CVE-2025 records published in December 2025
Page five of five: records 4,001 to 4,374 of the 4,374 published in December 2025, newest first. The first page carries the figures for December 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-63401 | Hcltech Dragon HCL Technologies Limited cross-site scripting | 5.5CISA ADP v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-62686 | Plugin-alliance Installation Manager local privilege escalation | 6.2CISA ADP v3.1 | 0.2% | 2025-12-03 | |
| CVE-2025-61727 | Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 | 6.5CISA ADP v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-57202 | AVTECH DGM1104 stored cross-site scripting | 6.1CISA ADP v3.1 | 0.5% | 2025-12-03 | Emerging Threats |
| CVE-2025-57201 | AVTECH DGM1104 command injection | 8.8CISA ADP v3.1 | 17.2% | 2025-12-03 | Emerging Threats |
| CVE-2025-57200 | AVTECH DGM1104 command injection | 6.5CISA ADP v3.1 | 2.4% | 2025-12-03 | Emerging Threats |
| CVE-2025-57199 | AVTECH DGM1104 command injection | 8.8CISA ADP v3.1 | 3.3% | 2025-12-03 | Emerging ThreatsExploit code |
| CVE-2025-57198 | AVTECH DGM1104 command injection | 8.8CISA ADP v3.1 | 2.8% | 2025-12-03 | Emerging Threats |
| CVE-2025-55182 | Meta React Server Components remote code execution | 10.0CNA v3.1 | 99.8% | 2025-12-03 | KEVNucleiMetasploitEmerging ThreatsExploit codeFix |
| CVE-2025-55076 | Plugin-alliance Installation Manager InstallationHelper service included local privilege escalation | 6.2CISA ADP v3.1 | 0.2% | 2025-12-03 | |
| CVE-2025-54326 | Samsung Exynos 1280 null pointer dereference | 7.5CISA ADP v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-54065 | GZDoom engine allows arbitrary code execution via ZScript actor states | 7.8CNA v3.1 | 0.1% | 2025-12-03 | |
| CVE-2025-53965 | Samsung Exynos 980 memory corruption | 5.3CISA ADP v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-53841 | Akamai Guardicore Platform Agent inclusion of untrusted functionality | 7.8CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-50361 | Smallbasic buffer overflow | 5.1CISA ADP v3.1 | 0.2% | 2025-12-03 | Exploit code |
| CVE-2025-50360 | Dannyvankooten Pepper compiler.c and compiler.h heap-based buffer overflow | 8.4CISA ADP v3.1 | 0.2% | 2025-12-03 | Exploit code |
| CVE-2025-39665 | Nagvis livestatus injection in dynmaps | 6.9CNA v4.0 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-34319 | TOTOLINK N300RT Boa formWsc RCE | 9.3CNA v4.0 | 4.4% | 2025-12-03 | Fix |
| CVE-2025-33211 | NVIDIA Triton Inference Server improper quantity validation | 7.5CNA v3.1 | 0.7% | 2025-12-03 | Fix |
| CVE-2025-33208 | NVIDIA TAO uncontrolled search path | 8.8CNA v3.1 | 0.4% | 2025-12-03 | Fix |
| CVE-2025-33201 | NVIDIA Triton Inference Server improper check for exceptional conditions | 7.5CNA v3.1 | 0.9% | 2025-12-03 | Fix |
| CVE-2025-29864 | ESTsoft ALZIP protection mechanism failure | 6.2CNA v4.0 | 0.1% | 2025-12-03 | Fix |
| CVE-2025-20389 | Improper input validation in label column field in Splunk Secure Gateway App | 4.3CNA v3.1 | 0.4% | 2025-12-03 | Fix |
| CVE-2025-20388 | Blind server side request forgery (SSRF) through Distributed Search Peers in Splunk Enterprise | 2.7CNA v3.1 | 0.4% | 2025-12-03 | Fix |
| CVE-2025-20387 | Splunk Universal Forwarder Windows installation directory incorrect permission assignment | 8.0CNA v3.1 | 0.5% | 2025-12-03 | Fix |
| CVE-2025-20386 | Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade | 8.0CNA v3.1 | 0.5% | 2025-12-03 | Fix |
| CVE-2025-20385 | Splunk Enterprise navigation bar collections stored cross-site scripting | 2.4CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-20384 | Unauthenticated log injection in Splunk Enterprise | 5.3CNA v3.1 | 0.4% | 2025-12-03 | Fix |
| CVE-2025-20383 | Splunk Secure Gateway push notifications information disclosure | 4.3CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-20382 | URL validation bypass through Views Dashboard in Splunk Enterprise | 3.5CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-20381 | SPL commands allowlist controls bypass in Splunk MCP Server app through run_splunk_query MCP tool | 5.4CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13992 | Google Chrome Navigation and Loading side-channel information leak | 4.7CISA ADP v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13949 | ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload | 5.3CNA v4.0 | 0.2% | 2025-12-03 | |
| CVE-2025-13948 | opsre go-ldap-admin JWT docker-compose.yaml hard-coded key | 6.3CNA v4.0 | 0.3% | 2025-12-03 | |
| CVE-2025-13947 | Webkit: Webkitgtk: Remote user-assisted information disclosure via file drag-and-drop | 7.4CNA v3.1 | 0.3% | 2025-12-03 | Exploit codeFix |
| CVE-2025-13946 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.1% | 2025-12-03 | Fix |
| CVE-2025-13945 | Improperly controlled sequential memory allocation in Wireshark | 5.5CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13756 | techjewel Fluent Booking calendar import missing authorization | 4.3CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13751 | OpenVPN resource exhaustion | 1.3CNA v4.0 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13646 | Modula - Authenticated (Author+) arbitrary file upload via race condition | 6.6NVD v3.1 | 0.8% | 2025-12-03 | Fix |
| CVE-2025-13645 | Modula - Authenticated (Author+) arbitrary file deletion | 7.2CNA v3.1 | 1.0% | 2025-12-03 | Fix |
| CVE-2025-13495 | FluentCart A New Era of eCommerce WordPress plugin SQL injection | 4.9CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-13492 | HP Image Assistant potential escalation of privilege | 5.4CNA v4.0 | 0.1% | 2025-12-03 | Fix |
