CVE-2025 list

CVE-2025 records published after 2025

Page five of six: records 4,001 to 5,000 of the 5,305 published after 2025, newest first. The first page carries the figures for After 2025.

CVE-2025 records published after 2025, newest first: records 4,001 to 5,000 of 5,305
CVE Summary CVSS EPSS Published Signals
CVE-2025-36113IBM Sterling Connect:Express Adapter for Sterling B2B Integrator cross-site scripting5.4CNA v3.10.2%2026-01-20Fix
CVE-2025-36066IBM Sterling Connect:Express Adapter for Sterling B2B Integrator cross-site scripting6.1CNA v3.10.2%2026-01-20Fix
CVE-2025-36065IBM Sterling Connect:Express Adapter for Sterling B2B Integrator insufficient session expiration6.3CNA v3.10.2%2026-01-20Fix
CVE-2025-36063IBM Sterling Connect:Express Adapter for Sterling B2B Integrator insufficient session expiration6.3CNA v3.10.2%2026-01-20Fix
CVE-2025-36059IBM Business Automation Workflow containers execution with unnecessary privileges4.7CNA v3.10.1%2026-01-20Fix
CVE-2025-36058IBM Business Automation Workflow configuration map information disclosure5.5CNA v3.10.1%2026-01-20Fix
CVE-2025-33233NVIDIA Merlin Transformers4Rec code injection7.8CNA v3.10.2%2026-01-20Fix
CVE-2025-33231NVIDIA CUDA Toolkit uncontrolled search path6.7CNA v3.10.2%2026-01-20Fix
CVE-2025-33230NVIDIA CUDA Toolkit OS command injection7.3CNA v3.11.4%2026-01-20Fix
CVE-2025-33229NVIDIA CUDA Toolkit uncontrolled search path7.3CNA v3.10.2%2026-01-20Fix
CVE-2025-33228NVIDIA CUDA Toolkit OS command injection7.3CNA v3.11.4%2026-01-20Fix
CVE-2025-33015IBM Concert web interface unrestricted file upload8.8CNA v3.10.3%2026-01-20Fix
CVE-2025-15466Image Photo Gallery Final Tiles Grid WordPress plugin unauthorized access5.4CNA v3.10.2%2026-01-20Fix
CVE-2025-15380NotificationX WordPress plugin unauthenticated DOM-based cross-site scripting via nx-preview7.2CNA v3.10.3%2026-01-20Fix
CVE-2025-15367Python CPython POP3 command injection in user-controlled commands5.9CNA v4.00.4%2026-01-20Fix
CVE-2025-15366Python CPython IMAP command injection in user-controlled commands5.9CNA v4.00.4%2026-01-20Fix
CVE-2025-15347Creator LMS WordPress plugin unauthorized access8.8CNA v3.10.3%2026-01-20Fix
CVE-2025-15282Python CPython header injection via newlines in data URL mediatype6.0CNA v4.00.5%2026-01-20Fix
CVE-2025-15281The GNU C Library glibc wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory7.5CISA ADP v3.10.5%2026-01-20Fix
CVE-2025-15043The Events Calendar WordPress plugin missing authorization authenticated data Migration control5.4CNA v3.10.2%2026-01-20Fix
CVE-2025-14978PeachPay WordPress plugin unauthorized access5.3CNA v3.10.2%2026-01-20Fix
CVE-2025-14977Dokan Multivendor Marketplace settings REST API endpoint insecure direct object reference8.1CNA v3.10.3%2026-01-20Fix
CVE-2025-14798LearnPress WordPress plugin information disclosure5.3CNA v3.10.3%2026-01-20Fix
CVE-2025-14533Advanced Custom Fields: Extended WordPress plugin unauthenticated privilege escalation9.8CNA v3.11.5%2026-01-20Fix
CVE-2025-14377Verve Asset Manager plaintext storage8.8CNA v4.00.2%2026-01-20Fix
CVE-2025-14376Verve Asset Manager plaintext storage8.6CNA v4.00.1%2026-01-20Fix
CVE-2025-14369mackron dr_flac FLAC metadata parser integer overflow5.5CISA ADP v3.10.2%2026-01-20Fix
CVE-2025-14351Custom Fonts WordPress plugin missing authorization5.3CNA v3.10.3%2026-01-20Fix
CVE-2025-14348weMail WordPress plugin insufficient authorization5.3CNA v3.10.3%2026-01-20Fix
CVE-2025-14115IBM Sterling Connect:Direct for UNIX Container hard-coded credentials8.4CNA v3.10.1%2026-01-20Fix
CVE-2025-14027Rockwell Automation Recommends Upgrading from 1756-RM2 XT to 1756-RM3 XT8.7CNA v4.00.4%2026-01-20
CVE-2025-13925IBM Aspera Console log files information disclosure4.9CNA v3.10.3%2026-01-20Fix
CVE-2025-12985IBM Licensing Operator License Service: Privilege escalation8.4CNA v3.10.1%2026-01-20
CVE-2025-12573Bookingor WordPress plugin Subscriber+ Category deletion6.5CISA ADP v3.10.2%2026-01-20
CVE-2025-11743Rockwell Automation CompactLogix® 5370 denial of service7.1CNA v4.00.2%2026-01-20Fix
CVE-2025-11468Python CPython folding email comments of unfoldable characters doesn't preserve parenthesis5.7CNA v4.00.6%2026-01-20Fix
CVE-2025-9466ArmorStart® LT Multiple denial of service8.7CNA v4.00.6%2026-01-20
CVE-2025-9465ArmorStart® LT Multiple denial of service8.7CNA v4.00.5%2026-01-20
CVE-2025-9464Rockwell Automation ArmorStart® LT multiple denial of service8.7CNA v4.00.4%2026-01-20
CVE-2025-9283ArmorStart® LT Multiple denial of service8.7CNA v4.00.6%2026-01-20
CVE-2025-9282ArmorStart® LT Multiple denial of service8.7CNA v4.00.6%2026-01-20
CVE-2025-9281ArmorStart® LT Multiple denial of service8.7CNA v4.00.6%2026-01-20
CVE-2025-9280ArmorStart® LT Multiple denial of service8.7CNA v4.00.5%2026-01-20
CVE-2025-9279ArmorStart® LT Multiple denial of service8.7CNA v4.00.6%2026-01-20
CVE-2025-9278ArmorStart® LT Multiple denial of service8.7CNA v4.00.5%2026-01-20
CVE-2025-1722IBM Concert heap memory management information disclosure5.9CNA v3.10.4%2026-01-20Fix
CVE-2025-1719IBM Concert heap memory management information disclosure5.9CNA v3.10.4%2026-01-20Fix
CVE-2025-69199Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks8.3CNA v4.00.3%2026-01-19Fix
CVE-2025-69198Pterodactyl's improper resource locking allows raced queries to create more resources than alloted6.0CNA v4.00.2%2026-01-19Fix
CVE-2025-68616WeasyPrint vulnerable to server-side request forgery (SSRF) Protection Bypass via HTTP Redirect7.5CNA v3.10.7%2026-01-19Fix
