CVE-2025 records published after 2025
Page four of six: records 3,001 to 4,000 of the 5,305 published after 2025, newest first. The first page carries the figures for After 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-32393 | AutoGPT has a DoS vulnerability in ReadRSSFeedBlock | 8.7CNA v4.0 | 0.4% | 2026-02-05 | |
| CVE-2025-15557 | Improper certificate validation in TP-Link Tapo H100 and P100 allows man-in-the-middle Attack | 7.5CNA v4.0 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15551 | LAN code execution on TP-Link Archer MR200, Archer C20, TL-WR850N and Tl-wr845n | 5.9CNA v4.0 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15343 | Tanium addressed an incorrect default permissions vulnerability in Enforce | 6.5CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15342 | Tanium addressed an improper access controls vulnerability in Reputation | 4.3CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15341 | Tanium addressed an incorrect default permissions vulnerability in Benchmark | 6.5CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15340 | Tanium addressed an incorrect default permissions vulnerability in Comply | 6.5CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15339 | Tanium addressed an incorrect default permissions vulnerability in Discover | 6.5CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15338 | Tanium addressed an incorrect default permissions vulnerability in Partner Integration | 6.5CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15337 | Tanium addressed an incorrect default permissions vulnerability in Patch | 6.5CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15336 | Tanium addressed an incorrect default permissions vulnerability in Performance | 6.5CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15335 | Tanium addressed an information disclosure vulnerability in Threat Response | 4.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15334 | Tanium addressed an information disclosure vulnerability in Threat Response | 4.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15333 | Tanium addressed an information disclosure vulnerability in Threat Response | 4.3CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15332 | Tanium addressed an information disclosure vulnerability in Threat Response | 4.9CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15331 | Tanium addressed an uncontrolled resource consumption vulnerability in Connect | 4.3CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15330 | Tanium addressed an improper input validation vulnerability in Deploy | 8.8CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15329 | Tanium addressed an information disclosure vulnerability in Threat Response | 4.9CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15328 | Tanium addressed an improper link resolution before file access vulnerability in Enforce | 5.0CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15327 | Tanium addressed an improper access controls vulnerability in Deploy | 4.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15326 | Tanium addressed an improper access controls vulnerability in Patch | 4.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15325 | Tanium addressed an improper input validation vulnerability in Discover | 6.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15324 | Tanium addressed a local privilege escalation vulnerability in Engage | 6.6CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15323 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance | 3.7CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15321 | Tanium addressed an improper input validation vulnerability in Tanium Appliance | 2.7CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-15312 | Tanium addressed an improper output sanitization vulnerability in TanOS | 6.6CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-15311 | Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance | 7.8CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15289 | Tanium addressed an improper access controls vulnerability in Interact | 3.1CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-15080 | Mitsubishi Electric MELSEC iQ-R Series R08PCPU Input vulnerability improper input validation | 8.8CNA v4.0 | 0.6% | 2026-02-05 | Fix |
| CVE-2025-14150 | IBM webMethods Integration (on prem) system information disclosure | 6.5CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-14079 | ELEX WordPress HelpDesk and Customer Ticketing System WordPress plugin missing authorization | 5.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-13491 | IBM App Connect Enterprise Certified Container information disclosure | 5.1CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-13416 | metagauss ProfileGrid missing authorization | 4.3CNA v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-13379 | A SQL injection vulnerability has been addressed in IBM Aspera Console | 8.6CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-13192 | Popup builder with Gamification WordPress plugin unauthenticated SQL injection | 8.2CNA v3.1 | 0.4% | 2026-02-05 | Fix |
| CVE-2025-12131 | silabs.com Ember ZNet SDK truncated 802.15.4 packet leads to denial of service | 5.3CNA v4.0 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-11730 | Zyxel ATP series firmware OS command injection | 7.2CNA v3.1 | 1.4% | 2026-02-05 | Fix |
| CVE-2025-10314 | Mitsubishi Electric FREQSHIP-mini incorrect default permissions | 8.8CNA v3.1 | 0.2% | 2026-02-05 | Fix |
| CVE-2025-10258 | A time-based SQL injection vulnerability in Infinera DNA | 6.3CISA ADP v3.1 | 0.3% | 2026-02-05 | Fix |
| CVE-2025-71199 | Linux kernel at91-sama5d2_adc use-after-free | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71198 | Linux kernel ST LSM6DSx IMU driver null pointer dereference | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71197 | Linux kernel therm off-by-one error | – | 0.3% | 2026-02-04 | Fix |
| CVE-2025-71196 | Linux kernel STM32 USB PHY controller driver vulnerability | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71195 | Linux kernel Xilinx XDMA driver vulnerability | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71194 | Linux kernel Btrfs filesystem deadlock | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71193 | Linux kernel qcom-qusb2 null pointer dereference | – | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71192 | Linux kernel ALSA AC97 controller driver double free | 7.0CNA v3.1 | 0.1% | 2026-02-04 | Fix |
| CVE-2025-71031 | Melang Melon denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-02-04 | |
| CVE-2025-70997 | eladmin incorrect authorization | 6.5NVD v3.1 | 0.2% | 2026-02-04 | |
| CVE-2025-70545 | Belden Ppc 2k05x A stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-02-04 | |
| CVE-2025-69621 | Comic Book Reader file import path traversal | 8.1CISA ADP v3.1 | 0.5% | 2026-02-04 | |
| CVE-2025-69620 | Ntoolslab Office Reader Moo Chan Song v4.5.7 path traversal | 5.0CISA ADP v3.1 | 0.3% | 2026-02-04 | |
| CVE-2025-69618 | Coto.world Coto file import process of Tarot arbitrary file write | 6.5NVD v3.1 | 0.4% | 2026-02-04 | |
| CVE-2025-69215 | OpenSTAManager has an SQL injection in the Stampe module | 8.7CNA v4.0 | 0.4% | 2026-02-04 | Exploit code |
| CVE-2025-69213 | OpenSTAManager has a SQL injection in ajax_complete.php (get_sedi endpoint) | 8.7CNA v4.0 | 0.4% | 2026-02-04 | Exploit code |
| CVE-2025-68699 | NanoMQ shared subscription parsing null pointer dereference | 6.5CNA v3.1 | 0.3% | 2026-02-04 | |
| CVE-2025-64712 | Unstructured has path traversal via Malicious MSG Attachment that allows arbitrary file write | 9.8CNA v3.1 | 0.7% | 2026-02-04 | Fix |
| CVE-2025-62616 | AutoGPT has SSRF vulnerability in SendDiscordFileBlock | 9.3CNA v4.0 | 0.4% | 2026-02-04 | |
| CVE-2025-62615 | AutoGPT has SSRF vulnerability in ReadRSSFeedBlock | 9.3CNA v4.0 | 0.4% | 2026-02-04 | |
| CVE-2025-61917 | n8n Unsafe Buffer Allocation allows In-Process Memory Disclosure in Task Runner | 7.7CNA v3.1 | 0.4% | 2026-02-04 | Fix |
| CVE-2025-59818 | Zenitel TCIS-3+ authenticated remote code execution via the file name of an uploaded file | 9.8NVD v3.1 | 0.6% | 2026-02-04 | Fix |
| CVE-2025-41085 | Stored cross-site scripting (XSS) in Apidog Web Platform | 5.1CNA v4.0 | 0.3% | 2026-02-04 | |
| CVE-2025-29867 | Hancom Office 2018 type confusion | 8.5CNA v4.0 | 0.3% | 2026-02-04 | Fix |
| CVE-2025-27550 | IBM Jazz Reporting Service information disclosure | 3.5CNA v3.1 | 0.2% | 2026-02-04 | Fix |
| CVE-2025-22873 | Improper access to parent directory of root in os | 3.8CISA ADP v3.1 | 0.2% | 2026-02-04 | Fix |
| CVE-2025-15555 | Open5GS VoLTE Cx-Test hss-cx-path.c hss_ogs_diam_cx_mar_cb stack-based overflow | 8.2v3.1 | 0.6% | 2026-02-04 | |
| CVE-2025-15508 | Magic Import Document Extractor WordPress plugin unauthenticated sensitive information exposure | 5.3CNA v3.1 | 0.3% | 2026-02-04 | |
| CVE-2025-15507 | Magic Import Document Extractor WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2026-02-04 | Fix |
| CVE-2025-15487 | Code Explorer WordPress plugin authenticated (Administrator+) arbitrary file read via file parameter | 4.9CNA v3.1 | 0.5% | 2026-02-04 | |
| CVE-2025-15482 | Chapa Payment Gateway Plugin for WooCommerce WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2026-02-04 | |
| CVE-2025-15368 | SportsPress WordPress plugin authenticated (Contributor+) local file inclusion via shortcode | 8.8CNA v3.1 | 0.8% | 2026-02-04 | Exploit codeFix |
| CVE-2025-15285 | SEO Flow by LupsOnline WordPress plugin unauthenticated arbitrary Post/Category modification | 7.5CNA v3.1 | 0.4% | 2026-02-04 | Fix |
| CVE-2025-15268 | Infility Global WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 0.5% | 2026-02-04 | |
| CVE-2025-15260 | MyRewards WordPress plugin missing authorization | 6.5CNA v3.1 | 0.3% | 2026-02-04 | Exploit codeFix |
| CVE-2025-14740 | Docker Desktop for Windows incorrect permission assignment privilege escalation | 6.7CNA v3.1 | 0.2% | 2026-02-04 | Fix |
| CVE-2025-14461 | tpixendit Xendit Payment payment callback endpoint missing authorization | 5.3CNA v3.1 | 0.4% | 2026-02-04 | Fix |
| CVE-2025-13375 | IBM Common Cryptographic Architecture arbitrary command execution | 9.8CNA v3.1 | 0.6% | 2026-02-04 | Fix |
| CVE-2025-5329 | SQLi in Martcode Software's Delta Course Automation | 9.8CNA v3.1 | 0.5% | 2026-02-04 | |
| CVE-2025-2134 | IBM Jazz Reporting Service denial of service | 3.5CNA v3.1 | 0.2% | 2026-02-04 | Fix |
| CVE-2025-1823 | IBM Jazz Reporting Service denial of service | 3.5CNA v3.1 | 0.2% | 2026-02-04 | Fix |
| CVE-2025-71179 | Creativeitem Academy LMS cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-02-03 | Exploit code |
| CVE-2025-70849 | Podinfo affected by arbitrary file upload that leads to stored cross-site scripting (XSS) | 6.1CISA ADP v3.1 | 0.3% | 2026-02-03 | Exploit codeFix |
| CVE-2025-70841 | Amcoders Dokans improper authentication | 7.5NVD v3.1 | 0.4% | 2026-02-03 | |
| CVE-2025-70758 | chetans9 core-php-admin-panel auth_validate.php authentication bypass | 7.5CISA ADP v3.1 | 0.7% | 2026-02-03 | |
| CVE-2025-70560 | Boltz contains an insecure deserialization vulnerability in its molecule loading functionality | 8.4CISA ADP v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-70559 | Insecure deserialization (pickle) in pdfminer.six CMap Loader Local Privesc | 6.5CISA ADP v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-70311 | Huayi-tec JEEWMS SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-69983 | FUXA allows remote code execution (RCE) via the project import functionality | 9.8v3.1 | 0.4% | 2026-02-03 | |
| CVE-2025-69981 | FUXA contains an unrestricted file upload | 9.8v3.1 | 0.7% | 2026-02-03 | |
| CVE-2025-69971 | FUXA has a hard-coded fallback JWT signing secret | 9.8v3.1 | 2.0% | 2026-02-03 | NucleiFix |
| CVE-2025-69970 | FUXA contains an insecure default configuration | 9.3CISA ADP v3.1 | 0.5% | 2026-02-03 | |
| CVE-2025-69875 | Quickheal Total Security improper privilege management | 7.8CISA ADP v3.1 | 0.1% | 2026-02-03 | |
| CVE-2025-69848 | NetBox cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-69431 | ZSPACE Q2C link following | 6.1CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-69430 | Yottamaster DM200 link following | 6.1CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-69429 | ORICO CD3510 link following | 6.1CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-67857 | Moodle: Moodle: Data exposure of user identifiers in urls | 5.3NVD v3.1 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-67856 | Moodle: Moodle: Privilege escalation via incomplete role checks in badge awarding | 9.8NVD v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67855 | Moodle mooodle: Mooodle: Information disclosure and script execution | 6.1NVD v3.1 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-67853 | Moodle: Moodle: Brute-force facilitation due to missing rate limiting in confirmation email service | 7.5CNA v3.1 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-67852 | Moodle open redirect | 6.1NVD v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67851 | Moodle: Moodle: Formula injection allows arbitrary formula execution via unescaped data export | 7.8NVD v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67850 | Moodle: Moodle: Cross-site scripting vulnerability via inadequate input filtering in formula editor | 6.1NVD v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67849 | Moodle: Moodle: Cross-site scripting (XSS) via improper sanitization of ai prompt responses | 6.1NVD v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67848 | Moodle: Moodle: Authentication bypass | 8.1CNA v3.1 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-67484 | Wikimedia Foundation MediaWiki Action API xslt option improper input validation | 0.0CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-67483 | Wikimedia Foundation MediaWiki page preview module cross-site scripting | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67482 | Wikimedia Foundation Scribunto lua segfault in unpack | 1.7CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67481 | Wikimedia Foundation MediaWiki jQueryMsg message parser cross-site scripting | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67480 | Wikimedia Foundation MediaWiki list=allrevisions can be used to bypass Extension:Lockdown | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-67479 | Wikimedia Foundation MediaWiki Cite extension vulnerability | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67478 | Wikimedia Foundation CheckUser user mailer vulnerability | 0.0CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-67477 | Wikimedia Foundation MediaWiki stored XSS through a system message in Special:ApiSandbox | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67476 | Wikimedia Foundation MediaWiki importing leaks IP address of importer via EventStreams | 1.3CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-67475 | Wikimedia Foundation MediaWiki stored XSS through edit summaries in MW Core | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-67189 | TOTOLINK A950RG setParentalRules interface buffer overflow | 6.5CISA ADP v3.1 | 0.5% | 2026-02-03 | |
