google Android InputMethodInfo.java denial of service5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48601Google Android multiple locations denial of service5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48600Google Android multiple files information disclosure5.5NVD v3.10.2%2025-12-08Fix
CVE-2025-48599Google Android WifiScanModeActivity.java privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48598Google Android multiple locations privilege escalation6.6NVD v3.10.1%2025-12-08Fix
CVE-2025-48597Google Android multiple locations privilege escalation7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48596Google Android Parcel.cpp out-of-bounds read7.8NVD v3.10.1%2025-12-08Fix
CVE-2025-48594Google Android DisassociationProcessor.java privilege escalation7.3NVD v3.10.1%2025-12-08Fix
CVE-2025-48592Google Android C2SoftDav1dDec.cpp out-of-bounds read7.5NVD v3.10.3%2025-12-08Fix
CVE-2025-48591Google Android multiple locations information disclosure5.5CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48590Google Android AppOpsService.java denial of service5.5CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48589Google Android HeaderPrivacyIconsController.kt privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48588Google Android Vpn.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48586Google Android EditFdnContactScreen.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48584Google Android NotificationManagerService.java resource exhaustion5.5CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48583Google Android BaseBundle.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48580Google Android MediaBrowser.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48576Google Android NotificationManagerService.java denial of service5.5CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48575Google Android CertInstaller.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48573Google Android MediaSessionRecord.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48572Android Framework privilege escalation7.8CISA ADP v3.10.3%2025-12-08KEVKCVFix
CVE-2025-48569Google Android multiple locations denial of service5.5NVD v3.10.1%2025-12-08Fix
CVE-2025-48566Google Android multiple locations insecure permissions7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48565Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48564Google Android multiple locations privilege escalation7.0CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48555Google Android NotificationStation.java information disclosure7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48536Google Android SettingsSliceProvider.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-48525Google Android DisassociationProcessor.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-42620CSRF vulnerability in CIRCL vulnerability-Lookup8.3CNA v4.00.3%2025-12-08Fix
CVE-2025-42616CSRF vulnerability in CIRCL vulnerability-Lookup7.0CNA v4.00.2%2025-12-08Fix
CVE-2025-42615CIRCL vulnerability-Lookup two-factor authentication OTP verification vulnerability8.1CNA v4.00.4%2025-12-08Fix
CVE-2025-40326Linux kernel NFSv4 GETATTR handling denial of service7.5CNA v3.10.4%2025-12-08Fix
CVE-2025-40324Linux kernel NFSD read trace point denial of service7.5CNA v3.10.5%2025-12-08Fix
CVE-2025-40323Linux kernel framebuffer console mode handling use-after-free7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40322Linux kernel bitblit out-of-bounds read7.1CNA v3.10.1%2025-12-08Fix
CVE-2025-40321Linux kernel brcmfmac Wi-Fi driver null pointer dereference–0.2%2025-12-08Fix
CVE-2025-40320Linux kernel SMB client compound query handling use-after-free9.8CNA v3.10.4%2025-12-08Fix
CVE-2025-40319Linux kernel BPF ring buffer vulnerability7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40318Linux kernel Bluetooth HCI command sync queue use-after-free8.8CNA v3.10.3%2025-12-08Fix
CVE-2025-40317Linux kernel slimbus regmap bus vulnerability7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40316Linux kernel MediaTek DRM driver use-after-free–0.2%2025-12-08Fix
CVE-2025-40315Linux kernel f_fs null pointer dereference–0.2%2025-12-08Fix
CVE-2025-40314Linux kernel cdnsp USB gadget driver use-after-free–0.2%2025-12-08Fix
CVE-2025-40313Linux kernel NTFS3 $Extend record handling vulnerability–0.2%2025-12-08Fix
CVE-2025-40312Linux kernel JFS inode loading vulnerability–0.2%2025-12-08Fix
CVE-2025-40311Linux kernel habanalabs command buffer mapping denial of service–0.2%2025-12-08Fix
CVE-2025-40310Linux kernel amdkfd device teardown race condition–0.2%2025-12-08Fix
CVE-2025-40309Linux kernel Bluetooth SCO connection handling use-after-free8.0CNA v3.10.2%2025-12-08Fix
CVE-2025-40308Linux kernel BCSP UART driver null pointer dereference–0.2%2025-12-08Fix
CVE-2025-40307Linux kernel exFAT allocation bitmap vulnerability7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40306Linux kernel OrangeFS xattr handling vulnerability7.8CNA v3.10.2%2025-12-08Fix
CVE-2025-40305Linux kernel 9p trans_fd transport vulnerability–0.2%2025-12-08Fix
CVE-2025-40304Linux kernel fbdev console text rendering vulnerability7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40303Linux kernel btrfs metadata writeback use-after-free7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40302In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40301Linux kernel Bluetooth HCI event handling vulnerability7.6CNA v3.10.3%2025-12-08Fix
CVE-2025-40299Linux kernel gve PTP clock driver vulnerability–0.2%2025-12-08Fix
CVE-2025-40298Linux kernel gve PTP clock driver null pointer dereference–0.2%2025-12-08Fix
CVE-2025-40297Linux kernel bridge MST port state handling use-after-free7.8CNA v3.10.2%2025-12-08Fix
CVE-2025-40296Linux kernel int3472 GPIO driver double free–0.2%2025-12-08Fix
CVE-2025-40295Linux kernel fscrypt inline encryption integer underflow–0.2%2025-12-08Fix
CVE-2025-40294Linux kernel Bluetooth advertising monitor pattern parsing vulnerability–0.2%2025-12-08Fix
CVE-2025-40293Linux kernel IOMMUFD dirty tracking vulnerability–0.2%2025-12-08Fix
CVE-2025-40292Linux kernel virtio-net driver vulnerability8.4CNA v3.10.2%2025-12-08Fix
CVE-2025-40291In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple,7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-40290Linux kernel xsk kernel panic7.8CNA v3.10.1%2025-12-08Fix
CVE-2025-36140IBM watsonx.data denial of service6.5CNA v3.10.3%2025-12-08Fix
CVE-2025-36102IBM Controller client-side enforcement of server-side security2.7CNA v3.10.2%2025-12-08Fix
CVE-2025-36017IBM Controller information disclosure6.5CNA v3.10.3%2025-12-08Fix
CVE-2025-36015IBM Controller denial of service6.5CNA v3.10.3%2025-12-08Fix
CVE-2025-33111IBM Controller information disclosure4.3CNA v3.10.2%2025-12-08Fix
CVE-2025-32329Google Android Session.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-32328Google Android Session.java privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-32319Google Android RemotePrintService.java privilege escalation6.7CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-27020Improper configuration of SSH service in Infinera MTC-99.8CNA v3.10.5%2025-12-08Fix