CVE-2025-61684h2o quicly denial of service7.5CNA v3.10.4%2026-01-19Fix
CVE-2025-59355Apache Linkis: Password exposure6.5CISA ADP v3.10.5%2026-01-19Fix
CVE-2025-55252HCL AION is affected by a weak password Policy3.1CNA v3.10.2%2026-01-19
CVE-2025-55251HCL AION is affected by an unrestricted file upload3.1CNA v3.10.2%2026-01-19
CVE-2025-55250HCL AION is affected by a Technical Error Disclosure vulnerability1.8CNA v3.10.2%2026-01-19
CVE-2025-55249HCL AION is affected by a Missing Security Response headers vulnerability3.5CNA v3.10.2%2026-01-19Fix
CVE-2025-52661HCL Software AION insufficient session expiration2.4CNA v3.10.2%2026-01-19Fix
CVE-2025-52660HCL AION is affected by an host header injection2.7CNA v3.10.3%2026-01-19
CVE-2025-52659HCL AION is affected by a Cacheable HTTP Response vulnerability2.8CNA v3.10.2%2026-01-19Fix
CVE-2025-29847Apache Linkis: Arbitrary file read via Double URL Encoding Bypass7.5CISA ADP v3.10.9%2026-01-19Fix
CVE-2025-15539Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service7.5v3.10.8%2026-01-19
CVE-2025-11044Vulnerability on Automation Runtime my cause DoS Conditions8.9CNA v4.00.4%2026-01-19Fix
CVE-2025-11043Improper Server Certificate Validation in Automation Studio9.1CNA v4.00.2%2026-01-19Fix
CVE-2025-15538Open Asset Import Library Assimp LWOMaterial.cpp FindUVChannels use-after-free7.8v3.10.2%2026-01-18Fix
CVE-2025-15537Mapnik dbfile.cpp string_value heap-based overflow5.5v3.10.2%2026-01-18
CVE-2025-15536BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow5.5v3.10.3%2026-01-18Fix
CVE-2025-15535nicbarker clay clay.h Clay__MeasureTextCached null pointer dereference4.8CNA v4.00.1%2026-01-18
CVE-2025-15534raysan5 Raylib rtext.c LoadFontData integer overflow7.8v3.10.2%2026-01-18Fix
CVE-2025-15533raysan5 Raylib rtext.c GenImageFontAtlas heap-based overflow7.8v3.10.3%2026-01-18Fix
CVE-2025-15532Open5GS Timer resource consumption7.5v3.11.1%2026-01-17
CVE-2025-15531Open5GS context.c sgwc_bearer_add assertion6.9CNA v4.00.8%2026-01-17
CVE-2025-15530Open5GS S11 interface handler reachable assertion7.5v3.10.8%2026-01-17
CVE-2025-15403RegistrationMagic WordPress plugin unauthenticated privilege escalation via admin_order9.8CNA v3.11.7%2026-01-17NucleiExploit codeFix
CVE-2025-14632Filr Secure document library WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-17Fix
CVE-2025-14478Demo Importer Plus WordPress plugin blind XML external entity injection7.5CNA v3.10.4%2026-01-17Fix
CVE-2025-14463naa986 Payment Button for PayPal checkout AJAX endpoint missing authorization5.3CNA v3.10.4%2026-01-17Fix
CVE-2025-14450Wallet System for WooCommerce WordPress plugin unauthorized access6.5CNA v3.10.2%2026-01-17Fix
CVE-2025-14078PAYGENT for WooCommerce WordPress plugin missing authorization5.3CNA v3.10.3%2026-01-17Fix
CVE-2025-14075WP Hotel Booking WordPress plugin unauthenticated sensitive information exposure via email parameter5.3CNA v3.10.3%2026-01-17Fix
CVE-2025-14029Community Events WordPress plugin missing authorization unauthenticated arbitrary Event Approval5.3CNA v3.10.3%2026-01-17Fix
CVE-2025-13725Gutenberg Thim Blocks WordPress plugin arbitrary file read6.5CNA v3.10.4%2026-01-17Fix
CVE-2025-12984Advanced Ads Ad Manager and AdSense WordPress plugin authenticated (Admin+) SQL injection4.9CNA v3.10.4%2026-01-17Fix
CVE-2025-12825User Registration Using Contact Form 7 WordPress plugin information exposure5.3CNA v3.10.6%2026-01-17Fix
CVE-2025-12718Quick Contact Form WordPress plugin unauthenticated open Mail Relay5.8CNA v3.10.2%2026-01-17Fix
CVE-2025-12168Phrase TMS Integration for WordPress plugin missing authorization authenticated Log deletion4.3CNA v3.10.2%2026-01-17Fix
CVE-2025-12129CubeWP All-in-One Dynamic Content Framework WordPress plugin unauthenticated information exposure5.3CNA v3.10.2%2026-01-17Fix
CVE-2025-12002Feeds for YouTube Pro WordPress plugin unauthenticated arbitrary file read via path traversal5.9CNA v3.10.4%2026-01-17Fix
CVE-2025-10484FmeAddons Registration and Login with Mobile Phone Number for WooCommerce authentication bypass9.8CNA v3.10.5%2026-01-17Fix
CVE-2025-8615CubeWP WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-17Fix
CVE-2025-71020Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-16
CVE-2025-70746Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.5%2026-01-16
CVE-2025-69581chamilo-lms sensitive information in cache5.5CISA ADP v3.10.2%2026-01-16
CVE-2025-68924UmbracoForms vulnerable to remote code execution7.5CNA v3.10.8%2026-01-16Fix
CVE-2025-68921Steelseries Nahimic path traversal7.8CISA ADP v3.10.4%2026-01-16Exploit code
CVE-2025-68675Apache Airflow: Proxy credentials for various providers might leak in task logs7.5CISA ADP v3.12.0%2026-01-16Fix
CVE-2025-68438Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated7.5CISA ADP v3.10.7%2026-01-16Fix
CVE-2025-65118AVEVA Process Optimization uncontrolled search path element9.3CNA v4.00.3%2026-01-16Fix
CVE-2025-65117AVEVA Process Optimization use of potentially dangerous function7.7v3.10.2%2026-01-16Fix
CVE-2025-64769AVEVA Process Optimization cleartext transmission of sensitive information7.6CNA v4.00.2%2026-01-16Fix
CVE-2025-64729AVEVA Process Optimization missing authorization8.2v3.10.2%2026-01-16Fix
CVE-2025-64691AVEVA Process Optimization code injection9.3CNA v4.00.3%2026-01-16Fix
CVE-2025-62582DIAView authentication bypass9.8CNA v3.10.5%2026-01-16
CVE-2025-62581DIAView authentication bypass9.8CNA v3.10.6%2026-01-16
CVE-2025-62291strongSwan integer underflow8.1CNA v3.11.0%2026-01-16Fix
CVE-2025-61943AVEVA Process Optimization SQL injection7.8NVD v3.10.3%2026-01-16Fix
