CVE-2025 records published after 2025
This page lists the 5,305 CVE-2025 records published after 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists nine of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 65612.4% of these records
- Listed in CISA KEV
- 90.2% of these records
- Reported exploited
- 110.2% of these records
- Detection signal
- 500.9% of these records
- Exploit code
- 1422.7% of these records
- Actionable vendor fix
- 3,42864.6% of these records
Figures as of 2026-10-24 13:47 UTC. Records published after 2025 have had from less than a month to about 10 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-58403 | Reflected cross-site scripting (XSS) in CGM CLININET | 5.1CNA v4.0 | 0.5% | 2026-10-23 | |
| CVE-2025-45528 | Nitro PDF Pro for macOS arbitrary code execution | – | – | 2026-10-23 | |
| CVE-2025-30054 | Local privilege escalation in CGM CLININET | 9.3CNA v4.0 | 0.1% | 2026-10-23 | |
| CVE-2025-30053 | Missing authentication in CGM CLININET | 6.9CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2025-30052 | Authentication bypass via IP spoofing in CGM CLININET rsyncd | 8.8CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2025-30051 | Insecure file permissions in CGM CLININET | 6.8CNA v4.0 | 0.1% | 2026-10-23 | |
| CVE-2025-30050 | Remote code execution in CGM CLININET | 9.4CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2025-30049 | CGM CLININET weak password hash | 8.2CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2025-30047 | Remote code execution via Java deserialization in CGM CLININET | 9.4CNA v4.0 | 0.4% | 2026-10-23 | |
| CVE-2025-30046 | Remote code execution in CGM CLININET | 9.0CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2025-30045 | Code injection in CGM CLININET | 8.6CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2025-30043 | Missing authentication in CGM CLININET | 7.1CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2025-71434 | Weaver E-cology Unauthenticated SQL injection via doc/out/more/list | 8.8CNA v4.0 | 0.3% | 2026-10-22 | Reported exploitedFix |
| CVE-2025-69723 | localstack v4.9.2 reflected cross-site scripting | – | 0.1% | 2026-10-22 | |
| CVE-2025-65200 | localstack _localstack/cloudformation/deploy endpoint vulnerability | – | 0.2% | 2026-10-22 | |
| CVE-2025-71438 | gf_odf_ac4_cfg_dsi_v1 An out-of-bounds read | – | 0.2% | 2026-10-21 | |
| CVE-2025-71437 | Astral uv path traversal via Symlinks in Sdist Tar Extraction | 8.7CNA v4.0 | 0.3% | 2026-10-21 | Fix |
| CVE-2025-60497 | GPAC MP4Box GetESD function denial of service | 5.5CISA ADP v3.1 | 0.2% | 2026-10-21 | |
| CVE-2025-60493 | GPAC Project MP4Box check_media_profile function denial of service | – | 0.2% | 2026-10-21 | |
| CVE-2025-60492 | gf_bifs_dec_node function A stack-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-10-21 | |
| CVE-2025-60491 | dasher_flush_segment function heap use-after-free | – | 0.2% | 2026-10-21 | |
| CVE-2025-60490 | gf_filter_pid_send_event_downstream function heap use-after-free | – | 0.2% | 2026-10-21 | |
| CVE-2025-60489 | dasher_insert_timeline_entry function null pointer dereference | – | 0.2% | 2026-10-21 | |
| CVE-2025-60487 | A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. | – | 0.2% | 2026-10-21 | |
| CVE-2025-60479 | StatSFVec2f function null pointer dereference | – | 0.2% | 2026-10-21 | |
| CVE-2025-60478 | gf_filter_packet_destroy function use-after-free | – | 0.2% | 2026-10-21 | |
| CVE-2025-60476 | gf_odf_ac4_cfg_clean_list function heap use-after-free | – | 0.2% | 2026-10-21 | |
| CVE-2025-60469 | gf_ac4_presentation_ch_mode function null pointer dereference | – | 0.2% | 2026-10-21 | |
| CVE-2025-55702 | Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request | 7.0CNA v4.0 | 0.3% | 2026-10-21 | Fix |
| CVE-2025-31699 | Apache Traffic Server HTTP request smuggling | 9.1CNA v4.0 | 0.3% | 2026-10-21 | Fix |
| CVE-2025-0326 | Improper Token Revocation in WSO2 Identity Server allows unauthorized access | – | 0.1% | 2026-10-21 | Fix |
| CVE-2025-71436 | Raptor RDF Syntax Library heap buffer overflow via Language Tag | 7.1CNA v4.0 | 0.5% | 2026-10-20 | |
| CVE-2025-60496 | GPAC Project MP4Box reframer_send_packet function denial of service | – | 0.2% | 2026-10-20 | |
| CVE-2025-60494 | GPAC MP4Box filter_core denial of service | – | 0.2% | 2026-10-20 | |
| CVE-2025-60475 | gf_ac4_parser_bs function buffer overflow | – | 0.2% | 2026-10-20 | |
| CVE-2025-60482 | gf_odf_ac4_cfg_clean_list function heap use-after-free | – | 0.2% | 2026-10-19 | |
| CVE-2025-60480 | gf_odf_ac4_cfg_alternative_info function heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-10-19 | |
| CVE-2025-55667 | GPAC MP4Box dump_isom_saps function denial of service | 5.5CISA ADP v3.1 | 0.2% | 2026-10-19 | |
| CVE-2025-55654 | gf_filter_pid_get_packet function use-after-free | 5.5CISA ADP v3.1 | 0.1% | 2026-10-19 | |
| CVE-2025-52290 | FFmpeg avpriv_h264_has_num_reorder_frames null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2026-10-19 | |
| CVE-2025-36252 | IBM TS4500 Tape Library insufficient session expiration | 6.3CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-36069 | IBM TS4500 Tape Library insufficient session expiration | 5.5CNA v3.1 | 0.1% | 2026-10-19 | Fix |
| CVE-2025-36061 | IBM TS4500 Tape Library denial of service | 6.5CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-13591 | WSO2 Identity Server authentication endpoint information disclosure | 5.3CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-13173 | WSO2 API Control Plane insufficient session expiration | 6.5CNA v3.1 | 0.1% | 2026-10-19 | Fix |
| CVE-2025-10149 | Arbitrary Operations via SCIM endpoints in multiple WSO2 Products enables User account takeover | 8.2CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-7203 | WSO2 Universal Gateway cleartext storage of sensitive information | 4.9CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-7043 | WSO2 API Manager missing authorization | 5.4CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-6623 | WSO2 API Manager cross-site scripting | 4.3CNA v3.1 | 0.2% | 2026-10-19 | Fix |
| CVE-2025-71435 | Coder Session Expiration Bypass via OIDC without Refresh Token | 2.3CNA v4.0 | 0.2% | 2026-10-17 | Fix |
| CVE-2025-66969 | OpenModSim integer overflow | 7.5CISA ADP v3.1 | 0.3% | 2026-10-16 | |
| CVE-2025-55653 | GPAC MP4Box gf_parse_lfrac function denial of service | 5.5CISA ADP v3.1 | 0.1% | 2026-10-16 | |
| CVE-2025-55640 | stbl_AddSize function heap-based buffer overflow | – | 0.2% | 2026-10-16 | |
| CVE-2025-52097 | InstantASP ltd cross-site scripting | – | 0.3% | 2026-10-16 | |
| CVE-2025-68404 | Vcs_pentest race condition authentication bypass vulnerability in QuRouter management interface | 7.5CNA v4.0 | 0.2% | 2026-10-15 | Fix |
| CVE-2025-68403 | Inadequate Steps to Confirm vulnerability in QuRouter | 4.6CNA v4.0 | 0.1% | 2026-10-15 | Fix |
| CVE-2025-66275 | QNAP Systems Video Station remote code execution via command injection | 7.7CNA v4.0 | 0.4% | 2026-10-15 | Fix |
| CVE-2025-66272 | QNAP Systems Video Station arbitrary file deletion and remote code execution | 7.7CNA v4.0 | 0.4% | 2026-10-15 | Fix |
| CVE-2025-29897 | QNAP Systems Qsync Central stack-based buffer overflow in qsyncsrv.cgi | 2.3CNA v4.0 | 0.3% | 2026-10-15 | Fix |
| CVE-2025-29896 | QNAP Systems Qsync Central null pointer dereference in qsyncsrv.cgi | 2.3CNA v4.0 | 0.3% | 2026-10-15 | Fix |
| CVE-2025-29895 | QNAP Systems Qsync Central null pointer dereference in qsyncsrv.cgi | 2.3CNA v4.0 | 0.3% | 2026-10-15 | Fix |
| CVE-2025-23390 | Fleet doesn’t validate a server’s certificate when connecting through SSH | 6.3CNA v3.1 | 0.2% | 2026-10-15 | Fix |
| CVE-2025-71433 | Kaneo missing authorization allows Cross-Workspace Data Access | 7.7CNA v4.0 | 0.6% | 2026-10-14 | Fix |
| CVE-2025-9373 | PeproDev Branches Map WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-10-14 | Fix |
| CVE-2025-58774 | AMI AptioV UEFI OOB write and buffer overflow | 8.3CNA v4.0 | 0.1% | 2026-10-13 | Fix |
| CVE-2025-58773 | AMI AptioV UEFI OOB write and buffer overflow | 7.1CNA v4.0 | 0.1% | 2026-10-13 | Fix |
| CVE-2025-58772 | AMI AptioV UEFI OOB write and buffer overflow | 8.2CNA v4.0 | 0.1% | 2026-10-13 | Fix |
| CVE-2025-58771 | AMI AptioV UEFI OOB write and buffer overflow | 7.1CNA v4.0 | 0.1% | 2026-10-13 | Fix |
| CVE-2025-57739 | Fortinet FortiMail SQL injection | 7.7CNA v3.1 | 0.3% | 2026-10-13 | Fix |
| CVE-2025-46773 | Fortinet FortiAnalyzer Cloud SQL injection | 7.9CNA v3.1 | 0.3% | 2026-10-13 | Fix |
| CVE-2025-71432 | Frappe ERPNext reflected XSS leading to account takeover | 8.6CNA v4.0 | 0.3% | 2026-10-12 | Fix |
| CVE-2025-71431 | Frappe LDAP injection via Unsanitized endpoint parameters | 6.3CNA v4.0 | 0.3% | 2026-10-12 | Fix |
| CVE-2025-71430 | Frappe stored XSS via Leaderboard User Names | 5.1CNA v4.0 | 0.2% | 2026-10-12 | Fix |
| CVE-2025-71429 | GPT-SoVITS OS command injection via UVR5 vr.py | 9.3CNA v4.0 | 2.9% | 2026-10-12 | |
| CVE-2025-27902 | IBM DB2 Recovery Expert for Linux, Unix and Windows information disclosure | 6.1CNA v3.1 | 0.2% | 2026-10-12 | Fix |
| CVE-2025-27897 | IBM DB2 Recovery Expert for Linux, Unix and Windows cross-site scripting | 6.1CNA v3.1 | 0.2% | 2026-10-12 | Fix |
| CVE-2025-27896 | IBM DB2 Recovery Expert for Linux, Unix and Windows cross-site scripting | 6.1CNA v3.1 | 0.2% | 2026-10-12 | Fix |
| CVE-2025-27895 | IBM DB2 Recovery Expert for Linux, UNIX and Windows cross-site scripting | 6.1CNA v3.1 | 0.2% | 2026-10-12 | Fix |
| CVE-2025-15703 | HireZoot WordPress plugin job specification settings stored cross-site scripting | 3.5CISA ADP v3.1 | 0.1% | 2026-10-12 | Fix |
| CVE-2025-61560 | CNCF Argo CD SessionManager race condition | 8.1CISA ADP v3.1 | 0.3% | 2026-10-09 | |
| CVE-2025-15700 | AWP Classifieds WordPress plugin Admin+ arbitrary file upload via ZIP import | 8.8CISA ADP v3.1 | 0.4% | 2026-10-09 | Fix |
| CVE-2025-14123 | Redux Framework Authenticated (Subscriber+) privilege escalation via Users extension | 6.8CNA v3.1 | 0.2% | 2026-10-09 | Fix |
| CVE-2025-71428 | Jivejdon SQL injection via username in userListAction | 6.9CNA v4.0 | 0.4% | 2026-10-08 | |
| CVE-2025-70522 | Fanvil x7a firmware request handler cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-10-07 | |
| CVE-2025-70521 | Fanvil x7a firmware management portal diagnostic ping tool command injection | 9.8CISA ADP v3.1 | 0.4% | 2026-10-07 | |
| CVE-2025-70520 | Fanvil x7a firmware websocket handler vulnerability | 9.8CISA ADP v3.1 | 0.4% | 2026-10-07 | |
| CVE-2025-70519 | Fanvil x7a firmware device log component vulnerability | 6.1CISA ADP v3.1 | 0.2% | 2026-10-07 | |
| CVE-2025-70518 | Fanvil x7a firmware management portal diagnostic ping tool command injection | 10.0CISA ADP v3.1 | 0.6% | 2026-10-07 | |
| CVE-2025-70517 | Fanvil x7a firmware request handler cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-10-07 | |
| CVE-2025-70516 | Fanvil x7a firmware websocket handler missing authentication | 9.1CISA ADP v3.1 | 0.3% | 2026-10-07 | |
| CVE-2025-70515 | Fanvil x7a firmware device log component vulnerability | 6.1CISA ADP v3.1 | 0.2% | 2026-10-07 | |
| CVE-2025-64393 | Veeam Backup and Replication deserialization of untrusted data | 9.4CNA v4.0 | 0.4% | 2026-10-07 | Fix |
| CVE-2025-64392 | Veeam Backup Enterprise Manager cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-10-07 | Fix |
| CVE-2025-64391 | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it. | 4.1CNA v4.0 | 0.1% | 2026-10-07 | Fix |
| CVE-2025-71384 | Dbit WIFI4 N300 /api/addStaticDHCP comment field stack-based buffer overflow | 6.7CISA ADP v3.1 | 0.2% | 2026-10-06 | Exploit code |
| CVE-2025-71383 | Dbit WIFI4 N300 management interface JSON parser denial of service | 9.8CISA ADP v3.1 | 0.4% | 2026-10-06 | |
| CVE-2025-45871 | LogicalDOC Enterprise WorkflowsDataServlet blind SQL injection | 8.1CISA ADP v3.1 | 0.3% | 2026-10-06 | |
| CVE-2025-15591 | Cross-site scripting (XSS) vulnerability identified in OpenText™ Content Management | 5.3CNA v4.0 | 0.3% | 2026-10-06 | Fix |
| CVE-2025-8352 | Denial of service vulnerability in ESET PROTECT On-Prem | 6.9CNA v4.0 | 0.3% | 2026-10-06 | Fix |
| CVE-2025-15643 | Adsmonetizer WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-10-05 | |
| CVE-2025-12828 | Ultra Addons Lite for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-10-03 | Fix |
| CVE-2025-71427 | Office-PowerPoint-MCP-Server path traversal via save_presentation and manage_image | 7.6CNA v4.0 | 0.3% | 2026-10-01 | |
| CVE-2025-41753 | WAGO 0751-9x01 path traversal in dynamically created BACnet File Objects | 9.3CNA v4.0 | 0.6% | 2026-10-01 | Fix |
| CVE-2025-31980 | HCL BigFix Service Management improper input validation | 4.3CNA v3.1 | 0.2% | 2026-10-01 | Fix |
| CVE-2025-14564 | Viable URL Media Uploader WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-09-30 | |
| CVE-2025-33207 | NVIDIA BlueField GA improper access control | 6.8CNA v3.1 | 0.2% | 2026-09-29 | Fix |
| CVE-2025-71426 | Contrast Coordinator Impersonation via Unauthenticated Recovery | 7.1CNA v4.0 | 0.1% | 2026-09-27 | Fix |
| CVE-2025-71425 | Contrast information disclosure via Logging | 8.5CNA v4.0 | 0.2% | 2026-09-27 | Fix |
| CVE-2025-71424 | Edgeless Systems Contrast Insecure Volume Mount | 5.1CNA v4.0 | 0.2% | 2026-09-27 | Fix |
| CVE-2025-71423 | Edgelesssys Contrast Workload Secrets information disclosure | 8.5CNA v4.0 | 0.2% | 2026-09-27 | Fix |
| CVE-2025-71422 | Contrast Insecure LUKS2 Persistent Storage | 6.9CNA v4.0 | 0.1% | 2026-09-27 | Fix |
| CVE-2025-51457 | D-Link DAP-2610 web interface command injection | 8.8CISA ADP v3.1 | 1.3% | 2026-09-25 | |
| CVE-2025-14814 | CSS and JavaScript Toolbox WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-09-25 | Fix |
| CVE-2025-14181 | PHP integer overflow to buffer overflow in soap HTTP parsing | 6.5CNA v3.1 | 0.3% | 2026-09-25 | Fix |
| CVE-2025-1218 | PHP various packet overreads in mysqlnd_writeprotocol.c | 3.4CNA v3.1 | 0.2% | 2026-09-25 | Fix |
| CVE-2025-32000 | HCL Sametime improper input validation | 4.3CNA v3.1 | 0.2% | 2026-09-24 | |
| CVE-2025-63564 | Moodle Socialwall plugin v.3.0 SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2026-09-23 | |
| CVE-2025-15696 | Real3D Flipbook Lite WordPress plugin Author+ stored XSS | 6.8CISA ADP v3.1 | 0.3% | 2026-09-23 | Fix |
| CVE-2025-36084 | IBM Concert weak cryptographic algorithm | 5.9CNA v3.1 | 0.2% | 2026-09-22 | Fix |