CVE-2025-27019Remote shell service (RSH) in Infinera MTC-99.8CNA v3.10.4%2025-12-08Fix
CVE-2025-26489Improper input validation in Netconf service in Infinera MTC-96.5CNA v3.10.3%2025-12-08Fix
CVE-2025-26488Improper input validation in XML Management service in Infinera MTC-97.5CNA v3.10.4%2025-12-08Fix
CVE-2025-26487Server side request forgery (SSRF) in the web server of Infinera MTC-98.6CNA v3.10.3%2025-12-08Fix
CVE-2025-22432Google Android CallRedirectionProcessor.java privilege escalation6.7CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-22420Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2025-12-08Fix
CVE-2025-14276Ilevia EVE X1 Server leaf_search.php command injection6.3CNA v4.01.6%2025-12-08
CVE-2025-14262Jobs can be saved as workflows with wrong permissions on KNIME Business Hub5.3CNA v4.00.2%2025-12-08Fix
CVE-2025-14261LitmusChaos Litmus JWT secret generation insufficient entropy7.1CNA v3.10.3%2025-12-08Fix
CVE-2025-14259Jihai Jshop MiniProgram Mall System api.html SQL injection5.3CNA v4.00.2%2025-12-08
CVE-2025-14258itsourcecode Student Management System newsubject.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14257itsourcecode Student Management System newrecord.php SQL injection9.8NVD v3.10.5%2025-12-08
CVE-2025-14256itsourcecode Student Management System newcurriculm.php SQL injection9.8NVD v3.10.5%2025-12-08
CVE-2025-14255Galaxy Software Services｜Vitals ESP SQL injection7.1CNA v4.00.3%2025-12-08Fix
CVE-2025-14254Galaxy Software Services｜Vitals ESP SQL injection7.1CNA v4.00.3%2025-12-08Fix
CVE-2025-14253Galaxy Software Services｜Vitals ESP arbitrary file read6.9CNA v4.00.5%2025-12-08Fix
CVE-2025-14251code-projects Online Ordering System Admin Login admin SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14250code-projects Online Ordering System user_contact.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14249code-projects Online Ordering System user_school.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14248code-projects Simple Shopping Cart adminlogin.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14247code-projects Simple Shopping Cart additems.php SQL injection9.8NVD v3.10.3%2025-12-08
CVE-2025-14246code-projects Simple Shopping Cart settings.php SQL injection9.8NVD v3.10.3%2025-12-08
CVE-2025-14245IdeaCMS Coupon.php whereRaw SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14244GreenCMS Menu Management CustomController.class.php cross-site scripting4.8NVD v3.10.3%2025-12-08
CVE-2025-14230code-projects Daily Time Recording System add_payroll.php SQL injection8.8NVD v3.10.3%2025-12-08
CVE-2025-14229SourceCodester Inventory Management System SVC Report Export CSV injection8.0NVD v3.10.4%2025-12-08
CVE-2025-14228Yealink SIP-T21P E2 local directory cross-site scripting5.1CNA v4.00.2%2025-12-08
CVE-2025-14227Philipinho Simple-PHP-Blog edit.php SQL injection9.8NVD v3.10.3%2025-12-08
CVE-2025-14226itsourcecode Student Management System edit_user.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14225D-Link DCS-930L alphapd setSystemAdmin command injection8.8NVD v3.18.9%2025-12-08Emerging Threats
CVE-2025-14224Yottamaster DM2/DM3/DM200 file upload path traversal9.8NVD v3.10.8%2025-12-08
CVE-2025-14223code-projects Simple Leave Manager request.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14222code-projects Employee Profile Management System print_personnel_report.php SQL injection8.8NVD v3.10.3%2025-12-08
CVE-2025-14221SourceCodester Online Banking System page cross-site scripting5.4NVD v3.10.3%2025-12-08
CVE-2025-14220ORICO CD3510 file upload path traversal5.3CNA v4.00.4%2025-12-08
CVE-2025-14219Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload7.2NVD v3.10.3%2025-12-08
CVE-2025-14218code-projects Currency Exchange System editotheraccount.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14217code-projects Currency Exchange System edittrns.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14216code-projects Currency Exchange System viewserial.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14215code-projects Currency Exchange System edit.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14214itsourcecode Student Information System section_edit1.php SQL injection8.8NVD v3.10.3%2025-12-08
CVE-2025-14212Projectworlds Advanced Library Management System member_search.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14211Projectworlds Advanced Library Management System delete_book.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14210Projectworlds Advanced Library Management System delete_member.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14209Campcodes School File Management System update_query.php SQL injection9.8NVD v3.10.4%2025-12-08
CVE-2025-14208D-Link DIR-823X set_wan_settings sub_415028 command injection5.3CNA v4.03.4%2025-12-08
CVE-2025-14207tushar-2223 Hotel-Management-System invoiceprint.php SQL injection6.9CNA v4.00.3%2025-12-08
CVE-2025-14206SourceCodester Online Student Clearance System Fee Table delete-fee.php improper authorization7.5NVD v3.10.4%2025-12-08
CVE-2025-14205code-projects Chamber of Commerce Membership Management System cross-site scripting5.4NVD v3.10.2%2025-12-08
CVE-2025-12956Dassault Systèmes ENOVIA Collaborative Industry Innovator reflected cross-site scripting8.7CNA v3.10.2%2025-12-08Fix
CVE-2025-12832IBM InfoSphere Information Server server-side request forgery4.6CNA v3.10.2%2025-12-08Fix
CVE-2025-12635IBM WebSphere Application Server and WebSphere Application Server Liberty cross-site scripting5.4CNA v3.10.2%2025-12-08Fix
CVE-2025-14204TykoDev cherry-studio OAuth server discovery OS command injection5.3CNA v4.01.3%2025-12-07
CVE-2025-14203code-projects Question Paper Generator selectquestionuser.php SQL injection8.8NVD v3.10.4%2025-12-07
CVE-2025-14201alokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross-site scripting4.8NVD v3.10.3%2025-12-07
CVE-2025-14200alokjaiswal Hotel-Management-services-using-MYSQL-and-php cross-site scripting6.1NVD v3.10.2%2025-12-07
CVE-2025-14199Verysync 微力同步 Web Administration text.txt unrestricted upload9.8NVD v3.10.4%2025-12-07
CVE-2025-14198Verysync 微力同步 Web Administration download information disclosure6.9CNA v4.00.5%2025-12-07
CVE-2025-14197Verysync 微力同步 Web Administration f96956469e7be39d information disclosure6.9CNA v4.00.4%2025-12-07
CVE-2025-14196H3C Magic B1 aspForm sub_44de0 buffer overflow8.7CNA v4.00.5%2025-12-07
CVE-2025-14195code-projects Employee Profile Management System add_file_query.php unrestricted upload8.8NVD v3.10.4%2025-12-07
CVE-2025-14194code-projects Employee Profile Management System view_personnel.php cross-site scripting5.4NVD v3.10.3%2025-12-07
CVE-2025-14193code-projects Employee Profile Management System view_personnel.php SQL injection8.8NVD v3.10.4%2025-12-07