CVE-2025-61937AVEVA Process Optimization code injection10.0CNA v4.01.5%2026-01-16Fix
CVE-2025-61873bestpractical Request Tracker CSV injection2.6CNA v3.10.2%2026-01-16Fix
CVE-2025-60021Apache bRPC: Remote command injection vulnerability in heap builtin service9.8CISA ADP v3.125.5%2026-01-16Exploit codeFix
CVE-2025-59870HCL MyXalytics JWT signing secret vulnerability7.4CNA v3.10.3%2026-01-16Fix
CVE-2025-56451Seeyon A8+ Collaborative Management seeyon Zhiyuan cross-site scripting6.1CISA ADP v3.10.2%2026-01-16
CVE-2025-51602VideoLAN VLC media player out-of-bounds read4.8CNA v3.10.4%2026-01-16Fix
CVE-2025-48647Google Devices cpm_fwtp_ipc.c privilege escalation7.8CISA ADP v3.10.1%2026-01-16Fix
CVE-2025-43904SchedMD Slurm incorrect authorization4.2CNA v3.10.3%2026-01-16Fix
CVE-2025-43508Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-01-16Fix
CVE-2025-31510LemonLDAP::NG cross-site scripting7.2CNA v3.10.4%2026-01-16Fix
CVE-2025-31186Apple Xcode insecure permissions3.3CISA ADP v3.10.2%2026-01-16Fix
CVE-2025-29943AMD EPYC™ 9004 Series Processors write-what-where condition4.6CNA v4.00.2%2026-01-16Exploit codeFix
CVE-2025-24531OpenSC project pam_pkcs11 authentication bypass6.7CNA v3.10.2%2026-01-16Fix
CVE-2025-24528MIT Kerberos 5 integer overflow7.1CNA v3.10.5%2026-01-16Fix
CVE-2025-24090Apple iOS and iPadOS insecure permissions3.3CISA ADP v3.10.1%2026-01-16Fix
CVE-2025-24089Apple iOS and iPadOS insecure permissions5.3CISA ADP v3.10.3%2026-01-16Fix
CVE-2025-15529Open5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of service7.5v3.10.8%2026-01-16
CVE-2025-15528Open5GS GTPv2 Bearer Response denial of service7.5v3.10.9%2026-01-16
CVE-2025-15527WP Recipe Maker WordPress plugin insecure direct object reference to sensitive information exposure4.3CNA v3.10.4%2026-01-16Fix
CVE-2025-15526Fancy Product Designer WooCommerce WordPress plugin unauthenticated full path disclosure5.3CNA v3.10.3%2026-01-16Fix
CVE-2025-15370Shield Security WordPress plugin insecure direct object reference to Disable Google Authenticator4.3CNA v3.10.3%2026-01-16Fix
CVE-2025-15104Nu Html Checker (Validator.nu) Restriction bypass vulnerability allowing local SSRF5.3v3.10.5%2026-01-16
CVE-2025-15032Increased spoofing risk; custom new window missing about:blank7.4CNA v3.10.3%2026-01-16Fix
CVE-2025-14982Booking Calendar WordPress plugin missing authorization to sensitive information exposure4.3CNA v3.10.4%2026-01-16Fix
CVE-2025-14894Livewire Filemanager does not restrict uploaded file types9.8v3.10.6%2026-01-16Fix
CVE-2025-14853LEAV Last Email Address Validator WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-01-16
CVE-2025-14844Membership Plugin WordPress plugin missing authentication7.5v3.10.4%2026-01-16Fix
CVE-2025-14822Mattermost DoS from quadratic complexity in model.ParseHashtags3.1CNA v3.10.4%2026-01-16Fix
CVE-2025-14793DK PDF WordPress PDF Generator plugin authenticated (Author+) server-side request forgery5.0CNA v3.10.3%2026-01-16Fix
CVE-2025-14757Cost Calculator Builder WordPress plugin missing authorization unauthenticated Payment Status bypass5.3CNA v3.10.4%2026-01-16Fix
CVE-2025-14510ABB Ability OPTIMAX authentication bypass in Single-Sign on9.2CNA v4.00.4%2026-01-16Fix
CVE-2025-14435Mattermost Application-Level DoS via infinite re-render loop in user profile handling6.8CNA v3.10.3%2026-01-16Fix
CVE-2025-14384All in One SEO WordPress plugin unauthorized access4.3CNA v3.10.2%2026-01-16Fix
CVE-2025-14375RSS Aggregator WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-01-16Fix
CVE-2025-14237Canon Satera LBP670C Series buffer overflow9.3CNA v4.01.0%2026-01-16Fix
CVE-2025-14236Canon Satera LBP670C Series buffer overflow9.3CNA v4.00.9%2026-01-16Fix
CVE-2025-14235Canon Satera LBP670C Series buffer overflow9.3CNA v4.00.9%2026-01-16Fix
CVE-2025-14234Canon Satera LBP670C Series buffer overflow9.3CNA v4.00.9%2026-01-16Fix
CVE-2025-14233Canon Satera LBP670C Series release of an invalid pointer9.3CNA v4.00.8%2026-01-16Fix
CVE-2025-14232Canon Satera LBP670C Series buffer overflow9.3CNA v4.00.9%2026-01-16Fix
CVE-2025-14231Canon Satera LBP670C Series buffer overflow9.3CNA v4.00.9%2026-01-16Fix
CVE-2025-12957All-in-One Video Gallery WordPress plugin arbitrary file upload8.8CNA v3.10.7%2026-01-16Fix
CVE-2025-12641Awesome Support WordPress plugin authorization bypass6.5CNA v3.10.4%2026-01-16Fix
CVE-2025-12007SMCI X13SEM-F supermicro BMC firmware update validation bypass8.4CISA ADP v3.10.1%2026-01-16
CVE-2025-12006SMCI X12STW-F supermicro BMC firmware update validation bypass7.2CNA v3.10.3%2026-01-16
CVE-2025-71019Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70893PHPGurukul Cyber Cafe Management System blind SQL injection8.8CISA ADP v3.10.4%2026-01-15
CVE-2025-70892PHPGurukul Cyber Cafe Management System SQL injection9.8CISA ADP v3.10.5%2026-01-15
CVE-2025-70891PHPGurukul Cyber Cafe Management System stored cross-site scripting6.1CISA ADP v3.10.3%2026-01-15
CVE-2025-70890PHPGurukul Cyber Cafe Management System stored cross-site scripting6.1CISA ADP v3.10.3%2026-01-15
CVE-2025-70744Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70656Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70310gpac vorbis_to_intern function heap-based buffer overflow5.5CISA ADP v3.10.2%2026-01-15
CVE-2025-70309gpac pcmreframe_flush_packet function stack-based buffer overflow5.5CISA ADP v3.10.2%2026-01-15
CVE-2025-70308gpac GSF demuxer filter component out-of-bounds read7.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70307gpac dump_ttxt_sample function stack-based buffer overflow7.5CISA ADP v3.10.5%2026-01-15