| CVE-2025-14487 | kamleshyadav Handily payment settings missing authorization | 5.3CNA v3.1 | 0.2% | 2026-09-22 | Fix |
| CVE-2025-14486 | PixelPlay WordPress plugin missing authorization unauthenticated arbitrary API Key deletion | 5.3CNA v3.1 | 0.2% | 2026-09-22 | |
| CVE-2025-14484 | Image Buzz WordPress plugin missing authorization unauthenticated arbitrary API Key modification | 5.3CNA v3.1 | 0.2% | 2026-09-22 | |
| CVE-2025-12767 | IBM Concert regular expression processing denial of service | 5.3CNA v3.1 | 0.4% | 2026-09-22 | Fix |
| CVE-2025-1281 | BM Content Builder WordPress plugin authenticated (Subscriber+) arbitrary file deletion | 8.8CNA v3.1 | 0.6% | 2026-09-22 | Fix |
| CVE-2025-1280 | BM Content Builder WordPress plugin authenticated (Subscriber+) arbitrary file read | 6.5CNA v3.1 | 0.5% | 2026-09-22 | Fix |
| CVE-2025-71421 | UVdesk core-framework privilege escalation via editAgent | 8.6CNA v4.0 | 0.4% | 2026-09-21 | Fix |
| CVE-2025-71420 | UVdesk core-framework authorization bypass via Saved Reply | 5.3CNA v4.0 | 0.3% | 2026-09-21 | Fix |
| CVE-2025-71419 | UVdesk core-framework stored XSS via SwiftMailer | 5.1CNA v4.0 | 0.2% | 2026-09-21 | Fix |
| CVE-2025-12999 | Eclipse Open VSX insufficient verification of data authenticity | 9.1CNA v4.0 | 0.3% | 2026-09-21 | |
| CVE-2025-15698 | Business Name Generator WordPress plugin Admin+ stored XSS via Button Color setting | 3.5CISA ADP v3.1 | 0.1% | 2026-09-19 | |
| CVE-2025-66455 | LMDeploy has remote code execution by Pickle deserialization | 9.8CNA v3.1 | 0.7% | 2026-09-18 | Fix |
| CVE-2025-61682 | SemanticMediaWiki semantic MediaWiki vulnerable to stored XSS | 8.6CNA v3.1 | 0.3% | 2026-09-18 | Fix |
| CVE-2025-53837 | xwiki-rendering org.xwiki.rendering:xwiki-rendering-xml has an eval injection issue | 9.9CNA v3.1 | 0.6% | 2026-09-18 | Fix |
| CVE-2025-36421 | IBM Controller cleartext transmission of sensitive information | 5.9CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-36178 | IBM Controller input validation bypass | 5.4CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-36147 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms web UI cross-site scripting | 6.1CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-36076 | IBM Cognos Analytics source code vulnerability | 4.3CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-36045 | IBM TS4300 Tape library addresses security vulnerability | 4.3CNA v3.1 | 0.3% | 2026-09-18 | Fix |
| CVE-2025-33147 | IBM Cognos Analytics network communication weak cryptographic algorithm | 5.9CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-33141 | IBM QRadar backup files information disclosure | 6.5CNA v3.1 | 0.3% | 2026-09-18 | Fix |
| CVE-2025-15399 | IBM Common Licensing cross-site request forgery | 10.0CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-14754 | IBM Cloud Pak for Data is vulnerable to OS command injection | 8.8CNA v3.1 | 0.4% | 2026-09-18 | Fix |
| CVE-2025-14753 | IBM Cloud Pak for Data is vulnerable to path traversal | 7.5CNA v3.1 | 0.5% | 2026-09-18 | Fix |
| CVE-2025-13882 | IBM Sterling Partner Engagement Manager email service denial of service | 5.3CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-13533 | CSS and JavaScript Toolbox WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-1350 | IBM Controller information disclosure | 5.3CNA v3.1 | 0.2% | 2026-09-18 | Fix |
| CVE-2025-59607 | Qualcomm Snapdragon untrusted pointer dereference in Windows Compute | 7.8CNA v3.1 | 0.1% | 2026-09-17 | Fix |
| CVE-2025-55787 | MailData Email Archiving System SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-09-17 | |
| CVE-2025-15697 | Dictionary WordPress plugin reflected XSS via Multiple parameters | 7.1CISA ADP v3.1 | 0.2% | 2026-09-17 | |
| CVE-2025-59953 | LMdeploy has remote code execution by Pickle deserialization | 9.8CNA v3.1 | 0.8% | 2026-09-16 | Fix |
| CVE-2025-56566 | MikroTik firmware non-volatile storage vulnerability | 4.6CISA ADP v3.1 | 0.2% | 2026-09-16 | |
| CVE-2025-56565 | TP-Link TL-WR740N DD-WRT firmware vulnerability | 7.6CISA ADP v3.1 | 0.2% | 2026-09-16 | |
| CVE-2025-56563 | sat_proxy.php in Zenith Satellite Tracker server-side request forgery | 9.8CISA ADP v3.1 | 0.4% | 2026-09-16 | |
| CVE-2025-43936 | Dell ObjectScale improper authentication | 8.1CNA v3.1 | 0.5% | 2026-09-16 | Fix |
| CVE-2025-36591 | Dell Elastic Cloud Storage (ECS) weak cryptographic algorithm | 4.4CNA v3.1 | 0.1% | 2026-09-16 | Fix |
| CVE-2025-14871 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.5% | 2026-09-16 | Fix |
| CVE-2025-66974 | Prolink 13A Smart Plug Wi-Fi provisioning denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-09-15 | |
| CVE-2025-13166 | Username Enumeration via SMS OTP Flow in WSO2 Identity Server allows User Account Discovery | 3.7CNA v3.1 | 0.2% | 2026-09-15 | Fix |
| CVE-2025-11395 | Red Hat Enterprise Linux 10 podman: Arbitrary file write when importing oci archive | 5.5CNA v3.1 | 0.4% | 2026-09-15 | Fix |
| CVE-2025-5802 | WSO2 Identity Server self-registration flow vulnerability | 5.3CNA v3.1 | 0.3% | 2026-09-15 | Fix |
| CVE-2025-68624 | N-able Mail Assure authentication bypass by spoofing | 4.3CNA v3.1 | 0.3% | 2026-09-14 | Fix |
| CVE-2025-64031 | libarchive heap-based buffer overflow | 2.5CNA v3.1 | 0.2% | 2026-09-14 | Fix |
| CVE-2025-26790 | WithSecure Atlant out-of-bounds read | 3.7CNA v3.1 | 0.3% | 2026-09-14 | Fix |
| CVE-2025-24890 | GitoxideLabs gitoxide gix-sec safe.directory protections absent for elevated administrators | 6.8CNA v3.1 | 0.2% | 2026-09-14 | Fix |
| CVE-2025-70820 | Zettlab D6 Ultra absolute path traversal | 3.5CNA v3.1 | 0.2% | 2026-09-13 | Fix |
| CVE-2025-70819 | Zettlab D6 Ultra path traversal | 6.3CNA v3.1 | 0.1% | 2026-09-13 | Fix |
| CVE-2025-64059 | getgrav grav cross-site scripting | 1.8CNA v3.1 | 0.3% | 2026-09-13 | |
| CVE-2025-63842 | Repetico web backend cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-09-13 | |
| CVE-2025-45480 | projectfloodlight Floodlight incorrect resource transfer | 3.0CNA v3.1 | 0.2% | 2026-09-13 | |
| CVE-2025-69904 | Linkstack path traversal | 4.9CISA ADP v3.1 | 0.4% | 2026-09-11 | |
| CVE-2025-15695 | GTranslate WordPress plugin Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.1% | 2026-09-11 | Fix |
| CVE-2025-15679 | BMC root account active without password on BullSequana XH3406 and XH3515 | 7.3CNA v4.0 | 0.1% | 2026-09-11 | Fix |
| CVE-2025-57231 | avatar attachments in Docmost v0.21.0 path traversal | 7.5CISA ADP v3.1 | 1.8% | 2026-09-10 | NucleiExploit code |
| CVE-2025-71418 | PocketMine-MP denial of service via explode | 6.9CNA v4.0 | 0.4% | 2026-09-09 | Fix |
| CVE-2025-71417 | PocketMine-MP denial of service via ResourcePackClientResponsePacket | 7.1CNA v4.0 | 0.3% | 2026-09-09 | Fix |
| CVE-2025-51619 | Thesycon DPC Latency Checker dpc.sys driver denial of service | 5.5CISA ADP v3.1 | 0.1% | 2026-09-09 | |
| CVE-2025-46808 | Sensitive information is leaked into NeuVector’s manager container logs | 6.8CNA v3.1 | 0.2% | 2026-09-09 | Fix |
| CVE-2025-15690 | Content Mask - Contributor+ stored XSS via Post scripts and Styles | 6.8CISA ADP v3.1 | 0.3% | 2026-09-09 | Fix |
| CVE-2025-7062 | Stored cross-site scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education | 5.2CNA v4.0 | 0.3% | 2026-09-09 | Fix |
| CVE-2025-3271 | DOM-based XSS vulnerability in OpenText™ Documentum Webtop | 4.8CNA v4.0 | 0.2% | 2026-09-09 | Fix |
| CVE-2025-64868 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64866 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64854 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64838 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64830 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64618 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64610 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64589 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64588 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64584 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-64542 | Adobe Experience Manager cross-site scripting (DOM-based XSS) | 5.4CNA v3.1 | 0.3% | 2026-09-08 | Fix |
| CVE-2025-52657 | HCL MyXalytics denial of service | 3.5CNA v3.1 | 0.2% | 2026-09-07 | |
| CVE-2025-52652 | HCL MyXalytics content spoofing | 3.5CNA v3.1 | 0.1% | 2026-09-07 | |
| CVE-2025-52651 | HCL MyXalytics improper input validation | 3.5CNA v3.1 | 0.1% | 2026-09-07 | |
| CVE-2025-15694 | Joli Table Of Contents - Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.2% | 2026-09-05 | Fix |
| CVE-2025-15693 | JCH Optimize - Admin+ path traversal | 2.7CISA ADP v3.1 | 0.3% | 2026-09-05 | Fix |
| CVE-2025-15647 | CDT out-of-bounds read via opposedVertexInd | 6.8CNA v4.0 | 0.3% | 2026-09-05 | Fix |
| CVE-2025-15614 | ugrep heap buffer over-read via .Z decompression | 4.8CNA v4.0 | 0.1% | 2026-09-05 | Fix |
| CVE-2025-14945 | Events Manager WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-09-05 | Fix |
| CVE-2025-9049 | Nokri Job Board WordPress theme missing authorization authenticated privilege escalation | 8.8CNA v3.1 | 0.2% | 2026-09-05 | Fix |
| CVE-2025-67066 | oasys sysoa version SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2026-09-04 | |
| CVE-2025-15691 | WPFunnels WordPress plugin unauthenticated user Registration via Opt-in Forms | 5.3CISA ADP v3.1 | 0.2% | 2026-09-04 | Fix |
| CVE-2025-12737 | WSO2 Open Banking AM Carbon Console administrative operations OS command injection | 8.4CNA v3.1 | 0.2% | 2026-09-03 | Fix |
| CVE-2025-46418 | Westermo WeOS OS command injection | 7.6CNA v3.1 | 0.7% | 2026-09-02 | |
| CVE-2025-15692 | Icegram Express WordPress plugin Admin+ stored XSS | 3.5CNA v3.1 | 0.2% | 2026-09-02 | Fix |
| CVE-2025-15664 | Ultimate WordPress plugin cross-site scripting | 6.8CISA ADP v3.1 | 0.3% | 2026-09-02 | Fix |
| CVE-2025-15663 | Ultimate WordPress plugin cross-site scripting | 6.8CISA ADP v3.1 | 0.3% | 2026-09-02 | Fix |
| CVE-2025-15490 | Passster WordPress plugin Global Protection bypass | 5.3CNA v3.1 | 0.2% | 2026-09-02 | Fix |
| CVE-2025-15489 | Passster WordPress plugin password Protection bypass | 5.3CNA v3.1 | 0.2% | 2026-09-02 | Fix |
| CVE-2025-15485 | Auto x LINE Unauthenticated REST API Endpoints Call | 8.2CNA v3.1 | 0.2% | 2026-09-02 | |
| CVE-2025-15481 | Notification Bar for WordPress Unauthenticated Subscriber data disclosure | 5.3CNA v3.1 | 0.2% | 2026-09-02 | |
| CVE-2025-9314 | Developer Tools unauthenticated arbitrary file upload | 9.8CNA v3.1 | 0.3% | 2026-09-02 | |
| CVE-2025-8945 | Wp Edit Password Protected WordPress plugin Protection bypass via REST API | 5.3CNA v3.1 | 0.2% | 2026-09-02 | Fix |
| CVE-2025-7963 | Easy Waveform Player WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-09-02 | Fix |
| CVE-2025-15613 | Kyverno SSRF via Service Call | 6.9CNA v4.0 | 0.3% | 2026-09-01 | Fix |
| CVE-2025-12768 | FactoryTalk® Historian Machine Edition out-of-bounds write | 8.6CNA v4.0 | 0.3% | 2026-09-01 | |
| CVE-2025-63607 | TechStore contact_display cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2026-08-31 | |
| CVE-2025-64649 | IBM Concert improper certificate validation | 5.9CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2025-36290 | IBM Integrated Analytics System JWT service improper certificate validation | 5.9CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2025-36271 | IBM Integrated Analytics System is affected by a predictable salt vulnerability in Magneto component | 5.9CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2025-62343 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 3.1CNA v3.1 | 0.2% | 2026-08-27 | |
| CVE-2025-62342 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 6.4CNA v3.1 | 0.2% | 2026-08-27 | |
| CVE-2025-30156 | Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery | 8.9CNA v3.1 | 0.1% | 2026-08-27 | Fix |
| CVE-2025-70340 | ThingsBoard Professional Edition missing authorization | 6.5CISA ADP v3.1 | 0.2% | 2026-08-26 | |
| CVE-2025-70293 | Denx U-Boot ext4fs_get_bgdtable function integer overflow | 9.8CISA ADP v3.1 | 0.8% | 2026-08-26 | Fix |
| CVE-2025-70290 | Denx U-Boot ZFS filesystem support integer overflow | 9.8CISA ADP v3.1 | 0.7% | 2026-08-26 | Fix |
| CVE-2025-62341 | HCL Connections is vulnerable to server-side request forgery (SSRF) | 3.7CNA v3.1 | 0.1% | 2026-08-26 | |
| CVE-2025-61480 | Vanderbilt Industries Acre Security SPC5300 Main Board denial of service | 7.5CISA ADP v3.1 | 0.1% | 2026-08-26 | |
| CVE-2025-61479 | Vanderbilt Industries Acre Security SPC5300 Main Board SPC Connect Pro software vulnerability | 7.5CISA ADP v3.1 | 0.2% | 2026-08-26 | |
| CVE-2025-61478 | Vanderbilt Industries Acre Security SPC5300 Main Board denial of service | 7.5CISA ADP v3.1 | 0.3% | 2026-08-26 | |
| CVE-2025-61165 | Cohere North AI batch upload endpoint unrestricted file upload | 9.8CISA ADP v3.1 | 0.4% | 2026-08-26 | |
| CVE-2025-61164 | Cohere North AI WebSocket endpoint information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2026-08-26 | Fix |
| CVE-2025-61163 | Cohere North AI cross-origin request handling permissive cross-domain policy | 9.8CISA ADP v3.1 | 0.3% | 2026-08-26 | Fix |
| CVE-2025-61162 | Cohere North AI user info API endpoint improper access control | 7.5CISA ADP v3.1 | 0.2% | 2026-08-26 | Fix |
| CVE-2025-56798 | Lime Technology cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-08-26 | |
| CVE-2025-51679 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior. | 9.1CISA ADP v3.1 | 0.4% | 2026-08-26 | |
| CVE-2025-51675 | OpenRISC OR1200 program counter update denial of service | 7.5CISA ADP v3.1 | 0.3% | 2026-08-26 | |
| CVE-2025-29419 | CTFd man-in-the-middle | 7.1CISA ADP v3.1 | 0.2% | 2026-08-26 | |
| CVE-2025-10903 | Loop with unreachable exit condition (infinite loop) in GitLab | 6.5CNA v3.1 | 0.4% | 2026-08-26 | Fix |
| CVE-2025-9878 | PPWP WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-08-25 | Fix |
| CVE-2025-68833 | HCL Hive is affected by use of a cryptographic primitive with a risky implementation | 5.3CNA v3.1 | 0.2% | 2026-08-24 | |
| CVE-2025-68825 | HCL Hive is affected by incorrect default permissions | 7.5CNA v3.1 | 0.2% | 2026-08-24 | |
| CVE-2025-63080 | Authenticated RCE in KAON PG5298 | 8.5CNA v4.0 | 0.3% | 2026-08-24 | Fix |
| CVE-2025-36940 | Google Android zircon kernel pager proxy use-after-free | 8.8CISA ADP v3.1 | 0.2% | 2026-08-24 | Fix |
| CVE-2025-36939 | Google Nest stack-based buffer overflow | 10.0CNA v4.0 | 0.2% | 2026-08-24 | Fix |