CVE-2025-14192RashminDungrani online-banking auth_login.php SQL injection6.9CNA v4.00.3%2025-12-07
CVE-2025-14191UTT 进取 512W formP2PLimitConfig strcpy buffer overflow9.8NVD v3.10.8%2025-12-07
CVE-2025-14190Chanjet TPlus SQL injection6.9CNA v4.00.3%2025-12-07
CVE-2025-14189Chanjet CRM jxf_dump_table_demo.php SQL injection6.9CNA v4.00.3%2025-12-07
CVE-2025-14188UGREEN DH2100+ nas_svr create handler_file_backup_create command injection8.6CNA v4.02.7%2025-12-07
CVE-2025-14187UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow8.6CNA v4.00.6%2025-12-07
CVE-2025-14186Grandstream GXP1625 Network Status api.values.post cross-site scripting5.1CNA v4.00.2%2025-12-07
CVE-2025-14185Yonyou U8 Cloud AppServletService.class SQL injection5.3CNA v4.00.2%2025-12-07
CVE-2025-14184SGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX_UPLOAD command injection5.3CNA v4.02.2%2025-12-07
CVE-2025-14183SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storage5.3CNA v4.00.3%2025-12-07
CVE-2025-14182Sobey Media Convergence System upload path traversal9.8NVD v3.10.4%2025-12-07
CVE-2025-40289Linux kernel amdgpu VRAM sysfs attributes vulnerability–0.2%2025-12-06Fix
CVE-2025-40288Linux kernel amdgpu VRAM resource manager null pointer dereference–0.2%2025-12-06Fix
CVE-2025-40287Linux kernel exFAT dentry size validation denial of service–0.2%2025-12-06Fix
CVE-2025-40286Linux kernel ksmbd read handler memory leak–0.2%2025-12-06Fix
CVE-2025-40285Linux kernel ksmbd session setup vulnerability7.5CNA v3.10.4%2025-12-06Fix
CVE-2025-40284Linux kernel Bluetooth MGMT mesh send timer use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40283Linux kernel btusb driver disconnect handling use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40282Linux kernel 6LoWPAN IPv6 receive path denial of service8.8CNA v3.10.3%2025-12-06Fix
CVE-2025-40281Linux kernel SCTP transport RTO calculation vulnerability–0.2%2025-12-06Fix
CVE-2025-40280Linux kernel TIPC neighbor monitor use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40279In the Linux kernel, the following vulnerability has been resolved: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_pu–0.2%2025-12-06Fix
CVE-2025-40278In the Linux kernel, the following vulnerability has been resolved: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was part–0.2%2025-12-06Fix
CVE-2025-40277Linux kernel vmwgfx GPU driver vulnerability7.8CNA v3.10.2%2025-12-06Fix
CVE-2025-40276Linux kernel Panthor GPU driver vulnerability7.3CNA v3.10.1%2025-12-06Fix
CVE-2025-40275Linux kernel USB audio mixer controls null pointer dereference–0.2%2025-12-06Fix
CVE-2025-40274Linux kernel KVM guest_memfd use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40273In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in8.8CNA v3.10.4%2025-12-06Fix
CVE-2025-40272Linux kernel secretmem fault handler use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40271Linux kernel fs/proc use-after-free7.8CNA v3.10.5%2025-12-06Exploit codeFix
CVE-2025-40270Linux kernel swap VMA readahead use-after-free7.8CNA v3.10.1%2025-12-06Fix
CVE-2025-40269Linux kernel USB audio PCM driver out-of-bounds write7.8CNA v3.10.2%2025-12-06Fix
CVE-2025-40268Linux kernel cifs client memory leak–0.2%2025-12-06Fix
CVE-2025-40267Linux kernel io_uring read/write iovec handling vulnerability–0.2%2025-12-06Fix
CVE-2025-14141UTT 进取 520W formArpBindConfig strcpy buffer overflow9.8NVD v3.10.8%2025-12-06
CVE-2025-14140UTT 进取 520W websHostFilter strcpy buffer overflow7.1CNA v4.00.6%2025-12-06
CVE-2025-14139UTT 进取 520W formConfigDnsFilterGlobal strcpy buffer overflow6.9CNA v4.01.0%2025-12-06
CVE-2025-14136Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow8.7CNA v4.01.1%2025-12-06
CVE-2025-14135Linksys RE6500 stack-based buffer overflow8.7CNA v4.00.9%2025-12-06
CVE-2025-14134Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow8.7CNA v4.00.9%2025-12-06
CVE-2025-14133Linksys RE6500 stack-based buffer overflow8.7CNA v4.00.9%2025-12-06
CVE-2025-14126TOZED ZLT M30S/ZLT M30S PRO web hard-coded credentials8.7CNA v4.00.4%2025-12-06
CVE-2025-14117fit2cloud Halo cross-site request forgery6.5NVD v3.10.2%2025-12-06
CVE-2025-13922Tag, Category, and Taxonomy Manager AI Autotagger with OpenAI WordPress plugin SQL injection6.5CNA v3.10.3%2025-12-06Fix
CVE-2025-13907CSS3 Buttons WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13899TR Timthumb WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13898Ultra Skype Button WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13896Social Feed Gallery Portfolio WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13894CSV Sumotto WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-12-06
CVE-2025-13863RevInsite WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13857Yet Another WebClap for WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13856Extra Post Images WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13748Fluent Forms WordPress plugin insecure direct object reference5.3CNA v3.10.3%2025-12-06Fix
CVE-2025-13666Helloprint WordPress plugin missing authorization5.3CNA v3.10.3%2025-12-06
CVE-2025-13656Cute News Ticker WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-13629WP Landing Page WordPress plugin cross-site request forgery to arbitrary post Meta update4.3CNA v3.10.2%2025-12-06
CVE-2025-13626myLCO WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2025-12-06
CVE-2025-1337710Web Booster WordPress plugin arbitrary Folder deletion via two_clear_page_cache8.1NVD v3.10.5%2025-12-06Fix
CVE-2025-13358Accessiy by CodeConfig WordPress plugin missing authorization5.3CNA v3.10.3%2025-12-06Fix
CVE-2025-13309Accessiy By CodeConfig Accessibility WordPress plugin authorization bypass4.3CNA v3.10.3%2025-12-06
CVE-2025-13308Application Passwords WordPress plugin reflected cross-site scripting via reject_url5.4CNA v3.10.2%2025-12-06
CVE-2025-13292Google Cloud Apigee-X cross-tenant analytics access improper access control7.6CNA v4.00.3%2025-12-06Fix
CVE-2025-13137Live Sales Notification for Woocommerce Woomotiv WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-12-06
CVE-2025-13065Starter Templates WordPress plugin arbitrary file upload8.8CNA v3.113.5%2025-12-06Fix
CVE-2025-12966All-in-One Video Gallery Authenticated (Author+) arbitrary file upload via Import ZIP8.8CNA v3.10.5%2025-12-06Fix
CVE-2025-12721g-FFL Cockpit WordPress plugin missing authorization to unauthenticated information exposure5.3CNA v3.10.3%2025-12-06Exploit codeFix
CVE-2025-12720g-FFL Cockpit WordPress plugin improper authorization to unauthenticated Product deletion5.3CNA v3.10.3%2025-12-06Exploit codeFix
CVE-2025-12717List Attachments Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-12715Canadian Nutrition Facts Label WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-06
CVE-2025-12673Flex QR Code Generator WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.10.7%2025-12-06Exploit codeFix
CVE-2025-12577Listar WordPress plugin unauthorized access4.3CNA v3.10.2%2025-12-06