CVE-2025-70305gpac dmx_saf function stack-based buffer overflow5.5CISA ADP v3.10.2%2026-01-15
CVE-2025-70304gpac vobsub_get_subpic_duration function buffer overflow7.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70303gpac uncv_parse_config function heap-based buffer overflow5.5CISA ADP v3.10.2%2026-01-15
CVE-2025-70302gpac ghi_dmx_declare_opid_bin function heap-based buffer overflow5.5CISA ADP v3.10.2%2026-01-15
CVE-2025-70299gpac avi_parse_input_file function heap-based buffer overflow6.5CISA ADP v3.10.4%2026-01-15
CVE-2025-70298gpac out-of-bounds read8.2CISA ADP v3.10.4%2026-01-15
CVE-2025-68671lakeFS is Missing Timestamp Validation in S3 Gateway Authentication6.5CNA v3.10.3%2026-01-15Fix
CVE-2025-67823Mitel Micontact Center Business cross-site scripting8.2CISA ADP v3.10.3%2026-01-15Fix
CVE-2025-67822Mitel Mivoice Mx-one improper authentication9.4CISA ADP v3.10.4%2026-01-15Fix
CVE-2025-67647sveltejs kit SvelteKit denial of service and possible SSRF when using prerendering8.4CNA v4.00.5%2026-01-15Fix
CVE-2025-67246Ludashi Driver local information disclosure7.3CISA ADP v3.10.2%2026-01-15Exploit code
CVE-2025-67084InvoicePlane file upload9.9CISA ADP v3.10.5%2026-01-15
CVE-2025-67083InvoicePlane path traversal5.3CISA ADP v3.10.7%2026-01-15
CVE-2025-67082InvoicePlane SQL injection6.5CISA ADP v3.10.3%2026-01-15
CVE-2025-67081ITFlow An SQL injection4.9CISA ADP v3.10.3%2026-01-15
CVE-2025-67079Agora Project Omnispace file upload9.8CISA ADP v3.10.4%2026-01-15
CVE-2025-67078Agora Project Omnispace cross-site scripting6.1v3.10.2%2026-01-15
CVE-2025-67077Agora Project Omnispace file upload8.8CISA ADP v3.10.4%2026-01-15
CVE-2025-67076Agora Project Omnispace path traversal7.5CISA ADP v3.10.9%2026-01-15
CVE-2025-67025Anycomment.io cross-site scripting6.1CISA ADP v3.10.3%2026-01-15Fix
CVE-2025-66417GLPI has an unauthenticated SQL injection through the inventory endpoint7.5CNA v3.10.5%2026-01-15Fix
CVE-2025-66292DPanel has an arbitrary file deletion vulnerability in /API/common/attach/delete interface8.1CNA v3.10.7%2026-01-15Fix
CVE-2025-65368CodeWithCJ SparkyFitness cross-site scripting6.1CISA ADP v3.10.3%2026-01-15
CVE-2025-65349Eachitaly Wireless Mini Router Wireless-n 300M stored cross-site scripting5.4CISA ADP v3.10.3%2026-01-15
CVE-2025-64516GLPI incorrectly authorizes access to documents7.5CNA v3.10.3%2026-01-15Exploit codeFix
CVE-2025-62193NOAA PMEL Live Access Server (LAS) PyFerret command injection9.3CNA v4.01.3%2026-01-15Fix
CVE-2025-61973Epic Games Store local privilege escalation8.8CNA v3.10.2%2026-01-15
CVE-2025-60011Juniper Networks Junos OS routing protocol daemon improper check for exceptional conditions6.9CNA v4.00.5%2026-01-15Fix
CVE-2025-60007Junos OS: A specifically crafted show chassis command causes chassisd to crash6.8CNA v4.00.1%2026-01-15Fix
CVE-2025-60003Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash8.7CNA v4.00.4%2026-01-15Fix
CVE-2025-59961Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable6.8CNA v4.00.1%2026-01-15Fix
CVE-2025-59960Juniper Networks Junos OS An improper check for exceptional conditions6.3CNA v4.00.3%2026-01-15Fix
CVE-2025-59959Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash6.8CNA v4.00.1%2026-01-15Fix
CVE-2025-52987Paragon Automation: A clickjacking vulnerability in the web server configuration has been addressed5.1CNA v4.00.3%2026-01-15Fix
CVE-2025-36911Google Android key-based pairing logic flaw7.1CISA ADP v3.18.4%2026-01-15Exploit codeFix
CVE-2025-15265Svelte Hydratable Key Script-Breakout XSS (SSR)6.1v3.10.4%2026-01-15Fix
CVE-2025-14457Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin unauthorized access7.4v3.10.2%2026-01-15Fix
CVE-2025-14448WP-Members Membership WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-01-15Fix
CVE-2025-13859AffiliateX - Authenticated missing authorization to stored cross-site scripting6.4CNA v3.10.2%2026-01-15Fix
CVE-2025-13845Schneider Electric EcoStruxure Power Build Rapsody use-after-free8.4CNA v4.00.4%2026-01-15Fix
CVE-2025-13844Schneider Electric EcoStruxure Power Build Rapsody double free8.4CNA v4.00.2%2026-01-15Fix
CVE-2025-13062Supreme Modules Lite WordPress plugin arbitrary file upload8.8CNA v3.10.6%2026-01-15Fix
CVE-2025-12895Kalium WordPress theme missing authorization unauthenticated Mail Relay5.3CNA v3.10.3%2026-01-15Fix
CVE-2025-9014Null pointer dereference vulnerability on TL-WR841N6.3CNA v4.00.5%2026-01-15Fix
CVE-2025-71166Typesetter CMS reflected XSS via Move Message Handling5.4v3.10.2%2026-01-14
CVE-2025-71165Typesetter CMS reflected XSS via Status.php5.4v3.10.2%2026-01-14
CVE-2025-71164Typesetter CMS reflected XSS via Editing.php5.4v3.10.2%2026-01-14
CVE-2025-71144Linux kernel MPTCP disconnect handling vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71143Linux kernel Exynos clkout clock driver improper array index validation7.8v3.10.1%2026-01-14Fix
CVE-2025-71142Linux kernel cpuset remote partition vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71141Linux kernel tilcdc DRM driver probe teardown vulnerability5.5NVD v3.10.1%2026-01-14Fix
CVE-2025-71140Linux kernel mediatek vcodec context list locking improper locking–0.2%2026-01-14Fix
CVE-2025-71139Linux kernel kexec IMA CMA allocation vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71138Linux kernel msm dpu pingpong interface null pointer dereference5.5v3.10.1%2026-01-14Fix
CVE-2025-71137Linux kernel octeontx2 PF driver out-of-bounds write7.8v3.10.2%2026-01-14Fix