| CVE-2025-26238 | D-Link DI-8100G msp_info code injection | 8.1CISA ADP v3.1 | 0.2% | 2026-08-24 | |
| CVE-2025-26237 | D-Link DI-7001 MINI_5G msp_info command injection | 8.1CISA ADP v3.1 | 0.2% | 2026-08-24 | |
| CVE-2025-15671 | Welcart e-Commerce WordPress plugin session fixation via uscesid parameter | 5.4CISA ADP v3.1 | 0.3% | 2026-08-21 | Fix |
| CVE-2025-62307 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 5.4CNA v3.1 | 0.3% | 2026-08-20 | |
| CVE-2025-62306 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 5.0CNA v3.1 | 0.3% | 2026-08-20 | |
| CVE-2025-62300 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 5.9CNA v3.1 | 0.2% | 2026-08-20 | |
| CVE-2025-62299 | HCL IntelliOps Event Management is affected by multiple security vulnerabilities | 6.6CNA v3.1 | 0.3% | 2026-08-20 | |
| CVE-2025-53999 | Altair WordPress theme broken access control | 6.5CNA v3.1 | 0.3% | 2026-08-20 | |
| CVE-2025-52182 | The Library Corporation LS2 Admin information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2026-08-20 | |
| CVE-2025-15689 | Capella WordPress theme privilege escalation | 9.8CNA v3.1 | 0.5% | 2026-08-20 | |
| CVE-2025-15688 | Capella WordPress theme SQL injection | 9.3CNA v3.1 | 0.4% | 2026-08-20 | |
| CVE-2025-15637 | Shuffle WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-08-20 | Fix |
| CVE-2025-14602 | Weak File Name Generation in vsDesk | 5.3CNA v4.0 | 0.5% | 2026-08-20 | |
| CVE-2025-14601 | vsDesk Task Scheduler OS command injection | 8.6CNA v4.0 | 1.1% | 2026-08-20 | |
| CVE-2025-36398 | IBM DS8900F and DS8A00 information disclosure | 5.4CNA v3.1 | 0.3% | 2026-08-19 | Fix |
| CVE-2025-36255 | IBM DS8900F and DS8A00 privilege escalation | 7.5CNA v3.1 | 0.2% | 2026-08-19 | Fix |
| CVE-2025-36254 | IBM DS8900F and DS8A00 authentication bypass | 7.4CNA v3.1 | 0.5% | 2026-08-19 | Fix |
| CVE-2025-14603 | vsDesk SQL injection | 8.8CNA v4.0 | 0.4% | 2026-08-19 | |
| CVE-2025-14600 | Admin account takeover via path traversal in vsDesk | 9.3CNA v4.0 | 0.5% | 2026-08-19 | |
| CVE-2025-11729 | PPWP: Password Protect Pages, Posts and Full or Partial Content WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2026-08-18 | Fix |
| CVE-2025-9211 | Cross-site scripting in Otalio Ship Property Management System | 6.7CNA v3.1 | 0.5% | 2026-08-18 | Fix |
| CVE-2025-9210 | Missing JSON Web Token signature validation in Otalio Ship Property Management System | 8.1CNA v3.1 | 0.3% | 2026-08-18 | Fix |
| CVE-2025-27772 | Uptrain vulnerable to remote code execution via `/new_run` endpoint | 7.4CNA v4.0 | 0.8% | 2026-08-17 | |
| CVE-2025-27771 | Uptrain vulnerable to remote code execution via `/add_prompts` endpoint | 7.4CNA v4.0 | 0.8% | 2026-08-17 | |
| CVE-2025-27770 | UpTrain vulnerable to remote code execution at `/create_project` | 7.4CNA v4.0 | 0.8% | 2026-08-17 | |
| CVE-2025-27621 | UpTrain has a Constant Default API Key | 7.7CNA v4.0 | 0.5% | 2026-08-17 | |
| CVE-2025-10005 | PPWP WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2026-08-16 | Fix |
| CVE-2025-71405 | go-chi chi open redirect via RedirectSlashes | 5.1CNA v4.0 | 0.4% | 2026-08-14 | Fix |
| CVE-2025-10308 | Astro Booking Engine WordPress plugin cross-site request forgery to settings reset | 4.3CNA v3.1 | 0.2% | 2026-08-14 | Fix |
| CVE-2025-7639 | AVEVA Enterprise SCADA deserialization of untrusted data | 6.1CNA v4.0 | 0.6% | 2026-08-14 | Fix |
| CVE-2025-62318 | HCL Software AION cross-site request forgery | 3.7CNA v3.1 | 0.1% | 2026-08-13 | |
| CVE-2025-62315 | HCL AION improper input validation | 3.4CNA v3.1 | 0.2% | 2026-08-13 | |
| CVE-2025-62314 | HCL Software AION missing brute-force protection | 5.6CNA v3.1 | 0.1% | 2026-08-13 | |
| CVE-2025-52640 | HCL AION shared storage incorrect default permissions | 4.7CNA v3.1 | 0.1% | 2026-08-13 | |
| CVE-2025-59327 | CryptoPro Secure Disk for BitLocker bootxsa.efi LUKS validation improper signature verification | 7.5CISA ADP v3.1 | 0.2% | 2026-08-12 | |
| CVE-2025-59326 | CryptoPro Secure Disk for BitLocker temporary file systems vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2026-08-12 | |
| CVE-2025-59325 | CryptoPro Secure Disk for BitLocker initramfs missing encryption | 7.5CISA ADP v3.1 | 0.3% | 2026-08-12 | |
| CVE-2025-59324 | CryptoPro Secure Disk for BitLocker LUKS encryption validation improper signature verification | 9.1CISA ADP v3.1 | 0.2% | 2026-08-12 | |
| CVE-2025-59323 | CryptoPro Secure Disk for BitLocker DataStore vulnerability | 8.4CISA ADP v3.1 | 0.1% | 2026-08-12 | |
| CVE-2025-59322 | CryptoPro Secure Disk for BitLocker decryption improper error handling | 7.5CISA ADP v3.1 | 0.5% | 2026-08-12 | |
| CVE-2025-59321 | CryptoPro Secure Disk for BitLocker TPM PCR policy vulnerability | 9.8CISA ADP v3.1 | 0.8% | 2026-08-12 | |
| CVE-2025-59320 | CryptoPro Secure Disk for BitLocker TPM secret storage insecure storage of sensitive information | 4.6CISA ADP v3.1 | 0.2% | 2026-08-12 | |
| CVE-2025-59319 | CryptoPro Secure Disk for BitLocker boot partition validation vulnerability | 7.2CISA ADP v3.1 | 0.7% | 2026-08-12 | |
| CVE-2025-41771 | Phoenix Contact AXC F 1152 SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-12 | Fix |
| CVE-2025-41770 | Phoenix Contact AXC F 1152 unauthenticated denial of service | 8.7CNA v4.0 | 0.5% | 2026-08-12 | Fix |
| CVE-2025-41769 | Phoenix Contact AXC F 1152 unauthenticated buffer overflow in PROFINET service | 9.3CNA v4.0 | 0.8% | 2026-08-12 | Fix |
| CVE-2025-15687 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service | 5.3CNA v4.0 | 0.6% | 2026-08-12 | Fix |
| CVE-2025-15686 | Open5GS HSS service fd_msg_sess_get denial of service | 5.3CNA v4.0 | 0.5% | 2026-08-12 | |
| CVE-2025-15685 | Open5GS freeDiameter memory corruption | 5.3CNA v4.0 | 0.3% | 2026-08-12 | |
| CVE-2025-15684 | Open5GS CER init.c diam_log_func assertion | 6.9CNA v4.0 | 0.7% | 2026-08-12 | Fix |
| CVE-2025-9486 | Incorrect privilege assignment in GitLab | 3.3CNA v3.1 | 0.3% | 2026-08-12 | Fix |
| CVE-2025-61970 | AMD Vitis™ Embedded Single File Download (SFD) insecure permissions | 7.3CNA v4.0 | 0.1% | 2026-08-11 | |
| CVE-2025-54512 | AMD Ryzen™ Master uncontrolled search path | 7.0CNA v4.0 | 0.2% | 2026-08-11 | |
| CVE-2025-48506 | AMD Vitis™ Unified Installer for FPGAs and Adaptive SoCs in Windows uncontrolled search path | 7.3CNA v4.0 | 0.2% | 2026-08-11 | |
| CVE-2025-48505 | AMD Vitis™ Unified Installer for FPGAs and Adaptive SoCs in Windows insecure permissions | 7.3CNA v4.0 | 0.2% | 2026-08-11 | |
| CVE-2025-35987 | Intel(R) Software Guard Extensions Data Center Attestation Primitives denial of service | 4.3CNA v4.0 | 0.1% | 2026-08-11 | Fix |
| CVE-2025-35973 | Intel(R) Processors privilege escalation | 4.5CNA v4.0 | 0.1% | 2026-08-11 | Fix |
| CVE-2025-31938 | Intel Xeon 6 Scalable processors TDX information disclosure | 4.3CNA v4.0 | 0.1% | 2026-08-11 | Fix |
| CVE-2025-31936 | Intel(R) Xeon(R) 6 processors when using Intel(R) TDX privilege escalation | 7.0CNA v4.0 | 0.1% | 2026-08-11 | Fix |
| CVE-2025-31356 | Intel(R) Trust Domain Extensions (Intel(R) TDX) insufficient verification of data authenticity | 5.6CNA v4.0 | 0.1% | 2026-08-11 | Fix |
| CVE-2025-31114 | Fooocus webui vulnerable to remote code execution | 9.3CNA v4.0 | 0.7% | 2026-08-11 | |
| CVE-2025-8087 | AMD Power Design Manager (PDM) Software Un-Installer DLL hijacking | 7.0CNA v4.0 | 0.2% | 2026-08-11 | |
| CVE-2025-0046 | AMD Power Design Manager (PDM) Software Installer incorrect permission assignment | 7.0CNA v4.0 | 0.1% | 2026-08-11 | |
| CVE-2025-0041 | AMD Vitis™ Embedded Single File Download (SFD) uncontrolled search path | 7.3CNA v4.0 | 0.2% | 2026-08-11 | |
| CVE-2025-32736 | PingFederate Administrative Console CSRF weaknesses | 4.9CNA v4.0 | 0.2% | 2026-08-10 | Fix |
| CVE-2025-30241 | OS command injection in Web interface in multiple TP-Link Aginet Devices | 8.6CNA v4.0 | 0.4% | 2026-08-10 | Fix |
| CVE-2025-30240 | TP-Link Systems HB810(US2) link following | 5.1CNA v4.0 | 0.2% | 2026-08-10 | Fix |
| CVE-2025-30239 | Sensitive data exposure due to hard-coded cryptographic keys in multiple TP-Link Aginet Devices | 8.5CNA v4.0 | 0.2% | 2026-08-10 | Fix |
| CVE-2025-30238 | TP-Link Systems HB810(US2) incorrect authorization | 8.6CNA v4.0 | 0.2% | 2026-08-10 | Fix |
| CVE-2025-30237 | Authentication bypass via broken access control in Web Server in multiple TP-Link Aginet Devices | 8.7CNA v4.0 | 0.3% | 2026-08-10 | Fix |
| CVE-2025-15683 | TBEA TLogger multiple Unauthenticated denial of service Conditions | 8.8CNA v4.0 | 0.6% | 2026-08-10 | |
| CVE-2025-15682 | TBEA TLogger unauthenticated resource exhaustion | 8.7CNA v4.0 | 0.5% | 2026-08-10 | |
| CVE-2025-15681 | TBEA TLogger Insufficient Webserver Authentication | 9.2CNA v4.0 | 0.7% | 2026-08-10 | |
| CVE-2025-15680 | TBEA TLogger information disclosure via UART | 2.4CNA v4.0 | 0.2% | 2026-08-10 | |
| CVE-2025-13294 | TBEA TLogger unauthenticated SQL injection | 9.3CNA v4.0 | 0.6% | 2026-08-10 | |
| CVE-2025-13293 | TBEA TLogger backdoor / default root credentials | 9.3CNA v4.0 | 0.5% | 2026-08-10 | |
| CVE-2025-71413 | In CPDLC, Malformed or Out of Sequence Frames can cause Resets | 6.0CNA v4.0 | 0.3% | 2026-08-07 | |
| CVE-2025-71412 | In CPDLC, False Emergency or Status Messages Will be Accepted as Legitimate | 7.1CNA v4.0 | 0.3% | 2026-08-07 | |
| CVE-2025-71411 | In CPDLC, Broadcast Control Frames can Disconnect multiple Aircraft Simultaneously | 6.0CNA v4.0 | 0.3% | 2026-08-07 | |
| CVE-2025-71410 | Malicious Link Control Frames can cause Loss of CPDLC functions | 6.0CNA v4.0 | 0.3% | 2026-08-07 | |
| CVE-2025-71409 | No authentication for Very High Frequency Data Link messages used in CPDLC | 7.1CNA v4.0 | 0.3% | 2026-08-07 | |
| CVE-2025-63235 | sol broker denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-08-07 | |
| CVE-2025-58375 | Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in v | 8.1CNA v3.1 | 0.3% | 2026-08-07 | Fix |
| CVE-2025-49506 | Apache Portable Runtime Utility: Apr_password_validate vulnerable to timing attack | 7.5CISA ADP v3.1 | 0.4% | 2026-08-06 | Fix |
| CVE-2025-15678 | Nexter Blocks WordPress plugin Author+ stored XSS via SVG upload | 6.1CISA ADP v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-15674 | Content Protector (Passster) WordPress plugin Protected content disclosure via Core REST API | 2.7CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-15039 | Account takeover via Conditional Authentication Script Logic in multiple WSO2 Products | 9.4CNA v3.1 | 0.7% | 2026-08-06 | Fix |
| CVE-2025-15028 | FormGent WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-14779 | Improper access control via Secret Type Management API in WSO2 Identity Server | 3.8CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-14561 | WSO2 API Manager Publisher REST API improper access control | 9.0CNA v3.1 | 0.4% | 2026-08-06 | Fix |
| CVE-2025-13909 | WSO2 Identity Server multi-tenant authentication information disclosure | 4.3CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-13736 | Username Enumeration via Login interface in multiple WSO2 Products allows User Account Discovery | 3.7CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-13394 | WSO2 Identity Server Ajax processor cross-site request forgery | 5.4CNA v3.1 | 0.1% | 2026-08-06 | Fix |
| CVE-2025-12627 | WSO2 Identity Server user impersonation refresh tokens insufficient session expiration | 2.4CNA v3.1 | 0.2% | 2026-08-06 | Fix |
| CVE-2025-12317 | WSO2 Enterprise Integrator SOAP services vulnerability | 5.0CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-11850 | WSO2 Identity Server implicit-association resolver insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-9266 | Accelerate WordPress theme unauthorized access | 4.3CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-6508 | WSO2 API Manager Swagger UI Try-out console information disclosure | 4.3CNA v3.1 | 0.3% | 2026-08-06 | Fix |
| CVE-2025-70962 | Zosi C519M RTSP authentication hard-coded credentials | 7.5CISA ADP v3.1 | 0.5% | 2026-08-05 | Exploit code |
| CVE-2025-63823 | My Safetipin Android application authentication module hard-coded credentials | 9.8CISA ADP v3.1 | 0.8% | 2026-08-05 | |
| CVE-2025-63822 | SirenGPS Android application improper access control | 8.1CISA ADP v3.1 | 0.4% | 2026-08-05 | |
| CVE-2025-15677 | GeoDirectory WordPress plugin Editor+ stored XSS via Place Categories | 3.5CISA ADP v3.1 | 0.2% | 2026-08-05 | Fix |
| CVE-2025-29296 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The affec | 9.8CISA ADP v3.1 | 2.3% | 2026-08-04 | |
| CVE-2025-15673 | Import and export users and customers WordPress plugin Admin+ arbitrary file read | 4.9CISA ADP v3.1 | 0.5% | 2026-08-03 | Fix |
| CVE-2025-15672 | ChamaWP PHP object injection | 8.1CISA ADP v3.1 | 0.6% | 2026-08-03 | Fix |
| CVE-2025-15631 | Weak credential Storage in TP-Link Omada Devices | 5.7CNA v4.0 | 0.3% | 2026-08-03 | Fix |
| CVE-2025-15630 | Device Provisioning race condition in TP-Link Omada Adoption Workflow | 5.8CNA v4.0 | 0.3% | 2026-08-03 | Fix |
| CVE-2025-15629 | Weak Session Key Generation in TP-Link Omada Adoption protocol | 6.9CNA v4.0 | 0.3% | 2026-08-03 | Fix |
| CVE-2025-15628 | Hard-coded Certificates in TP-Link Omada Device Communications | 8.2CNA v4.0 | 0.3% | 2026-08-03 | Fix |
| CVE-2025-15627 | Hard-coded cryptographic keys in TP-Link Omada Adoption Protocol Authentication | 6.9CNA v4.0 | 0.7% | 2026-08-03 | Fix |
| CVE-2025-15544 | Weak credential Protection during TP-Link Omada Device Adoption | 6.9CNA v4.0 | 0.3% | 2026-08-03 | Fix |
| CVE-2025-9291 | Improper certificate validation in TP-Link Omada Cloud Communications | 7.7CNA v4.0 | 0.2% | 2026-08-03 | Fix |
| CVE-2025-71401 | better-auth basePath modification DoS | 9.3CNA v4.0 | 0.5% | 2026-08-02 | Fix |
| CVE-2025-71400 | better-auth passkey IDOR via delete-passkey | 7.1CNA v4.0 | 0.4% | 2026-08-02 | Fix |
| CVE-2025-71399 | better-auth Better Auth Path Normalization Bypass via rou3 | 8.8CNA v4.0 | 0.5% | 2026-08-02 | Fix |
| CVE-2025-15675 | Charitable WordPress plugin Admin+ stored XSS via Photo field ALT Text | 4.8CISA ADP v3.1 | 0.2% | 2026-08-02 | Fix |
| CVE-2025-71404 | better-auth reflected XSS via error parameter | 5.1CNA v4.0 | 0.5% | 2026-08-01 | Fix |
| CVE-2025-71403 | better-auth open redirect via trustedOrigins Bypass | 7.1CNA v4.0 | 0.3% | 2026-08-01 | Fix |
| CVE-2025-71402 | better-auth Session Revocation via Forged Cookie | 2.0CNA v4.0 | 0.3% | 2026-08-01 | Fix |