| CVE-2025-13486 | Advanced Custom Fields: Extended - unauthenticated remote code execution in prepare_form | 9.8CNA v3.1 | 67.6% | 2025-12-03 | Reported exploitedNucleiMetasploitExploit codeFix |
| CVE-2025-13472 | Missing authorization in BlazeMeter Jenkins plugin | 5.3CNA v4.0 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13448 | CSSIgniter Shortcodes WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13401 | Autoptimize WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-13390 | WP Directory Kit WordPress plugin authentication bypass to privilege escalation via account takeover | 9.8v3.1 | 4.6% | 2025-12-03 | NucleiExploit codeFix |
| CVE-2025-13359 | Tag, Category, and Taxonomy Manager AI Autotagger with OpenAI WordPress plugin SQL injection | 6.5CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-13354 | Tag WordPress plugin authorization bypass | 4.3CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-13342 | Frontend Admin by DynamiApps WordPress plugin unauthenticated arbitrary options update | 9.8CNA v3.1 | 2.2% | 2025-12-03 | NucleiExploit codeFix |
| CVE-2025-13109 | HUSKY Products Filter Professional for WooCommerce WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-13086 | OpenVPN improper input validation | 4.6CNA v4.0 | 0.6% | 2025-12-03 | Fix |
| CVE-2025-12954 | Timetable and Event Schedule by MotoPress WordPress plugin Contributor+ Event disclosure via IDOR | 2.7CISA ADP v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-12887 | Post SMTP WordPress plugin authorization bypass | 5.4CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-12819 | Untrusted search path in auth_query connection in PgBouncer | 7.5CNA v3.1 | 0.4% | 2025-12-03 | Fix |
| CVE-2025-12744 | Red Hat Enterprise Linux 6 abrt: Command-injection in abrt leading to local privilege escalation | 8.8CNA v3.1 | 0.6% | 2025-12-03 | Exploit codeFix |
| CVE-2025-12585 | MxChat AI Chatbot for WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-12-03 | Exploit codeFix |
| CVE-2025-12385 | Qt Company Qt Quick Text component image tag parsing denial of service | 8.7CNA v4.0 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-12358 | ShopEngine WordPress plugin cross-site request forgery to Wishlist manipulation | 4.3CNA v3.1 | 0.1% | 2025-12-03 | Fix |
| CVE-2025-12084 | Python CPython quadratic complexity in node ID cache clearing | 6.3CNA v4.0 | 0.8% | 2025-12-03 | Fix |
| CVE-2025-10304 | Everest Backup WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.2% | 2025-12-03 | Fix |
| CVE-2025-7044 | Privilege escalation in MAAS via Websocket Request Manipulation | 7.7CNA v3.1 | 0.3% | 2025-12-03 | Fix |
| CVE-2025-66476 | Vim for Windows uncontrolled search path element remote code execution | 7.8CNA v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-66468 | Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors | 7.7CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-66460 | Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables | 5.3CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-66459 | Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML | 5.3CNA v4.0 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-66458 | Lookyloo has multiple XSS due to unsafe use of f-strings in Markup | 5.3CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-66454 | ArcadeAI Arcade MCP default worker secret hard-coded credentials | 6.5CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-66416 | Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default | 7.6CNA v4.0 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-66414 | Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default | 7.6CNA v4.0 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-66409 | espressif esp-idf ESF-IDF has an out-of-bounds read in ESP32 Bluetooth AVRCP Command Handling | 2.7CNA v4.0 | 0.6% | 2025-12-02 | Fix |
| CVE-2025-66399 | SNMP command injection leads to RCE in Cacti | 7.4CNA v4.0 | 10.8% | 2025-12-02 | Emerging ThreatsFix |
| CVE-2025-65955 | ImageMagick has a use-after-free/double free risk in Options::fontFamily when clearing family | 4.9CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-65896 | Asyncmy is vulnerable to SQL injection via crafted dict keys | 9.8CISA ADP v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-65881 | oretnom23 Zoo Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-12-02 | Exploit code |
| CVE-2025-65877 | Wanliofficial Lvzhou Cms SQL injection | 7.5CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-65858 | Calibre-Web has a stored cross-site scripting vulnerability | 3.5CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65844 | evershop unrestricted file upload | 7.5CISA ADP v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-65657 | FeehiCMS has a remote code execution via unrestricted file upload in Ad Management | 6.5CISA ADP v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-65656 | Dcat-Admin remote file inclusion | 9.8CISA ADP v3.1 | 0.5% | 2025-12-02 | |
| CVE-2025-65380 | PHPGurukul Billing System SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65379 | PHPGurukul Billing System SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65358 | Hashenudara eDoc Doctor Appointment System SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-65215 | Senior-walter Web-based Pharmacy Product Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65187 | CiviCRM A stored cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65186 | Grav CMS is vulnerable to cross-site scripting (XSS) in the page editor | 6.1v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-65105 | Apptainer ineffective application of selinux and apparmor --security options | 4.5CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-64778 | Mirion Medical EC2 Software NMIS BioDose use of hard-coded credentials | 7.8v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-64750 | sylabs singularity singluarity ineffectively applies of selinux / apparmor LSM process labels | 4.5CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-64642 | Mirion Medical EC2 Software NMIS BioDose incorrect permission assignment for critical resource | 7.8v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-64460 | Django potential denial of service vulnerability in XML serializer text extraction | 7.5CISA ADP v3.1 | 2.1% | 2025-12-02 | Fix |