CVE-2025-71136Linux kernel adv7842 out-of-bounds read7.1CNA v3.10.1%2026-01-14Fix
CVE-2025-71135Linux kernel md raid5 sysfs interface null pointer dereference5.5v3.10.2%2026-01-14Fix
CVE-2025-71134Linux kernel page allocator pageblock migration vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71133Linux kernel irdma RDMA driver out-of-bounds read7.1NVD v3.10.2%2026-01-14Fix
CVE-2025-71132In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: wor7.5CNA v3.10.2%2026-01-14Fix
CVE-2025-71131Linux kernel seqiv crypto template vulnerability7.5CNA v3.10.3%2026-01-14Fix
CVE-2025-71130Linux kernel i915 GEM execbuffer null pointer dereference7.8CNA v3.10.2%2026-01-14Fix
CVE-2025-71129Linux kernel BPF kernel panic5.5v3.10.1%2026-01-14Fix
CVE-2025-71128Linux kernel ERSPAN GRE tunnel options vulnerability7.5CNA v3.10.3%2026-01-14Fix
CVE-2025-71127Linux kernel mac80211 beacon frame handling vulnerability7.1CNA v3.10.2%2026-01-14Fix
CVE-2025-71126Linux kernel MPTCP fallback handling deadlock7.5CNA v3.10.3%2026-01-14Fix
CVE-2025-71125Linux kernel tracing synthetic events null pointer dereference5.5NVD v3.10.2%2026-01-14Fix
CVE-2025-71124Linux kernel msm a6xx GPU preemption null pointer dereference5.5v3.10.1%2026-01-14Fix
CVE-2025-71123Linux kernel ext4 mount options parsing vulnerability7.8NVD v3.10.2%2026-01-14Fix
CVE-2025-71122Linux kernel iommufd selftest reserved region check vulnerability7.8v3.10.2%2026-01-14Fix
CVE-2025-71121Linux kernel parisc ASP chip affinity handling denial of service5.5v3.10.1%2026-01-14Fix
CVE-2025-71120Linux kernel SunRPC GSS authentication null pointer dereference7.5CNA v3.10.5%2026-01-14Fix
CVE-2025-71119Linux kernel powerpc kexec CPU wakeup vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71118Linux kernel ACPICA namespace walk null pointer dereference5.5NVD v3.10.1%2026-01-14Fix
CVE-2025-71117Linux kernel block layer sysfs store callbacks deadlock5.5v3.10.1%2026-01-14Fix
CVE-2025-71116Linux kernel libceph out-of-bounds read9.1CNA v3.10.4%2026-01-14Fix
CVE-2025-71115Linux kernel UML cpu_tasks array vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71114Linux kernel VIA watchdog driver memory leak5.5NVD v3.10.2%2026-01-14Fix
CVE-2025-71113Linux kernel AF_ALG crypto interface vulnerability5.5NVD v3.10.2%2026-01-14Fix
CVE-2025-71112Linux kernel HNS3 Ethernet driver out-of-bounds read8.8CNA v3.10.2%2026-01-14Fix
CVE-2025-71111Linux kernel hwmon time-of-check time-of-use race condition4.7NVD v3.10.1%2026-01-14Fix
CVE-2025-71110Linux kernel slub allocator use-after-free7.8v3.10.1%2026-01-14Fix
CVE-2025-71109Linux kernel MIPS ftrace out-of-bounds write7.1CNA v3.10.2%2026-01-14Fix
CVE-2025-71108Linux kernel USB Type-C UCSI driver vulnerability5.5NVD v3.10.1%2026-01-14Fix
CVE-2025-71107Linux kernel f2fs superblock teardown null pointer dereference5.5v3.10.2%2026-01-14Fix
CVE-2025-71106Linux kernel filesystem freeze callback denial of service5.5v3.10.1%2026-01-14Fix
CVE-2025-71105Linux kernel f2fs inline xattr slab cache vulnerability5.5v3.10.1%2026-01-14Fix
CVE-2025-71104Linux kernel KVM APIC hypervisor timer improper locking5.5NVD v3.10.1%2026-01-14Fix
CVE-2025-71103Linux kernel Adreno GPU driver null pointer dereference5.5v3.10.1%2026-01-14Fix
CVE-2025-71102Linux kernel shadow call stack denial of service5.5v3.10.1%2026-01-14Fix
CVE-2025-71021Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-14
CVE-2025-70968FreeImage use-after-free9.8CISA ADP v3.10.5%2026-01-14
CVE-2025-70747Tenda AX1806 stack-based buffer overflow7.5CISA ADP v3.10.6%2026-01-14
CVE-2025-68970Huawei HarmonyOS permission verification bypass vulnerability in the media library module6.1CNA v3.10.1%2026-01-14Fix
CVE-2025-68969Huawei HarmonyOS multi-thread race condition vulnerability in the thermal management module6.8CNA v3.10.1%2026-01-14Fix
CVE-2025-68968Huawei HarmonyOS double free vulnerability in the multi-mode input module7.8CNA v3.10.1%2026-01-14Fix
CVE-2025-68967Huawei HarmonyOS vulnerability of improper permission control in the print module5.7CNA v3.10.1%2026-01-14Fix
CVE-2025-68966Huawei HarmonyOS permission control vulnerability in the Notepad module5.1CNA v3.10.1%2026-01-14Fix
CVE-2025-68965Huawei HarmonyOS permission control vulnerability in the Notepad module4.7CNA v3.10.1%2026-01-14Fix
CVE-2025-68964Huawei HarmonyOS data verification vulnerability in the HiView module6.2CNA v3.10.1%2026-01-14Fix
CVE-2025-68963Huawei HarmonyOS man-in-the-middle attack vulnerability in the Clone module5.7CNA v3.10.1%2026-01-14Fix
CVE-2025-68962Huawei HarmonyOS multi-thread race condition vulnerability in the camera framework module5.1CNA v3.10.1%2026-01-14Fix
CVE-2025-68961Huawei HarmonyOS multi-thread race condition vulnerability in the camera framework module5.1CNA v3.10.1%2026-01-14Fix
CVE-2025-68960Huawei HarmonyOS multi-thread race condition vulnerability in the video framework module8.4CNA v3.10.1%2026-01-14Fix
CVE-2025-68959Huawei HarmonyOS permission verification bypass vulnerability in the media library module6.2CNA v3.10.1%2026-01-14Fix
CVE-2025-68958Huawei HarmonyOS multi-thread race condition vulnerability in the card framework module8.0CNA v3.10.1%2026-01-14Fix
CVE-2025-68957Huawei HarmonyOS multi-thread race condition vulnerability in the card framework module8.4CNA v3.10.1%2026-01-14Fix
CVE-2025-68956Huawei HarmonyOS multi-thread race condition vulnerability in the card framework module8.0CNA v3.10.1%2026-01-14Fix
CVE-2025-68955Huawei HarmonyOS multi-thread race condition vulnerability in the card framework module8.0CNA v3.10.1%2026-01-14Fix