| CVE-2025-67188 | TOTOLINK A950RG buffer overflow | 9.8CISA ADP v3.1 | 0.7% | 2026-02-03 | |
| CVE-2025-67187 | TOTOLINK A950RG stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2026-02-03 | |
| CVE-2025-67186 | TOTOLINK A950RG buffer overflow | 9.8CISA ADP v3.1 | 0.8% | 2026-02-03 | |
| CVE-2025-66374 | CyberArk Endpoint Privilege Manager improper privilege management | 7.8CISA ADP v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-65924 | frappe erpnext cross-site scripting | 4.1CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-65923 | frappe erpnext cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-65875 | Fpdf AddFont function arbitrary file upload | 9.8v3.1 | 0.4% | 2026-02-03 | |
| CVE-2025-65081 | Lexmark MXTCT out-of-bounds read vulnerability in Postscript interpreter | 6.9CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-65080 | Lexmark MXTCT type confusion vulnerability in Postscript interpreter | 6.9CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-65079 | Lexmark MXTCT heap-based buffer overflow vulnerability in Postscript interpreter | 6.9CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-65078 | Lexmark MXTCT untrusted search path vulnerability in Embedded Solutions Framework | 9.3CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-65077 | Lexmark MXTCT relative path traversal vulnerability in Embedded Solutions Framework | 8.8CNA v4.0 | 0.7% | 2026-02-03 | Fix |
| CVE-2025-65017 | Decidim's private data exports can lead to data leaks | 8.2CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-64438 | Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS | 1.7CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-64098 | eProsima Fast DDS readOctetVector function integer overflow | 1.7CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-63624 | Sdkede Iot Smart Water Meter Shandong Kede Electronics Co SQL injection | 9.8CISA ADP v3.1 | 0.7% | 2026-02-03 | |
| CVE-2025-63372 | Articentgroup ZIP Rar Extractor Tool path traversal | 4.3CISA ADP v3.1 | 0.4% | 2026-02-03 | |
| CVE-2025-62799 | eProsima Fast-DDS FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS | 7.2CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-62673 | Heap-based buffer overflow vulnerability in Archer AX53 and AX12 | 8.6CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-62603 | eProsima Fast DDS DDS Security message parser out-of-bounds read | 1.7CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-62602 | eProsima Fast-DDS FastDDS has heap buffer overflow in readData | 1.7CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-62601 | eProsima Fast-DDS FastDDS has heap buffer overflow in readString | 1.7CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-62600 | eProsima Fast DDS readBinaryPropertySeq integer overflow | 8.6CNA v3.1 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-62599 | eProsima Fast DDS readPropertySeq integer overflow | 8.6CNA v3.1 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-62501 | SSH Hostkey Misconfiguration vulnerability in Archer Devices | 7.0CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-62405 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-62404 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-61983 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-61944 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-61658 | Wikimedia Foundation CheckUser Special:GlobalContributions vulnerability | 1.3CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61657 | Wikimedia Foundation Vector cross-site scripting | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61656 | Wikimedia Foundation VisualEditor XSS when pasting into VE | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61655 | Stored XSS through system messages in VisualEditor | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61654 | Wikimedia Foundation Thanks UserInfoCard vulnerability | 0.0CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-61653 | Extension:TextExtracts does not check for authorizeRead when returning extracts | 2.7CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-61652 | Wikimedia Foundation DiscussionTools discussiontoolspageinfo API vulnerability | 2.7CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61651 | I18n XSS through Special:CheckUser CheckUser helper | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61650 | Wikimedia Foundation CheckUser UserInfoCard is vulnerable to message key stored XSS | 1.1CNA v4.0 | 0.3% | 2026-02-03 | |
| CVE-2025-61649 | Wikimedia Foundation CheckUser UserInfoCard vulnerability | 1.1CNA v4.0 | 0.4% | 2026-02-03 | |
| CVE-2025-61648 | Stored XSS through system messages in CheckUser | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61647 | Wikimedia Foundation CheckUser UserInfoCard vulnerability | 0.3CNA v4.0 | 0.3% | 2026-02-03 | |
| CVE-2025-61646 | Wikimedia Foundation MediaWiki watchlist group mode reveals authors of edits with hidden authorship | 1.2CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61645 | Wikimedia Foundation MediaWiki CodexTablePager has i18n XSS | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61644 | Wikimedia Foundation MediaWiki i18n XSS through Special:Watchlist | 0.0CNA v4.0 | 0.3% | 2026-02-03 | |
| CVE-2025-61643 | Wikimedia Foundation MediaWiki recent changes feed notifier vulnerability | 2.7CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61642 | Wikimedia Foundation MediaWiki stored XSS through system messages provided to CodexHtmlForms | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61641 | Wikimedia Foundation MediaWiki API list=allpages with maxsize is making really slow queries | 1.7CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61640 | Wikimedia Foundation MediaWiki stored XSS | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61639 | Wikimedia Foundation MediaWiki information disclosure | 1.7CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61638 | Wikimedia Foundation MediaWiki Sanitizer::validateAttributes data-XSS | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Exploit codeFix |
| CVE-2025-61637 | Wikimedia Foundation MediaWiki stored XSS through system messages in MW Core | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61636 | Wikimedia Foundation MediaWiki codex Special:Block vulnerable to message key XSS | 0.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-61635 | Wikimedia Foundation ConfirmEdit add rate limiting to ApiFancyCaptchaReload | 0.0CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-61634 | Wikimedia Foundation MediaWiki HTML rest endpoint needs PoolCounter and proper parser cache check | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-61506 | MediaCrush unrestricted file upload | 9.8CISA ADP v3.1 | 0.6% | 2026-02-03 | Exploit code |
| CVE-2025-60865 | Avanquest PC Helpsoft Driver Updater insecure permissions | 7.8CISA ADP v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-59902 | HTML injection in Nice Chat | 7.1CNA v4.0 | 0.4% | 2026-02-03 | |
| CVE-2025-59487 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-59482 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-59439 | Samsung Exynos 980 improper exception handling | 7.5CISA ADP v3.1 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-58455 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-58383 | Privilege escalation via bind command in Brocade Fabric OS | 8.4CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-58382 | Privilege escalation in Brocade Fabric and | 8.5CNA v4.0 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-58381 | Directory transversal vulnerability in Brocade Fabric OS and using various shell commands | 4.6CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58380 | Directory transversal vulnerability in Brocade Fabric OS using grep command | 4.6CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58379 | Password exposure in Brocade Fabric OS | 6.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58348 | Samsung Exynos 980 resource exhaustion | 5.5CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58347 | Samsung Exynos 980 resource exhaustion | 5.5CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58346 | Samsung Exynos 980 resource exhaustion | 5.5CISA ADP v3.1 | 0.1% | 2026-02-03 | Fix |
| CVE-2025-58345 | Samsung Exynos 980 resource exhaustion | 5.5CISA ADP v3.1 | 0.1% | 2026-02-03 | Fix |
| CVE-2025-58344 | Samsung Exynos 980 resource exhaustion | 6.2CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58343 | Samsung Exynos 980 resource exhaustion | 5.5CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58342 | Samsung Exynos 980 resource exhaustion | 6.2CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58341 | Samsung Exynos 980 resource exhaustion | 6.2CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58340 | Samsung Exynos 980 resource exhaustion | 6.2CISA ADP v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-58077 | Heap-based buffer overflow vulnerability in TP-Link Archer AX53 | 7.3CNA v4.0 | 0.5% | 2026-02-03 | Fix |
| CVE-2025-57529 | Youdatasum Cpas Audit Management System SQL injection | 9.8CISA ADP v3.1 | 0.6% | 2026-02-03 | Exploit code |
| CVE-2025-52633 | HCL AION is susceptible to Missing Content-Security-Policy | 3.1CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-52631 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security header vulnerability | 3.7CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-52629 | HCL AION is susceptible to Missing Content-Security-Policy | 3.7CNA v3.1 | 0.1% | 2026-02-03 | Fix |
| CVE-2025-52628 | HCL AION is susceptible to Missing SameSite vulnerability | 4.6CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-52627 | HCL AION is susceptible to incorrect permission assignment for critical resource | 5.5CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-52626 | HCL AION is susceptible to potential command injection | 4.5CNA v3.1 | 0.7% | 2026-02-03 | Fix |
| CVE-2025-52623 | HCL AION is affected by an Autocomplete HTML attribute not Disabled for Password field vulnerability | 3.7CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-46651 | prasathmani TinyFileManager server-side request forgery | 4.3CISA ADP v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-41065 | Stored cross-site scripting (XSS) in LUNA from Luna Imaging | 5.1CNA v4.0 | 0.3% | 2026-02-03 | |
| CVE-2025-36094 | IBM Cloud Pak for Business Automation denial of service | 5.4CNA v3.1 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-36033 | IBM Engineering Lifecycle Management Global Configuration Management cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-33081 | IBM Concert log files cleartext storage of sensitive information | 3.3CNA v3.1 | 0.1% | 2026-02-03 | Fix |
| CVE-2025-15556 | Notepad++ download of code without integrity check | 7.5NVD v3.1 | 1.8% | 2026-02-03 | KEVExploit codeFix |
| CVE-2025-14550 | Django potential denial of service vulnerability via repeated headers when using ASGI | 7.5CISA ADP v3.1 | 1.1% | 2026-02-03 | Fix |
| CVE-2025-14274 | Unlimited Elements for Elementor WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-13473 | Django username enumeration through timing difference in mod_wsgi authentication handler | 5.3CISA ADP v3.1 | 0.8% | 2026-02-03 | Fix |
| CVE-2025-12774 | SQL queries with sensitive information printed in logs with Brocade SANnav | 4.6CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-12773 | Broadcom SANnav reports purge settings script vulnerability | 7.1CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-11598 | Exposure of Confidential Information in mObywatel application | 1.0CNA v4.0 | 0.2% | 2026-02-03 | Fix |
| CVE-2025-11261 | Wikimedia Foundation MediaWiki stored i18n XSS exposed by security patch for T402077 | 0.0CNA v4.0 | 0.3% | 2026-02-03 | Fix |
| CVE-2025-11173 | Wikimedia Foundation OATHAuth reauth for enabling 2FA can be bypassed by submitting a form | 0.0CNA v4.0 | 0.4% | 2026-02-03 | Fix |
| CVE-2025-10878 | Insaat Fikir Odalari AdminPando login functionality SQL injection | 10.0v3.1 | 0.6% | 2026-02-03 | Fix |
| CVE-2025-9711 | Privilege escalation in Brocade Fabric OS, and though | 8.5CNA v4.0 | 0.1% | 2026-02-03 | Fix |
| CVE-2025-8590 | Information disclosure in AKCE Software's SKSPro | 7.5CNA v3.1 | 0.4% | 2026-02-03 | |
| CVE-2025-8589 | Reflected XSS in AKCE Software's SKSPro | 7.6CNA v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-8461 | Reflected XSS in Seres Software's syWEB | 7.6CNA v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-8456 | Reflected XSS in Kod8 Software's Kod8 Individual and SME Website | 7.6CNA v3.1 | 0.2% | 2026-02-03 | |
| CVE-2025-7760 | Reflected XSS in Ofisimo's Association Web Package Flora | 7.6CNA v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-6397 | XSS in Ankara Hosting's web site | 8.6CNA v3.1 | 0.3% | 2026-02-03 | |
| CVE-2025-5319 | SQLi in Emit Informatics' DIGITA Efficiency Management System | 9.8CNA v3.1 | 0.5% | 2026-02-03 | |
| CVE-2025-70960 | Tendenci CMS contains a stored cross-site scripting (XSS) vulnerability in the Forums module | 5.4CISA ADP v3.1 | 0.3% | 2026-02-02 | |
| CVE-2025-70959 | Tendenci CMS Contains a cross-site scripting vulnerability in its Jobs module | 5.4CISA ADP v3.1 | 0.3% | 2026-02-02 | |