CVE-2025-12574passionui Listar REST API place deletion endpoint missing authorization4.3CNA v3.10.2%2025-12-06
CVE-2025-12510Widgets for Google Reviews WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-12-06Fix
CVE-2025-12505weDocs WordPress plugin missing authorization to settings update5.4CNA v3.10.2%2025-12-06Fix
CVE-2025-12499Rich Shortcodes for Google Reviews WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-12-06Fix
CVE-2025-12091Search, Filters and Merchandising for WooCommerce WordPress plugin unauthorized access4.3CNA v3.10.2%2025-12-06Fix
CVE-2025-11263Link Whisper Free WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2025-12-06Fix
CVE-2025-66644Array Networks ArrayOS AG OS command injection9.8v3.13.4%2025-12-05KEVFix
CVE-2025-66629HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF3.7CNA v3.10.1%2025-12-05Fix
CVE-2025-66624BACnet-stack MS/TP reply matcher OOB read7.5CNA v3.10.4%2025-12-05Fix
CVE-2025-66623Strimzi Kafka Connect and MirrorMaker 2 role information disclosure7.4CNA v3.10.2%2025-12-05Fix
CVE-2025-66581Frappe LMS is Missing Server-Side Authorization in Business Logic1.3CNA v4.00.2%2025-12-05Fix
CVE-2025-66577cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust5.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66570cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (remote*/local*)10.0CNA v3.10.3%2025-12-05Fix
CVE-2025-66566yawkat LZ4 Java has a possible information leak in Java safe decompressor8.2CNA v4.00.6%2025-12-05Fix
CVE-2025-66562TUUI vulnerable to remote code execution (RCE) via XSS in Markdown ECharts Rendering8.9CNA v4.00.5%2025-12-05Fix
CVE-2025-66558Nextcloud Twofactor WebAuthn app was updated based on public key3.1CNA v3.10.3%2025-12-05Fix
CVE-2025-66557Nextcloud Deck app allowed user with Can share permission to modify permissions of other non-owners5.4CNA v3.10.3%2025-12-05Fix
CVE-2025-66556Nextcloud Talk allows participants to blindly delete poll drafts of other users by ID3.5CNA v3.10.3%2025-12-05Fix
CVE-2025-66554Nextcloud Contacts vulnerable to stored XSS in Contacts app via organisation and title field3.5CNA v3.10.3%2025-12-05Fix
CVE-2025-66553Nextcloud Tables app allowed users to view columns metadata information of any table4.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66552Nextcloud Server admin_audit does not log all actions on files in groupfolders4.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66551Nextcloud Tables column ownership check insecure direct object reference6.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66550Nextcloud Calendar attachments of local files are offered to downloaded5.7CNA v3.10.3%2025-12-05Fix
CVE-2025-66549Nextcloud Desktop encrypted file locking information disclosure2.4CNA v3.10.3%2025-12-05Fix
CVE-2025-66548Nextcloud Deck app allows to spoof file extensions by using RTLO characters3.3CNA v3.10.2%2025-12-05Fix
CVE-2025-66547Nextcloud Server users can modify tags on files that do not belong to them4.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66546Nextcloud Calendar app allowed booking appointments without the generated token3.3CNA v3.10.1%2025-12-05Fix
CVE-2025-66545Nextcloud Group Folders trash bin restore vulnerability3.5CNA v3.10.3%2025-12-05Fix
CVE-2025-66515Nextcloud Approval app allows users to request Approval for other users file2.7CNA v3.10.3%2025-12-05Fix
CVE-2025-66514Nextcloud Mail stored HTML injection in subject text3.5CNA v3.10.3%2025-12-05Fix
CVE-2025-66513Nextcloud Tables app share information not limited to relevant users4.3CNA v3.10.3%2025-12-05Fix
CVE-2025-66512Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud5.4CNA v3.10.3%2025-12-05Fix
CVE-2025-66511Nextcloud Calendar app used predictable proposal participant tokens4.8CNA v3.10.3%2025-12-05Fix
CVE-2025-66510Nextcloud Server contacts search information disclosure4.5CNA v3.10.4%2025-12-05Fix
CVE-2025-66471urllib3 Streaming API improperly handles highly compressed data8.9CNA v4.00.7%2025-12-05Fix
CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chain8.9CNA v4.00.7%2025-12-05Fix
CVE-2025-66270KDE Connect protocol authentication bypass by spoofing4.7CNA v3.10.2%2025-12-05Fix
CVE-2025-66200Apache HTTP Server: Mod_userdir+suexec bypass via AllowOverride FileInfo5.4CISA ADP v3.10.7%2025-12-05Fix
CVE-2025-65897Zhaoyachao Zdh Web path traversal8.8CISA ADP v3.10.8%2025-12-05
CVE-2025-65879yeqifu Warehouse Management System path traversal8.1CISA ADP v3.10.8%2025-12-05
CVE-2025-65878yeqifu Warehouse Management System path traversal7.5CISA ADP v3.10.7%2025-12-05
CVE-2025-65730Pommee Goaway hard-coded credentials8.8CISA ADP v3.10.5%2025-12-05Fix
CVE-2025-65082Apache HTTP Server: CGI environment variable override6.5CISA ADP v3.10.8%2025-12-05Fix
CVE-2025-65036XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro8.3CNA v3.10.4%2025-12-05Fix
CVE-2025-64057Fanvil X210 path traversal8.3CISA ADP v3.10.8%2025-12-05
CVE-2025-64056Fanvil X210 file upload4.3CISA ADP v3.10.2%2025-12-05
CVE-2025-64054Fanvil X210 cross-site scripting9.6CISA ADP v3.10.4%2025-12-05
CVE-2025-64053Fanvil X210 buffer overflow7.5CISA ADP v3.12.9%2025-12-05
CVE-2025-64052Fanvil X210 command injection5.1CISA ADP v3.12.8%2025-12-05
CVE-2025-62223Microsoft Edge (Chromium-based) for Mac spoofing4.3CNA v3.10.4%2025-12-05Fix
CVE-2025-59775Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF7.5CISA ADP v3.10.8%2025-12-05Fix
CVE-2025-58098Apache HTTP Server: Server Side Includes adds query string to #exec cmd=8.3CISA ADP v3.11.4%2025-12-05Exploit codeFix
CVE-2025-55753Apache HTTP Server: Mod_md (ACME), unintended retry intervals7.5CISA ADP v3.10.5%2025-12-05Fix
CVE-2025-46603Dell CloudBoost Virtual Appliance missing brute-force protection7.0CNA v3.10.2%2025-12-05Fix
CVE-2025-34291Langflow origin validation error8.8NVD v3.192.8%2025-12-05KEVNucleiFix
CVE-2025-34266Advantech WISE-DeviceOn Server authenticated stored XSS via plugin-config/addins/menus5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34265Advantech WISE-DeviceOn Server authenticated stored XSS via rule-engines5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34264Advantech WISE-DeviceOn Server Software Watchdog rules stored cross-site scripting5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34263Advantech WISE-DeviceOn Server authenticated stored XSS via plugin-config/dashboards/menus5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34262Advantech WISE-DeviceOn Server device name field stored cross-site scripting5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34261Advantech WISE-DeviceOn Server authenticated stored XSS via devicegroups/5.4NVD v3.10.3%2025-12-05Fix
CVE-2025-34260Advantech WISE-DeviceOn Server authenticated stored XSS via action/schedule5.4NVD v3.10.3%2025-12-05Fix
CVE-2025-34259Advantech WISE-DeviceOn Server authenticated stored XSS via devicemap/building5.4NVD v3.10.3%2025-12-05Fix