CVE-2025-68492Chainlit contains an authorization bypass2.3CNA v4.00.2%2026-01-14Fix
CVE-2025-67859Polkit Authorization Check can be Bypassed in the TLP power daemon5.1CNA v4.00.2%2026-01-14Fix
CVE-2025-67835Paessler PRTG Network Monitor denial of service6.5CISA ADP v3.10.4%2026-01-14Fix
CVE-2025-67834Paessler PRTG Network Monitor cross-site scripting5.4CISA ADP v3.10.3%2026-01-14Fix
CVE-2025-67833Paessler PRTG Network Monitor cross-site scripting6.1CISA ADP v3.10.3%2026-01-14Fix
CVE-2025-67399Airth Smart Home Aqi Monitor Bootloader information disclosure4.6CISA ADP v3.10.2%2026-01-14
CVE-2025-66169Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component5.3CISA ADP v3.10.7%2026-01-14Fix
CVE-2025-66005ShadowBlip InputPlumber InputManager D-Bus interface missing authentication8.5CNA v4.00.2%2026-01-14Fix
CVE-2025-65397Blurams Dome Flare improper authentication6.8CISA ADP v3.10.3%2026-01-14
CVE-2025-65396Blurams Dome Flare out-of-bounds read6.1CISA ADP v3.10.2%2026-01-14
CVE-2025-63644PH7BUILDER PH7 Social Dating Builder pH7-Social-Dating-CMS affected by a stored cross-site scripting5.4CISA ADP v3.10.3%2026-01-14
CVE-2025-56226libsndfile memory leak5.3CISA ADP v3.10.4%2026-01-14Fix
CVE-2025-37185HPE EdgeConnect SD-WAN Orchestrator web interface stored cross-site scripting5.5CNA v3.10.3%2026-01-14Fix
CVE-2025-37184HPE EdgeConnect SD-WAN Orchestrator improper authentication9.8CNA v3.10.7%2026-01-14Fix
CVE-2025-37183Authenticated SQL injection in EdgeConnect SD-WAN Orchestrator Web-Based Management interface7.2CNA v3.10.5%2026-01-14Fix
CVE-2025-37182Authenticated SQL injection in EdgeConnect SD-WAN Orchestrator Web-Based Management interface7.2CNA v3.10.5%2026-01-14Fix
CVE-2025-37181Authenticated SQL injection in EdgeConnect SD-WAN Orchestrator Web-Based Management interface7.2CNA v3.10.5%2026-01-14Fix
CVE-2025-33206NVIDIA NSIGHT Graphics OS command injection7.8CNA v3.10.9%2026-01-14Fix
CVE-2025-15513Float Payment Gateway WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-14Fix
CVE-2025-15512Aplazo Payment Gateway WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-14Fix
CVE-2025-15486Kunze Law WordPress plugin authenticated (Administrator+) stored cross-site scripting4.4CNA v3.10.3%2026-01-14
CVE-2025-15475PayHere Payment Gateway Plugin for WooCommerce WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-14Fix
CVE-2025-15378AJS Footnotes WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-01-14
CVE-2025-15377Sosh Share Buttons WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-01-14
CVE-2025-15376Stopwords for comments WordPress plugin missing authorization to cross-site request forgery4.3CNA v3.10.1%2026-01-14
CVE-2025-15283Name Directory WordPress plugin unauthenticated stored cross-site scripting via Multiple parameters7.2CNA v3.10.4%2026-01-14Fix
CVE-2025-15266GeekyBot WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-01-14Fix
CVE-2025-15021Gotham Block Extra Light WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14Fix
CVE-2025-15020Gotham Block Extra Light WordPress plugin arbitrary file read6.5CNA v3.10.4%2026-01-14Fix
CVE-2025-14880Netcash WooCommerce Payment Gateway WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-14Fix
CVE-2025-14854WP-CRM System WordPress plugin unauthorized access5.4CNA v3.10.3%2026-01-14Fix
CVE-2025-14846SocialChamp with WordPress WordPress plugin cross-site request forgery4.3CNA v3.10.1%2026-01-14Fix
CVE-2025-14770Shipping Rate By Cities WordPress plugin unauthenticated SQL injection via city parameter7.5CNA v3.10.3%2026-01-14Fix
CVE-2025-14725Internal Link Builder WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2025-14615DASHBOARD BUILDER WordPress plugin cross-site request forgery to SQL injection7.1CNA v3.10.2%2026-01-14
CVE-2025-14613GetContentFromURL WordPress plugin server-side request forgery7.2CNA v3.10.3%2026-01-14
CVE-2025-14557XSS in Drupal 7 Facebook Pixel module4.8CNA v4.00.2%2026-01-14
CVE-2025-14556XSS in Drupal 7 Flag Module4.8CNA v4.00.2%2026-01-14Fix
CVE-2025-14502News and Blog Designer Bundle WordPress plugin unauthenticated local file inclusion9.8CNA v3.11.5%2026-01-14
CVE-2025-14482Crush.pics Image Optimizer WordPress plugin unauthorized access4.3CNA v3.10.3%2026-01-14
CVE-2025-14464PDF Resume Parser WordPress plugin information disclosure5.3CNA v3.10.4%2026-01-14
CVE-2025-14389WPBlogSyn WordPress plugin cross-site request forgery to arbitrary remote Sync Configuration update4.3CNA v3.10.1%2026-01-14
CVE-2025-14379Testimonials Creator Authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2025-14338Polkit authentication dis isabled by default in inputplumber8.5CNA v4.00.2%2026-01-14Fix
CVE-2025-14317User Enumeration in Crazy Bubble Tea mobile application7.1CNA v4.00.3%2026-01-14Fix
CVE-2025-14301Integration Opvius AI for WooCommerce WordPress plugin unauthenticated arbitrary file deletion/Read9.8CNA v3.10.7%2026-01-14
CVE-2025-14242Red Hat Enterprise Linux 10 vsftpd: Vsftpd: Denial of service6.5CNA v3.10.8%2026-01-14Fix
CVE-2025-14173Perfit WooCommerce WordPress plugin missing authorization5.3CNA v3.10.3%2026-01-14
CVE-2025-14058Lenovo Tab M11 TB330FU TB330XU missing authentication2.4CNA v4.00.2%2026-01-14Fix
CVE-2025-13627Makesweat WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2025-13455Lenovo ThinkPlus FU100 authentication bypass by spoofing7.3CNA v4.00.1%2026-01-14Fix
CVE-2025-13454Lenovo ThinkPlus FU100 cleartext transmission of sensitive information6.8CNA v4.00.1%2026-01-14Fix
CVE-2025-13453Lenovo ThinkPlus FU100 missing encryption5.1CNA v4.00.1%2026-01-14Fix