| CVE-2025-15669 | Bit Form WordPress plugin Admin+ stored XSS via Conversational form Progress Label | 4.8CISA ADP v3.1 | 0.2% | 2026-08-01 | Fix |
| CVE-2025-14469 | Theme Editor WordPress plugin cross-site request forgery to CSS modification | 4.3CNA v3.1 | 0.2% | 2026-08-01 | Fix |
| CVE-2025-14073 | WooCommerce PayPal Payments WordPress plugin unauthenticated sensitive information disclosure | 5.3CNA v3.1 | 0.4% | 2026-08-01 | Fix |
| CVE-2025-69948 | SourceCodester Modern Loan Management System delete_group.php SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2026-07-31 | |
| CVE-2025-69946 | SourceCodester Modern Loan Management System ajaxData.php SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2026-07-31 | |
| CVE-2025-67651 | CSRF in PHP Jabbers scripts | 6.9CNA v4.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2025-67650 | Authenticated SQL injection in PHP Jabbers scripts | 8.6CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2025-67649 | Unauthenticated SQL injection in PHP Jabbers Car Rental Script script | 9.3CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2025-62347 | HCL iControl improper input validation | 4.3CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2025-69947 | SourceCodester Tailor Management System customeredit.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69941 | SourceCodester Tailor Management System addmeasurement.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69938 | CodeAstro Membership Management System renew.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69937 | CodeAstro Membership Management System edit_type.php SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2026-07-30 | |
| CVE-2025-69936 | CodeAstro Membership Management System edit_member.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69935 | CodeAstro Membership Management System report.php and revenue_report.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69934 | CodeAstro Membership Management System delete_members.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69933 | CodeAstro Membership Management System memberProfile.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69931 | CodeAstro Membership Management System delete_membership.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-69930 | CodeAstro Membership Management System print_membership_card.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-65342 | code-projects Blood System don.php cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | |
| CVE-2025-65341 | Fruits Bazar admin/edit_product.php cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | |
| CVE-2025-65336 | Fruits Bazar show_price_by_pdtId.php SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2026-07-30 | |
| CVE-2025-51684 | CleverTap Web SDK postMessage handling cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2025-36431 | IBM Sterling B2B Integrator and Sterling File Gateway response header cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2025-36374 | IBM DataPower Gateway affected by XML external entity injection | 5.5CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2025-36298 | IBM Sterling B2B Integrator and Sterling File Gateway Ebics server cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2025-0152 | IBM Engineering Requirements Management DOORS and DOORS Web Access web UI cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2025-69949 | kishan0725 Hospital Management System check_availability.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-69945 | kishan0725 Hospital Management System edit-patient.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-69944 | kishan0725 Hospital Management System view-medhistory.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-69943 | kishan0725 Hospital Management System get_doctor.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-69942 | kishan0725 Hospital Management System view-patient.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-67408 | Sourcecodester CASAP Automated Enrollment System save_user.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-67407 | Sourcecodester CASAP Automated Enrollment System update_student.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-67406 | Sourcecodester Advocate Office Management System activate_case.php SQL injection | 7.3CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-67405 | Sourcecodester CASAP Automated Enrollment System update_password.php SQL injection | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-67404 | Sourcecodester CASAP Automated Enrollment System save_stud.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-67403 | Sourcecodester CASAP Automated Enrollment System update_class.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-65340 | kishan0725 Hospital Management System betweendates-detailsreports.php SQL injection | 9.8CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-65337 | Sourcecodester Fantastic Blog CMS pageEditMember.php cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2025-60931 | Infor Global HR Employee Compensation View function insecure direct object reference | 7.5CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2025-14562 | Incorrect authorization in GitLab | 3.1CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2025-10656 | Spreadsheet Price Changer for WooCommerce and WP E-commerce WordPress plugin missing authorization | 9.8CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2025-63913 | OpenSBI SBI PMU extension denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-07-27 | Fix |
| CVE-2025-59181 | Ericsson Packet Core Controller (PCC) path traversal | 4.8CNA v4.0 | 0.4% | 2026-07-27 | Fix |
| CVE-2025-59180 | Ericsson Packet Core Controller (PCC) use of hard-coded credentials | 5.1CNA v4.0 | 0.2% | 2026-07-27 | Fix |
| CVE-2025-59178 | Ericsson Packet Core Controller Configuration Management information disclosure | 4.8CNA v4.0 | 0.2% | 2026-07-27 | Fix |
| CVE-2025-59177 | Ericsson Packet Core Controller (PCC) generation of error message containing sensitive information | 6.8CNA v4.0 | 0.2% | 2026-07-27 | Fix |
| CVE-2025-59172 | Ericsson Packet Core Controller improper neutralization of special elements used in an OS command | 8.5CNA v4.0 | 0.3% | 2026-07-27 | Fix |
| CVE-2025-50455 | EasyAppointments customer search endpoint SQL injection | 9.1CISA ADP v3.1 | 1.1% | 2026-07-27 | Exploit code |
| CVE-2025-15662 | Printcart Web to Print Product Designer for WooCommerce server-side request forgery | 8.6CISA ADP v3.1 | 0.4% | 2026-07-27 | Fix |
| CVE-2025-71408 | NLTK eval injection via collocations.py Command-Line arguments | 8.5CNA v4.0 | 0.3% | 2026-07-24 | Fix |
| CVE-2025-9205 | MapSVG Lite WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-07-24 | Fix |
| CVE-2025-71389 | calcom cal.diy Cal.com remote code execution via RSC | 10.0CNA v4.0 | 1.4% | 2026-07-23 | Fix |
| CVE-2025-68081 | WP-Polls WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2026-07-23 | Fix |
| CVE-2025-60835 | IZArc unrar.dll path traversal | 7.8CISA ADP v3.1 | 0.2% | 2026-07-22 | |
| CVE-2025-50330 | ZipGenius zipgenius.exe privilege escalation | 8.8CISA ADP v3.1 | 0.7% | 2026-07-22 | |
| CVE-2025-50329 | ConeXware Power Archiver powerarc.exe privilege escalation | 9.8CISA ADP v3.1 | 1.1% | 2026-07-22 | |
| CVE-2025-50327 | Franco Corbelli ZPAQFRANZ privilege escalation | 8.8CISA ADP v3.1 | 0.7% | 2026-07-22 | Fix |
| CVE-2025-50325 | BandiZip Mark-of-the-Web protection mechanism authentication bypass | 5.4CISA ADP v3.1 | 0.5% | 2026-07-22 | |
| CVE-2025-50324 | Milos Paripovic OneCommander OneCommander.exe arbitrary code execution | 8.8CISA ADP v3.1 | 0.7% | 2026-07-22 | |
| CVE-2025-44090 | OhSoft CoffeeZip arbitrary code execution | 8.8CISA ADP v3.1 | 0.5% | 2026-07-22 | |
| CVE-2025-44089 | NCH Software ExpressZip arbitrary code execution | 8.8CISA ADP v3.1 | 0.5% | 2026-07-22 | |
| CVE-2025-13146 | DTX WordPress plugin code injection | 6.5CNA v3.1 | 0.5% | 2026-07-22 | |
| CVE-2025-68640 | Apple Find My missing authentication | 5.3CISA ADP v3.1 | 0.4% | 2026-07-21 | |
| CVE-2025-66390 | Microsoft Azure API Management self-service signup improper access control | 9.8CISA ADP v3.1 | 0.4% | 2026-07-21 | Exploit code |
| CVE-2025-71398 | SurrealDB SSRF via HTTP Redirect Bypass | 7.6NVD v3.1 | 0.3% | 2026-07-18 | Fix |
| CVE-2025-71397 | SurrealDB CPU exhaustion via nested FOR loops | 6.5NVD v3.1 | 0.6% | 2026-07-18 | Fix |
| CVE-2025-71396 | SurrealDB denial of service via JavaScript Scripting | 6.5NVD v3.1 | 0.6% | 2026-07-18 | Fix |
| CVE-2025-71395 | SurrealDB memory exhaustion via string::replace | 6.5NVD v3.1 | 0.5% | 2026-07-18 | Fix |
| CVE-2025-71394 | SurrealDB Local File Read via DEFINE ANALYZER | 4.3NVD v3.1 | 0.4% | 2026-07-18 | Fix |
| CVE-2025-71393 | SurrealDB memory exhaustion via Nested functions | 6.5NVD v3.1 | 0.5% | 2026-07-18 | Fix |
| CVE-2025-71392 | SurrealDB SurrealQL injection via export | 8.0NVD v3.1 | 0.4% | 2026-07-18 | Fix |
| CVE-2025-71391 | SurrealDB denial of service via /SQL endpoint | 6.5NVD v3.1 | 0.6% | 2026-07-18 | Fix |
| CVE-2025-71390 | SurrealDB deny-net Bypass via DNS Resolution | 8.8NVD v3.1 | 0.2% | 2026-07-18 | Fix |
| CVE-2025-60357 | Ahnlab Epp Management NoSQL injection | 8.1CISA ADP v3.1 | 0.4% | 2026-07-17 | Exploit code |
| CVE-2025-59866 | HCL Software DFXAnalytics incorrect permission assignment | 3.3CNA v3.1 | 0.1% | 2026-07-17 | |
| CVE-2025-51678 | PicoRV32 PCPI interface memory corruption | 7.5CISA ADP v3.1 | 0.6% | 2026-07-17 | |
| CVE-2025-51677 | OpenRISC OR1200 CPU output port improper output encoding | 9.1CISA ADP v3.1 | 0.6% | 2026-07-17 | |
| CVE-2025-71388 | stoatchat 20241213-1 Webhook token disclosure via Read Permissions | 7.6CNA v4.0 | 0.5% | 2026-07-16 | Fix |
| CVE-2025-71377 | stoatchat Unrestricted Message History Fetch | 8.7CNA v4.0 | 0.7% | 2026-07-16 | Fix |
| CVE-2025-45870 | LogicalDOC Enterprise OnlyOfficeEditor servlet path traversal | 6.5CISA ADP v3.1 | 0.5% | 2026-07-16 | |
| CVE-2025-45868 | LogicalDOC Enterprise ComparisonServlet SQL injection | 8.8CISA ADP v3.1 | 0.5% | 2026-07-16 | |
| CVE-2025-65720 | GPT Researcher MCP STDIO configuration allows remote command execution | 9.8CISA ADP v3.1 | 0.7% | 2026-07-15 | |
| CVE-2025-32781 | Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center | 6.5CNA v3.1 | 0.4% | 2026-07-15 | Fix |
| CVE-2025-62826 | Fortinet FortiProxy HTTP headers CRLF injection | 3.1CNA v3.1 | 0.4% | 2026-07-14 | Fix |
| CVE-2025-62675 | Fortinet FortiOS HTTP headers CRLF injection | 3.4CNA v3.1 | 0.3% | 2026-07-14 | Fix |
| CVE-2025-56365 | Csa-iot Matter reachable assertion | 5.7NVD v3.1 | 0.3% | 2026-07-14 | |
| CVE-2025-56364 | Csa-iot Matter use of uninitialized memory use | 5.7NVD v3.1 | 0.2% | 2026-07-14 | |
| CVE-2025-56363 | Csa-iot Matter null pointer dereference | 5.7NVD v3.1 | 0.4% | 2026-07-14 | |
| CVE-2025-56362 | Csa-iot Matter reachable assertion | 5.7NVD v3.1 | 0.3% | 2026-07-14 | |
| CVE-2025-56361 | Csa-iot Matter reachable assertion | 5.7NVD v3.1 | 0.3% | 2026-07-14 | |
| CVE-2025-53379 | Fortinet FortiAuthenticator out-of-bounds read | 7.0CNA v3.1 | 0.5% | 2026-07-14 | Fix |
| CVE-2025-43892 | Fortinet FortiOS A buffer over-read | 4.1CNA v3.1 | 0.4% | 2026-07-14 | Fix |
| CVE-2025-40945 | Siemens COMOS untrusted search path | 8.5CNA v4.0 | 0.2% | 2026-07-14 | Fix |
| CVE-2025-15665 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with adm | 5.4CISA ADP v3.1 | 0.2% | 2026-07-14 | Fix |
| CVE-2025-12012 | CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® buffer overflow | 9.2CNA v4.0 | 0.4% | 2026-07-14 | Fix |
| CVE-2025-12011 | CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® buffer overflow | 9.2CNA v4.0 | 0.4% | 2026-07-14 | Fix |
| CVE-2025-11698 | CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® buffer overflow | 9.2CNA v4.0 | 0.4% | 2026-07-14 | Fix |
| CVE-2025-8412 | SUSE Virtual Machine Driver Pack buffer overflow | 2.0CNA v4.0 | 0.1% | 2026-07-14 | |
| CVE-2025-45869 | LogicalDOC Enterprise ShareFileCallback servlet server-side request forgery | 7.3CISA ADP v3.1 | 0.3% | 2026-07-13 | |
| CVE-2025-13968 | Starboard Suite Reservation Calendars WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-07-11 | Fix |
| CVE-2025-6784 | Code Engine WordPress plugin authenticated (Contributor+) remote code execution | 8.8CNA v3.1 | 0.9% | 2026-07-11 | Fix |
| CVE-2025-5017 | Catalyst Connect Zoho CRM Client Portal WordPress plugin SQL injection | 4.9CNA v3.1 | 0.3% | 2026-07-11 | |
| CVE-2025-70796 | web management interface of WTI unauthenticated path traversal | 7.5CISA ADP v3.1 | 0.7% | 2026-07-10 | |
| CVE-2025-30008 | HestiaCP stored XSS via DNS Record Management interface | 5.4NVD v3.1 | 0.3% | 2026-07-10 | Fix |
| CVE-2025-30007 | HestiaCP authenticated OS command injection via DNS Record Management | 8.7CNA v4.0 | 3.2% | 2026-07-10 | Fix |
| CVE-2025-11977 | HappyForms WordPress plugin authenticated (Admin+) local file inclusion | 6.6CNA v3.1 | 0.9% | 2026-07-10 | Fix |
| CVE-2025-63579 | Kyocera Command Center RX address book information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2026-07-09 | |
| CVE-2025-58151 | Xen Project varstored shared guest memory buffer race condition | 9.4CNA v4.0 | 0.1% | 2026-07-09 | Fix |
| CVE-2025-58146 | XAPI UTF-8 string handling | 9.4CNA v4.0 | 0.2% | 2026-07-09 | Fix |
| CVE-2025-45422 | Proximus b-box port forwarding configuration improper access control | 8.1CISA ADP v3.1 | 0.4% | 2026-07-09 | Exploit code |
| CVE-2025-27464 | Xen Windows PV drivers WinPVDrivers: Excessive permissions on user-exposed devices | 9.4CNA v4.0 | 0.2% | 2026-07-09 | Fix |
| CVE-2025-27463 | Xen Windows PV drivers WinPVDrivers: Excessive permissions on user-exposed devices | 9.4CNA v4.0 | 0.2% | 2026-07-09 | Fix |
| CVE-2025-27462 | Xen Windows PV drivers WinPVDrivers: Excessive permissions on user-exposed devices | 9.4CNA v4.0 | 0.2% | 2026-07-09 | Fix |
| CVE-2025-14785 | Website Builder by SeedProd WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-07-08 | Fix |
| CVE-2025-12506 | GitLab Git reference name resolution vulnerability | 3.5CNA v3.1 | 0.3% | 2026-07-08 | Fix |
| CVE-2025-3110 | OpenVPN Access Server HTTP request smuggling | 6.9CNA v4.0 | 0.4% | 2026-07-08 | Fix |
| CVE-2025-12799 | Red Hat JBoss Enterprise Application Platform Jastow cross-site scripting | 6.5CNA v3.1 | 0.4% | 2026-07-07 | Fix |
| CVE-2025-59617 | Qualcomm Snapdragon use-after-free in Computer Vision | 6.6CNA v3.1 | 0.1% | 2026-07-06 | Fix |