CVE-2025-34258Advantech WISE-DeviceOn Server authenticated stored XSS via devicemap/plan5.4NVD v3.10.2%2025-12-05Fix
CVE-2025-34257Advantech WISE-DeviceOn Server authenticated stored XSS via action/defined5.4v3.10.3%2025-12-05Fix
CVE-2025-34256Advantech WISE-DeviceOn Server Hard-coded JWT Key authentication bypass9.8v3.10.7%2025-12-05Fix
CVE-2025-32901KDEConnect improper type validation4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-32900KDE Connect information-exchange protocol use of a less trusted source4.3CNA v3.10.1%2025-12-05Fix
CVE-2025-32899KDE Connect device discovery vulnerability4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-32898KDE Connect verification-code protocol insufficient entropy4.7CNA v3.10.1%2025-12-05Fix
CVE-2025-27389ColorOS Application Installation Source Verification Flaw may lead to Risk Detection Bypass5.1CNA v4.00.1%2025-12-05
CVE-2025-14116xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery5.1CNA v4.00.3%2025-12-05
CVE-2025-14111Rarlab RAR App com.rarlab.rar path traversal8.1v3.10.6%2025-12-05
CVE-2025-14108ZSPACE Q2C NAS HTTP POST request open zfilev2_api.OpenSafe command injection8.7CNA v4.010.5%2025-12-05Emerging Threats
CVE-2025-14107ZSPACE Q2C NAS HTTP POST request status zfilev2_api.SafeStatus command injection8.7CNA v4.012.2%2025-12-05Emerging Threats
CVE-2025-14106ZSPACE Q2C NAS HTTP POST request close zfilev2_api.CloseSafe command injection8.7CNA v4.012.1%2025-12-05Emerging Threats
CVE-2025-14105TOZED ZLT M30S/ZLT M30S PRO Web proc_post denial of service5.3CNA v4.00.3%2025-12-05
CVE-2025-14104Util-linux: Util-linux: Heap buffer overread in setpwnam when processing 256-byte usernames6.1CNA v3.10.2%2025-12-05Fix
CVE-2025-14094Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection9.8NVD v3.120.3%2025-12-05Emerging Threats
CVE-2025-14093Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection9.8NVD v3.119.6%2025-12-05Emerging Threats
CVE-2025-14092Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection7.2NVD v3.116.9%2025-12-05Emerging Threats
CVE-2025-14091TrippWasTaken PHP-Guitar-Shop Product Details product.php SQL injection6.9CNA v4.00.3%2025-12-05
CVE-2025-14090AMTT Hotel Broadband Operation System cardmake_down.php SQL injection7.2NVD v3.10.3%2025-12-05
CVE-2025-14089Himool ERP AdminActionViewSet update_account improper authorization5.3CNA v4.00.2%2025-12-05
CVE-2025-14088ketr JEPaaS load improper authorization5.3CNA v4.00.2%2025-12-05
CVE-2025-14086youlaitech youlai-mall openid access control8.8NVD v3.10.3%2025-12-05
CVE-2025-14085youlaitech youlai-mall orders improper control of dynamically-identified variables8.8NVD v3.10.4%2025-12-05
CVE-2025-14052youlaitech youlai-mall members getMemberById access control6.5v3.10.3%2025-12-05
CVE-2025-13860Easy Jump Links Menus WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-05
CVE-2025-13739CryptX WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2025-12-05Fix
CVE-2025-13684ARK Related Posts WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-13682Trail Manager WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-12-05
CVE-2025-13678Thai Lottery Widget WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-12-05Fix
CVE-2025-13654Duc buffer_get function stack-based buffer overflow7.5CISA ADP v3.10.9%2025-12-05Fix
CVE-2025-13625WP-SOS-Donate Donation Sidebar WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2025-12-05
CVE-2025-13623Twitscription WordPress plugin reflected cross-site scripting via admin.php PATH_INFO6.1CNA v3.10.3%2025-12-05
CVE-2025-13622Jabbernotification WordPress plugin reflected cross-site scripting via admin.php PATH_INFO6.1CNA v3.10.3%2025-12-05
CVE-2025-13621dream gallery WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.1%2025-12-05
CVE-2025-13620Wp Social Login and Register Social Counter WordPress plugin missing authorization5.3CNA v3.10.4%2025-12-05Fix
CVE-2025-13614Cool Tag Cloud WordPress plugin authenticated (Contributor+) stored cross-site scripting8.1CNA v3.10.3%2025-12-05
CVE-2025-13528Feedback Modal for Website WordPress plugin unauthorized access5.3CNA v3.10.9%2025-12-05Nuclei
CVE-2025-13515Nouri.sh Newsletter WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.2%2025-12-05
CVE-2025-13512CoSign Single Signon WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.2%2025-12-05
CVE-2025-13494SSP Debug WordPress plugin unauthenticated sensitive information exposure5.3CNA v3.10.3%2025-12-05
CVE-2025-13426Improper Sandboxing in Google Apigee's JavaCallout Policy allows for remote code execution8.7CNA v4.00.4%2025-12-05Fix
CVE-2025-13362Norby AI WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2025-12-05
CVE-2025-13360Quantic Social Image Hover WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2025-12-05
CVE-2025-13313CRM Memberships WordPress plugin missing authorization privilege escalation9.8CNA v3.10.5%2025-12-05Fix
CVE-2025-13312CRM Memberships tag creation endpoint missing authorization5.3CNA v3.10.3%2025-12-05Fix
CVE-2025-13144ContentStudio WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-13066Demo Importer Plus WordPress plugin arbitrary file upload8.8CNA v3.10.6%2025-12-05Fix
CVE-2025-13006SurveyFunnel Survey Plugin for WordPress unauthenticated information exposure5.3CNA v3.10.3%2025-12-05
CVE-2025-12879User Generator and Importer WordPress plugin cross-site request forgery to privilege escalation8.8CNA v3.10.2%2025-12-05
CVE-2025-12876Projectopia WordPress plugin unauthorized access5.3CNA v3.10.3%2025-12-05Fix
CVE-2025-12851My auctions allegro WordPress plugin unauthenticated local file inclusion via controller8.1CNA v3.10.8%2025-12-05Fix
CVE-2025-12850My auctions allegro WordPress plugin unauthenticated SQL injection via auction_id7.5CNA v3.10.3%2025-12-05Fix
CVE-2025-12804Booking Calendar WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-12-05Fix
CVE-2025-12417SurveyFunnel Survey Plugin for WordPress stored cross-site scripting6.4CNA v3.10.2%2025-12-05
CVE-2025-12374Email Verification WordPress plugin authentication bypass9.8CNA v3.10.5%2025-12-05Fix
CVE-2025-12373Torod WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-12370Takeads WordPress plugin missing authorization to plugin settings deletion4.3CNA v3.10.2%2025-12-05
CVE-2025-12368Sermon Manager WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-12-05
CVE-2025-12355Payaza WordPress plugin missing authorization to unauthenticated order Status update5.3CNA v3.10.2%2025-12-05Fix
CVE-2025-12354Live CSS Preview WordPress plugin missing authorization authenticated settings update4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-12191PDF Catalog for WooCommerce WordPress plugin authenticated (Subscriber+) stored cross-site scripting5.4CNA v3.10.2%2025-12-05
CVE-2025-12190Image Optimizer by wps.sk WordPress plugin cross-site request forgery to Bulk Image Optimization4.3CNA v3.10.2%2025-12-05
CVE-2025-12189Bread and Butter: AI-Powered Lead Intelligence WordPress plugin cross-site request forgery8.8v3.10.3%2025-12-05Fix