| CVE-2025-64298 | Mirion Medical EC2 Software NMIS BioDose incorrect permission assignment for critical resource | 7.5v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-64070 | Remyandrade Student Grades Management System cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-63872 | Deepseek cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-62575 | Mirion Medical EC2 Software NMIS BioDose incorrect permission assignment for critical resource | 8.8v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-61940 | Mirion Medical EC2 Software NMIS BioDose use of client-side authentication | 8.8v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-61729 | Go crypto/x509 HostnameError.Error denial of service | 7.5CISA ADP v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-60854 | D-Link R15 command injection | 9.8CISA ADP v3.1 | 1.2% | 2025-12-02 | Exploit codeFix |
| CVE-2025-60736 | Anisha Online Medicine Guide SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-12-02 | Exploit code |
| CVE-2025-59705 | Entrust Nshield Hsmi improper privilege management | 6.8CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59704 | Entrust Nshield Hsmi improper authentication | 4.6NVD v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59703 | Entrust Nshield Hsmi improper access control | 9.1CISA ADP v3.1 | 0.5% | 2025-12-02 | |
| CVE-2025-59702 | Entrust Nshield Hsmi observable discrepancy | 7.2CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59701 | Entrust Nshield Hsmi cleartext storage of sensitive information | 4.1CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-59700 | Entrust Nshield Hsmi insufficient verification of data authenticity | 3.9NVD v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-59699 | Entrust Nshield Hsmi authentication bypass by spoofing | 6.8CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59698 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically proximate attacker to gain access to the EOL legacy bootloader. | 6.8CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59697 | Entrust Nshield Hsmi improper privilege management | 7.2CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59696 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to modify or erase tamper events via the Chassis management board. | 3.2CISA ADP v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-59695 | Entrust Nshield Hsmi missing authentication | 9.8CISA ADP v3.1 | 0.7% | 2025-12-02 | |
| CVE-2025-59694 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To e | 6.8CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-59693 | Entrust Nshield Hsmi improper privilege management | 9.8CISA ADP v3.1 | 0.9% | 2025-12-02 | |
| CVE-2025-58488 | Samsung Mobile Smart Touch Call improper verification of communication source | 4.5CNA v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-58487 | Samsung Mobile Samsung Account improper authorization | 4.0CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-58486 | Samsung Mobile Samsung Account improper input validation | 4.0CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-58485 | Samsung Mobile Samsung Internet improper input validation | 5.5CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58484 | Samsung Mobile Samsung Cloud Assistant incorrect default permissions | 4.0CNA v3.1 | 0.1% | 2025-12-02 | |
| CVE-2025-58483 | Samsung Mobile Galaxy Store for Galaxy Watch improper export of Android application components | 5.9CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58482 | Samsung Mobile MotionPhoto MPLocalService improper access control | 7.3CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58481 | Samsung Mobile MotionPhoto MPRemoteService improper access control | 7.3CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58480 | Samsung Mobile Devices libimagecodec.quram.so heap-based buffer overflow | 4.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-58479 | Samsung Mobile Devices libimagecodec.quram.so out-of-bounds read | 4.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-58478 | Samsung Mobile Devices libimagecodec.quram.so out-of-bounds write | 4.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-58477 | Samsung Mobile Devices parsing IFD tag in libimagecodec.quram.so out-of-bounds write | 4.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-58476 | Samsung Mobile Devices bootloader out-of-bounds read | 4.2CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58475 | Samsung Mobile Devices libsec-ril.so improper input validation | 5.6CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-58386 | Terminalfour improper authorization | 9.8CISA ADP v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-58113 | PDF-XChange Editor EMF functionality out-of-bounds read | 6.5CNA v3.1 | 0.5% | 2025-12-02 | |