| CVE-2025-70958 | Subrion CMS vulnerable to cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-02-02 | |
| CVE-2025-69207 | Khoj has an IDOR in Notion OAuth Flow enables Index Poisoning | 5.4CNA v3.1 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-66480 | wildfirechat im-server wildfire has arbitrary file upload | 9.8CNA v3.1 | 1.5% | 2026-02-02 | Fix |
| CVE-2025-47402 | Qualcomm Snapdragon buffer over-read in WLAN firmware | 6.5CNA v3.1 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-47399 | Qualcomm Snapdragon buffer copy without checking size of input in Camera | 7.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47398 | Qualcomm Snapdragon use-after-free in Graphics | 7.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47397 | Qualcomm Snapdragon Improper Release of Memory before Removing Last Reference in Graphics | 7.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47366 | Qualcomm Snapdragon exposed dangerous method or function in HLOS | 7.1CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47364 | Qualcomm Snapdragon integer overflow or wraparound in Automotive | 6.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47363 | Qualcomm Snapdragon integer overflow or wraparound in Automotive | 6.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47359 | Qualcomm Snapdragon use-after-free in Secure Processor | 7.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-47358 | Qualcomm Snapdragon use-after-free in Secure Processor | 7.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-36436 | IBM Cloud Pak for Business Automation web UI stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-36253 | IBM Concert unsalted password hash | 5.9CNA v3.1 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-36238 | IBM PowerVM Hypervisor Power System Exposure of Sensitive System Information | 6.0CNA v3.1 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-36194 | IBM PowerVM Hypervisor this Power System update is being released to address | 2.8CNA v3.1 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-15396 | Library Viewer WordPress plugin reflected cross-site scripting | 7.1CISA ADP v3.1 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-15395 | IBM Jazz Foundation access control violation | 4.3CNA v3.1 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-15030 | User Profile Builder WordPress plugin unauthenticated arbitrary password reset | 9.8CISA ADP v3.1 | 0.5% | 2026-02-02 | Exploit codeFix |
| CVE-2025-14914 | IBM WebSphere Application Server Liberty path traversal | 7.6CNA v3.1 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-13881 | Red Hat Keycloak admin API incorrect privilege assignment | 2.7CNA v3.1 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-13348 | ASUS Business Manager ASUS Secure Delete driver improper access control | 8.5CNA v4.0 | 0.1% | 2026-02-02 | Fix |
| CVE-2025-13096 | XML eXternal entity injection (XXE) vulnerability affect IBM Business Automation Workflow | 7.1CNA v3.1 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-12772 | Plaintext Switch admin login password is seen in Brocade SANnav support save | 8.5CNA v4.0 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-12680 | Brocade SANnav DataBase plaintext password is logged in failover logs | 6.0CNA v4.0 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-12679 | Plain text pbe key visible in audit log during Brocade SANnav migration from to | 7.1CNA v4.0 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-10279 | Privilege escalation in MLflow/MLflow | 7.0CNA v3.0 | 0.2% | 2026-02-02 | Fix |
| CVE-2025-9974 | Insufficient input validation on WEBUI in Nokia ONT/Beacon product | 8.0CISA ADP v3.1 | 0.4% | 2026-02-02 | Exploit code |
| CVE-2025-8587 | Time-based blind SQLi in AKCE Software's SKSPro | 9.8v3.1 | 0.3% | 2026-02-02 | |
| CVE-2025-7105 | Denial of service via JavaScript Memory Overflow in danny-avila/librechat | 5.7CNA v3.0 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-6927 | Wikimedia Foundation MediaWiki autoblocks from global account suppressions are publicly visible | 2.3CNA v4.0 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-6597 | MediaWiki should not consider autocreation as login for the purposes of security reauthentication | 0.0CNA v4.0 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-6596 | Vector inserts portlet labels as HTML, allowing for stored XSS through system messages | 0.0CNA v4.0 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-6595 | Wikimedia Foundation MultimediaViewer cross-site scripting | 0.0CNA v4.0 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-6594 | Wikimedia Foundation MediaWiki XSS in Special:ApiSandbox | 0.0CNA v4.0 | 0.3% | 2026-02-02 | Fix |
| CVE-2025-6593 | Wikimedia Foundation MediaWiki email address verification information disclosure | 2.1CNA v4.0 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-6592 | Wikimedia Foundation AbuseFilter AbuseLog vulnerability | 2.1CNA v4.0 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-6591 | Wikimedia MediaWiki feedcontributions API cross-site scripting | 0.0CNA v4.0 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-6590 | Wikimedia Foundation MediaWiki information disclosure | 4.6CNA v4.0 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-6589 | Wikimedia Foundation MediaWiki path traversal | 2.1CNA v4.0 | 0.5% | 2026-02-02 | Fix |
| CVE-2025-6208 | Uncontrolled Memory Consumption in run-llama/llama_index | 5.3CNA v3.0 | 0.4% | 2026-02-02 | Fix |
| CVE-2025-71191 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources. Note that commit 3832b78b3ec2 ("dmaengin | 5.5NVD v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71190 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind. | 5.5NVD v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71189 | Linux kernel dmamux memory leak | 5.5NVD v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71188 | Linux kernel LPC18xx DMA mux driver memory leak | 5.5v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71187 | Linux kernel rz-dmac memory leak | 5.5v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71186 | Linux kernel STM32 DMA mux driver memory leak | 5.5NVD v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71185 | Linux kernel TI DMA crossbar driver memory leak | 5.5NVD v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-71184 | Linux kernel Btrfs filesystem null pointer dereference | 5.5v3.1 | 0.1% | 2026-01-31 | Fix |
| CVE-2025-71183 | Linux kernel Btrfs inode logging vulnerability | 9.1CNA v3.1 | 0.3% | 2026-01-31 | Fix |
| CVE-2025-71182 | Linux kernel J1939 CAN protocol driver race condition | 5.5NVD v3.1 | 0.1% | 2026-01-31 | Fix |
| CVE-2025-71181 | Linux kernel Rust Binder shrinker vulnerability | 5.5v3.1 | 0.1% | 2026-01-31 | Fix |
| CVE-2025-71180 | Linux kernel interrupt counter driver improper locking | 5.5v3.1 | 0.2% | 2026-01-31 | Fix |
| CVE-2025-15525 | Ajax Load More WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2026-01-31 | Fix |
| CVE-2025-15510 | NEX-Forms WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2026-01-31 | Fix |
| CVE-2025-14554 | Sell BTC WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2026-01-31 | Fix |
| CVE-2025-69662 | Geopandas SQL injection vulnerability in to_postgis allows information disclosure | 8.6CISA ADP v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-62349 | Salt Master authentication protocol downgrade may enable minion impersonation | 7.5CNA v4.0 | 0.5% | 2026-01-30 | Fix |
| CVE-2025-62348 | Salt junos module uses an unsafe YAML loader which may allow unintended code execution | 7.3CNA v4.0 | 0.2% | 2026-01-30 | Fix |
| CVE-2025-51958 | Aelsantex Runcommand OS command injection | 9.8CISA ADP v3.1 | 0.7% | 2026-01-30 | |
| CVE-2025-36442 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36428 | IBM Db2 denial of service | 5.3CNA v3.1 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-36427 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36424 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36423 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-36407 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-36387 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36384 | IBM Db2 privilege escalation | 8.4CNA v3.1 | 0.2% | 2026-01-30 | Fix |
| CVE-2025-36366 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36365 | IBM Db2 privilege escalation | 6.8CNA v3.1 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-36353 | IBM Db2 denial of service | 6.2CNA v3.1 | 0.2% | 2026-01-30 | Fix |
| CVE-2025-36184 | IBM Db2 privilege escalation | 7.2CNA v3.1 | 0.5% | 2026-01-30 | Fix |
| CVE-2025-36123 | IBM Db2 denial of service | 6.2CNA v3.1 | 0.2% | 2026-01-30 | Fix |
| CVE-2025-36098 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36070 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36009 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-36001 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-26385 | Metasys product command injection vulnerability could allow remote SQL execution | 9.5CNA v4.0 | 1.5% | 2026-01-30 | |
| CVE-2025-24293 | rails activestorage active Storage allowed transformation methods that were potentially unsafe | 9.2CNA v4.0 | 5.5% | 2026-01-30 | MetasploitExploit codeKCVFix |
| CVE-2025-15497 | OpenVPN reachable assertion | 3.8CNA v4.0 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-15322 | Tanium addressed an improper access controls vulnerability in Tanium Server | 4.3CNA v3.1 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-13176 | Local privilege escalation in ESET Inspect Connector for Windows | 8.4CNA v4.0 | 0.2% | 2026-01-30 | |
| CVE-2025-12899 | zephyrproject-rtos Zephyr net: Icmp: Out of bound memory read | 6.5CNA v3.1 | 0.3% | 2026-01-30 | |
| CVE-2025-11175 | The Wikimedia Foundation Mediawiki DiscussionTools should use better regex | 8.8CNA v4.0 | 0.5% | 2026-01-30 | Fix |
| CVE-2025-9226 | Zoho ManageEngine OpManager stored XSS | 4.6CNA v3.1 | 0.5% | 2026-01-30 | Fix |
| CVE-2025-7964 | Zigbee Router denial of service | 9.2CNA v4.0 | 0.3% | 2026-01-30 | Fix |
| CVE-2025-6723 | Progress Software Chef InSpec untrusted user data can lead to privilege escalation | 5.8CNA v4.0 | 0.1% | 2026-01-30 | |
| CVE-2025-4686 | Time-based blind SQLi in Kodmatic Computer's Online Exam and Assessment | 8.6CNA v3.1 | 0.3% | 2026-01-30 | |
| CVE-2025-2668 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.4% | 2026-01-30 | Fix |
| CVE-2025-1395 | Sensitive data exposure in CoDeriApp's HeyGarson | 8.2CNA v3.1 | 0.3% | 2026-01-30 | |
| CVE-2025-71011 | Oneflow improper input validation | 6.2CISA ADP v3.1 | 0.2% | 2026-01-29 | |
| CVE-2025-71009 | Oneflow improper input validation | 6.2CISA ADP v3.1 | 0.2% | 2026-01-29 | |
| CVE-2025-71008 | Oneflow denial of service | 6.2CISA ADP v3.1 | 0.2% | 2026-01-29 | |
| CVE-2025-69929 | N3URON Web User Interface weak cryptographic algorithm | 9.8CISA ADP v3.1 | 0.5% | 2026-01-29 | |
| CVE-2025-69749 | tale cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-01-29 | |
| CVE-2025-69604 | Shirt-pocket Superduper! incorrect default permissions | 7.8CISA ADP v3.1 | 0.1% | 2026-01-29 | Fix |
| CVE-2025-69516 | Amidaware Tactical Rmm /reporting/templates/preview/ endpoint server-side template injection | 8.8CISA ADP v3.1 | 2.3% | 2026-01-29 | MetasploitExploit code |
| CVE-2025-63658 | monkey mk_http_index_lookup function stack-based buffer overflow | 7.5CISA ADP v3.1 | 1.3% | 2026-01-29 | |
| CVE-2025-63657 | monkey mk_mimetype_find function out-of-bounds read | 7.5CISA ADP v3.1 | 1.2% | 2026-01-29 | |
| CVE-2025-63656 | monkey header_cmp function out-of-bounds read | 7.5CISA ADP v3.1 | 1.2% | 2026-01-29 | |
| CVE-2025-63655 | monkey mk_http_range_parse function null pointer dereference | 7.5CISA ADP v3.1 | 8.6% | 2026-01-29 | |
| CVE-2025-63653 | monkey mk_vhost_fdt_close function out-of-bounds read | 7.5CISA ADP v3.1 | 1.2% | 2026-01-29 | |
| CVE-2025-63652 | monkey mk_http_request_end function use-after-free | 7.5CISA ADP v3.1 | 1.2% | 2026-01-29 | |
| CVE-2025-63651 | monkey mk_string_char_search function use-after-free | 7.5CISA ADP v3.1 | 1.1% | 2026-01-29 | |
| CVE-2025-63650 | monkey mk_ptr_to_buf in mk_core function out-of-bounds read | 7.5CISA ADP v3.1 | 1.2% | 2026-01-29 | |
| CVE-2025-63649 | monkey out-of-bounds read | 7.5CISA ADP v3.1 | 1.1% | 2026-01-29 | |
| CVE-2025-62514 | Scille parsec-cloud `libparsec_crypto` does not check for weak order point of curve 25519 | 8.3CNA v3.1 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-55704 | Brother Industries Multiple MFPs multiple MFPs provided by hidden functionality | 6.9CNA v4.0 | 0.3% | 2026-01-29 | |
| CVE-2025-53869 | Brother Industries Multiple MFPs improper certificate validation | 6.3CNA v4.0 | 0.2% | 2026-01-29 | |
| CVE-2025-45160 | Cacti file upload error message cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-01-29 | Fix |
| CVE-2025-15550 | birkir prime cross-site request forgery in GraphQL | 5.1CNA v4.0 | 0.2% | 2026-01-29 | |
| CVE-2025-15549 | FluentCMS 2026 stored XSS via SVG upload in File Management | 4.8CNA v4.0 | 0.3% | 2026-01-29 | |
| CVE-2025-15548 | Missing Application-Layer Encryption in Web interface endpoints on TP-Link VX800v | 5.3CNA v4.0 | 0.1% | 2026-01-29 | Fix |
| CVE-2025-15545 | Insufficient Backup file upload Input Validation on TP-Link Archer RE605X | 7.3CNA v4.0 | 0.5% | 2026-01-29 | Exploit codeFix |
| CVE-2025-15543 | Read-Only Root Access via USB Storage Device in TP-Link VX800v | 5.1CNA v4.0 | 0.2% | 2026-01-29 | Fix |
| CVE-2025-15542 | Denial of service (DoS) of VoIP Communication on TP-Link VX800v | 6.3CNA v4.0 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-15541 | Access to System files via SFTP on TP-Link VX800v | 6.9CNA v4.0 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-15344 | Tanium addressed a SQL injection vulnerability in Asset | 6.3CNA v3.1 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-15288 | Tanium addressed an improper access controls vulnerability in Interact | 3.1CNA v3.1 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-14975 | Custom Login Page Customizer WordPress plugin unauthenticated arbitrary password reset | 8.1CISA ADP v3.1 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-13905 | Schneider Electric EcoStruxure Process Expert incorrect default permissions | 7.0CNA v4.0 | 0.1% | 2026-01-29 | Fix |