CVE-2025-12186Weekly Planner WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-12-05
CVE-2025-12181ContentStudio WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.10.6%2025-12-05Fix
CVE-2025-12165Webcake Landing Page Builder WordPress plugin missing authorization authenticated settings update4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-12163Omnipress WordPress plugin authenticated (Author+) stored cross-site scripting6.4CNA v3.10.4%2025-12-05Fix
CVE-2025-12154Auto Thumbnailer WordPress plugin authenticated (Contributor+) arbitrary file upload8.8CNA v3.10.5%2025-12-05
CVE-2025-12153Featured Image via URL WordPress plugin authenticated (Contributor+) arbitrary file upload8.8CNA v3.10.5%2025-12-05
CVE-2025-12133EPROLO Dropshipping WordPress plugin missing authorization authenticated Tracking data modification4.3CNA v3.10.2%2025-12-05Fix
CVE-2025-12130WC Vendors WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-12-05Fix
CVE-2025-12128Hide Categories Or Products On Shop Page WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-12-05
CVE-2025-12124FitVids for WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-12-05
CVE-2025-12093Voidek Employee Portal WordPress plugin missing authorization5.3CNA v3.10.3%2025-12-05Fix
CVE-2025-11759Backup, Restore and Migrate your sites with XCloner WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-12-05Fix
CVE-2025-10055Time Sheets WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-12-05
CVE-2025-8148Improper access control in SFTP service of GoAnywhere MFT4.2CNA v3.10.2%2025-12-05Fix
CVE-2025-6966Null-pointer dereference in Python-apt TagSection.keys6.9CNA v4.00.1%2025-12-05Fix
CVE-2025-66576Remote Keyboard Desktop remote code execution (RCE)9.8v3.11.3%2025-12-04Exploit code
CVE-2025-66575VeeVPN unquoted service path remote code execution7.8v3.10.5%2025-12-04Exploit code
CVE-2025-66574TranzAxis stored cross-site scripting (XSS)5.4v3.10.2%2025-12-04Exploit code
CVE-2025-66573Solstice Pod API Session Key Extraction via API endpoint7.5v3.10.3%2025-12-04Exploit code
CVE-2025-66572Loaded Commerce Client-Side template injection (CSTI)6.9CNA v4.00.5%2025-12-04Exploit code
CVE-2025-66571UNA CMS --RC4 PHP object injection9.3CNA v4.00.6%2025-12-04Exploit code
CVE-2025-66564Sigstore Timestamp Authority allocates excessive memory during request parsing7.5CNA v3.10.4%2025-12-04Fix
CVE-2025-66563Monkeytype vulnerable to stored XSS in approve quotes page7.1CNA v4.00.2%2025-12-04
CVE-2025-66561SysReptor vulnerable to an authenticated stored cross-site scripting (XSS)7.3CNA v3.10.2%2025-12-04Fix
CVE-2025-66559taikoxyz taiko-mono taiko Alethia Pacaya inbox verification pointer corruption8.0CNA v4.00.3%2025-12-04
CVE-2025-66555AirKeyboard iOS App remote input injection8.8CNA v4.00.7%2025-12-04Exploit code
CVE-2025-66516Apache Tika core Critical XML external entity injection8.4CNA v3.189.0%2025-12-04NucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2025-66509LaraDashboard: 1-Click Pre-Auth RCE via host header + Module Installation Chain8.9CNA v4.00.4%2025-12-04Fix
CVE-2025-66506Fulcio allocates excessive memory during token parsing7.5CNA v3.10.2%2025-12-04Fix
CVE-2025-66479Anthropic Sandbox Runtime network sandbox enforcement protection mechanism failure1.8CNA v4.00.2%2025-12-04Fix
CVE-2025-66373AkamaiGhost HTTP request smuggling4.8CISA ADP v3.10.3%2025-12-04Fix
CVE-2025-66287Webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash8.8CNA v3.10.5%2025-12-04Fix
CVE-2025-66238Sunbird DCIM dcTrack and Power IQ authentication bypass using an alternate path or channel7.4CNA v4.00.3%2025-12-04Fix
CVE-2025-66237Sunbird DCIM dcTrack and Power IQ use of hard-coded credentials8.4CNA v4.00.1%2025-12-04Fix
CVE-2025-65959open-webui Open WebUI vulnerable to Stored DOM XSS via Note Download PDF8.7CNA v3.10.2%2025-12-04Fix
CVE-2025-65958open-webui open WebUI vulnerable to server-side request forgery8.5CNA v3.14.4%2025-12-04Fix
CVE-2025-65945Auth0/node-jws improper HMAC signature verification7.5CNA v3.10.2%2025-12-04Exploit codeFix
CVE-2025-65900Difuse Kalmia incorrect authorization6.5CISA ADP v3.10.3%2025-12-04Exploit code
CVE-2025-65899Difuse Kalmia response discrepancy5.3CISA ADP v3.10.3%2025-12-04Exploit code
CVE-2025-65883Genexis Platinum-4410 insufficient session expiration8.4CISA ADP v3.10.4%2025-12-04
CVE-2025-65806E-point Cms unrestricted file upload4.3CISA ADP v3.10.3%2025-12-04
CVE-2025-65637Logrus is vulnerable to DoS when using Entry.Writer7.5CISA ADP v3.10.6%2025-12-04Exploit codeFix
CVE-2025-65516seafile-server cross-site scripting6.1CISA ADP v3.10.2%2025-12-04Fix
CVE-2025-65346Alexusmai laravel-file-manager is vulnerable to directory traversal9.1CISA ADP v3.11.0%2025-12-04Exploit code
CVE-2025-63896Jxlindia Jxl 9 Inch Car Android Double Din Player missing authentication7.6CISA ADP v3.10.3%2025-12-04
CVE-2025-63681open-webui is vulnerable to Incorrect Access Control4.3v3.10.3%2025-12-04Fix
CVE-2025-63499Alinto SOGo cross-site scripting6.1CISA ADP v3.10.3%2025-12-04Exploit codeFix
CVE-2025-63364Waveshare Rs232/485 To Wifi Eth (b) cleartext transmission of sensitive information7.5CISA ADP v3.10.3%2025-12-04
CVE-2025-63363Waveshare Rs232/485 To Wifi Eth (b) man-in-the-middle7.5CISA ADP v3.10.3%2025-12-04
CVE-2025-63362Waveshare Rs232/485 To Wifi Eth (b) unverified password change9.8CISA ADP v3.10.6%2025-12-04
CVE-2025-63361Waveshare Rs232/485 To Wifi Eth (b) insufficiently protected credentials5.7CISA ADP v3.10.3%2025-12-04
CVE-2025-62173FreePBX restapps authenticated SQL injection in endpoint Module Rest API8.6CNA v4.00.3%2025-12-04Fix
CVE-2025-61148Edupluscampus An insecure direct object reference6.5CISA ADP v3.10.3%2025-12-04Exploit code
CVE-2025-59788Nextcloud reachable files_pdfviewer example directory cross-site scripting5.4v3.10.3%2025-12-04Fix
CVE-2025-57213fuyang_lipengjun platform information disclosure7.5v3.10.3%2025-12-04
CVE-2025-57212fuyang_lipengjun platform information disclosure7.5v3.10.3%2025-12-04
CVE-2025-57210fuyang_lipengjun platform information disclosure7.5v3.10.3%2025-12-04
CVE-2025-56427composio ComposioHQ has a directory traversal7.5CISA ADP v3.10.9%2025-12-04
CVE-2025-55948yzcheng90 X-SpringBoot incorrect privilege assignment7.3CISA ADP v3.10.3%2025-12-04
CVE-2025-54307Thermo Fisher Torrent Suite Software path traversal8.8CISA ADP v3.10.8%2025-12-04Fix
CVE-2025-54306Thermo Fisher Torrent Suite Software improper input validation7.2CISA ADP v3.10.8%2025-12-04Fix
CVE-2025-54305Thermo Fisher Torrent Suite Software authentication bypass by spoofing7.8CISA ADP v3.10.2%2025-12-04Fix
CVE-2025-54304Thermo Fisher Ion Torrent Onetouch 2 information disclosure9.8CISA ADP v3.10.5%2025-12-04Fix
CVE-2025-54303Thermo Fisher Torrent Suite Software default credentials9.8CISA ADP v3.10.4%2025-12-04Fix
CVE-2025-54160Synology BeeDrive for desktop path traversal7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-54159Synology BeeDrive for desktop missing authorization7.5CNA v3.10.4%2025-12-04Fix