| CVE-2025-59616 | Qualcomm Snapdragon use-after-free in Computer Vision | 6.6CNA v3.1 | 0.1% | 2026-07-06 | Fix |
| CVE-2025-59615 | Qualcomm Snapdragon use-after-free in Computer Vision | 6.6CNA v3.1 | 0.1% | 2026-07-06 | Fix |
| CVE-2025-53831 | DrawIO for ownCloud 10 is vulnerable to stored XSS | 8.2CNA v3.1 | 0.3% | 2026-07-06 | Fix |
| CVE-2025-53830 | Anti-Virus for ownCloud 10 is vulnerable to server-side request forgery (SSRF) | 9.1CNA v3.1 | 0.5% | 2026-07-06 | Fix |
| CVE-2025-53829 | ownCloud 10 is vulnerable to relative path traversal | 8.0CNA v3.1 | 0.5% | 2026-07-06 | Fix |
| CVE-2025-53828 | SharePoint for ownCloud 10 is vulnerable to server-side request forgery (SSRF) | 8.5CNA v3.1 | 0.4% | 2026-07-06 | Fix |
| CVE-2025-53827 | ownCloud Core: Updater has an exposed dangerous method or function | 9.1CNA v3.1 | 0.6% | 2026-07-06 | Fix |
| CVE-2025-15668 | GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow | 4.8CNA v4.0 | 0.2% | 2026-07-06 | |
| CVE-2025-15667 | GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free | 4.8CNA v4.0 | 0.2% | 2026-07-06 | |
| CVE-2025-8591 | Reflected cross-site scripting via URL parameter in multiple WSO2 Products enables UI Modification | 6.1CNA v3.1 | 0.3% | 2026-07-06 | Fix |
| CVE-2025-71380 | n8n arbitrary command execution via Execute Command Node | 8.7CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71375 | picklescan Undetected remote code execution via _operator.methodcaller | 7.6CNA v4.0 | 0.5% | 2026-07-04 | Fix |
| CVE-2025-71373 | picklescan remote code execution via operator.methodcaller Detection Bypass | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71372 | Picklescan arbitrary code execution via numpy.f2py.crackfortran.getlincoef Gadget | 7.6CNA v4.0 | 0.5% | 2026-07-04 | Fix |
| CVE-2025-71369 | picklescan unsafe deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71367 | picklescan remote code execution via _operator.attrgetter Detection Bypass | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71366 | picklescan arbitrary code execution via torch.utils.bottleneck.__main__.run_cprofile | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71364 | picklescan arbitrary code execution | 7.6CNA v4.0 | 0.7% | 2026-07-04 | Fix |
| CVE-2025-71362 | picklescan arbitrary code execution via unsafe deserialization in numpy.f2py.crackfortran | 7.6CNA v4.0 | 0.4% | 2026-07-04 | Fix |
| CVE-2025-71360 | picklescan remote code execution via Undetected idlelib.calltip.get_entity | 7.6CNA v4.0 | 0.4% | 2026-07-04 | Fix |
| CVE-2025-71359 | picklescan unsafe deserialization via lib2to3.pgen2.grammar.Grammar.loads | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71356 | picklescan arbitrary code execution | 7.6CNA v4.0 | 0.4% | 2026-07-04 | Fix |
| CVE-2025-71353 | picklescan remote code execution via torch._dynamo.guards.GuardBuilder.get | 7.6CNA v4.0 | 0.4% | 2026-07-04 | Fix |
| CVE-2025-71347 | picklescan Undetected remote code execution via numpy.f2py.crackfortran.param_eval | 7.6CNA v4.0 | 0.6% | 2026-07-04 | Fix |
| CVE-2025-71345 | picklescan arbitrary code execution via torch.utils.bottleneck.__main__.run_autograd_prof | 7.6CNA v4.0 | 0.5% | 2026-07-04 | Fix |
| CVE-2025-71343 | picklescan arbitrary code execution | 7.6CNA v4.0 | 0.4% | 2026-07-04 | Fix |
| CVE-2025-71342 | picklescan Undetected remote code execution via idlelib.run.Executive.runcode | 7.6CNA v4.0 | 0.5% | 2026-07-04 | Fix |
| CVE-2025-13475 | WSO2 Identity Server application consent management authentication bypass | 3.5CNA v3.1 | 0.3% | 2026-07-04 | Fix |
| CVE-2025-71385 | Netdata reflected cross-site scripting via love parameter in ilove.svg endpoint | 5.1CNA v4.0 | 0.4% | 2026-07-02 | Fix |
| CVE-2025-69156 | Kids Zone - Children WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-69155 | Fitness Zone WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-69154 | SpaLab Beauty Salon WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-69153 | Trendy Travel WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-69152 | Artale Wedding Photography WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-69134 | OpenAI Chatbot for WordPress Helper plugin arbitrary content deletion vulnerability | 7.5CNA v3.1 | 0.4% | 2026-07-02 | |
| CVE-2025-69133 | Tourmaster WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.4% | 2026-07-02 | |
| CVE-2025-69132 | Corpkit WordPress theme sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2026-07-02 | |
| CVE-2025-69094 | Unicamp WordPress theme SQL injection | 8.5CNA v3.1 | 0.4% | 2026-07-02 | |
| CVE-2025-66076 | Woostify Sites Library WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2026-07-02 | |
| CVE-2025-58902 | Lighthouse WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-07-02 | |
| CVE-2025-23351 | NVIDIA BlueField GA out-of-bounds write | 9.0CNA v3.1 | 0.4% | 2026-07-01 | Fix |
| CVE-2025-23350 | NVIDIA BlueField GA out-of-bounds write | 9.0CNA v3.1 | 0.4% | 2026-07-01 | Fix |
| CVE-2025-15666 | Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow | 4.8CNA v4.0 | 0.1% | 2026-07-01 | Fix |
| CVE-2025-15646 | HTML::Gumbo versions for Perl disclose heap memory via type confusion | 9.8CISA ADP v3.1 | 0.7% | 2026-07-01 | Fix |
| CVE-2025-71381 | Hono Vary header injection in CORS Middleware | 6.9CNA v4.0 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-71374 | picklescan arbitrary code execution via Undetected profile.Profile.run | 7.6CNA v4.0 | 0.7% | 2026-06-30 | Fix |
| CVE-2025-71371 | picklescan remote code execution via code.InteractiveInterpreter Detection Bypass | 7.6CNA v4.0 | 0.6% | 2026-06-30 | Fix |
| CVE-2025-71368 | picklescan arbitrary code execution via Undetected doctest.debug_script | 7.6CNA v4.0 | 0.8% | 2026-06-30 | Fix |
| CVE-2025-71363 | picklescan arbitrary code execution via Undetected cProfile.run in Pickle deserialization | 7.6CNA v4.0 | 0.7% | 2026-06-30 | Fix |
| CVE-2025-71355 | Picklescan arbitrary code execution via Unsafe Numpy Function Detection Bypass | 7.6CNA v4.0 | 0.6% | 2026-06-30 | Fix |
| CVE-2025-71352 | picklescan remote code execution via Undetected trace.Trace.runctx in Pickle files | 7.6CNA v4.0 | 0.7% | 2026-06-30 | Fix |
| CVE-2025-71350 | picklescan Undetected remote code execution via torch.utils.collect_env.run | 7.6CNA v4.0 | 0.4% | 2026-06-30 | Fix |
| CVE-2025-71349 | picklescan arbitrary code execution via Undetected trace.Trace.run in Pickle files | 7.6CNA v4.0 | 0.6% | 2026-06-30 | Fix |
| CVE-2025-53648 | Apache Gravitino: SQL misconfiguration can access or truncate files | 5.4CISA ADP v3.1 | 0.6% | 2026-06-30 | Fix |
| CVE-2025-36372 | IBM Db2 sensitive information in an accessible file | 5.5CNA v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-36359 | IBM DevOps Loop is susceptible to an insufficient session expiration | 8.1CNA v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-36336 | IBM cleartext transmission of sensitive information in Watson Data Intelligence | 5.9CNA v3.1 | 0.2% | 2026-06-30 | Fix |
| CVE-2025-36333 | IBM vulnerabilities found in Watson Data Intelligence | 4.3CNA v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-36328 | IBM Error Message Containing Sensitive Information found in Watson Data Intelligence | 4.3CNA v3.1 | 0.4% | 2026-06-30 | Fix |
| CVE-2025-36327 | IBM vulnerabilities found in Watson Data Intelligence | 6.5CNA v3.1 | 0.4% | 2026-06-30 | Fix |
| CVE-2025-36324 | IBM vulnerabilities found in Watson Data Intelligence | 4.3CNA v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-36323 | IBM vulnerabilities found in Watson Data Intelligence | 5.4CNA v3.1 | 0.2% | 2026-06-30 | Fix |
| CVE-2025-36321 | IBM vulnerabilities found in Watson Data Intelligence | 5.7CNA v3.1 | 0.4% | 2026-06-30 | Fix |
| CVE-2025-36320 | IBM vulnerabilities found in Watson Data Intelligence | 6.4CNA v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-36319 | IBM vulnerabilities found in Watson Data Intelligence | 4.3CNA v3.1 | 0.4% | 2026-06-30 | Fix |
| CVE-2025-24816 | An improper access control vulnerability in Nokia MantaRay NM | 6.5CISA ADP v3.1 | 0.3% | 2026-06-30 | Fix |
| CVE-2025-24815 | An unrestricted file upload vulnerability in Nokia MantaRay NM | 7.8CISA ADP v3.1 | 0.2% | 2026-06-30 | Fix |
| CVE-2025-12530 | IBM vulnerabilities found in Watson Data Intelligence | 5.9CNA v3.1 | 0.2% | 2026-06-30 | Fix |
| CVE-2025-7406 | A Sudo privilege escalation vulnerability in Nokia MantaRay NM | 7.8CISA ADP v3.1 | 0.1% | 2026-06-30 | Fix |
| CVE-2025-7386 | Information exposure vulnerability in Hitachi Storage Navigator | 6.8CNA v3.1 | 0.4% | 2026-06-29 | Fix |
| CVE-2025-2902 | Improper authorization vulnerability of Maintenance utility in Hitachi Virtual Storage Platform | 8.3CNA v3.1 | 0.4% | 2026-06-29 | Fix |
| CVE-2025-0824 | Lack of validation for firmware update in Hitachi Virtual Storage | 3.7CNA v3.1 | 0.1% | 2026-06-29 | Fix |
| CVE-2025-59868 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure | 5.5CNA v3.1 | 0.2% | 2026-06-27 | Fix |
| CVE-2025-68075 | BNE Testimonials WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-06-26 | Fix |
| CVE-2025-68074 | Image Carousel WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-06-26 | |
| CVE-2025-68064 | Goya Core WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.4% | 2026-06-26 | Fix |
| CVE-2025-68063 | Splash - Sport Club WordPress theme for Basketball, Football, Hockey local file inclusion | 7.5CNA v3.1 | 0.4% | 2026-06-26 | Fix |
| CVE-2025-68052 | Eagle Booking WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2026-06-26 | |
| CVE-2025-66123 | BookPro WordPress plugin insecure direct object references (IDOR) | 5.3CNA v3.1 | 0.3% | 2026-06-26 | |
| CVE-2025-64637 | Auros Core WordPress plugin content injection | 5.3CNA v3.1 | 0.3% | 2026-06-26 | |
| CVE-2025-64636 | Donation Thermometer WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2026-06-26 | Fix |
| CVE-2025-64152 | Apache IoTDB: Path traversal | 9.1CISA ADP v3.1 | 0.5% | 2026-06-26 | Fix |
| CVE-2025-63079 | Live Copy Paste for Elementor WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2026-06-26 | Fix |
| CVE-2025-63078 | Restaurant Menu by MotoPress WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2026-06-26 | Fix |
| CVE-2025-63041 | Forget About Shortcode Buttons WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-06-26 | |
| CVE-2025-55017 | Apache IoTDB: Path traversal | 9.1CISA ADP v3.1 | 0.5% | 2026-06-26 | Fix |
| CVE-2025-32423 | AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock | 5.3CNA v4.0 | 0.3% | 2026-06-26 | Fix |
| CVE-2025-32394 | AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock | 5.3CNA v4.0 | 0.4% | 2026-06-26 | Fix |
| CVE-2025-11919 | Unprotected temporary directories in Wolfram Cloud may result in privilege escalation | 9.6CISA ADP v3.1 | 0.5% | 2026-06-26 | |
| CVE-2025-10268 | Printcart Web to Print Product Designer for WooCommerce path traversal | 5.3CISA ADP v3.1 | 0.4% | 2026-06-26 | |
| CVE-2025-7958 | Trellix Network Security NX A code injection | 7.1CNA v4.0 | 0.3% | 2026-06-26 | |
| CVE-2025-71340 | picklescan remote code execution via idlelib.pyshell.ModifiedInterpreter.runcode | 7.6CNA v4.0 | 0.4% | 2026-06-25 | Fix |
| CVE-2025-71338 | Flowise arbitrary file write to remote code execution via document-store API | 9.8NVD v3.1 | 1.2% | 2026-06-25 | Exploit codeFix |
| CVE-2025-71336 | Flowise Unsandboxed remote code execution via Custom MCP | 9.3CNA v4.0 | 1.1% | 2026-06-25 | Fix |
| CVE-2025-71335 | Flowise Session Invalidation failure after Password Change | 8.6CNA v4.0 | 0.4% | 2026-06-25 | Fix |
| CVE-2025-71334 | Flowise arbitrary File Access via Missing Chat Flow ID Validation | 9.3CNA v4.0 | 4.4% | 2026-06-25 | NucleiEmerging ThreatsFix |
| CVE-2025-71333 | Flowise arbitrary file upload via Unauthenticated /API/v1/attachments endpoint | 9.8NVD v3.1 | 0.9% | 2026-06-25 | |
| CVE-2025-71328 | Flowise unverified password change via Account settings | 8.8NVD v3.1 | 0.5% | 2026-06-25 | Fix |
| CVE-2025-71327 | Flowise authentication bypass via Unprotected Registration endpoint | 9.3CNA v4.0 | 0.7% | 2026-06-25 | |
| CVE-2025-71324 | Flowise arbitrary file read via chatId parameter | 8.7CNA v4.0 | 1.6% | 2026-06-25 | NucleiFix |
| CVE-2025-60473 | gpac gf_filter_in_parent_chain function null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-25 | |
| CVE-2025-60466 | gpac gf_filter_pid_get_packet function use-after-free | 5.0CISA ADP v3.1 | 0.2% | 2026-06-25 | |
| CVE-2025-60465 | gpac gf_filter_pid_inst_swap function use-after-free | 6.1CISA ADP v3.1 | 0.2% | 2026-06-25 | |
| CVE-2025-60464 | gpac gf_sei_load_from_state_internal function use-after-free | 7.8CISA ADP v3.1 | 0.2% | 2026-06-25 | |
| CVE-2025-71361 | picklescan remote code execution via Undetected idlelib.calltip.Calltip.fetch_tip | 7.6CNA v4.0 | 0.4% | 2026-06-24 | Fix |
| CVE-2025-71354 | picklescan remote code execution via idlelib.debugobj.ObjectTreeItem.SetText | 7.6CNA v4.0 | 0.4% | 2026-06-24 | Fix |
| CVE-2025-71332 | Flowise SQL injection in importChatflows API via chatflow.id parameter | 8.8NVD v3.1 | 0.5% | 2026-06-24 | |
| CVE-2025-64719 | Gogs: Denial of service in repository/wiki file listing web pages | 4.9CNA v3.1 | 0.4% | 2026-06-24 | Fix |
| CVE-2025-60474 | gpac gf_media_import function buffer overflow | 7.5CISA ADP v3.1 | 0.8% | 2026-06-24 | |
| CVE-2025-60471 | gpac use-after-free | 5.5CISA ADP v3.1 | 0.2% | 2026-06-24 | |
| CVE-2025-60468 | gpac heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-06-24 | |
| CVE-2025-60467 | gpac gf_filter_pid_inst_swap_delete_task function use-after-free | 7.5CISA ADP v3.1 | 0.7% | 2026-06-24 | |
| CVE-2025-71382 | MuPDF stack exhaustion DoS via EPUB CSS Rendering | 7.1CNA v4.0 | 0.6% | 2026-06-23 | Fix |
| CVE-2025-71376 | picklescan arbitrary code execution | 7.6CNA v4.0 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-71370 | picklescan remote code execution via torch.jit.unsupported_tensor_ops.execWrapper | 7.6CNA v4.0 | 0.5% | 2026-06-23 | Fix |
| CVE-2025-71365 | picklescan arbitrary code execution via numpy.f2py.crackfortran.myeval Detection Bypass | 7.6CNA v4.0 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-71341 | picklescan remote code execution via Undetected profile.Profile.runctx | 7.6CNA v4.0 | 0.6% | 2026-06-23 | Fix |