| CVE-2025-57850 | Red Hat OpenShift Dev Spaces codeready-ws: Privilege escalation | 6.4CNA v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-55181 | Facebook proxygen excessive iteration | 5.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-55129 | Revive Adserver improper Unicode handling | 5.4CNA v3.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-52622 | HCL BigFix SaaS Remediate HTTP response headers vulnerability | 5.4CNA v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-41744 | Sprecher Automation: SPRECON-E series has static default key material for TLS connections | 9.1CNA v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-41743 | Sprecher Automation: SPRECON-E series prone to weak encryption of update files | 4.0CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-41742 | Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance. | 9.8CNA v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-41086 | Authorization bypass in Gams from Gams Development Corp | 6.5v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-41066 | Disclosure of sensitive information in Horde Groupware | 5.3v3.1 | 0.2% | 2025-12-02 | |
| CVE-2025-41015 | TCMAN GIM PDAWebService SOAP endpoint information disclosure | 7.5v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-41014 | TCMAN GIM PDAWebService SOAP endpoint information disclosure | 7.5v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-41013 | SQL injection vulnerability in TCMAN GIM | 9.8v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-41012 | Unauthorized access vulnerability in TCMAN GIM | 5.3NVD v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-40700 | Reflected cross-site scripting (XSS) in Governalia by IDI Eikon | 6.1v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-34352 | JumpCloud Remote Assist arbitrary file write/Delete via Insecure Temp Directory | 8.5CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-21080 | Samsung Mobile Devices Dynamic Lockscreen improper export of Android application components | 6.2CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-21072 | Samsung Mobile Devices decoding metadata in fingerprint trustlet out-of-bounds write | 5.7CNA v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20792 | MediaTek chipsets reachable assertion in Modem | 5.3CISA ADP v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-20791 | MediaTek chipsets reachable assertion in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-20790 | MediaTek chipsets null pointer dereference in Modem | 5.3CISA ADP v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-20789 | MediaTek chipsets information exposure through sent data in GPU pdma | 4.4CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20788 | MediaTek MT6991, MT8196 improper access control for register interface in GPU pdma | 4.4CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20777 | MediaTek chipsets out-of-bounds write in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20776 | MediaTek chipsets out-of-bounds read in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20775 | MediaTek chipsets double free in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20774 | MediaTek chipsets heap overflow in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20773 | MediaTek chipsets double free in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20772 | MediaTek chipsets double free in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20771 | MediaTek chipsets use of uninitialized variable in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20770 | MediaTek chipsets use-after-free in display | 6.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20769 | MediaTek chipsets stack overflow in display | 6.7v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20768 | MediaTek chipsets out-of-bounds read in display | 7.8CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20767 | MediaTek chipsets out-of-bounds write in display | 7.8CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20766 | MediaTek chipsets use of uninitialized variable in display | 7.8CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20765 | MediaTek chipsets double free in aee daemon | 4.7CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20764 | MediaTek chipsets out-of-bounds write in smi | 7.8CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20763 | MediaTek chipsets out-of-bounds write in mmdvfs | 7.8CISA ADP v3.1 | 0.1% | 2025-12-02 | Fix |
| CVE-2025-20759 | MediaTek chipsets out-of-bounds read in Modem | 6.5CISA ADP v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-20758 | MediaTek chipsets uncaught exception in Modem | 4.9CISA ADP v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-20757 | MediaTek chipsets reachable assertion in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-20756 | MediaTek chipsets Specified type in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-20755 | MediaTek chipsets null pointer dereference in Modem | 5.3CISA ADP v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-20754 | MediaTek chipsets uncaught exception in Modem | 5.3CISA ADP v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-20753 | MediaTek chipsets uncaught exception in Modem | 5.3CISA ADP v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-20752 | MediaTek chipsets reachable assertion in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-20751 | MediaTek chipsets out-of-bounds write in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-20750 | MediaTek chipsets null pointer dereference in Modem | 6.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13879 | Directory traversal vulnerability in EfficientIP's SOLIDserver IPAM | 2.7NVD v3.1 | 0.5% | 2025-12-02 | Fix |
| CVE-2025-13877 | nocobase JWT service jwt-service.ts hard-coded key | 6.3CNA v4.0 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13876 | Rareprob HD Video Player All Formats App com.rocks.music.videoplayer path traversal | 7.8v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-13875 | Yohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversal | 5.3CNA v4.0 | 0.4% | 2025-12-02 | |