CVE-2025-13175Insecure Password Storage in Y Soft SafeQ 65.1CNA v4.00.3%2026-01-14Fix
CVE-2025-13154Lenovo Vantage link following6.8CNA v4.00.1%2026-01-14Fix
CVE-2025-12178SpiceForms Form Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-14
CVE-2025-12166Appointment Booking Calendar WordPress plugin blind SQL injection7.5CNA v3.10.3%2026-01-14Fix
CVE-2025-12053Insyde Software InsydeH2O tools egwindrvx64.sys is potentially vulnerable to a buffer overflow7.8CNA v3.10.2%2026-01-14
CVE-2025-12052Insyde Software InsydeH2O tools egwindrv.sys is potentially vulnerable to a buffer overflow7.8CNA v3.10.2%2026-01-14
CVE-2025-12051Insyde Software InsydeH2O tools H2OFFT64.sys is potentially vulnerable to a buffer overflow7.8CNA v3.10.2%2026-01-14
CVE-2025-12050Insyde Software InsydeH2O tools in H2OFFT32.sys is potentially vulnerable to a buffer overflow7.8CNA v3.10.2%2026-01-14
CVE-2025-11224Improper neutralization of input during web page generation (cross-site scripting) in GitLab7.7CNA v3.10.3%2026-01-14Fix
CVE-2025-9142Local privilege escalation in Harmony SASE Windows agent7.5CNA v3.10.1%2026-01-14
CVE-2025-0647Arm Neoverse N2 sensitive information not cleared before reuse7.9CISA ADP v3.10.2%2026-01-14Fix
CVE-2025-71101Linux kernel hp-bioscfg ACPI driver out-of-bounds read7.1CNA v3.10.1%2026-01-13Fix
CVE-2025-71100Linux kernel rtlwifi 8192cu Wi-Fi driver improper array index validation7.6CNA v3.10.2%2026-01-13Fix
CVE-2025-71099Linux kernel Xe GPU OA config ioctl use-after-free7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71098Linux kernel ip6_gre crash5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71097Linux kernel IPv4 nexthop routing vulnerability5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71096Linux kernel RDMA netlink IP resolver vulnerability5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71095Linux kernel stmmac Ethernet driver denial of service9.1CNA v3.10.3%2026-01-13Fix
CVE-2025-71094Linux kernel ASIX USB Ethernet driver vulnerability5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71093Linux kernel e1000 out-of-bounds read9.1CNA v3.10.3%2026-01-13Fix
CVE-2025-71092Linux kernel bnxt_re RDMA driver out-of-bounds write7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71091In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122)7.8NVD v3.10.1%2026-01-13Fix
CVE-2025-71090In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCE7.5CNA v3.10.2%2026-01-13Fix
CVE-2025-71089Linux kernel IOMMU shared virtual addressing use-after-free7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-71088Linux kernel MPTCP simultaneous connect handling race condition5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71087Linux kernel iavf driver RSS configuration off-by-one error5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71086Linux kernel ROSE protocol device handling improper array index validation7.8NVD v3.10.1%2026-01-13Fix
CVE-2025-71085Linux kernel IPv6 CALIPSO labeling reachable assertion7.5CNA v3.10.3%2026-01-13Fix
CVE-2025-71084In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying th5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71083Linux kernel drm/ttm null pointer dereference5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71082Linux kernel btusb Bluetooth USB driver vulnerability7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71081Linux kernel STM32 SAI audio driver memory leak5.5v3.10.1%2026-01-13Fix
CVE-2025-71080Linux kernel ipv6 reachable assertion7.5CNA v3.10.3%2026-01-13Fix
CVE-2025-71079Linux kernel NFC rfkill handling deadlock5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71078Linux kernel PowerPC hash MMU SLB preload vulnerability7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71077Linux kernel TPM PCR bank allocation vulnerability5.5NVD v3.10.1%2026-01-13Fix
CVE-2025-71076In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations. Add check to ensure5.5v3.10.1%2026-01-13Fix
CVE-2025-71075Linux kernel aic94xx SCSI driver use-after-free7.8NVD v3.10.2%2026-01-13Fix
CVE-2025-71074Linux kernel functionfs use-after-free7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71073Linux kernel lkkbd keyboard driver use-after-free7.8NVD v3.10.2%2026-01-13Fix
CVE-2025-71072Linux kernel shmem rename handling vulnerability8.2CNA v3.10.3%2026-01-13Fix
CVE-2025-71071Linux kernel MediaTek IOMMU driver use-after-free7.8v3.10.1%2026-01-13Fix
CVE-2025-71070Linux kernel ublk driver vulnerability7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-71069Linux kernel F2FS whiteout rename handling vulnerability–0.2%2026-01-13Fix
CVE-2025-71068Linux kernel NFS RDMA server (svcrdma) vulnerability9.8CNA v3.10.4%2026-01-13Fix
CVE-2025-71067Linux kernel NTFS3 boot block parsing vulnerability–0.2%2026-01-13Fix
CVE-2025-71066Linux kernel ets race condition7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-71065Linux kernel F2FS filesystem deadlock–0.2%2026-01-13Fix
CVE-2025-71064Linux kernel HNS3 virtual function driver vulnerability–0.2%2026-01-13Fix
CVE-2025-71027Tenda AX3 stack-based buffer overflow7.5v3.10.4%2026-01-13
CVE-2025-71026Tenda AX3 stack-based buffer overflow7.5v3.10.4%2026-01-13
CVE-2025-71025Tenda AX3 stack-based buffer overflow7.5v3.10.4%2026-01-13
CVE-2025-71024Tenda AX3 stack-based buffer overflow7.5v3.10.4%2026-01-13
CVE-2025-71023Tenda AX3 stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-13
CVE-2025-70753Tenda AX1806 stack-based buffer overflow7.5v3.10.4%2026-01-13