| CVE-2025-71337 | Flowise Unverified Email Change via Account Profile endpoint | 8.7CNA v4.0 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-64105 | FOSSBilling support ticket creation insecure direct object reference | 5.1CNA v4.0 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-62180 | Pegasystems Pega Infinity insecure direct object reference | 7.1CNA v4.0 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61029 | An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61028 | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.6% | 2026-06-23 | Fix |
| CVE-2025-61027 | An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61025 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61024 | An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61023 | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.6% | 2026-06-23 | Fix |
| CVE-2025-61022 | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61021 | An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61020 | An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.6% | 2026-06-23 | Fix |
| CVE-2025-61019 | An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.4% | 2026-06-23 | Fix |
| CVE-2025-61018 | An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | 7.5CISA ADP v3.1 | 0.7% | 2026-06-23 | Fix |
| CVE-2025-55639 | gpac null pointer dereference | 6.5CISA ADP v3.1 | 0.5% | 2026-06-23 | |
| CVE-2025-15619 | HCL Connections is vulnerable to broken access control | 3.5CNA v3.1 | 0.2% | 2026-06-23 | |
| CVE-2025-13162 | ABB Control Builder A uncontrolled search path | 4.1CNA v4.0 | 0.1% | 2026-06-23 | Fix |
| CVE-2025-71358 | picklescan remote code execution via idlelib.autocomplete.AutoComplete.get_entity | 7.6CNA v4.0 | 0.3% | 2026-06-22 | Fix |
| CVE-2025-71344 | picklescan arbitrary code execution via Undetected ensurepip._run_pip function | 7.6CNA v4.0 | 0.5% | 2026-06-22 | Fix |
| CVE-2025-71339 | Picklescan arbitrary code execution via numpy.f2py.crackfortran._eval_length Gadget | 7.6CNA v4.0 | 0.4% | 2026-06-22 | Fix |
| CVE-2025-66389 | Microsoft GITHUB Copilot files accessible to external parties | 7.5CISA ADP v3.1 | 1.2% | 2026-06-22 | |
| CVE-2025-66336 | Apache Doris MCP Server: SQL injection leading the authentication bypass | 8.1CISA ADP v3.1 | 0.6% | 2026-06-22 | Fix |
| CVE-2025-62198 | Apache Atlas: Stored XSS in Create Entity page | 5.4CISA ADP v3.1 | 0.5% | 2026-06-22 | Fix |
| CVE-2025-33128 | IBM Engineering Workflow Management Web UI cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-06-22 | Fix |
| CVE-2025-4994 | Authentication bypass for SafeLine SL6 and SL6+ | 8.7CNA v4.0 | 0.3% | 2026-06-22 | Fix |
| CVE-2025-2669 | IBM Db2 on Cloud Pak for Data token validation vulnerability | 6.0CNA v3.1 | 0.3% | 2026-06-22 | Fix |
| CVE-2025-71378 | picklescan remote code execution via Undetected cProfile.runctx in Pickle files | 7.8NVD v3.1 | 0.5% | 2026-06-21 | Fix |
| CVE-2025-71357 | picklescan arbitrary code execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand | 7.8NVD v3.1 | 0.4% | 2026-06-21 | Fix |
| CVE-2025-71351 | picklescan remote code execution via timeit.timeit Detection Bypass | 7.6CNA v4.0 | 0.6% | 2026-06-21 | Fix |
| CVE-2025-71348 | picklescan arbitrary code execution via torch.utils._config_module.load_config Bypass | 7.8NVD v3.1 | 0.6% | 2026-06-21 | Fix |
| CVE-2025-71379 | vLLM regular expression denial of service in multiple components | 7.5NVD v3.1 | 0.5% | 2026-06-20 | Fix |
| CVE-2025-71331 | Flowise cross-site scripting in Chat messages and Agent Workflows | 5.1CNA v4.0 | 0.3% | 2026-06-20 | Fix |
| CVE-2025-71326 | Avast Antivirus unquoted service path privilege escalation | 8.5CNA v4.0 | 0.2% | 2026-06-19 | Exploit code |
| CVE-2025-62821 | Microsoft HEIF Image Extension out-of-bounds read | 9.1CISA ADP v3.1 | 1.1% | 2026-06-19 | Exploit code |
| CVE-2025-7737 | DoS vulnerability in 10G iSCSI interface of Hitachi Virtual Storage Platform | 8.6CNA v3.1 | 0.5% | 2026-06-19 | Fix |
| CVE-2025-58175 | GeoServer has a server-side request forgery (SSRF) vulnerability in its XML Entity Resolution | 6.5CNA v3.1 | 0.3% | 2026-06-18 | Fix |
| CVE-2025-53114 | CometD has acknowledgement extension out of memory | 7.5CNA v3.1 | 0.7% | 2026-06-18 | Fix |
| CVE-2025-52465 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump page | 7.2CNA v3.1 | 0.6% | 2026-06-18 | Fix |
| CVE-2025-32437 | AutoGPT has a DoS vulnerability in MediaDurationBlock | 8.7CNA v4.0 | 0.3% | 2026-06-18 | Fix |
| CVE-2025-32436 | AutoGPT has a DoS vulnerability in AddAudioToVideoBlock | 7.1CNA v4.0 | 0.3% | 2026-06-18 | Fix |
| CVE-2025-32424 | AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock | 8.7CNA v4.0 | 0.3% | 2026-06-18 | Fix |
| CVE-2025-32422 | AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock | 8.7CNA v4.0 | 0.3% | 2026-06-18 | Fix |
| CVE-2025-32392 | AutoGPT has a DoS vulnerability in LoopVideoBlock | 8.7CNA v4.0 | 0.4% | 2026-06-18 | Fix |
| CVE-2025-27511 | GeoServer DB2 DataStore extension has a JNDI vulnerability via Store Connection | 7.2CNA v3.1 | 1.1% | 2026-06-18 | Fix |
| CVE-2025-15661 | libssh2 heap buffer over-read via sftp_symlink in sftp.c | 6.5NVD v3.1 | 0.6% | 2026-06-18 | Fix |
| CVE-2025-10560 | Silver Leaf Technologies Worksnaps client application hard-coded credentials | 9.3CNA v4.0 | 0.4% | 2026-06-18 | Fix |
| CVE-2025-71325 | picklescan Detection Bypass via STACK_GLOBAL Opcode Parsing logic flaw | 9.3CNA v4.0 | 0.6% | 2026-06-17 | Fix |
| CVE-2025-71323 | picklescan remote code execution via Unblocked ctypes module | 9.3CNA v4.0 | 1.0% | 2026-06-17 | Fix |
| CVE-2025-71322 | PickleScan Unsafe Globals Check Bypass via pty.spawn function | 8.7CNA v4.0 | 0.4% | 2026-06-17 | Fix |
| CVE-2025-71321 | picklescan arbitrary File Writing via distutils Module Bypass | 9.3CNA v4.0 | 0.8% | 2026-06-17 | Fix |
| CVE-2025-71320 | picklescan remote code execution via Incomplete Disallowed Inputs | 9.3CNA v4.0 | 0.8% | 2026-06-17 | Fix |
| CVE-2025-69189 | JobBank WordPress plugin broken access control | 7.3CNA v3.1 | 0.2% | 2026-06-17 | |
| CVE-2025-69179 | Support Ticket Management System WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69178 | Truemag WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69177 | Roneous WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69176 | ITactics WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69175 | Line Agency WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69174 | Etude WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69173 | Tipsy WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69172 | Resurs WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69171 | Orpheus WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69170 | Eventicity WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69168 | Spike WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69167 | Eros WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69166 | Gunslinger WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69165 | Choreo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69164 | Skyward WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69163 | WineShop WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69162 | Grecko WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69161 | Snowy WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69160 | Gita WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69159 | Printo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69158 | Granola WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69157 | Gamic WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69151 | Grand Car Rental WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-17 | |
| CVE-2025-69150 | Medeus WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69149 | Top Dog WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69148 | Quirky WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69147 | Putter WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69146 | Dom WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69145 | Gat WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69144 | Preservation WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69143 | Mission WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69142 | Abelle WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69141 | Kelly Young WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69140 | SweetDate Core WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-69139 | Car Zone WordPress theme arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69138 | Genemy WordPress theme privilege escalation | 8.8CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69137 | Genemy WordPress theme broken access control | 6.5CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69136 | Wanium WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69135 | Events Schedule - WordPress Events Calendar plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69131 | WordPress and WooCommerce Scraper Plugin, Import Data from Any Site arbitrary file download | 7.5CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69130 | Entrepreneur - Booking for Small Businesses WordPress theme PHP object injection | 8.8CNA v3.1 | 0.5% | 2026-06-17 | Fix |
| CVE-2025-69129 | WordPress and WooCommerce Scraper Plugin, Import Data from Any Site arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69128 | JobCareer WordPress theme arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69127 | Plumbing WordPress theme PHP object injection | 9.8CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69126 | Fortius WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69125 | Food Drop WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69124 | Especio WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69123 | Snow Club WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69122 | SeaFood Company WordPress theme PHP object injection | 9.8CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69121 | Deliciosa WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69120 | Dazzle WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69119 | Corbesier WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69118 | CopyPress WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69117 | Ingenioso WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69116 | Iona WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69115 | LuxMed Medicine and Healthcare Doctor WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-69114 | MaxiNet WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69113 | Nexio WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69112 | Planty WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69111 | Reisen WordPress theme PHP object injection | 9.8CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69110 | AirSupply WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69109 | Raider Spirit WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69108 | Hot Coffee WordPress theme PHP object injection | 9.8CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-69107 | Rosaleen WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69106 | Imba WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69105 | Modernee WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-69104 | Qreatix WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-17 | |
| CVE-2025-69103 | Brikk WordPress theme arbitrary content deletion vulnerability | 7.5CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-68524 | Avante WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-66391 | Citrix Cloud password reset workflow improper access control | 8.8CISA ADP v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-62340 | HCL iControl was affected by Inadequate Session Timeout vulnerability | 3.1CNA v3.1 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-60236 | Creatify WordPress theme PHP object injection | 9.8CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-60231 | The Hospital WordPress theme PHP object injection | 9.8CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-60230 | The Barber Shop WordPress theme PHP object injection | 9.8CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-60229 | Lagom WordPress theme PHP object injection | 9.8CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-60223 | WPBot Pro Wordpress Chatbot plugin arbitrary file deletion | 7.7CNA v3.1 | 0.5% | 2026-06-17 | |
| CVE-2025-60218 | PT Luxa Addons WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-60205 | ThemeREX Addons WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2026-06-17 | Fix |
| CVE-2025-60085 | Learnify WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-59872 | HCL ZIE for Web is affetced by an unrestricted file upload | 4.3CNA v3.1 | 0.5% | 2026-06-17 | Fix |
| CVE-2025-59563 | Sonaar WordPress theme privilege escalation | 8.8CNA v3.1 | 0.4% | 2026-06-17 | Fix |
| CVE-2025-59560 | Sonaar WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-59554 | Advanced Ads Tracking WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-06-17 | Fix |
| CVE-2025-58954 | HomeRoofer WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | Fix |
| CVE-2025-58953 | Joly WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | Fix |
| CVE-2025-58952 | Neuronet WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-17 | Fix |
| CVE-2025-58924 | Geya WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-17 | |
| CVE-2025-49403 | Premium Age Verification / Restriction for WordPress plugin arbitrary file download | 7.5CNA v3.1 | 0.3% | 2026-06-17 | |
| CVE-2025-48643 | Google Android improper input validation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-17 | Fix |
| CVE-2025-48640 | Google Android multiple locations privilege escalation | 8.0CISA ADP v3.1 | 0.1% | 2026-06-17 | Fix |
| CVE-2025-48617 | Google Android CarrierConfigLoader.java privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-17 | Exploit codeFix |
| CVE-2025-48571 | Google Android btm_sec.cc information disclosure | 4.3CISA ADP v3.1 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-32748 | Dell PowerFlex rack open redirect | 4.3CNA v3.1 | 0.1% | 2026-06-17 | Fix |
| CVE-2025-31013 | Themify Folo WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-06-17 | |
| CVE-2025-26240 | Pdfkit: Path traversal in from_string | 8.4CISA ADP v3.1 | 0.4% | 2026-06-17 | Exploit code |
| CVE-2025-15657 | School Management WordPress plugin insecure direct object references (IDOR) | 5.3CNA v3.1 | 0.2% | 2026-06-17 | |
| CVE-2025-15642 | Netskope Client Service Insufficient Access Controls | 6.8CNA v4.0 | 0.1% | 2026-06-17 | Fix |