| CVE-2025-13873 | ObjectPlanet Opinio the feature to import a survey is prone to stored Cross-Site script attacks | 5.4v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13872 | Blind server-side request forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio | 9.1v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13871 | ObjectPlanet Opinio the feature to manage resources is prone to cross-site request forgery attacks | 8.8v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13870 | Mattermost unauthorized access and subscription vulnerability in Boards | 3.1CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13828 | Mautic user without privileged access to the Marketplace can install and uninstall composer packages | 9.0CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13827 | Mautic GrapesJsBuilder file upload allows all file uploads | 8.8CNA v4.0 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-13731 | Nexter Extension WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13724 | VikRentCar Car Rental Management System WordPress plugin SQL injection | 7.5CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13721 | Google Chrome race condition | 7.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13720 | Google Chrome incorrect type conversion | 8.8CISA ADP v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13697 | BlockArt Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13696 | Zigaform WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13685 | Photo Gallery by Ays WordPress plugin cross-site request forgery to Bulk actions | 4.3CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13658 | Industrial Video and Control Longwatch has a code injection | 9.3CNA v4.0 | 0.7% | 2025-12-02 | Fix |
| CVE-2025-13640 | Google Chrome Passwords inappropriate implementation | 3.5CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13639 | Google Chrome WebRTC inappropriate implementation | 8.1v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13638 | Google Chrome Media Stream use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13637 | Google Chrome Downloads inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13636 | Google Chrome Split view inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13635 | Google Chrome Downloads inappropriate implementation | 4.4CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13634 | Google Chrome Downloads inappropriate implementation | 4.4CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13633 | Google Chrome Digital Credentials use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-13632 | Google Chrome DevTools inappropriate implementation | 5.4CISA ADP v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13631 | Google Chrome Google Updater inappropriate implementation | 8.8CISA ADP v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13630 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-13606 | Export All Posts WordPress plugin cross-site request forgery | 6.5CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13542 | DesignThemes LMS WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.4% | 2025-12-02 | Fix |
| CVE-2025-13534 | ELEX WordPress HelpDesk and Customer Ticketing System plugin privilege escalation | 8.8v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13516 | SureMail WordPress plugin unrestricted file upload | 8.1CNA v3.1 | 1.0% | 2025-12-02 | Fix |
| CVE-2025-13510 | Iskra iHUB and iHUB Lite has a missing authentication for critical function vulnerabilitiy | 9.3CNA v4.0 | 0.6% | 2025-12-02 | |
| CVE-2025-13505 | Stored XSS in Datateam's Datactive | 6.1v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13387 | Kadence WooCommerce Email Designer WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13372 | Django potential SQL injection in FilteredRelation column aliases on PostgreSQL | 4.3CISA ADP v3.1 | 0.9% | 2025-12-02 | Fix |
| CVE-2025-13353 | gokey allows secret recovery from a seed file without the master password | 7.1CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13295 | Sensitive data exposure in ArgusTech's BILGER | 7.5CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13140 | SurveyJS: Drag and Drop WordPress Form Builder plugin cross-site request forgery to Survey deletion | 4.3CNA v3.1 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-13090 | WP Directory Kit WordPress plugin authenticated (Admin+) SQL injection | 4.9CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13007 | WP Social Ninja WordPress plugin stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-13001 | Donation WordPress plugin Admin+ SQLi | 4.1CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-13000 | DB Access AJAX action SQL injection | 7.7CISA ADP v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-12630 | Upload.am File Hosting VPN WordPress plugin Contributor+ arbitrary option disclosure | 4.9CISA ADP v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-12529 | Cost Calculator Builder WordPress plugin unauthenticated arbitrary file deletion | 8.8CNA v3.1 | 0.6% | 2025-12-02 | Fix |
| CVE-2025-12483 | Visualizer: Tables and Charts Manager for WordPress plugin SQL injection | 6.5CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-12465 | Blind SQL injection in QuickCMS | 8.6CNA v4.0 | 0.3% | 2025-12-02 | |
| CVE-2025-11789 | Out-of-bounds read vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 7.5v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-11788 | Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-11787 | Command injection vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 8.8v3.1 | 1.0% | 2025-12-02 | |