| CVE-2025-13399 | Insecure encryption in Communication with the Web interface on TP-Link VX800v | 7.7CNA v4.0 | 0.2% | 2026-01-29 | Fix |
| CVE-2025-7714 | Time Based SQLi in Global Medya's PHP CMS | 9.8v3.1 | 0.3% | 2026-01-29 | |
| CVE-2025-7713 | Reflected XSS in Global Medya's PHP CMS | 6.1NVD v3.1 | 0.2% | 2026-01-29 | |
| CVE-2025-7016 | Improper access control in Akinsoft's QR Menu | 9.8v3.1 | 0.3% | 2026-01-29 | Fix |
| CVE-2025-7015 | Session hijacking in Akinsoft's QR Menu | 9.8v3.1 | 0.2% | 2026-01-29 | Fix |
| CVE-2025-7014 | Session hijacking in QRMenumPro's Menu Panel | 8.8v3.1 | 0.3% | 2026-01-29 | |
| CVE-2025-7013 | IDOR in QRMenumPro's Menu Panel | 9.8v3.1 | 0.3% | 2026-01-29 | |
| CVE-2025-71007 | Oneflow improper input validation | 7.5CISA ADP v3.1 | 0.5% | 2026-01-28 | |
| CVE-2025-71006 | Oneflow divide by zero | 6.5CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-71005 | Oneflow divide by zero | 6.5CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-71004 | Oneflow out-of-bounds read | 6.5CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-71003 | Oneflow improper input validation | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-71002 | Oneflow divide by zero | 6.5CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-71001 | Oneflow out-of-bounds read | 6.5CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-71000 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-70999 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-70336 | PodcastGenerator 'Create New Live Item' stored cross-site scripting | 4.8CISA ADP v3.1 | 0.6% | 2026-01-28 | Exploit code |
| CVE-2025-69602 | Altumcode 66biolinks session fixation | 9.1CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-69601 | Altumcode 66biolinks “Static Sites” feature of path traversal | 6.5CISA ADP v3.1 | 0.7% | 2026-01-28 | |
| CVE-2025-69517 | Amidaware Inc Tactical RMM v1.3.1 An HTML injection | 8.8CISA ADP v3.1 | 0.5% | 2026-01-28 | |
| CVE-2025-69289 | Discourse moderator email change controls privilege escalation | 5.1CNA v4.0 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-69218 | Discourse moderators can access admin-only reports exposing private upload URLs | 7.1CNA v4.0 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-68934 | Discourse has denial of service (DoS) vulnerability in Drafts Creation endpoint | 6.5CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-68933 | Discourse non-admin moderators can exfiltrate private content via post ownership transfer | 6.9CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-68666 | Discourse users archives leaked to users with moderation privileges | 5.9CNA v4.0 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-68662 | discourse FinalDestination hostname matching allows SSRF protection bypass | 7.6CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-68660 | Discourse AI Discover persona controller incorrect authorization | 5.3CNA v4.0 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-68659 | Discourse has DoS vulnerability in username change endpoint | 4.3CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-68479 | Discourse subscriptions are susceptible to takeover | 7.1CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-68119 | Unexpected code execution when invoking toolchain in cmd/go | 7.0CISA ADP v3.1 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-67723 | Discourse vulnerable to stored cross-site scripting via Katex in discourse-math plugin | 4.6CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-67645 | OpenEMR vulnerable to broken access control in Profile Edit endpoint | 8.8CNA v3.1 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-66488 | Discourse allows script execution in uploaded HTML/XML files on S3 | 4.6CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-65891 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.6% | 2026-01-28 | |
| CVE-2025-65890 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-01-28 | |
| CVE-2025-65889 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-65888 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-65887 | Oneflow divide by zero | 6.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-65886 | Oneflow denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-61731 | Arbitrary file write using cgo pkg-config directive in cmd/go | 7.8CISA ADP v3.1 | 0.6% | 2026-01-28 | Fix |
| CVE-2025-61730 | Handshake messages may be processed at the incorrect encryption level in crypto/tls | 5.3CISA ADP v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-61728 | Excessive CPU consumption when building archive index in archive/zip | 6.5CISA ADP v3.1 | 0.7% | 2026-01-28 | Fix |
| CVE-2025-61726 | Memory exhaustion in query parameter parsing in net/url | 7.5CISA ADP v3.1 | 2.3% | 2026-01-28 | Fix |
| CVE-2025-61140 | Dchester json-path prototype pollution | 9.8CISA ADP v3.1 | 0.5% | 2026-01-28 | Fix |
| CVE-2025-59901 | Authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server | 8.5CNA v4.0 | 0.2% | 2026-01-28 | |
| CVE-2025-59900 | Authenticated cross-site scripting (XSS) vulnerability in Sync Breeze Enterprise Server | 5.4v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-59899 | Authenticated cross-site scripting (XSS) vulnerability in Sync Breeze Enterprise Server | 5.4v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-59898 | Authenticated cross-site scripting (XSS) vulnerability in Sync Breeze Enterprise Server | 5.4v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-59897 | Authenticated cross-site scripting (XSS) vulnerability in Sync Breeze Enterprise Server | 5.4v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-59896 | Authenticated cross-site scripting (XSS) vulnerability in Sync Breeze Enterprise Server | 5.4v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-59895 | Remote denial of service (DoS) vulnerability in Sync Breeze Enterprise Server | 7.5v3.1 | 0.4% | 2026-01-28 | |
| CVE-2025-59894 | Cross-site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server | 8.0v3.1 | 0.1% | 2026-01-28 | |
| CVE-2025-59893 | Cross-site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server | 8.0v3.1 | 0.1% | 2026-01-28 | |
| CVE-2025-59892 | Cross-site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server | 8.0v3.1 | 0.1% | 2026-01-28 | |
| CVE-2025-59891 | Cross-site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server | 8.0v3.1 | 0.1% | 2026-01-28 | |
| CVE-2025-58150 | Xen x86: Buffer overrun with shadow paging + tracing | 8.8CISA ADP v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-57796 | Explorance Blue recoverable password storage | 6.8CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-57795 | Unauthenticated Remote File Download in Explorance Blue | 9.9CISA ADP v3.1 | 0.6% | 2026-01-28 | Fix |
| CVE-2025-57794 | Unrestricted file upload vulnerability in Explorance Blue | 9.1CISA ADP v3.1 | 0.6% | 2026-01-28 | Fix |
| CVE-2025-57793 | SQL injection vulnerability in Explorance Blue | 8.6CISA ADP v3.1 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-57792 | SQL injection vulnerability in Explorance Blue | 10.0CISA ADP v3.1 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-57283 | BrowserStack Local vulnerable to command injection through logfile variable | 7.8CISA ADP v3.1 | 0.8% | 2026-01-28 | Fix |
| CVE-2025-55292 | In Meshtastic, an attacker can spoof licensed amateur flag for a node | 8.2CNA v3.1 | 0.1% | 2026-01-28 | |
| CVE-2025-54373 | OpenEMR Clinical Notes and Care Plan information disclosure | 7.1CNA v4.0 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-46691 | Dell PremierColor improper access control | 7.8CNA v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-46316 | Apple Pages out-of-bounds read | 4.3CISA ADP v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-46306 | Apple Keynote out-of-bounds read | 5.5CISA ADP v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-41351 | Weak encryption on Funambol's Cloud Server | 6.0CNA v4.0 | 0.2% | 2026-01-28 | |
| CVE-2025-40554 | SolarWinds Web Help Desk authentication bypass | 9.8CNA v3.1 | 60.6% | 2026-01-28 | Reported exploitedNucleiExploit codeKCVFix |
| CVE-2025-40553 | SolarWinds Web Help Desk deserialization of untrusted data remote code execution | 9.8CNA v3.1 | 68.0% | 2026-01-28 | Reported exploitedKCVFix |
| CVE-2025-40552 | SolarWinds Web Help Desk authentication bypass | 9.8CNA v3.1 | 52.0% | 2026-01-28 | NucleiExploit codeKCVFix |
| CVE-2025-40551 | SolarWinds Web Help Desk deserialization of untrusted data | 9.8CNA v3.1 | 84.2% | 2026-01-28 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-40537 | SolarWinds Web Help Desk hard-coded credentials | 7.5CNA v3.1 | 0.6% | 2026-01-28 | Fix |
| CVE-2025-40536 | SolarWinds Web Help Desk security control bypass | 8.1CNA v3.1 | 73.6% | 2026-01-28 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-33237 | NVIDIA GeForce null pointer dereference | 5.5CNA v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-33220 | NVIDIA Virtual GPU Manager use-after-free | 7.8CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-33219 | NVIDIA GeForce integer overflow | 7.8CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-33218 | NVIDIA GeForce integer overflow | 7.8CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-33217 | NVIDIA GeForce use-after-free | 7.8CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-26386 | Stack-based buffer overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool | 7.1CNA v4.0 | 0.5% | 2026-01-28 | Fix |
| CVE-2025-15511 | Rupantorpay WordPress plugin missing authorization to unauthenticated order Status modification | 5.3CNA v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-14865 | Passster Password Protect Pages and Content WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-14840 | HTTP Client Manager Less critical information disclosure SA-CONTRIB-2025-126 | 7.5CISA ADP v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-14795 | Stop Spammers Classic WordPress plugin cross-site request forgery via email Allowlist | 4.3CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-14616 | Recooty WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2026-01-28 | |
| CVE-2025-14610 | TableMaster for Elementor WordPress plugin server-side request forgery | 7.2CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-14472 | Acquia Content Hub Moderately critical cross-site request forgery SA-CONTRIB-2025-125 | 8.1CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-14386 | Search Atlas SEO WordPress plugin authentication bypass | 8.8CNA v3.1 | 0.4% | 2026-01-28 | Fix |
| CVE-2025-14283 | BlockArt Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-14063 | SEO Links Interlinking WordPress plugin reflected cross-site scripting via google_error parameter | 6.1CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-14039 | Simple Folio WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-13986 | Drupal Disable Login Page authentication bypass | 4.2CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13985 | Entity Share Moderately critical Access bypass, information disclosure SA-CONTRIB-2025-123 | 5.3CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13984 | Next.js Critical Access bypass SA-CONTRIB-2025-122 | 6.1CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13983 | Tagify Moderately critical cross-site scripting SA-CONTRIB-2025-121 | 5.4CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13982 | Login Time Restriction Moderately critical cross-site request forgery SA-CONTRIB-2025-120 | 8.1CISA ADP v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13981 | AI (Artificial Intelligence) Moderately critical cross-site scripting SA-CONTRIB-2025-119 | 4.4CISA ADP v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-13980 | CKEditor 5 Premium Features Moderately critical Access bypass SA-CONTRIB-2025-118 | 5.3CISA ADP v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-13979 | Mini site Moderately critical cross-site scripting SA-CONTRIB-2025-117 | 5.4v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13919 | Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client | 4.4CNA v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-13918 | Elevation of privileges in Symantec Endpoint Protection Windows Client | 6.7CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-13917 | Elevation of privileges in Web Security Services (WSS) Agent | 7.0CNA v3.1 | 0.1% | 2026-01-28 | Fix |
| CVE-2025-13471 | User Activity Log WordPress plugin unauthenticated limited arbitrary option update | 5.3CISA ADP v3.1 | 0.3% | 2026-01-28 | |
| CVE-2025-12709 | Interactions WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-9082 | WPBITS Addons For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-8072 | Target Video Easy Publish WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-28 | Fix |
| CVE-2025-7740 | Hitachi Energy SuprOS default credentials | 8.8CNA v4.0 | 0.2% | 2026-01-28 | Fix |
| CVE-2025-69565 | Fabian Mobile Shop Management System unrestricted file upload | 9.8CISA ADP v3.1 | 0.5% | 2026-01-27 | |
| CVE-2025-69564 | Fabian Mobile Shop Management System code injection | 9.8CISA ADP v3.1 | 0.5% | 2026-01-27 | |
| CVE-2025-69563 | Fabian Mobile Shop Management System SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2026-01-27 | |
| CVE-2025-69562 | Fabian Mobile Shop Management System SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2026-01-27 | |
| CVE-2025-69559 | Carmelo Computer Book Store unrestricted file upload | 9.8CISA ADP v3.1 | 0.6% | 2026-01-27 | |
| CVE-2025-69421 | OpenSSL null pointer dereference in PKCS12_item_decrypt_d2i_ex function | 7.5NVD v3.1 | 1.0% | 2026-01-27 | Fix |
| CVE-2025-69420 | OpenSSL missing ASN1_TYPE validation in TS_RESP_verify_response function | 7.5CISA ADP v3.1 | 0.9% | 2026-01-27 | Fix |
| CVE-2025-69419 | OpenSSL out-of-bounds write in PKCS12_get_friendlyname UTF-8 conversion | 7.4CISA ADP v3.1 | 0.6% | 2026-01-27 | Fix |
| CVE-2025-69418 | OpenSSL unauthenticated/unencrypted trailing bytes with low-level OCB function calls | 4.0CISA ADP v3.1 | 0.1% | 2026-01-27 | Fix |