CVE-2025-54158Synology BeeDrive for desktop missing authentication7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-53963Thermo Fisher Ion Torrent Onetouch 2 weak password requirements9.8CISA ADP v3.10.5%2025-12-04Fix
CVE-2025-53704MAXHUB Pivot weak password recovery mechanism for forgotten password8.7CNA v4.00.3%2025-12-04Fix
CVE-2025-41080Seafile file upload API stored cross-site scripting6.1v3.10.2%2025-12-04Fix
CVE-2025-41079Seafile user profile API stored cross-site scripting6.1v3.10.2%2025-12-04Fix
CVE-2025-40266Linux kernel KVM arm64 FF-A memory share vulnerability8.2CNA v3.10.2%2025-12-04Fix
CVE-2025-40265Linux kernel vfat filesystem vulnerability–0.2%2025-12-04Fix
CVE-2025-40264Linux kernel be2net OS2BMC packet handling null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40263In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_–0.2%2025-12-04Fix
CVE-2025-40262Linux kernel imx_sc_key input driver memory corruption7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-40261In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had9.8CNA v3.10.6%2025-12-04Fix
CVE-2025-40260Linux kernel sched_ext scheduler class vulnerability–0.2%2025-12-04Fix
CVE-2025-40259Linux kernel SCSI generic (sg) driver vulnerability–0.2%2025-12-04Fix
CVE-2025-40258Linux kernel MPTCP worker scheduling use-after-free9.8CNA v3.10.5%2025-12-04Fix
CVE-2025-40257Linux kernel mptcp use-after-free9.8CNA v3.10.5%2025-12-04Fix
CVE-2025-40256In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (–0.2%2025-12-04Fix
CVE-2025-40255Linux kernel net core null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40254In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates–0.2%2025-12-04Fix
CVE-2025-40253In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' fre8.8CNA v3.10.3%2025-12-04Fix
CVE-2025-40252Linux kernel qede driver TPA packet handling out-of-bounds read9.8CNA v3.10.6%2025-12-04Fix
CVE-2025-40251Linux kernel devlink rate node parent pointer null pointer dereference7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40250Linux kernel mlx5 IRQ allocation vulnerability7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40249Linux kernel GPIO character device event notification use-after-free7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-40248Linux kernel vsock connect handling race condition7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40247Linux kernel MSM GPU page table preallocation null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40246Linux kernel XFS symlink repair out-of-bounds read–0.2%2025-12-04Fix
CVE-2025-40245Linux kernel nios2 memory limit setup improper initialization7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40244In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() The syzbot reported issue in __hfsplus_ext_cache_extent(): [ 70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195022]7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40243Linux kernel HFS bitmap search vulnerability7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40242Linux kernel GFS2 distributed lock manager race condition7.0CNA v3.10.1%2025-12-04Fix
CVE-2025-40241Linux kernel EROFS encoded extents vulnerability7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-40240Linux kernel SCTP chunk handling null pointer dereference7.5CNA v3.10.6%2025-12-04Fix
CVE-2025-40239Linux kernel Micrel LAN8814 PHY driver null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40238Linux kernel mlx5 IPsec MPV device cleanup null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40237Linux kernel inotify file handle export race condition–0.2%2025-12-04Fix
CVE-2025-40236Linux kernel virtio-net GSO tunnel hashing information disclosure–0.2%2025-12-04Fix
CVE-2025-40235Linux kernel Btrfs fs_info initialization null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40234Linux kernel Alienware WMI sleep handler null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40233Linux kernel OCFS2 extent map cache vulnerability7.8CNA v3.10.2%2025-12-04Fix
CVE-2025-40232Linux kernel rv crash–0.2%2025-12-04Fix
CVE-2025-40231Linux kernel vsock transport assignment deadlock–0.2%2025-12-04Fix
CVE-2025-40230Linux kernel transparent huge page splitting denial of service–0.2%2025-12-04Fix
CVE-2025-40229Linux kernel DAMON scheme destruction memory leak–0.2%2025-12-04Fix
CVE-2025-40228Linux kernel DAMON sysfs commit test context vulnerability–0.2%2025-12-04Fix
CVE-2025-40227Linux kernel DAMON sysfs commit test context vulnerability–0.2%2025-12-04Fix
CVE-2025-40226Linux kernel ARM SCMI firmware debug interface vulnerability–0.2%2025-12-04Fix
CVE-2025-40225Linux kernel Panthor GPU VA region unmapping null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40224Linux kernel cgbc hwmon driver null pointer dereference–0.2%2025-12-04Fix
CVE-2025-40223Linux kernel MOST USB driver disconnect handling use-after-free–0.2%2025-12-04Fix
CVE-2025-40222Linux kernel sh-sci serial driver FIFO handling vulnerability–0.2%2025-12-04Fix
CVE-2025-40221Linux kernel mg4b PCI media driver information disclosure–0.2%2025-12-04Fix
CVE-2025-40220In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the fil–0.2%2025-12-04Fix
CVE-2025-40219Linux kernel PCI SR-IOV hotplug handling race condition–0.2%2025-12-04Fix
CVE-2025-40218Linux kernel DAMON virtual address monitoring denial of service–0.2%2025-12-04Fix
CVE-2025-40217Linux kernel pidfs ioctl handling vulnerability–0.2%2025-12-04Fix
CVE-2025-40216In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-40215Linux kernel xfrm IPComp tunnel state vulnerability7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-40214Linux kernel AF_UNIX garbage collection vulnerability7.8CNA v3.10.1%2025-12-04Fix
CVE-2025-29846Synology Router Manager (SRM) path traversal7.2CNA v3.10.6%2025-12-04Fix
CVE-2025-29845Synology Router Manager (SRM) path traversal4.3CNA v3.10.4%2025-12-04Fix
CVE-2025-29844Synology Router Manager (SRM) path traversal4.3CNA v3.10.4%2025-12-04Fix
CVE-2025-29843Synology Router Manager (SRM) path traversal5.4CNA v3.10.4%2025-12-04Fix
CVE-2025-29269ALLNET All-rut22gw OS command injection9.8CISA ADP v3.12.0%2025-12-04Emerging Threats
CVE-2025-29268ALLNET All-rut22gw hard-coded credentials9.8CISA ADP v3.18.5%2025-12-04Emerging Threats
CVE-2025-27935Authentication bypass in OTP (One-time Passcode) IdP Adapter Integration Kit8.6CNA v4.00.5%2025-12-04
CVE-2025-14051youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables8.8v3.10.5%2025-12-04
CVE-2025-14016macrozheng mall-swarm delete improper authorization8.1v3.10.3%2025-12-04
CVE-2025-14015H3C Magic B0 aspForm EditWlanMacList buffer overflow9.8v3.10.8%2025-12-04
CVE-2025-14013jizhiCMS Comment addcomment.html cross-site scripting4.8v3.10.3%2025-12-04
CVE-2025-14012jizhiCMS Batch Delete Comments deleteAll.html delete SQL injection7.2v3.10.4%2025-12-04
CVE-2025-14011jizhiCMS Add Display Name field addcomment.html commentlist SQL injection7.2v3.10.4%2025-12-04