| CVE-2025-11786 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-11785 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-11784 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-11783 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.6% | 2025-12-02 | |
| CVE-2025-11782 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-11781 | SGE-PLC1000 SGE-PLC50 Circutor hard-coded cryptographic key | 7.8v3.1 | 0.1% | 2025-12-02 | |
| CVE-2025-11780 | Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.3% | 2025-12-02 | |
| CVE-2025-11779 | Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 1.3% | 2025-12-02 | |
| CVE-2025-11778 | Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/Sge-plc50 | 9.8v3.1 | 0.4% | 2025-12-02 | |
| CVE-2025-11726 | Beaver Builder WordPress plugin missing authorization | 4.3CNA v3.1 | 0.3% | 2025-12-02 | Fix |
| CVE-2025-10971 | FERMAX ELECTRÓNICA S.A.U MeetMe insecure storage of sensitive information | 8.8CNA v4.0 | 0.1% | 2025-12-02 | |
| CVE-2025-10543 | Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes | 6.3CNA v4.0 | 0.2% | 2025-12-02 | Fix |
| CVE-2025-66448 | vLLM vulnerable to remote code execution via transformers_utils/get_config | 7.1CNA v3.1 | 0.7% | 2025-12-01 | Fix |
| CVE-2025-66415 | fastify-reply-from bypass of reply forwarding | 6.9CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66412 | Angular stored XSS vulnerability via SVG Animation, SVG URL and MathML attributes | 8.5CNA v4.0 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66410 | Gin-vue-admin has an arbitrary file deletion | 8.7CNA v4.0 | 0.6% | 2025-12-01 | Fix |
| CVE-2025-66405 | Portkey.ai Gateway: Server-side request forgery (SSRF) in Custom host | 6.9CNA v4.0 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66403 | FileRise vulnerable to stored XSS via SVG upload | 4.6CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66401 | MCP Watch cloneRepo function OS command injection | 9.8CNA v3.1 | 2.2% | 2025-12-01 | |
| CVE-2025-66400 | mdast-util-to-hast unsanitized class attribute | 6.9CNA v4.0 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-66313 | ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter | 5.1CNA v4.0 | 0.4% | 2025-12-01 | |
| CVE-2025-66312 | Grav admin plugin stored cross-site scripting | 6.2CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66311 | Grav admin plugin stored cross-site scripting | 6.2CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66310 | Grav admin plugin stored cross-site scripting | 6.2CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66309 | Grav admin plugin reflected cross-site scripting | 6.2CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66308 | Grav Admin plugin site configuration taxonomies field stored cross-site scripting | 6.8CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-66307 | Grav Admin plugin vulnerable to User Enumeration and email disclosure | 6.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-66306 | Grav vulnerable to information disclosure via IDOR in Grav Admin Panel | 4.3CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-66305 | Grav vulnerable to denial of service via Improper Input Handling in Supported parameter | 6.9CNA v4.0 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66304 | Grav exposes Password Hashes leading to privilege escalation | 6.2CNA v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66303 | Grav is vulnerable to a DOS on the admin panel | 4.9CNA v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66302 | Grav vulnerable to path traversal allowing server files backup | 6.8CNA v3.1 | 0.5% | 2025-12-01 | Fix |
| CVE-2025-66301 | Grav page YAML frontmatter form processing improper authorization | 8.6CNA v4.0 | 1.3% | 2025-12-01 | MetasploitExploit codeKCVFix |
| CVE-2025-66300 | Grav is vulnerable to arbitrary file read | 8.5CNA v3.1 | 0.5% | 2025-12-01 | Fix |
| CVE-2025-66299 | Security sandbox bypass with SSTI (server side template injection) in the Grav CMS | 8.8CNA v3.1 | 0.6% | 2025-12-01 | Fix |
| CVE-2025-66298 | Grav is vulnerable to server-side template injection (SSTI) via forms | 7.7CNA v4.0 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-66297 | Grav vulnerable to privilege escalation and authenticated remote code execution via Twig injection | 7.4CNA v4.0 | 0.8% | 2025-12-01 | Fix |
| CVE-2025-66296 | Grav Admin plugin user creation privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-66295 | Grav vulnerable to path traversal / arbitrary YAML write | 8.8CNA v3.1 | 0.6% | 2025-12-01 | Fix |
| CVE-2025-66294 | Grav is vulnerable to RCE via SSTI through Twig sandbox bypass | 8.7CNA v4.0 | 2.8% | 2025-12-01 | MetasploitExploit codeKCVFix |
| CVE-2025-66206 | Frappe vulnerable to a path traversal allowing reading certain files | 6.8CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-66205 | Frappe has the possibility of SQL injection due to improper validations | 7.1CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-65840 | PublicCMS cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-65838 | PublicCMS path traversal | 7.5v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-65836 | PublicCMS server-side request forgery | 9.1CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-65622 | Snipe-IT allows stored XSS via the Locations Country field | 5.4v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-65621 | Snipe-IT is vulnerable to stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-65408 | LIVE555 Streaming Media null pointer dereference | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-65407 | LIVE555 Streaming Media MPEG1or2Demux::newElementaryStream function use-after-free | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-65406 | LIVE555 Streaming Media heap-based buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-65405 | LIVE555 Streaming Media use-after-free | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-65404 | LIVE555 Streaming Media getSideInfo2 function buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-65403 | hfiref0x LightFTP g_cfg.MaxUsers component buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-64775 | Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) | 7.5CISA ADP v3.1 | 1.5% | 2025-12-01 | Fix |