| CVE-2025-68670 | xrdp improperly checks bounds of domain string length, which leads to stack-based buffer overflow | 9.1CNA v3.1 | 1.4% | 2026-01-27 | Fix |
| CVE-2025-68160 | OpenSSL heap out-of-bounds write in BIO_f_linebuffer on short writes | 4.7CISA ADP v3.1 | 0.2% | 2026-01-27 | Fix |
| CVE-2025-66199 | OpenSSL TLS 1.3 CompressedCertificate excessive memory allocation | 5.9CISA ADP v3.1 | 0.5% | 2026-01-27 | Fix |
| CVE-2025-65264 | Cpuid Cpu-z information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2026-01-27 | Exploit code |
| CVE-2025-55102 | eclipse Threadx Netx Duo NetX IPv6 component functionality denial of service | 8.7CNA v4.0 | 0.4% | 2026-01-27 | |
| CVE-2025-55095 | Eclipse ThreadX stack-based buffer overflow | 4.2CNA v3.1 | 0.2% | 2026-01-27 | |
| CVE-2025-41728 | Beckhoff: Information leak via Beckhoff Device Manager | 5.3CNA v3.1 | 0.3% | 2026-01-27 | Fix |
| CVE-2025-41727 | Beckhoff: Performing privileged operations and gaining administrator access | 7.8CNA v3.1 | 0.2% | 2026-01-27 | Fix |
| CVE-2025-41726 | Beckhoff: Arbitrary code execution within privileged processes | 8.8CNA v3.1 | 0.5% | 2026-01-27 | Fix |
| CVE-2025-33234 | NVIDIA runx OS command injection | 7.8CNA v3.1 | 0.3% | 2026-01-27 | Fix |
| CVE-2025-28164 | libpng buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-01-27 | Fix |
| CVE-2025-28162 | libpng buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-01-27 | Fix |
| CVE-2025-21589 | Session Smart Router, Session Smart Conductor, WAN Assurance Router: API authentication bypass | 9.3CNA v4.0 | 1.6% | 2026-01-27 | Fix |
| CVE-2025-15469 | OpenSSL dgst one-shot codepath silently truncates inputs | 5.5CISA ADP v3.1 | 0.2% | 2026-01-27 | Fix |
| CVE-2025-15468 | OpenSSL null dereference in SSL_CIPHER_find function on unknown cipher ID | 5.9CISA ADP v3.1 | 0.8% | 2026-01-27 | Fix |
| CVE-2025-15467 | OpenSSL stack buffer overflow in CMS (Auth)EnvelopedData parsing | 8.8CISA ADP v3.1 | 55.9% | 2026-01-27 | Exploit codeFix |
| CVE-2025-14988 | Incorrect permission assignment for critical resource vulnerability in iba Systems ibaPDA | 10.0CNA v4.0 | 0.4% | 2026-01-27 | Fix |
| CVE-2025-14971 | Link Invoice Payment for WooCommerce WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2026-01-27 | Fix |
| CVE-2025-14911 | MongoDB Mongo-c-driver integer overflow in GridFS chunkSize leading to Heap Allocation failure | 7.1CNA v4.0 | 0.3% | 2026-01-27 | Fix |
| CVE-2025-12810 | Failure in Password Rotation and Check-in Mechanism in Secret Server allows Reuse of Credentials | 5.3CNA v4.0 | 0.5% | 2026-01-27 | Fix |
| CVE-2025-12387 | Denial of service in Pix-Link LV-WR21Q | 6.9CNA v4.0 | 0.7% | 2026-01-27 | |
| CVE-2025-12386 | Missing authentication for Critical endpoint in Pix-Link LV-WR21Q | 6.9CNA v4.0 | 0.8% | 2026-01-27 | |
| CVE-2025-11187 | OpenSSL improper validation of PBMAC1 parameters in PKCS#12 MAC verification | 6.1CISA ADP v3.1 | 5.1% | 2026-01-27 | Exploit codeFix |
| CVE-2025-71178 | Crucial Storage Executive Installer DLL preloading LPE | 7.1CNA v4.0 | 0.2% | 2026-01-26 | Fix |
| CVE-2025-70982 | Bladex SpringBlade improper access control | 9.9CISA ADP v3.1 | 0.3% | 2026-01-26 | |
| CVE-2025-70368 | worklenz cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-01-26 | |
| CVE-2025-67274 | Continuous.software Aangine information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-01-26 | |
| CVE-2025-59473 | ExpressionEngine Structure for Admin authenticated user SQL injection | 7.2v3.1 | 0.3% | 2026-01-26 | |
| CVE-2025-59472 | Next.js has Unbounded Memory Consumption via PPR Resume endpoint | 7.5v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-59471 | Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | 7.5v3.1 | 0.5% | 2026-01-26 | Fix |
| CVE-2025-59109 | UART Leaking Sensitive Data in dormakaba registration unit 9002 | 5.1CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-59108 | Weak default passwords in dormakaba access manager | 9.2CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-59107 | Static Firmware Encryption Password in dormakaba access manager | 8.5CNA v4.0 | 0.2% | 2026-01-26 | |
| CVE-2025-59106 | Web Server Running with Root Privileges in dormakaba access manager | 8.8CISA ADP v3.1 | 0.8% | 2026-01-26 | |
| CVE-2025-59105 | Unencrypted Flash Storage in dormakaba access manager | 7.0CNA v4.0 | 0.1% | 2026-01-26 | |
| CVE-2025-59104 | Unlocked Bootloader in dormakaba access manager | 7.0CNA v4.0 | 0.2% | 2026-01-26 | |
| CVE-2025-59103 | Weak default passwords for SSH Access in dormakaba access manager | 9.2CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-59102 | Secrets Stored in Plaintext in Database in dormakaba access manager | 6.9CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-59101 | Insufficient Session Management in dormakaba access manager | 7.7CNA v4.0 | 0.8% | 2026-01-26 | |
| CVE-2025-59100 | Unauthenticated access to the SQLite Database in dormakaba access manager | 5.9CNA v4.0 | 0.8% | 2026-01-26 | |
| CVE-2025-59099 | Unauthenticated path traversal in dormakaba access manager | 8.8CNA v4.0 | 0.9% | 2026-01-26 | |
| CVE-2025-59098 | Trace Functionality Leaking Sensitive Data in dormakaba access manager | 8.7CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-59097 | Unauthenticated SOAP API in dormakaba access manager | 9.3CNA v4.0 | 0.7% | 2026-01-26 | |
| CVE-2025-59096 | Weak default password in dormakaba Kaba exos 9300 | 4.6CNA v4.0 | 0.2% | 2026-01-26 | |
| CVE-2025-59095 | Hard-coded key for PIN Encryption in dormakaba Kaba exos 9300 | 6.8CNA v4.0 | 0.1% | 2026-01-26 | Fix |
| CVE-2025-59094 | Local privilege escalation in dormakaba Kaba exos 9300 System management | 8.4CNA v4.0 | 0.2% | 2026-01-26 | |
| CVE-2025-59093 | Insecure Password Derivation function for Database Administrator in dormakaba Kaba exos 9300 | 8.5CNA v4.0 | 0.2% | 2026-01-26 | |
| CVE-2025-59092 | Unauthenticated RPC service in dormakaba Kaba exos 9300 | 8.7CNA v4.0 | 0.9% | 2026-01-26 | Fix |
| CVE-2025-59091 | Hard-coded Legacy Accounts allowing Control over Access Managers in dormakaba Kaba exos 9300 | 9.3CNA v4.0 | 0.9% | 2026-01-26 | Fix |
| CVE-2025-59090 | Unauthenticated SOAP API in dormakaba Kaba exos 9300 | 9.3CNA v4.0 | 1.2% | 2026-01-26 | Fix |
| CVE-2025-57785 | Hiawatha Web server double free in XSLT in show_index | 6.5v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-57784 | Hiawatha Web server tomahawk authentication timing attack due to usage of strcmp | 3.3NVD v3.1 | 0.2% | 2026-01-26 | |
| CVE-2025-57783 | Hiawatha Web server improper header parsing may lead to request smuggling | 5.3CISA ADP v3.1 | 0.5% | 2026-01-26 | |
| CVE-2025-50537 | Openjsf Eslint stack-based buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2026-01-26 | |
| CVE-2025-41083 | Improper neutralization in Altitude Communication Server | 5.1CNA v4.0 | 0.6% | 2026-01-26 | |
| CVE-2025-41082 | HTTP Request/Response Smuggling in Altitude Communication Server | 6.9CNA v4.0 | 0.4% | 2026-01-26 | |
| CVE-2025-30248 | Western Digital WD Discovery WD Discovery Installer DLL hijacking | 8.9CNA v4.0 | 0.6% | 2026-01-26 | Fix |
| CVE-2025-27821 | HDFS native client: Out-of-bounds write in URI parser of native HDFS client | 7.3CISA ADP v3.1 | 1.0% | 2026-01-26 | Fix |
| CVE-2025-14973 | Recipe Card Blocks WordPress plugin Contributor+ SQLi | 6.8CISA ADP v3.1 | 0.3% | 2026-01-26 | Fix |
| CVE-2025-14969 | Red Hat build of Quarkus Hibernate Reactive vulnerable to DoS via Connection Pool Exhaustion | 4.3CNA v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-14756 | Authenticated command injection vulnerability in Archer MR600 | 8.5CNA v4.0 | 2.8% | 2026-01-26 | Fix |
| CVE-2025-14525 | Red Hat OpenShift Virtualization 4 kubevirt: Kubevirt: Vm administration denial of service | 6.4CNA v3.1 | 0.3% | 2026-01-26 | Fix |
| CVE-2025-14459 | Red Hat RHEL-9-CNV-4.19 virt-cdi-controller: Unauthorized pvc cloning via dataimportcron | 8.5CNA v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-14316 | AhaChat Messenger Marketing WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.2% | 2026-01-26 | |
| CVE-2025-11687 | Gi-docgen: Reflected dom XSS in gi-docgen | 6.1CNA v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-11065 | Red Hat OpenShift Pipelines information disclosure through error messages | 5.3CNA v3.1 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-9820 | Red Hat Enterprise Linux 10 gnutls: Stack-based buffer overflow in gnutls_pkcs11_token_init function | 4.0CNA v3.1 | 0.2% | 2026-01-26 | Fix |
| CVE-2025-9615 | Red Hat Enterprise Linux 10 networkmanager: Networkmanager file access | 3.3CNA v3.0 | 0.2% | 2026-01-26 | Fix |
| CVE-2025-9522 | Blind server-side request forgery (SSRF) in Omada Controller | 5.1CNA v4.0 | 0.3% | 2026-01-26 | Fix |
| CVE-2025-9521 | Password Confirmation Bypass in Omada Controller | 2.1CNA v4.0 | 0.3% | 2026-01-26 | Fix |
| CVE-2025-9520 | IDOR leading to Owner Account Hijacking in Omada Controller | 8.3CNA v4.0 | 0.4% | 2026-01-26 | Fix |
| CVE-2025-71163 | Linux kernel idxd compat bind and unbind interface memory leak | 5.5NVD v3.1 | 0.2% | 2026-01-25 | Fix |
| CVE-2025-71162 | Linux kernel Tegra ADMA driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-01-25 | Fix |
| CVE-2025-6461 | CubeWP WordPress plugin information disclosure | 4.3CNA v3.1 | 0.2% | 2026-01-25 | Fix |
| CVE-2025-15516 | All-in-One Video Gallery - missing authorization to Authenticated Limited User Meta Update | 4.3CNA v3.1 | 0.2% | 2026-01-24 | Fix |
| CVE-2025-14985 | Alpha Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-01-24 | |
| CVE-2025-14941 | GZSEO WordPress plugin authorization bypass to stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-24 | Fix |
| CVE-2025-14907 | Moderate Selected Posts WordPress plugin cross-site request forgery to plugin settings update | 4.3CNA v3.1 | 0.1% | 2026-01-24 | |
| CVE-2025-14906 | WP Youtube Video Gallery WordPress plugin cross-site request forgery to plugin settings update | 4.3CNA v3.1 | 0.2% | 2026-01-24 | |
| CVE-2025-14903 | Simple Crypto Shortcodes WordPress plugin cross-site request forgery to plugin settings update | 4.3CNA v3.1 | 0.2% | 2026-01-24 | |
| CVE-2025-14843 | Wizit Gateway for WooCommerce handle_checkout_redirecturl_response function missing authorization | 5.3CNA v3.1 | 0.4% | 2026-01-24 | Fix |
| CVE-2025-14797 | Same Category Posts WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-01-24 | Fix |
| CVE-2025-14630 | AdminQuickbar WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2026-01-24 | |
| CVE-2025-14629 | Alchemist Ajax Upload WordPress plugin file deletion | 5.3CNA v3.1 | 0.3% | 2026-01-24 | |
| CVE-2025-14609 | Wise Analytics WordPress plugin missing authorization | 5.3CNA v3.1 | 0.4% | 2026-01-24 | Fix |
| CVE-2025-13952 | GPU Ddk libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP | 9.8CISA ADP v3.1 | 0.5% | 2026-01-24 | Fix |
| CVE-2025-13920 | WP Directory Kit WordPress plugin unauthenticated email exposure via wdk_public_action | 5.3CNA v3.1 | 0.7% | 2026-01-24 | NucleiFix |
| CVE-2025-13676 | JustClick registration WordPress plugin reflected cross-site scripting via PHP_SELF | 6.1CNA v3.1 | 0.3% | 2026-01-24 | |
| CVE-2025-13374 | Kalrav AI Agent WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 1.2% | 2026-01-24 | Exploit codeFix |
| CVE-2025-13205 | devsoftbaltic SurveyJS Drag and Drop Form Builder survey cloning cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2026-01-24 | Fix |
| CVE-2025-13194 | devsoftbaltic SurveyJS Drag and Drop Form Builder survey renaming cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2026-01-24 | Fix |
| CVE-2025-13139 | SurveyJS: Drag and Drop WordPress Form Builder plugin cross-site request forgery to Survey creation | 4.3CNA v3.1 | 0.1% | 2026-01-24 | Fix |
| CVE-2025-12836 | VK Google Job Posting Manager WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-24 | Fix |
| CVE-2025-71177 | LavaLite CMS stored XSS via Package Creation and Search | 5.4NVD v3.1 | 0.2% | 2026-01-23 | |
| CVE-2025-71161 | Linux kernel dm-verity forward error correction denial of service | 7.5CNA v3.1 | 0.4% | 2026-01-23 | Fix |
| CVE-2025-71160 | Linux kernel nf_tables chain validation denial of service | 5.5v3.1 | 0.2% | 2026-01-23 | Fix |
| CVE-2025-71159 | Linux kernel Btrfs delayed node handling use-after-free | 9.8CNA v3.1 | 0.2% | 2026-01-23 | Fix |
| CVE-2025-71158 | Linux kernel MPSSE GPIO driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-01-23 | Fix |
| CVE-2025-71157 | Linux kernel RDMA core sub-device handling vulnerability | 7.8v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71156 | Linux kernel gve Ethernet driver vulnerability | 7.8v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71155 | Linux kernel KVM s390 guest memory management out-of-bounds write | 7.8CNA v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71154 | Linux kernel rtl8150 USB Ethernet driver memory leak | 5.5NVD v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71153 | Linux kernel ksmbd get_file_all_info memory leak | 5.5v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71152 | Linux kernel DSA conduit device handling vulnerability | 7.8v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71151 | Linux kernel cifs information disclosure | 5.5v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71150 | Linux kernel ksmbd session lookup vulnerability | 7.5CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-71148 | Linux kernel kernel TLS handshake upcall vulnerability | 3.3v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71147 | Linux kernel TPM2 trusted keys memory leak | 5.5NVD v3.1 | 0.1% | 2026-01-23 | Fix |
| CVE-2025-71146 | Linux kernel nf_conncount netfilter module memory leak | 7.5CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-71145 | Linux kernel ISP1301 USB PHY driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-01-23 | Fix |
| CVE-2025-70986 | RuoYi missing authorization | 7.5CISA ADP v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-70985 | RuoYi missing authorization | 9.1CISA ADP v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-70983 | Bladex SpringBlade missing authorization | 9.9CISA ADP v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-70458 | Remyandrade Domain Availability Checker DOM-based cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-01-23 | |