CVE-2025-14010Ansible Community General Collection is vulnerable to exposure of sensitive information5.5CNA v3.10.1%2025-12-04Fix
CVE-2025-14008dayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7e.php server-side request forgery7.2v3.10.4%2025-12-04
CVE-2025-14007dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross-site scripting6.1v3.10.3%2025-12-04
CVE-2025-14006dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross-site scripting6.1v3.10.3%2025-12-04
CVE-2025-14005dayrui XunRuiCMS Add Display Name field admind45f74adbd95.php cross-site scripting6.1v3.10.3%2025-12-04
CVE-2025-14004dayrui XunRuiCMS Email setting admind45f74adbd95.php server-side request forgery9.8v3.10.4%2025-12-04
CVE-2025-13940WatchGuard Firebox Boot Time System Integrity Check Bypass6.7CNA v4.00.1%2025-12-04Fix
CVE-2025-13939WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in Gateway Wireless controller4.8CNA v4.00.2%2025-12-04Fix
CVE-2025-13938WatchGuard Fireware OS Autotask integration module stored cross-site scripting4.8CNA v4.00.2%2025-12-04Fix
CVE-2025-13937WatchGuard Fireware OS ConnectWise integration module stored cross-site scripting4.8CNA v4.00.2%2025-12-04Fix
CVE-2025-13936WatchGuard Fireware OS Tigerpaw integration module stored cross-site scripting4.8CNA v4.00.2%2025-12-04Fix
CVE-2025-13932SolisCloud Monitoring Platform (Cloud API and Device Control API) insecure direct object reference8.3CNA v4.00.3%2025-12-04
CVE-2025-13543PostGallery WordPress plugin authenticated (Subscriber+) arbitrary file upload8.8CNA v3.10.8%2025-12-04
CVE-2025-13513Clik stats WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.2%2025-12-04
CVE-2025-13488Nexus Repository 3 stored cross-site scripting (XSS)5.1CNA v4.00.3%2025-12-04Fix
CVE-2025-13373Advantech iView SQL injection8.7CNA v4.00.4%2025-12-04Fix
CVE-2025-12997Medtronic CareLink Network insecure direct object reference2.2CNA v3.10.2%2025-12-04Fix
CVE-2025-12996Medtronic CareLink Network sensitive information in log files4.1CNA v3.10.1%2025-12-04Fix
CVE-2025-12995Medtronic CareLink Network missing brute-force protection8.1CNA v3.10.3%2025-12-04Fix
CVE-2025-12994Medtronic CareLink Network response discrepancy5.3CNA v3.10.3%2025-12-04Fix
CVE-2025-12986silabs.com Gecko SDK denial of service vulnerability in Silicon Labs WF200 and WGM160P Devices6.0CNA v4.00.2%2025-12-04Fix
CVE-2025-12826Custom Post Type UI WordPress plugin authorization bypass4.8CNA v3.10.3%2025-12-04Fix
CVE-2025-12782Beaver Builder WordPress plugin authorization bypass4.3CNA v3.10.3%2025-12-04Fix
CVE-2025-12196WatchGuard Firebox Authenticated out-of-bounds write in Management CLI Ping command8.6CNA v4.00.6%2025-12-04Fix
CVE-2025-12195WatchGuard Firebox Authenticated out-of-bounds write in Management CLI IPSec Configuration8.6CNA v4.00.7%2025-12-04Fix
CVE-2025-12097Relative path traversal vulnerability in NI System Web Server8.7CNA v4.00.6%2025-12-04
CVE-2025-12026WatchGuard Firebox Authenticated out-of-bounds write in certd8.6CNA v4.00.4%2025-12-04Fix
CVE-2025-11838WatchGuard Firebox iked memory corruption8.7CNA v4.00.5%2025-12-04Fix
CVE-2025-11727Omnichannel for WooCommerce: Google WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2025-12-04
CVE-2025-11379WebP Express WordPress plugin unauthenticated information exposure5.3CNA v3.10.3%2025-12-04Fix
CVE-2025-11222Central Dogma's Login function has an open redirect6.1CNA v3.10.2%2025-12-04Fix
CVE-2025-10285silabs.com Simplicity Studio V6 Simplcity Device Manager exposes NTLMv2 hash7.4CNA v4.00.2%2025-12-04Fix
CVE-2025-9127PX Enterprise improper sanitization5.5NVD v3.10.1%2025-12-04Fix
CVE-2025-8074Synology BeeDrive for desktop origin validation error5.6CNA v3.10.1%2025-12-04Fix
CVE-2025-6946WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in IPS Configuration4.8CNA v4.00.2%2025-12-04Fix
CVE-2025-2848Synology Mail Server missing authorization6.3CNA v3.10.4%2025-12-04Fix
CVE-2025-1910WatchGuard Mobile VPN with SSL local privilege escalation via Update Package6.3CNA v4.00.3%2025-12-04Exploit codeFix
CVE-2025-1547WatchGuard Firebox Authenticated stack overflow in Certificate request command7.5CNA v4.00.4%2025-12-04Fix
CVE-2025-1545WatchGuard Firebox XPath injection vulnerability in Web CGI8.2CNA v4.00.5%2025-12-04Fix
CVE-2025-66489Cal.com authentication bypass via bad TOTP + password checks9.9CNA v4.00.8%2025-12-03Fix
CVE-2025-66453Mozilla Rhino toFixed function denial of service5.5CNA v4.00.3%2025-12-03Fix
CVE-2025-66431Plesk symlink following7.8CNA v3.10.3%2025-12-03Fix
CVE-2025-66411Coder logged sensitive objects unsanitized7.8CNA v3.10.2%2025-12-03Fix
CVE-2025-66406smallstep certificates improper authorization Check for SSH Certificate Revocation5.0CNA v3.10.2%2025-12-03Fix
CVE-2025-66404mcp-server-kubernetes potential security issue in exec_in_pod tool6.4CNA v3.11.5%2025-12-03Fix
CVE-2025-66293LIBPNG has an out-of-bounds read in png_image_read_composite7.1CNA v3.10.4%2025-12-03Fix
CVE-2025-66222DeepChat cross-site scripting(XSS) escalate to remote code execution(RCE)9.7CNA v3.10.6%2025-12-03Fix
CVE-2025-66220Envoy proxy Envoy TLS certificate SAN matcher improper null termination5.0CNA v3.10.2%2025-12-03Fix
CVE-2025-66208CollaboraOnline online Configuration-Dependent RCE (OS command injection) in richdocumentscode proxy7.2CNA v4.01.1%2025-12-03Fix
CVE-2025-66032anthropics claude-code Claude Code Command Validation Bypass allows arbitrary code execution8.7CNA v4.00.7%2025-12-03Fix
CVE-2025-65868EyouCMS XML external entity injection7.5NVD v3.10.4%2025-12-03
CVE-2025-65843Acustica-audio Aquarius link following7.7CISA ADP v3.10.3%2025-12-03
CVE-2025-65842Acustica-audio Aquarius Helpertool incorrect privilege assignment5.1CISA ADP v3.10.2%2025-12-03
CVE-2025-65841Acustica-audio Aquarius improper access control6.2CISA ADP v3.10.2%2025-12-03
CVE-2025-65345Alexusmai laravel-file-manager is vulnerable to directory traversal6.5CISA ADP v3.10.6%2025-12-03Exploit code
CVE-2025-65320Abacre Restaurant Point Of Sale cleartext storage of sensitive information7.5CISA ADP v3.10.2%2025-12-03
CVE-2025-65267frappe erpnext cross-site scripting9.0CISA ADP v3.10.3%2025-12-03
CVE-2025-65097rommapp romm insecure direct object reference allows Unauthorized Deletion of User Collections7.1CNA v4.00.2%2025-12-03Fix
CVE-2025-65096RomM insecure direct object reference (IDOR) allows unauthorized access to Private Collections5.3CNA v4.00.2%2025-12-03Fix
CVE-2025-65027RomM Chained XSS and CSRF vulnerabilities Enable Admin account takeover7.6CNA v3.10.3%2025-12-03Exploit codeFix
CVE-2025-64763Envoy forwards early CONNECT data in TCP proxy mode3.7CNA v3.10.3%2025-12-03Fix
CVE-2025-64527Envoy crashes when JWT authentication is configured with the remote JWKS fetching6.5CNA v3.10.5%2025-12-03Fix
CVE-2025-64443Docker mcp-gateway exposed dangerous method7.3CNA v4.00.4%2025-12-03Fix
CVE-2025-64055Fanvil X210 improper authentication9.8CISA ADP v3.10.5%2025-12-03
CVE-2025-63402Hcltech Dragon resource exhaustion5.5CISA ADP v3.10.3%2025-12-03Fix