| CVE-2025-64772 | Sony INZONE Hub uncontrolled search path | 8.4CNA v4.0 | 0.2% | 2025-12-01 | |
| CVE-2025-64030 | Chinasystems Eximbills Enterprise cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63535 | Shridharshukl Blood Bank Management System SQL injection | 8.8NVD v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-63534 | Shridharshukl Blood Bank Management System cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63533 | Shridharshukl Blood Bank Management System cross-site scripting | 5.4NVD v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63532 | Shridharshukl Blood Bank Management System SQL injection | 8.8NVD v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-63531 | Shridharshukl Blood Bank Management System SQL injection | 9.8v3.1 | 0.6% | 2025-12-01 | |
| CVE-2025-63529 | Shridharshukl Blood Bank Management System session fixation | 8.8v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-63528 | Shridharshukl Blood Bank Management System cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-63527 | Shridharshukl Blood Bank Management System cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-63526 | Shridharshukl Blood Bank Management System cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-63525 | Shridharshukl Blood Bank Management System improper access control | 8.8NVD v3.1 | 0.5% | 2025-12-01 | |
| CVE-2025-63523 | FeehiCMS fails to enforce server-side immutability | 6.5v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-63522 | FeehiCMS is vulnerable to reverse tabnabbing | 4.6CISA ADP v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63520 | FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function | 6.1CISA ADP v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63365 | Epub File Reader path traversal | 7.1CISA ADP v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-63317 | Doist Todoist cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-63095 | Tempus-ex Hello-video-codec improper input validation | 6.5CISA ADP v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-61619 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61618 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61617 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61610 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61609 | UNISOC chipsets modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61608 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61607 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-61229 | Shirt-pocket Superduper! incorrect default permissions | 7.8v3.1 | 0.1% | 2025-12-01 | Exploit codeFix |
| CVE-2025-61228 | Shirt-pocket Superduper! download without integrity check | 7.8CISA ADP v3.1 | 0.1% | 2025-12-01 | Fix |
| CVE-2025-59789 | Apache bRPC: Stack exhaustion via Unbounded Recursion in JSON parser | 7.5CISA ADP v3.1 | 1.6% | 2025-12-01 | Fix |
| CVE-2025-58408 | GPU Ddk KASAN read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code | 5.9CISA ADP v3.1 | 0.1% | 2025-12-01 | Fix |
| CVE-2025-58044 | JumpServer has an open redirect | 5.5CNA v4.0 | 0.5% | 2025-12-01 | NucleiFix |
| CVE-2025-57489 | Shirt-pocket Superduper! privilege escalation | 8.1CISA ADP v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-55749 | The XWiki Jetty package (XJetty) allows accessing any application file through URL | 8.7CNA v4.0 | 1.5% | 2025-12-01 | NucleiFix |
| CVE-2025-55222 | Socomec DIRIS Digiware M-70 denial of service | 7.5v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-55221 | Socomec DIRIS Digiware M-70 denial of service | 7.5v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-54851 | Socomec DIRIS Digiware M-70 denial of service | 7.5CNA v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-54850 | Socomec DIRIS Digiware M-70 denial of service | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-54849 | Socomec DIRIS Digiware M-70 denial of service | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-54848 | Socomec DIRIS Digiware M-70 denial of service | 7.5CNA v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-51683 | mJobTime A blind SQL injection | 9.8CISA ADP v3.1 | 2.0% | 2025-12-01 | Nuclei |
| CVE-2025-51682 | mJobTime client-side enforcement of server-side security | 9.8CISA ADP v3.1 | 1.6% | 2025-12-01 | |
| CVE-2025-49643 | Frontend DoS vulnerability due to asymmetric resource consumption | 6.0CNA v4.0 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-49642 | Zabbix agent builds for AIX vulnerable to library loading hijacking | 5.8CNA v4.0 | 0.1% | 2025-12-01 | |
| CVE-2025-41739 | CODESYS Control Linux/QNX SysSocket flaw | 5.9CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-41738 | CODESYS Control Invalid type usage in visualization | 7.5CNA v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-41700 | CODESYS Development System deserialization of untrusted data | 7.8CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-41070 | Reflected cross-site scripting (XSS) in Sanoma's Clickedu | 4.8CNA v4.0 | 0.3% | 2025-12-01 | |