| CVE-2025-70457 | Remyandrade Modern Image Gallery App Sourcecodester remote code execution | 9.8CISA ADP v3.1 | 0.9% | 2026-01-23 | |
| CVE-2025-69908 | Newgensoft Omniapp information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-69907 | Newgen OmniDocs GetListofCabinet API endpoint information disclosure | 7.5CISA ADP v3.1 | 0.6% | 2026-01-23 | |
| CVE-2025-67847 | Moodle: Moodle: Remote code execution via insufficient restore input validation | 8.8CNA v3.1 | 0.6% | 2026-01-23 | Fix |
| CVE-2025-67264 | Doogee NOTE59 Pro com.sprd.engineermode component OS command injection | 7.8CISA ADP v3.1 | 0.9% | 2026-01-23 | |
| CVE-2025-67231 | ToDesktop Builder A reflected cross-site scripting | 5.9CISA ADP v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-67230 | ToDesktop Builder handler for the Custom URL Scheme improper permissions | 7.1CISA ADP v3.1 | 0.2% | 2026-01-23 | Fix |
| CVE-2025-67229 | ToDesktop Builder An improper certificate validation | 9.8CISA ADP v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-67125 | Docopt.cpp signed integer overflow | 4.4CISA ADP v3.1 | 0.2% | 2026-01-23 | |
| CVE-2025-67124 | Miniserve affected by a TOCTOU and symlink race | 6.8CISA ADP v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-66720 | free5gc pcf null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2026-01-23 | |
| CVE-2025-66719 | Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value | 9.1CISA ADP v3.1 | 0.4% | 2026-01-23 | Fix |
| CVE-2025-52026 | Aptsys Gemscms Backend information disclosure | 7.5CISA ADP v3.1 | 0.3% | 2026-01-23 | |
| CVE-2025-52025 | Aptsys Gemscms Backend GetServiceByRestaurantID endpoint of the SQL injection | 9.4CISA ADP v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-52024 | Aptsys Gemscms Backend missing authentication | 9.4CISA ADP v3.1 | 0.5% | 2026-01-23 | |
| CVE-2025-52023 | Aptsys Gemscms Backend information disclosure through error messages | 5.3CISA ADP v3.1 | 0.5% | 2026-01-23 | |
| CVE-2025-52022 | Aptsys Gemscms Backend information disclosure through error messages | 5.3CISA ADP v3.1 | 0.5% | 2026-01-23 | |
| CVE-2025-46699 | Dell Data Protection Advisor server-side template injection | 4.3CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-15522 | Uncanny Automator WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-15351 | Anritsu VectorStar CHX File Parsing deserialization of untrusted data remote code execution | 7.8CNA v3.0 | 0.4% | 2026-01-23 | |
| CVE-2025-15350 | Anritsu VectorStar CHX File Parsing deserialization of untrusted data remote code execution | 7.8CNA v3.0 | 0.4% | 2026-01-23 | |
| CVE-2025-15349 | Anritsu ShockLine SCPI race condition remote code execution | 7.5CNA v3.0 | 0.5% | 2026-01-23 | |
| CVE-2025-15348 | Anritsu ShockLine CHX File Parsing deserialization of untrusted data remote code execution | 7.8CNA v3.0 | 0.4% | 2026-01-23 | |
| CVE-2025-15063 | Ollama MCP Server execAsync command injection remote code execution | 9.8CNA v3.0 | 2.0% | 2026-01-23 | |
| CVE-2025-15062 | Trimble SketchUp SKP File Parsing use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2026-01-23 | |
| CVE-2025-15061 | Framelink Figma MCP Server fetchWithRetry command injection remote code execution | 9.8CNA v3.0 | 2.2% | 2026-01-23 | Fix |
| CVE-2025-15059 | GIMP PSP File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.8% | 2026-01-23 | Fix |
| CVE-2025-14947 | All-in-One Video Gallery WordPress plugin unauthorized access | 6.5CNA v3.1 | 0.4% | 2026-01-23 | Fix |
| CVE-2025-14866 | Melapress Role Editor WordPress plugin improper authorization to authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2026-01-23 | Fix |
| CVE-2025-14745 | RSS Aggregator WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-14069 | Schema and Structured Data for WP and AMP WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-13921 | weDocs WordPress plugin missing authorization authenticated Documentation post update | 4.3CNA v3.1 | 0.3% | 2026-01-23 | Fix |
| CVE-2025-11002 | 7-Zip ZIP File Parsing directory traversal remote code execution | 7.8v3.1 | 0.5% | 2026-01-23 | Fix |
| CVE-2025-4320 | Information disclosure in Birebirsoft's Sufirmam | 10.0CNA v3.1 | 0.5% | 2026-01-23 | |
| CVE-2025-4319 | Improper access control in Birebirsoft's Sufirmam | 9.4CNA v3.1 | 0.4% | 2026-01-23 | |
| CVE-2025-3839 | Epiphany: Insecure external protocol invocation in epiphany | 8.0CNA v3.1 | 0.4% | 2026-01-23 | Fix |
| CVE-2025-2204 | XSS in Tapandsign Technologies' Tap&Sign App | 4.7CNA v3.1 | 0.3% | 2026-01-23 | |
| CVE-2025-71176 | pytest insecure temporary file | 6.8CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-70899 | PHPGurukul Online Course Registration cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69828 | TMS Global Software TMS Management Console logo upload in Customer AddEdit vulnerability | 10.0CISA ADP v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69822 | Atomberg Erica Smart Fan Firmware improper authentication | 7.4CISA ADP v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69821 | Beatxp VEGA Smartwatch Firmware improper resource release | 7.4CISA ADP v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69820 | Beam BETA9 potential URI resolution path traversal in the AWS SDK for PHP | 6.0CISA ADP v3.1 | 1.0% | 2026-01-22 | Fix |
| CVE-2025-69764 | Tenda AX3 Firmware stack-based buffer overflow | 9.8CISA ADP v3.1 | 1.1% | 2026-01-22 | |
| CVE-2025-69612 | Tmsglobalsoft Tms Management Console path traversal | 6.5CISA ADP v3.1 | 1.0% | 2026-01-22 | Exploit code |
| CVE-2025-69321 | Grand Spa WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-69320 | Grand Magazine WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69319 | Beaver Builder WordPress plugin arbitrary code execution | 7.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-69318 | JobWP WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69317 | CarSpot WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69316 | TableOn WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69315 | Simply Schedule Appointments WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69314 | Werkstatt WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-69313 | PostX WordPress plugin broken access control | 7.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-69312 | Xpro Elementor Addons WordPress plugin arbitrary file upload | 9.1CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-69311 | Broadstreet Ads WordPress plugin broken access control | 7.6CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-69300 | Premium Addons for Elementor WordPress plugin settings Change vulnerability | 5.4CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-69293 | Final User WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69292 | WP Membership WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69193 | WP Membership WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69192 | Real Estate Pro WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69191 | ListingHub WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69190 | Listihub WordPress theme broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69188 | fitness-trainer WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69187 | Final User WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69186 | Hospital Doctor Directory WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69185 | Hotel Listing WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69184 | Institutions Directory WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69183 | Hospital Doctor Directory WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69182 | Institutions Directory WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69181 | Lawyer Directory WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69180 | Ultra Portfolio WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69102 | WP Test Email WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69101 | Workreap Core WordPress plugin broken authentication | 9.8CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69100 | North WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69099 | North WordPress theme PHP object injection | 8.8CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69098 | Hide My WP WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69097 | WPLMS WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69095 | Reservation WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-69079 | Sound Musical Instruments Online Store WordPress theme deserialization of untrusted data | 9.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69078 | Malta WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69077 | Hobo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69076 | Modern Housewife WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69075 | Yolox WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69074 | Pearson Specter WordPress theme local file inclusion | 8.1CISA ADP v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69073 | Piqes WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69072 | Prider WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69071 | TanTum WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69070 | Tornados WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69068 | Muji WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69067 | Tails WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69066 | Indoor Plants WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69065 | Snow Mountain WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69064 | Pets Land WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69062 | Weedles WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69061 | MoveMe WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69060 | uReach WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69059 | DiveIt WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69058 | PartyMaker WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69057 | Eldon WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69056 | Hotel Listing WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69055 | BM Content Builder WordPress plugin arbitrary file download | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-69054 | Super Logos Showcase WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69053 | Universal Video Player WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69052 | FmeAddons Registration and Login with Mobile Phone Number for WooCommerce missing authorization | 9.8CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-69051 | ListingPro Reviews WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-69050 | Overworld WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69049 | Töbel WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69048 | Universal Video Player WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69047 | MaxShop WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69046 | iRecco Core WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69045 | FooEvents for WooCommerce WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-69044 | Vango WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69043 | Rashy WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69042 | Lindo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69041 | Dekoro WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69040 | Bfres WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69039 | Bailly WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-69038 | Hyori WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69037 | Pippo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69036 | Tech Life CPT WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69035 | Dental Care CPT WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69005 | Search and Go WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69004 | Bajaar - Highly Customizable WooCommerce WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-69003 | KenthaRadio WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-69002 | OneLife WordPress theme PHP object injection | 8.8CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-69001 | FluentForm WordPress plugin arbitrary shortcode execution vulnerability | 5.3CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68999 | Happy Addons for Elementor WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2026-01-22 | Exploit codeFix |