| CVE-2025-15641 | Netskope Client Exposed IOCTL with Insufficient Access Controls | 6.8CNA v4.0 | 0.2% | 2026-06-17 | Fix |
| CVE-2025-71261 | Harvester's SUSE Virtualization Registration client vulnerable to MITM and DOS | 8.6CNA v3.1 | 0.2% | 2026-06-16 | Fix |
| CVE-2025-68045 | WP Event SOlution WordPress plugin broken access control | 7.5CNA v3.1 | 0.2% | 2026-06-16 | Fix |
| CVE-2025-14272 | Rockwell Automation FactoryTalk Analytics PavilionX API endpoints missing authorization | 8.3CNA v4.0 | 0.2% | 2026-06-16 | Fix |
| CVE-2025-13036 | Rockwell Automation FactoryTalk Historian Site Edition authentication bypass | 9.2CNA v4.0 | 0.3% | 2026-06-16 | |
| CVE-2025-11694 | Rockwell Automation CompactLogix 5370 CIP protocol denial of service | 8.7CNA v4.0 | 0.2% | 2026-06-16 | Fix |
| CVE-2025-10262 | An unsanitized format validation vulnerability in Nokia SR Linux | 6.3CISA ADP v3.1 | 0.1% | 2026-06-16 | Fix |
| CVE-2025-9912 | A local privilege escalation vulnerability in Nokia SR Linux | 6.3CISA ADP v3.1 | 0.1% | 2026-06-16 | Fix |
| CVE-2025-70102 | Roy Marples NetworkConfiguration/dhcpcd null pointer dereference | 6.3CISA ADP v3.1 | 0.2% | 2026-06-15 | Fix |
| CVE-2025-69332 | Bookify WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-06-15 | Fix |
| CVE-2025-68872 | Eli's WordCents adSense Widget with Analytics WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-68851 | Okay Toolkit WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-68840 | iRobots.txt SEO WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-68713 | An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application' | 8.0CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-68049 | bunny.net WordPress plugin broken access control | 6.3CNA v3.1 | 0.2% | 2026-06-15 | Fix |
| CVE-2025-64215 | MasterStudy LMS Pro WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-06-15 | Fix |
| CVE-2025-60175 | PopAd WordPress plugin server side request forgery (SSRF) | 4.4CNA v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-59133 | Projectopia WordPress plugin insecure direct object references (IDOR) | 7.5CNA v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-56814 | OpenCPN wxExecute function command injection | 7.8CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55663 | gpac null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55661 | gpac Opus audio stream parser component heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-55660 | gpac gf_opus_read_length function stack-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-55652 | gpac gf_isom_vp_config_new function heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-55650 | gpac gf_node_get_tag function use-after-free | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55649 | gpac gf_media_map_esd function null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55648 | gpac gf_opus_parse_packet_header function heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-55647 | gpac integer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55645 | gpac gf_cenc_set_pssh function heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.3% | 2026-06-15 | |
| CVE-2025-55644 | gpac gf_node_get_tag function use-after-free | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55643 | gpac TrackWriter handling component null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-55642 | gpac divide by zero | 6.5CISA ADP v3.1 | 0.5% | 2026-06-15 | |
| CVE-2025-55641 | gpac gf_isom_copy_sample_info function null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-15 | |
| CVE-2025-15659 | Elizaibots WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-06-15 | |
| CVE-2025-15658 | WP Emmet WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.1% | 2026-06-15 | |
| CVE-2025-15546 | Iptanus File Upload WordPress plugin file Overwrite via race condition | 5.4CISA ADP v3.1 | 0.2% | 2026-06-14 | Fix |
| CVE-2025-14098 | Avira Antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-9033 | Avira Antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3) | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-9032 | Avira Antivirus engine heap buffer OOB read when scanning a malformed PE file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7019 | Avast Antivirus stack overflow when scanning a malformed Office Open XML file | 5.5CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7018 | Avira Antivirus engine null pointer dereference when scanning a malformed PE file | 5.5CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7017 | Avira Antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7011 | Avast Antivirus heap OOB when scanning a malformed zip file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7010 | Avast Antivirus stack overflow when scanning a malformed PDF file | 5.5CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7009 | Avast Antivirus heap buffer OOB read when scanning a malformed PE file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7008 | Avast Antivirus heap buffer OOB read when scanning a malformed PE file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7006 | Avast Antivirus use of stack memory after free when scanning a malformed PE file | 5.5CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7005 | Avast Antivirus infinite recursion when scanning a malformed PE file | 5.5CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7004 | Avast Antivirus heap buffer OOB write when scanning a malformed PE file | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7003 | Avira Antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1) | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-7002 | Avira Antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2) | 7.8CNA v3.1 | 0.1% | 2026-06-12 | Fix |
| CVE-2025-46315 | Apple macOS insecure permissions | 7.5CISA ADP v3.1 | 0.3% | 2026-06-11 | Fix |
| CVE-2025-46313 | Apple macOS sensitive information in log files | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-46308 | Apple macOS information disclosure | 5.3CISA ADP v3.1 | 0.2% | 2026-06-11 | Fix |
| CVE-2025-46293 | Apple macOS link following | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-43339 | Apple macOS information disclosure | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-43278 | Apple macOS symlink following | 5.5CISA ADP v3.1 | 0.2% | 2026-06-11 | Fix |
| CVE-2025-31272 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-30459 | Apple macOS personal information exposure | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-30431 | Apple macOS protection mechanism failure | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-24284 | Apple macOS sandbox escape | 8.8CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-24268 | Apple macOS path traversal | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-24165 | Apple macOS insecure permissions | 5.5CISA ADP v3.1 | 0.1% | 2026-06-11 | Fix |
| CVE-2025-7064 | Freelance Security Lock Access to Windows OS | 5.6CNA v4.0 | 0.1% | 2026-06-11 | |
| CVE-2025-71330 | image-size denial of service via Malformed ICNS Image Parsing | 8.7CNA v4.0 | 0.4% | 2026-06-10 | Fix |
| CVE-2025-71329 | image-size denial of service via infinite loop in JXL/HEIF parser | 8.7CNA v4.0 | 0.4% | 2026-06-10 | Fix |
| CVE-2025-66281 | QNAP QTS and QuTS hero null pointer dereference | 6.9CNA v4.0 | 0.5% | 2026-06-10 | Fix |
| CVE-2025-66280 | QNAP QTS and QuTS hero integer overflow | 5.1CNA v4.0 | 0.4% | 2026-06-10 | Fix |
| CVE-2025-66279 | QNAP QTS and QuTS hero OS command injection | 8.6CNA v4.0 | 1.1% | 2026-06-10 | Fix |
| CVE-2025-66276 | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later | 9.2CNA v4.0 | 0.3% | 2026-06-10 | Fix |
| CVE-2025-66273 | QNAP QTS and QuTS hero OS command injection | 8.6CNA v4.0 | 1.1% | 2026-06-10 | Fix |
| CVE-2025-62851 | QNAP License Center path traversal | 4.6CNA v4.0 | 0.3% | 2026-06-10 | Fix |
| CVE-2025-62850 | QNAP Systems QTS null pointer dereference in networkRequest.cgi | 5.1CNA v4.0 | 0.4% | 2026-06-10 | Fix |
| CVE-2025-59382 | QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) | 1.2CNA v4.0 | 0.4% | 2026-06-10 | Exploit code |
| CVE-2025-58468 | QNAP Notification Center cross-site request forgery | 5.1CNA v4.0 | 0.2% | 2026-06-10 | Fix |
| CVE-2025-10238 | Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS out-of-bounds write | 8.4CNA v4.0 | 0.1% | 2026-06-10 | Fix |
| CVE-2025-10237 | Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS weak cryptographic algorithm | 8.4CNA v4.0 | 0.1% | 2026-06-10 | Fix |
| CVE-2025-8444 | Animation Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-06-10 | |
| CVE-2025-6254 | Doctreat Core WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.5% | 2026-06-10 | Exploit codeFix |
| CVE-2025-71319 | image-size denial of service via infinite loop in JXL/HEIF parser | 8.7CNA v4.0 | 0.7% | 2026-06-09 | Fix |
| CVE-2025-67862 | Fortinet FortiOS and FortiProxy debug interface vulnerability | 6.0CNA v3.1 | 0.1% | 2026-06-09 | Fix |
| CVE-2025-62858 | QNAP QTS and QuTS hero stack-based buffer overflow | 5.1CNA v4.0 | 0.4% | 2026-06-09 | Fix |
| CVE-2025-55659 | gpac ctts_box_write function null pointer dereference | 6.5CISA ADP v3.1 | 0.3% | 2026-06-09 | |
| CVE-2025-55658 | gpac denial of service | 6.5CISA ADP v3.1 | 0.3% | 2026-06-09 | |
| CVE-2025-55657 | gpac gf_odf_vvc_cfg_write_bs function null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2026-06-09 | |
| CVE-2025-55651 | gpac gf_isom_get_user_data_count function null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2026-06-09 | |
| CVE-2025-54509 | AMD EPYC™ 9004 Series Processors Input-Output Memory Management Unit improper access control | 4.0CNA v4.0 | 0.1% | 2026-06-09 | |
| CVE-2025-52293 | gpac denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-06-09 | |
| CVE-2025-52292 | gpac filein_process function stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.5% | 2026-06-09 | |
| CVE-2025-40808 | Siemens SIPROTEC 5 6MD84 (CP300) unrestricted file upload | 6.9CNA v4.0 | 0.2% | 2026-06-09 | Fix |
| CVE-2025-10263 | Arm C1-Ultra race condition | 9.1CISA ADP v3.1 | 0.5% | 2026-06-09 | Fix |
| CVE-2025-71315 | In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Convert to DRM's vblank timer Replace vkms' vblank timer with the DRM implementation. The DRM code is identical in concept, but differs in implementation. Vblank timers are covered in vblank helpers and initializer macr | 5.5v3.1 | 0.1% | 2026-06-08 | Fix |
| CVE-2025-12656 | wpvividplugins WPvivid Backup and Migration staging site deletion function vulnerability | 3.8CNA v3.1 | 0.4% | 2026-06-06 | Fix |
| CVE-2025-71318 | Riello UPS Netman-204 NetMan 204 missing authentication for Administrative functions | 9.3CNA v4.0 | 0.5% | 2026-06-05 | Exploit code |
| CVE-2025-71317 | Riello UPS Netman-204 NetMan 204 Hard-coded backdoor Credentials | 9.3CNA v4.0 | 0.4% | 2026-06-05 | Exploit code |
| CVE-2025-59174 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation. | 7.1CNA v4.0 | 0.2% | 2026-06-05 | Fix |
| CVE-2025-5090 | Arista CloudVision Exchange Cluster Instability via Unexpected Switch messages | 7.1CNA v4.0 | 0.2% | 2026-06-05 | Fix |
| CVE-2025-5089 | Arista EOS SysDB agent denial of service via Malformed CVX Client/Server messages | 7.1CNA v4.0 | 0.2% | 2026-06-05 | Fix |
| CVE-2025-5088 | Arista CloudVision Exchange (CVX) Cluster privilege escalation via MCS Redis Session | 8.7CNA v4.0 | 0.3% | 2026-06-05 | Fix |
| CVE-2025-71316 | SQLite sqldiff remote code execution via argument injection | 9.2CNA v4.0 | 0.4% | 2026-06-04 | Fix |
| CVE-2025-69755 | Neterbit NW-431F Router at_command.asp interface OS command injection | 8.2CNA v3.1 | 0.5% | 2026-06-04 | |
| CVE-2025-67448 | Neterbit NW-431F Router SMS module stored cross-site scripting | 7.1CNA v3.1 | 0.2% | 2026-06-04 | |
| CVE-2025-67447 | Neterbit NW-431F Router network diagnosis ping module OS command injection | 9.8CNA v3.1 | 1.0% | 2026-06-04 | |
| CVE-2025-67446 | Neterbit NW-431F Router improper authentication | 9.8CNA v3.1 | 0.5% | 2026-06-04 | |
| CVE-2025-65640 | Arket Globe Document Intelligence task progress page vulnerability | 6.3CISA ADP v3.1 | 0.2% | 2026-06-04 | |
| CVE-2025-62338 | HCL BigFix Cloud Lifecycle Management is affected by lack of input validation | 3.3CNA v3.1 | 0.1% | 2026-06-04 | |
| CVE-2025-59874 | HCL Hive Telco Observability is affected by a Required directives missing from the CSP | 8.1CNA v3.1 | 0.3% | 2026-06-04 | |
| CVE-2025-52612 | HCL iControl was affected by Export CSV CSV injection | 7.1CNA v3.1 | 0.2% | 2026-06-04 | Fix |
| CVE-2025-52611 | HCL iControl was affected by unhandled exception Stack Trace Disclosure | 3.1CNA v3.1 | 0.2% | 2026-06-04 | Fix |
| CVE-2025-52609 | HCL iControl was affected by Missing Security headers vulnerability | 3.7CNA v3.1 | 0.2% | 2026-06-04 | Fix |
| CVE-2025-52608 | HCL iControl was affected by Missing Cookie attributes vulnerability | 3.1CNA v3.1 | 0.1% | 2026-06-04 | Fix |
| CVE-2025-52606 | HCL iControl was affected by Weak input validation vulnerability | 4.3CNA v3.1 | 0.2% | 2026-06-04 | Fix |
| CVE-2025-46638 | Dell BSAFE SSL-J resource exhaustion | 7.5CNA v3.1 | 0.3% | 2026-06-04 | Fix |
| CVE-2025-12694 | Local privilege escalation in VPN Client | 8.5CNA v4.0 | 0.1% | 2026-06-04 | Fix |
| CVE-2025-8873 | Arista EOS Dataplane denial of service via Malformed IPsec Packet | 8.7CNA v4.0 | 0.4% | 2026-06-04 | Fix |
| CVE-2025-71314 | Linux kernel Panthor GPU driver denial of service | 5.5v3.1 | 0.1% | 2026-06-03 | Fix |
| CVE-2025-71313 | Linux kernel PCI endpoint NTB driver null pointer dereference | 5.5NVD v3.1 | 0.1% | 2026-06-03 | Fix |
| CVE-2025-70101 | Gkostka Lwext4 out-of-bounds read | 6.5CISA ADP v3.1 | 0.3% | 2026-06-03 | |
| CVE-2025-70100 | Gkostka Lwext4 divide by zero | 5.5CISA ADP v3.1 | 0.2% | 2026-06-03 | |
| CVE-2025-60477 | gf_filter_pid_resolve_file_template_ex function null pointer dereference | 5.0CISA ADP v3.1 | 0.1% | 2026-06-03 | |
| CVE-2025-41259 | SWUpdate Untrusted Script Execution via Signed Update TOCTOU | 7.3CNA v4.0 | 0.1% | 2026-06-03 | Fix |
| CVE-2025-15656 | School Management WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.2% | 2026-06-03 | |
| CVE-2025-15655 | School Management WordPress plugin SQL injection | 7.6CNA v3.1 | 0.2% | 2026-06-03 | |
| CVE-2025-15654 | Prague WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-06-03 | Fix |