| CVE-2025-34297 | KissFFT integer overflow heap buffer overflow via kiss_fft_alloc | 8.6CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-27232 | Frontend arbitrary file read in oauth.authorize action | 6.8CNA v4.0 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-26858 | Socomec DIRIS Digiware M-70 Modbus TCP functionality buffer overflow | 7.5v3.1 | 0.6% | 2025-12-01 | Fix |
| CVE-2025-23417 | Socomec DIRIS Digiware M-70 Modbus RTU over TCP functionality denial of service | 7.5v3.1 | 0.5% | 2025-12-01 | Fix |
| CVE-2025-20085 | Socomec DIRIS Digiware M-70 Modbus RTU over TCP functionality denial of service | 6.5NVD v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-13837 | Python CPython Out-of-memory when loading Plist | 2.1CNA v4.0 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-13836 | Python CPython excessive read buffering DoS in http.client | 6.3CNA v4.0 | 1.6% | 2025-12-01 | Fix |
| CVE-2025-13835 | Arconix Shortcodes WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-13829 | Data Illusion Zumbrunn NGSurvey incorrect authorization | 8.6CNA v4.0 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-13819 | Open redirect in web server of MiR robots and MiR Fleet | 6.1CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-13816 | moxi159753 Mogu Blog v2 ZIP file unzipFile FileOperation.unzip path traversal | 8.8v3.1 | 0.6% | 2025-12-01 | |
| CVE-2025-13815 | moxi159753 Mogu Blog v2 pictures unrestricted upload | 9.8v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-13814 | moxi159753 Mogu Blog picture upload by URL server-side request forgery | 9.8v3.1 | 0.5% | 2025-12-01 | |
| CVE-2025-13813 | moxi159753 Mogu Blog v2 Storage Management endpoint storage authorization | 8.1v3.1 | 0.5% | 2025-12-01 | |
| CVE-2025-13811 | jsnjfz WebStack-Guns PageFactory.java SQL injection | 7.2v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-13810 | jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal | 7.5v3.1 | 1.0% | 2025-12-01 | |
| CVE-2025-13809 | orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery | 6.5NVD v3.1 | 0.3% | 2025-12-01 | |
| CVE-2025-13808 | orionsec orion-ops User Profile UserController.java update improper authorization | 8.8NVD v3.1 | 0.5% | 2025-12-01 | |
| CVE-2025-13807 | orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization | 4.3NVD v3.1 | 0.4% | 2025-12-01 | |
| CVE-2025-13806 | nutzam NutzBoot Transaction API EthModule.java improper authorization | 9.8v3.1 | 0.5% | 2025-12-01 | |
| CVE-2025-13805 | nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization | 6.3CNA v4.0 | 0.4% | 2025-12-01 | |
| CVE-2025-13804 | nutzam NutzBoot Ethereum Wallet EthModule.java information disclosure | 5.3CNA v4.0 | 0.3% | 2025-12-01 | |
| CVE-2025-13803 | MediaCrush header paths.py HTTP headers for scripting syntax | 6.9CNA v4.0 | 0.3% | 2025-12-01 | |
| CVE-2025-13802 | jairiidriss RestaurantWebsite Make a Reservation cross-site scripting | 5.3CNA v4.0 | 0.3% | 2025-12-01 | |
| CVE-2025-13800 | ADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection | 9.8v3.1 | 9.4% | 2025-12-01 | |
| CVE-2025-13799 | ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injection | 9.8v3.1 | 9.4% | 2025-12-01 | |
| CVE-2025-13798 | ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injection | 9.8v3.1 | 7.1% | 2025-12-01 | |
| CVE-2025-13797 | ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection | 9.8v3.1 | 7.1% | 2025-12-01 | |
| CVE-2025-13796 | deco-cx apps parameter analyticsScript.ts AnalyticsScript server-side request forgery | 5.3CNA v4.0 | 0.3% | 2025-12-01 | Exploit codeFix |
| CVE-2025-13653 | floragunn Search Guard FLX data streams incorrect authorization | 4.3CNA v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-13296 | CSRF in Tekrom Technology's T-Soft E-Commerce | 5.4CNA v3.1 | 0.1% | 2025-12-01 | |
| CVE-2025-13129 | Business logic error in Seneka Software's Onaylarım | 4.3CNA v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-12756 | Insecure direct object reference in Mattermost Boards plugin enables Unauthorised Comment Deletion | 4.3CNA v3.1 | 0.2% | 2025-12-01 | |
| CVE-2025-12106 | OpenVPN buffer over-read | 9.1CISA ADP v3.1 | 0.6% | 2025-12-01 | Fix |
| CVE-2025-11772 | Synaptics Fingerprint Driver Co-Installer privilege escalation | 6.6CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-11699 | nopSolutions nopCommerce insufficient session expiration | 7.1CISA ADP v3.1 | 0.4% | 2025-12-01 | Fix |
| CVE-2025-11133 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-11132 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-11131 | UNISOC chipsets nr modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-10101 | Avast Antivirus heap buffer OOB read when scanning a malformed Mach-O file | 7.8CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-8351 | Avira Antivirus engine heap buffer OOB read when scanning a malformed file | 7.8CNA v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-8045 | Mali GPU Kernel Driver allows improper GPU processing operations | 4.0CISA ADP v3.1 | 0.2% | 2025-12-01 | Exploit codeFix |
| CVE-2025-7007 | Null pointer dereference in Avast Antivirus on macOS or Linux | 7.5CNA v3.1 | 0.1% | 2025-12-01 | |
| CVE-2025-6349 | Mali GPU Kernel Driver allows improper GPU memory processing operations | 5.1CISA ADP v3.1 | 0.2% | 2025-12-01 | Fix |
| CVE-2025-3500 | Integer overflow in Avast Antiviurs on Windows may result in privilege escalation | 9.8v3.1 | 0.5% | 2025-12-01 | Exploit codeFix |
| CVE-2025-3012 | UNISOC chipsets dpc modem crash | 7.5CNA v3.1 | 0.3% | 2025-12-01 | Fix |
| CVE-2025-2879 | Mali GPU Kernel Driver allows improper GPU processing operations | 5.1CISA ADP v3.1 | 0.1% | 2025-12-01 | Fix |