| CVE-2025-68986 | Miion WordPress theme arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68913 | Miion WordPress theme local file inclusion | 7.5CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68912 | HDForms WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-68911 | Solace WordPress theme broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68910 | Blogzee WordPress theme arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68909 | Blogistic WordPress theme arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68908 | Barberry WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68907 | Hostme v2 WordPress theme arbitrary file deletion | 7.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68906 | JNews - Video WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68905 | JNews - Pay Writer WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68904 | JNews - Frontend Submit WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68903 | Anona WordPress theme PHP object injection | 8.8CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68902 | Anona WordPress theme arbitrary file download | 7.5CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68901 | Anona WordPress theme arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68900 | Enfold WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-68899 | Vivagh WordPress theme PHP object injection | 8.8CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-68898 | Synergy Project Manager WordPress plugin cross-site scripting (XSS) | 5.8CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68896 | WDV One Page Docs WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68894 | ShoutOut WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68884 | WP Simple Redirect WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68883 | bidorbuy Store Integrator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68882 | Scalenut WordPress plugin broken access control | 7.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68881 | AppExperts WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68871 | Dooodl WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68869 | LazyTasks WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-68866 | Dinatur WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68864 | Infility Global WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68859 | Syntax Highlighter Compress WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68858 | wpCAS WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68857 | Paid Downloads WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68849 | Quote Master WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68839 | Easy Theme Options WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68838 | MemberPress Discord Addon WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68835 | Ravpage WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-68609 | Authentication bypass in Aries due to misconfiguration | 6.6CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68558 | Depicter Slider WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68538 | Craft Coffee Shop Cafe Restaurant WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68520 | DotLife WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68518 | Hoteller WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68510 | Photography WordPress theme local file inclusion | 8.1CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-68507 | Icegram WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68073 | GDPR CCPA Compliance Support WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68072 | Easy Property Listings WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68059 | Hotel Listing WordPress plugin broken access control | 7.6CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68058 | Institutions Directory WordPress plugin broken access control | 7.6CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68057 | Hospital Doctor Directory WordPress plugin broken access control | 7.6CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68047 | Eventin WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-68046 | Contact Form and Lead Form Elementor Builder WordPress plugin sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68041 | Omnichannel for WooCommerce WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68039 | WP BackItUp WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68035 | Tabby Checkout WordPress plugin sensitive data exposure | 7.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68034 | CleverReach® WP WordPress plugin SQL injection | 9.3CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-68030 | Frontis Blocks WordPress plugin server side request forgery (SSRF) | 7.2CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68027 | Hydra Booking WordPress plugin privilege escalation | 7.3CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68020 | Notifier WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68019 | SEO Booster WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68018 | Order Listener for WooCommerce WordPress plugin broken access control | 9.4CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68017 | Antideo Email Validator WordPress plugin SQL injection | 7.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68016 | onepay Payment Gateway For WooCommerce WordPress plugin Other vulnerability type vulnerability | 6.5CISA ADP v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68015 | Event Tickets with Ticket Scanner WordPress plugin remote code execution (RCE) | 9.0CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68013 | Payment Gateway Authorize.Net CIM for WooCommerce WordPress plugin missing authorization | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68012 | CodeColorer WordPress plugin stored cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68011 | GLS Shipping for WooCommerce WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68010 | Netgsm WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-68009 | Slider Templates WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68008 | WP Mail WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-68007 | Event Espresso 4 Decaf WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-68006 | Booking Ultra Pro WordPress plugin sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68004 | My Post Order WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-68003 | Shown Connector WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-68001 | g-FFL Checkout WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.6% | 2026-01-22 | Exploit codeFix |
| CVE-2025-67968 | Real Homes CRM WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67967 | Lawyer Directory WordPress plugin broken access control | 7.6CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67966 | Lawyer Directory WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-67964 | Homey Core WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67963 | Movie Booking WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67961 | WPO365 WordPress plugin server side request forgery (SSRF) | 6.4CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67960 | WorkScout-Core WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67959 | WorkScout WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67958 | TaxCloud for WooCommerce WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67957 | Listivo Core WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67956 | User Registration WordPress plugin broken access control | 8.2CISA ADP v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67955 | MyHome Core WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-67954 | Salon booking system WordPress plugin sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67953 | Booking Activities WordPress plugin privilege escalation | 8.1CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67952 | Grand Tour WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67949 | Hostiko WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67947 | AdForest Elementor WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67946 | AdForest WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67945 | MailerLite WooCommerce integration WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67944 | Nelio AB Testing WordPress plugin arbitrary code execution | 9.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67943 | My auctions allegro WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67942 | Peach Payments Gateway WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67941 | The Aisle WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67940 | Powerlift WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67939 | Tickera WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-67938 | Biagiotti WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-67923 | JetEngine WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-67684 | Remote code execution via local file inclusion in Quick.Cart | 7.2NVD v3.1 | 0.8% | 2026-01-22 | |
| CVE-2025-67683 | Reflected XSS in Quick.Cart | 6.1v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-67652 | AutomationDirect CLICK Programmable Logic Controller weak encoding for password | 6.1CNA v3.1 | 0.1% | 2026-01-22 | Fix |
| CVE-2025-67626 | WP SEO Search WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-67620 | Anon WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-67619 | Kids Heaven WordPress theme PHP object injection | 8.8CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-67617 | Consult Aid WordPress theme PHP object injection | 9.8CNA v3.1 | 0.7% | 2026-01-22 | |
| CVE-2025-67616 | Mella WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-67615 | Myour WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-67614 | TheNa WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-67221 | Orjson does not limit recursion for deeply nested JSON documents | 7.5CISA ADP v3.1 | 0.6% | 2026-01-22 | Exploit codeFix |
| CVE-2025-66428 | WebPros WordPress Toolkit WordPress directory name handling privilege escalation | 8.8CISA ADP v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-66143 | Crumber WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66142 | Comparimager for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66141 | Scroller WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66140 | Uper for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66139 | Audier For Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66138 | Motionger for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66137 | Searcher for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66136 | Carter for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-66135 | Imager for Elementor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-65098 | Typebot vulnerable to Credential Theft via Client-Side Script Execution and API authorization bypass | 7.4CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-64252 | ANAC XML Viewer WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-64097 | NervesHub has Insufficient Token Entropy that allows authentication bypass via brute force | 9.5CNA v4.0 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-63051 | REHub Framework WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-63026 | Grand Restaurant Theme Elements for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-63019 | Cookies and Content Security Policy WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-63018 | Bard WordPress theme broken access control | 4.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-63017 | WerkStatt WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-62754 | Payment Gateway bKash for WC WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-62741 | Pool Services WordPress theme server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-62106 | WP-CRM System WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-62077 | Affiliate Link Tracker WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-62056 | News Event WordPress theme arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-62050 | Blogmatic WordPress theme arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2026-01-22 | Fix |
| CVE-2025-56590 | Apryse HTML2PDF OS command injection | 9.8CISA ADP v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-56589 | Apryse HTML2PDF server-side request forgery | 7.5CISA ADP v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-55705 | EVMAPA insufficient session expiration | 9.8v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-54816 | EVMAPA missing authentication for critical function | 9.8v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-54003 | Depot WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-54002 | xSmart WordPress theme broken access control | 6.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-53968 | EVMAPA improper restriction of excessive authentication attempts | 7.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-53240 | WordPress Photo Gallery plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-52762 | flexo-posts-manager WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-52746 | Restaurante WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-50007 | xSmart WordPress theme privilege escalation | 8.8CNA v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-50006 | xSmart WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-50005 | tagDiv Composer WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-50004 | JupiterX Core WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.7% | 2026-01-22 | Fix |
| CVE-2025-50003 | Amuli WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-50002 | Energia WordPress theme arbitrary file upload | 10.0CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-49994 | Athens WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-49375 | HomeLancer WordPress theme broken access control | 5.4CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-49336 | Pondol BBS WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-49249 | Drone WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-49066 | Accordion Slider PRO WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-49055 | WP Lead Capturing Pages WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-49050 | WP Lead Capturing Pages WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-49049 | DZS Video Gallery WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-49046 | xPromoter WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-49045 | Super Interactive Maps WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-49043 | Magic Responsive Slider and Carousel WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-48094 | Magic Slider WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-47666 | Image&Video FullScreen Background WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-47600 | WoodMart WordPress theme arbitrary shortcode execution vulnerability | 5.3CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-47555 | Tutor LMS WordPress plugin insecure direct object references (IDOR) | 3.8CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-47500 | Stackable WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-47474 | Anarkali WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2026-01-22 | |
| CVE-2025-36588 | Dell Unisphere for PowerMax SQL injection | 8.8CNA v3.1 | 0.7% | 2026-01-22 | Fix |
| CVE-2025-32123 | HTML5 Video Player with Playlist and Multiple Skins WordPress plugin reflected cross-site scripting | 7.1CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-32057 | Misconfigured SSL/TLS communication of Redbend service for Infotainment ECU | 6.5CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-32056 | Bosch Infotainment system ECU anti-theft response generation vulnerability | 4.0CNA v3.1 | 0.3% | 2026-01-22 | |