| CVE-2025-14774 | ABB T-MAC Plus communication analysis between the Card Reader and TP2CardReaderService daemon | 7.2CNA v4.0 | 0.2% | 2026-06-03 | Fix |
| CVE-2025-14773 | Stored cross-site scripting in ABB T-MAC Plus web application | 7.2CNA v4.0 | 0.2% | 2026-06-03 | Fix |
| CVE-2025-14772 | Broken access control in ABB T-MAC Plus web application | 7.3CNA v4.0 | 0.3% | 2026-06-03 | Fix |
| CVE-2025-14771 | File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server Default IIS Web Site | 7.3CNA v4.0 | 0.3% | 2026-06-03 | Fix |
| CVE-2025-69369 | Racquet WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-02 | |
| CVE-2025-68886 | Cookiteer WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-02 | |
| CVE-2025-64390 | Sony PS4 PlayStation privilege escalation | 7.4CISA ADP v3.1 | 0.1% | 2026-06-02 | Fix |
| CVE-2025-58897 | Fermentio WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-02 | |
| CVE-2025-58707 | Spin WordPress theme local file inclusion | 8.1CNA v3.1 | 0.3% | 2026-06-02 | |
| CVE-2025-58705 | Crafti WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-02 | |
| CVE-2025-58024 | Accordion FAQ WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.3% | 2026-06-02 | |
| CVE-2025-53440 | Confidant WordPress theme local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-06-02 | |
| CVE-2025-53346 | Thim Core WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2026-06-02 | |
| CVE-2025-53345 | Thim Core WordPress plugin arbitrary plugin installation vulnerability | 8.8CNA v3.1 | 0.2% | 2026-06-02 | |
| CVE-2025-53302 | Constructor WordPress theme broken access control | 5.3CNA v3.1 | 0.2% | 2026-06-02 | |
| CVE-2025-53209 | Masteriyo LMS PRO WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.3% | 2026-06-02 | Fix |
| CVE-2025-52766 | Printeers Print and Ship WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-06-02 | |
| CVE-2025-52759 | Accordion FAQ WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-06-02 | |
| CVE-2025-15653 | Dräger Zeus IE Anesthesia Workstation USB interface privilege escalation | 7.0CNA v4.0 | 0.2% | 2026-06-02 | Fix |
| CVE-2025-5085 | WP Nano AD WordPress plugin stored cross-site scripting | 5.5CNA v3.1 | 0.2% | 2026-06-02 | |
| CVE-2025-70099 | lwext4 ext4 directory entry parser null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2026-06-01 | |
| CVE-2025-60495 | GPAC Project MP4Box gf_media_get_color_info function null pointer dereference | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | |
| CVE-2025-60486 | dasher_process function heap use-after-free | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | |
| CVE-2025-60485 | GPAC Project MP4Box gf_isom_apple_set_tag_ex function null pointer dereference | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | |
| CVE-2025-60483 | gf_ac4_pres_b_4_back_channels_present function null pointer dereference | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | |
| CVE-2025-60481 | gf_odf_ac4_cfg_dsi_v1 function null pointer dereference | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | |
| CVE-2025-59614 | Qualcomm Snapdragon out-of-bounds write in Windows Compute | 6.7CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59613 | Qualcomm Snapdragon stack-based buffer overflow in Windows Compute | 6.7CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59612 | Qualcomm Snapdragon stack-based buffer overflow in Windows Compute | 6.7CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59611 | Qualcomm Snapdragon out-of-bounds write in Core services | 6.7CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59610 | Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in Camera driver | 6.4CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59609 | Qualcomm Snapdragon buffer over-read in WLAN Host Communication | 5.5CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59606 | Qualcomm Snapdragon null pointer dereference in HLOS | 7.8CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59605 | Qualcomm Snapdragon out-of-bounds write in HLOS | 7.8CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59604 | Qualcomm Snapdragon null pointer dereference in SPS Applications | 7.8CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-59601 | Qualcomm Snapdragon exposure of sensitive information | 6.5CNA v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-55664 | m2tsdmx_send_packet function heap-based buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-06-01 | |
| CVE-2025-48652 | Google Android InstallRepository.kt privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-48649 | Google Android multiple locations privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-48648 | Google Android NotificationManagerService.java denial of service | 5.5CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-48616 | Google Android KeyguardViewMediator.java information disclosure | 3.3CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-48595 | Android Framework integer overflow | 8.4CISA ADP v3.1 | 1.7% | 2026-06-01 | KEVExploit codeFix |
| CVE-2025-48570 | Google Android PipTaskOrganizer.java privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-32348 | Google Android multiple locations privilege escalation | 7.8v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-26418 | Google Android CarDevicePolicyService.java privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-22426 | Google Android ComputerEngine.java privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-22424 | Google Android multiple locations privilege escalation | 7.8v3.1 | 0.1% | 2026-06-01 | Fix |
| CVE-2025-41281 | Waterfall WF-500 OS command injection | 7.8NVD v3.1 | 0.5% | 2026-05-29 | Fix |
| CVE-2025-41280 | Waterfall WF-500 relative path traversal | 7.8NVD v3.1 | 0.1% | 2026-05-29 | Fix |
| CVE-2025-41279 | Waterfall WF-500 OS command injection | 7.2NVD v3.1 | 0.9% | 2026-05-29 | Fix |
| CVE-2025-41278 | Waterfall WF-500 out-of-bounds read | 7.8NVD v3.1 | 0.1% | 2026-05-29 | Fix |
| CVE-2025-41277 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41276 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41275 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41274 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41273 | Waterfall WF-500 authentication bypass | 9.8NVD v3.1 | 0.4% | 2026-05-29 | Fix |
| CVE-2025-41272 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41271 | Waterfall WF-500 relative path traversal | 7.5NVD v3.1 | 0.4% | 2026-05-29 | Fix |
| CVE-2025-41270 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41269 | Waterfall WF-500 OS command injection | 9.8NVD v3.1 | 1.4% | 2026-05-29 | Fix |
| CVE-2025-41268 | Waterfall WF-500 relative path traversal | 9.1NVD v3.1 | 0.4% | 2026-05-29 | Fix |
| CVE-2025-41267 | Waterfall WF-500 OS command injection | 7.2NVD v3.1 | 0.9% | 2026-05-29 | Fix |
| CVE-2025-41266 | Waterfall WF-500 OS command injection | 7.2NVD v3.1 | 0.9% | 2026-05-29 | Fix |
| CVE-2025-41265 | Waterfall WF-500 OS command injection | 7.2NVD v3.1 | 0.9% | 2026-05-29 | Fix |
| CVE-2025-14042 | Automotive Car Dealership Business WordPress theme stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-05-29 | Fix |
| CVE-2025-12714 | Rank Math SEO WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.4% | 2026-05-29 | Fix |
| CVE-2025-11993 | WooCommerce Infinite Scroll and Ajax Pagination WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.4% | 2026-05-29 | |
| CVE-2025-11262 | Link Whisper Free WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2026-05-29 | Fix |
| CVE-2025-48977 | Apache Ignite: REST HTTP arbitrary file read | 8.5CNA v4.0 | 0.5% | 2026-05-28 | Fix |
| CVE-2025-71312 | Linux kernel NTFS3 filesystem driver memory leak | 5.5NVD v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-71311 | Linux kernel NTFS3 folio initialization vulnerability | 8.2CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-71309 | Linux kernel NTFS3 compressed file reading deadlock | 5.5NVD v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-71308 | Linux kernel accel/amdxdna null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-71307 | Linux kernel Panthor GPU driver firmware unplug null pointer dereference | 5.5NVD v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-71306 | Linux kernel IMA integrity measurement out-of-bounds read | 7.1NVD v3.1 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-71305 | In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a slight chance we may end up with the wrong payload mask due to overflow if the delayed_destroy_work ends up coming into play after a DP 2.1 mon | 5.5NVD v3.1 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-71304 | Linux kernel Smack DOI handling vulnerability | 5.5NVD v3.1 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-71303 | Linux kernel accel/amdxdna race condition | 4.7NVD v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-70116 | GPAC MP4Box: null pointer dereference | 4.3CISA ADP v3.1 | 0.4% | 2026-05-27 | |
| CVE-2025-70103 | libjxl heap-based buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2026-05-27 | Fix |
| CVE-2025-69600 | Raynet rvia RayVentory Scan Engine command injection | 7.8CISA ADP v3.1 | 0.8% | 2026-05-27 | |
| CVE-2025-68712 | SpSoft AppLock lockscreen overlay authentication bypass | 5.5CISA ADP v3.1 | 0.1% | 2026-05-27 | |
| CVE-2025-67903 | Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass. | 5.3CISA ADP v3.1 | 0.2% | 2026-05-27 | |
| CVE-2025-66593 | Synology Assistant origin validation error | 6.1CNA v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-66592 | Synology Active Backup for Business Agent An origin validation error | 6.1CNA v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-52747 | Themebox - Digital Products Ecommerce WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-05-27 | |
| CVE-2025-41670 | Phoenix Contact AXC F 1152 untrusted search path | 8.7CNA v4.0 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-41669 | Phoenix Contact AXC F 1152 insufficient verification of data authenticity | 8.7CNA v4.0 | 0.2% | 2026-05-27 | Fix |
| CVE-2025-30028 | Synology Active Backup for Business SQL injection | 8.6CNA v3.1 | 0.4% | 2026-05-27 | Fix |
| CVE-2025-22741 | Felan Framework WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-05-27 | |
| CVE-2025-15649 | IO::Uncompress::Unzip zip header date parsing uncaught exception | 5.5CISA ADP v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-14713 | Synology C2 Identity Edge Server exposed dangerous method | 7.5CNA v3.1 | 0.5% | 2026-05-27 | Fix |
| CVE-2025-14481 | Yoast SEO WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-13593 | Synology ActiveProtect Agent origin validation error | 6.1CNA v3.1 | 0.1% | 2026-05-27 | Fix |
| CVE-2025-13392 | Synology DiskStation Manager (DSM) SSO improper check for exceptional conditions | 8.1CNA v3.1 | 0.5% | 2026-05-27 | Fix |
| CVE-2025-13167 | Synology Contacts cross-site scripting | 5.4CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-12686 | Synology BeeStation OS AdminCenter buffer overflow | 9.8CNA v3.1 | 2.8% | 2026-05-27 | Fix |
| CVE-2025-10466 | Synology Safe Access cross-site scripting | 5.9CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-3633 | IBM Cognos Analytics cross-site scripting | 5.4CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-0898 | Xpro Elementor Addons - Pro WordPress plugin arbitrary file read | 6.5CNA v3.1 | 0.3% | 2026-05-27 | Fix |
| CVE-2025-71310 | backdropcms GDPR cookies module for Backdrop CMS cross-site scripting | 1.8CNA v4.0 | 0.3% | 2026-05-26 | Fix |
| CVE-2025-68711 | AppLockZ App Lock and Fingerprint Lock lockscreen overlay authentication bypass | 2.4CISA ADP v3.1 | 0.2% | 2026-05-26 | |
| CVE-2025-68710 | Easyelife App Lock lockscreen overlay authentication bypass | 2.4CISA ADP v3.1 | 0.2% | 2026-05-26 | |
| CVE-2025-68709 | SailingLab AppLock BrowserMainActivity cross-site scripting | 5.2CISA ADP v3.1 | 0.2% | 2026-05-26 | |
| CVE-2025-68708 | SailingLab AppLock lockscreen overlay authentication bypass | 2.4CISA ADP v3.1 | 0.2% | 2026-05-26 | |
| CVE-2025-46307 | Apple macOS logic flaw | 5.5CISA ADP v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-46284 | Apple macOS race condition | 7.0CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-46280 | Apple macOS out-of-bounds read | 5.5CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-43451 | Apple macOS insecure permissions | 5.5CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-43306 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-43290 | Apple macOS incorrect permission assignment | 5.5CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-43289 | Apple macOS improper authorization | 5.5CISA ADP v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-36221 | Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS) Cyclops | 5.3CNA v3.1 | 0.3% | 2026-05-26 | Fix |
| CVE-2025-36220 | Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS) Cyclops | 4.3CNA v3.1 | 0.3% | 2026-05-26 | Fix |
| CVE-2025-36148 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-36145 | IBM watsonx.data Lakehouse vulnerability | 5.4CNA v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-36126 | IBM Cognos Analytics is affected by cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-33221 | NVIDIA GeForce incorrect permission assignment | 4.4CNA v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-14361 | Woocommerce Envato Affiliates WordPress plugin settings Change vulnerability | 7.1CNA v3.1 | 0.2% | 2026-05-26 | |
| CVE-2025-14290 | IBM webMethods Integration Sever is vulnerable to server-side request forgery | 5.4CNA v3.1 | 0.2% | 2026-05-26 | Fix |
| CVE-2025-13755 | IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets | 5.5CNA v3.1 | 0.1% | 2026-05-26 | Fix |
| CVE-2025-11482 | B&R Industrial Automation PPT30 Operating System OPC-UA Server used resource exhaustion | 8.7CNA v4.0 | 0.3% | 2026-05-26 | Fix |
| CVE-2025-62745 | Team Showcase WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-05-25 | |
| CVE-2025-46371 | Dell PowerFlex Manager weak cryptographic algorithm | 3.6CNA v3.1 | 0.1% | 2026-05-22 | Fix |
| CVE-2025-45145 | Follett Software's Destiny Library Manager path traversal | 7.5CISA ADP v3.1 | 0.7% | 2026-05-22 | |
| CVE-2025-32751 | Dell PowerFlex Manager insecure storage of sensitive information | 5.5CNA v3.1 | 0.1% | 2026-05-22 | Fix |
| CVE-2025-32749 | Dell PowerFlex Manager incorrect default permissions | 5.3CNA v3.1 | 0.1% | 2026-05-22 | Fix |