| CVE-2025-31413 | Element Pack Elementor Addons WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-27380 | HTML injection leading to Script Execution in Altium Enterprise Server | 7.6CNA v3.1 | 0.3% | 2026-01-22 | Fix |
| CVE-2025-27379 | Stored cross-site scripting in AES BOM Viewer | 6.8CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-27378 | SQL injection in AES due to Inactive SQL Parsing Configuration | 8.6CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-27377 | Missing Validation of Self-Signed Certificates in Altium Designer allows man-in-the-middle Attacks | 5.3CNA v3.1 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-27005 | HTML5 Video Player WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-25051 | AutomationDirect CLICK Programmable Logic Controller plaintext storage of a password | 6.1CNA v3.1 | 0.1% | 2026-01-22 | Fix |
| CVE-2025-22234 | Spring Security BCrypt Password Encoder maximum password length breaks timing attack mitigation | 5.3CNA v3.1 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-15523 | Inkscape TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app | 4.8CNA v4.0 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-14751 | Unverified password change in Weintek cMT X Series HMI EasyWeb service | 8.7CNA v4.0 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-14750 | External control of assumed-immutable web parameter in Weintek cMT X Series HMI EasyWeb service | 8.7CNA v4.0 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-14295 | Automated Logic WebCTRL and Carrier i-Vu session fixation | 7.0CNA v4.0 | 0.2% | 2026-01-22 | |
| CVE-2025-13928 | Incorrect authorization in GitLab | 7.5CNA v3.1 | 0.7% | 2026-01-22 | Fix |
| CVE-2025-13927 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.8% | 2026-01-22 | Fix |
| CVE-2025-13335 | Loop with unreachable exit condition (infinite loop) in GitLab | 6.5CNA v3.1 | 0.6% | 2026-01-22 | Fix |
| CVE-2025-12738 | neo4j Enterprise Edition enumeration of restricted property value | 1.3CNA v4.0 | 0.4% | 2026-01-22 | Fix |
| CVE-2025-10856 | Arbitrary file upload in Solvera Software's Teknoera | 8.1CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-10855 | IDOR in Solvera Software's Teknoera | 7.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-10024 | IDOR in EXERT Computer Technologies' Education Management System | 7.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-9290 | Authentication Weakness on Omada Controllers, Gateways and Access Points | 6.0CNA v4.0 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-9289 | Cross-site scripting (XSS) on Omada Controllers | 5.7CNA v4.0 | 0.2% | 2026-01-22 | Fix |
| CVE-2025-5805 | Electron WordPress theme broken access control | 6.5CNA v3.1 | 0.4% | 2026-01-22 | |
| CVE-2025-4764 | SQLi in Aida Computer's Hotspot | 8.8v3.1 | 0.5% | 2026-01-22 | |
| CVE-2025-4763 | XSS in Aida Computer's Hotspot | 6.1v3.1 | 0.2% | 2026-01-22 | |
| CVE-2025-70651 | Tenda AX1803 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-70650 | Tenda AX1806 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-70648 | Tenda AX1803 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-70646 | Tenda AX1803 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-70645 | Tenda AX1806 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-70644 | Tenda AX1806 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-69766 | Tenda AX3 Firmware stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.8% | 2026-01-21 | |
| CVE-2025-69763 | Tenda AX3 Firmware stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.9% | 2026-01-21 | |
| CVE-2025-69762 | Tenda AX3 Firmware stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.9% | 2026-01-21 | |
| CVE-2025-69285 | SQLBot uploadExcel endpoint has unauthenticated arbitrary file upload | 7.7CNA v4.0 | 0.5% | 2026-01-21 | Fix |
| CVE-2025-69209 | ArduinoCore-avr has stack-based buffer overflow in WString Float/Double Constructors | 6.9CNA v4.0 | 0.2% | 2026-01-21 | Fix |
| CVE-2025-68141 | EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization | 7.4CNA v3.1 | 0.3% | 2026-01-21 | Fix |
| CVE-2025-68140 | EVerest allows null session ID to bypass session ID verification | 4.3CNA v3.1 | 0.2% | 2026-01-21 | Fix |
| CVE-2025-68139 | Linux Foundation EVerest connection termination handling session fixation | 4.3CNA v3.1 | 0.2% | 2026-01-21 | Fix |
| CVE-2025-68138 | EVerest affected by memory exhaustion in libocpp | 4.7CNA v3.1 | 0.2% | 2026-01-21 | Fix |
| CVE-2025-68137 | everest-core buffer overflow | 8.4CNA v3.1 | 1.3% | 2026-01-21 | Exploit codeFix |
| CVE-2025-68136 | Linux Foundation EVerest SDP session handling null pointer dereference | 7.4CNA v3.1 | 0.3% | 2026-01-21 | Fix |
| CVE-2025-68135 | EVerest's inadequate exception handling leads to denial of service | 6.5CNA v3.1 | 0.3% | 2026-01-21 | Fix |
| CVE-2025-68134 | EVerest's use of assert functions can potentially lead to denial of service | 7.4CNA v3.1 | 0.2% | 2026-01-21 | Fix |
| CVE-2025-68133 | EVerest's unlimited connections can lead to DoS through operating system resource exhaustion | 7.4CNA v3.1 | 0.4% | 2026-01-21 | Fix |
| CVE-2025-68132 | EVerest has out-of-bounds read in DZG_GSH01 SLIP CRC parser that can crash powermeter driver | 2.4CNA v4.0 | 0.3% | 2026-01-21 | Fix |
| CVE-2025-66960 | Ollama denial of service | 7.5CISA ADP v3.1 | 0.4% | 2026-01-21 | |
| CVE-2025-66959 | Ollama denial of service | 7.5CISA ADP v3.1 | 5.2% | 2026-01-21 | |
| CVE-2025-57681 | Thestarware Worklogpro cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-01-21 | |
| CVE-2025-15521 | Academy LMS WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.4% | 2026-01-21 | Exploit codeFix |
| CVE-2025-14559 | Keycloak services allows the issuance of access and refresh tokens for disabled users | 6.5CNA v3.1 | 0.5% | 2026-01-21 | Fix |
| CVE-2025-14083 | Keycloak-server: Keycloak: Improper access control in admin rest API leads to information disclosure | 2.7CNA v3.1 | 0.4% | 2026-01-21 | Fix |
| CVE-2025-13878 | ISC BIND 9 malformed BRID/HHIT records can cause named to terminate unexpectedly | 7.5CNA v3.1 | 9.4% | 2026-01-21 | Fix |
| CVE-2025-13465 | Prototype pollution vulnerability in Lodash _.unset and _.omit functions | 6.9CNA v4.0 | 1.8% | 2026-01-21 | Fix |
| CVE-2025-12781 | Python CPython base64.b64decode always accepts +/ characters, despite setting altchars | 6.3CNA v4.0 | 0.6% | 2026-01-21 | Fix |
| CVE-2025-67824 | WorklogPRO - Jira Timesheets filter name field vulnerability | 6.1CISA ADP v3.1 | 0.2% | 2026-01-20 | |
| CVE-2025-67263 | Abacre Retail Point Of Sale cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2026-01-20 | |
| CVE-2025-67261 | Abacre Retail Point Of Sale SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2026-01-20 | Exploit code |
| CVE-2025-66902 | Pithikos Websocket Server in improper input validation | 7.5CISA ADP v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-66803 | Turbo Frame responses can restore stale session cookies | 4.8CISA ADP v3.1 | 0.3% | 2026-01-20 | Fix |
| CVE-2025-66692 | Trust Wallet Core PublicKey::verify method of Binance - buffer over-read | 7.5CISA ADP v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-66523 | Reflected cross-site scripting vulnerability in na1.foxitesign.Foxit.com | 6.1CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-65482 | XDocReport affected by an XML external entity (XXE) | 9.8CISA ADP v3.1 | 0.6% | 2026-01-20 | Fix |
| CVE-2025-64087 | XDocReport affected by a server-side template injection (SSTI) | 9.8CISA ADP v3.1 | 0.6% | 2026-01-20 | Fix |
| CVE-2025-63648 | owntone-server dacp_reply_playqueueedit_move function null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2026-01-20 | Fix |
| CVE-2025-63647 | owntone-server parse_meta function null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-59466 | Node.js Node uncaught exception | 7.5v3.1 | 0.6% | 2026-01-20 | Fix |
| CVE-2025-59465 | Node.js Node uncaught exception | 7.5CNA v3.0 | 4.0% | 2026-01-20 | Fix |
| CVE-2025-59464 | Node.js Node A memory leak | 7.5v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-58744 | Hard-Coded default credentials Enable Document Archive Decryption in Milner ImageDirector Capture | 7.5v3.1 | 0.1% | 2026-01-20 | Fix |
| CVE-2025-58743 | Milner ImageDirector Capture Password class in C2SConnections.dll weak cryptographic algorithm | 7.5v3.1 | 0.1% | 2026-01-20 | Fix |
| CVE-2025-58742 | Milner ImageDirector Capture Connection Settings dialog insufficiently protected credentials | 5.9NVD v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-58741 | Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture | 7.5v3.1 | 0.2% | 2026-01-20 | |
| CVE-2025-58740 | Hard-coded encryption key enables Database Credential Access in Milner ImageDirector Capture | 5.5NVD v3.1 | 0.1% | 2026-01-20 | Fix |
| CVE-2025-58095 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-58094 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58093 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58092 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58091 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58090 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58089 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58088 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-58087 | MedDream PACS Premium config.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-58080 | MedDream PACS Premium modifyHL7App functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-57881 | MedDream PACS Premium modifyEmail functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-57787 | MedDream PACS Premium modifyRoute functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-57786 | MedDream PACS Premium notifynewstudy functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-57156 | owntone-server null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2026-01-20 | |
| CVE-2025-57155 | owntone-server null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-56353 | Justdoit0910 Tinymqtt memory leak | 7.5CISA ADP v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-56005 | Dabeaz Ply deserialization of untrusted data | 9.8CISA ADP v3.1 | 18.8% | 2026-01-20 | Exploit codeFix |
| CVE-2025-55423 | Iptime A1004 upnp_relay function in multiple command injection | 9.8CISA ADP v3.1 | 3.8% | 2026-01-20 | Fix |
| CVE-2025-55132 | Node.js Node incorrect default permissions | 5.3v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-55131 | Node.js Node buffer overflow | 7.1CNA v3.0 | 3.5% | 2026-01-20 | Fix |
| CVE-2025-55130 | Node.js Node improper preservation of permissions | 9.1v3.1 | 1.7% | 2026-01-20 | Exploit codeFix |
| CVE-2025-55071 | MedDream PACS Premium modifyAnonymize functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-54861 | MedDream PACS Premium modifyCoercion functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54853 | MedDream PACS Premium modifyUser functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54852 | MedDream PACS Premium modifyAeTitle functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-54817 | MedDream PACS Premium autoPurge functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54814 | MedDream PACS Premium modifyAutopurgeFilter functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54778 | MedDream PACS Premium existingUser functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54495 | MedDream PACS Premium emailfailedjob functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-54157 | MedDream PACS Premium encapsulatedDoc functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-53912 | MedDream PACS Premium encapsulatedDoc functionality arbitrary file read | 8.1NVD v3.1 | 0.6% | 2026-01-20 | |
| CVE-2025-53854 | MedDream PACS Premium modifyHL7Route functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-53707 | MedDream PACS Premium modifyTranscript functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-53516 | MedDream PACS Premium downloadZip functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-46270 | MedDream PACS Premium fetchPriorStudies functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-44000 | MedDream PACS Premium sendOruReport functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-01-20 | |
| CVE-2025-41768 | Beckhoff: XSS vulnerability in TwinCAT 3 HMI Server | 5.5CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-41084 | Stored cross-site scripting (XSS) in Sesame web application | 5.1CNA v4.0 | 0.4% | 2026-01-20 | |
| CVE-2025-41081 | Reflected cross-site scripting (XSS) in IsMyGym | 5.1CNA v4.0 | 0.3% | 2026-01-20 | |
| CVE-2025-41025 | Stored cross-site scripting in Poultry Farm Management System | 5.4v3.1 | 0.2% | 2026-01-20 | |
| CVE-2025-41024 | Stored cross-site scripting in Poultry Farm Management System | 5.4v3.1 | 0.2% | 2026-01-20 | |
| CVE-2025-40679 | HTML injection in Isshue from Bdtask | 5.1CNA v4.0 | 0.3% | 2026-01-20 | |
| CVE-2025-40644 | Reflected cross-site scripting (XSS) in QRGen's Riftzilla | 5.1CNA v4.0 | 0.4% | 2026-01-20 | |
| CVE-2025-36556 | MedDream PACS Premium ldapUser functionality reflected cross-site scripting | 5.4v3.1 | 0.3% | 2026-01-20 | |
| CVE-2025-36419 | IBM ApplinX information disclosure | 5.3CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36418 | IBM ApplinX JWT token verification privilege escalation | 7.3CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36411 | IBM ApplinX cross-site request forgery | 3.5CNA v3.1 | 0.1% | 2026-01-20 | Fix |
| CVE-2025-36410 | IBM ApplinX client-side enforcement of server-side security | 3.1CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36409 | IBM ApplinX cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36408 | IBM ApplinX stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36397 | Security vulnerabilities have been found in IBM Application Gateway | 5.4CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36396 | Security vulnerabilities have been found in IBM Application Gateway | 5.4CNA v3.1 | 0.2% | 2026-01-20 | Fix |
| CVE-2025-36115 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator session fixation | 6.3CNA v3.1 | 0.2% | 2026-01-20 | Fix |