CVE-2025-69992PHPGurukul News Portal out-of-bounds read9.8CISA ADP v3.10.6%2026-01-13
CVE-2025-69991PHPGurukul News Portal SQL injection9.8CISA ADP v3.10.5%2026-01-13
CVE-2025-69990PHPGurukul News Portal files accessible to external parties9.1CISA ADP v3.10.5%2026-01-13
CVE-2025-68949n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching5.3CNA v3.10.3%2026-01-13Fix
CVE-2025-68947NSecsoft NSecKrnl process termination privilege escalation5.7CNA v4.00.1%2026-01-13
CVE-2025-68931Jervis has AES CBC Mode without Authentication8.7CNA v4.00.2%2026-01-13Fix
CVE-2025-68925Jervis has a JWT Algorithm Confusion vulnerability6.9CNA v4.00.2%2026-01-13Fix
CVE-2025-68823Linux kernel ublk block device driver deadlock5.5v3.10.1%2026-01-13Fix
CVE-2025-68822Linux kernel ALPS touchpad driver use-after-free7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68821Linux kernel FUSE readahead deadlock–0.2%2026-01-13Fix
CVE-2025-68820Linux kernel xattr null pointer dereference–0.2%2026-01-13Fix
CVE-2025-68819Linux kernel dtv5100 USB DVB driver vulnerability7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68818Linux kernel qla2xxx abort path vulnerability8.8CNA v3.10.3%2026-01-13Fix
CVE-2025-68817Linux kernel ksmbd tree connection handling use-after-free9.8CNA v3.10.5%2026-01-13Fix
CVE-2025-68816Linux kernel mlx5 firmware tracer denial of service–0.2%2026-01-13Fix
CVE-2025-68815Linux kernel ets qdisc scheduler vulnerability7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68814Linux kernel io_uring memory leak–0.2%2026-01-13Fix
CVE-2025-68813Linux kernel IPVS route error path null pointer dereference–0.2%2026-01-13Fix
CVE-2025-68811In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page. Found by ZeroP9.8CNA v3.10.5%2026-01-13Fix
CVE-2025-68810Linux kernel KVM guest_memfd memslot handling use-after-free7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-68809Linux kernel ksmbd VFS cache race condition9.1CNA v3.10.5%2026-01-13Fix
CVE-2025-68808In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownership vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables throu7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-68807In the Linux kernel, the following vulnerability has been resolved: block: fix race between wbt_enable_default and IO submission When wbt_enable_default() is moved out of queue freezing in elevator_change(), it can cause the wbt inflight counter to become negative (-1), leading to hung tasks in th–0.2%2026-01-13Fix
CVE-2025-68806Linux kernel ksmbd extended attribute buffer validation vulnerability7.5CNA v3.10.4%2026-01-13Fix
CVE-2025-68805Linux kernel FUSE io_uring request queue use-after-free7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-68804Linux kernel cros_ec_ishtp driver removal use-after-free–0.2%2026-01-13Fix
CVE-2025-68803Linux kernel NFSv4 file creation ACL handling vulnerability8.0CNA v3.10.4%2026-01-13Fix
CVE-2025-68802Linux kernel Xe exec and VM bind ioctls vulnerability–0.2%2026-01-13Fix
CVE-2025-68801Linux kernel mlxsw neighbour entries use-after-free7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68800Linux kernel mlxsw multicast route stats use-after-free7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68799Linux kernel CAIF frame receive integer underflow8.1CNA v3.10.3%2026-01-13Fix
CVE-2025-68798Linux kernel AMD performance counter enable null pointer dereference–0.2%2026-01-13Fix
CVE-2025-68797Linux kernel applicom driver ioctl handler null pointer dereference–0.2%2026-01-13Fix
CVE-2025-68796Linux kernel F2FS extent cache denial of service–0.2%2026-01-13Fix
CVE-2025-68795Linux kernel ethtool stats query buffer overflow7.8CNA v3.10.2%2026-01-13Fix
CVE-2025-68794Linux kernel iomap read range calculation vulnerability9.8CNA v3.10.6%2026-01-13Fix
CVE-2025-68793Linux kernel AMDGPU GPU recovery use-after-free7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-68792Linux kernel TPM2 session name_size indexing vulnerability7.8CNA v3.10.1%2026-01-13Fix
CVE-2025-68791Linux kernel FUSE io_uring argument copy vulnerability–0.2%2026-01-13Fix
CVE-2025-68790Linux kernel mlx5 HCA_PORTS devcom component use-after-free–0.2%2026-01-13Fix
CVE-2025-68788Linux kernel fsnotify special file events information disclosure–0.2%2026-01-13Fix
CVE-2025-68787Linux kernel NetRom socket layer memory leak–0.2%2026-01-13Fix
CVE-2025-68786Linux kernel ksmbd lock-range check integer underflow–0.2%2026-01-13Fix
CVE-2025-68785In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS_ACTION_ATTR_PUSH_NS7.1CNA v3.10.2%2026-01-13Fix
CVE-2025-68784Linux kernel XFS xattr repair use-after-free–0.2%2026-01-13Fix
CVE-2025-68783Linux kernel US-16x08 USB mixer driver out-of-bounds write–0.2%2026-01-13Fix
CVE-2025-68782Linux kernel SCSI target CDB handling vulnerability7.5CNA v3.10.7%2026-01-13Fix
CVE-2025-68781Linux kernel fsl-usb PHY driver use-after-free–0.2%2026-01-13Fix
CVE-2025-68780Linux kernel deadline scheduler CPU tracking vulnerability–0.2%2026-01-13Fix
CVE-2025-68779Linux kernel mlx5e PSP offload use-after-free–0.2%2026-01-13Fix
CVE-2025-68778Linux kernel Btrfs tree logging vulnerability–0.2%2026-01-13Fix
CVE-2025-68777Linux kernel TI AM335x touchscreen driver out-of-bounds access–0.2%2026-01-13Fix
CVE-2025-68776Linux kernel net/hsr null pointer dereference–0.2%2026-01-13Fix
CVE-2025-68775Linux kernel handshake upcall socket handling vulnerability9.8CNA v3.10.5%2026-01-13Fix
CVE-2025-68774Linux kernel HFS+ B-tree node creation vulnerability7.5CNA v3.10.6%2026-01-13Fix
CVE-2025-68773Linux kernel fsl-cpm buffer overflow–0.2%2026-01-13Fix
CVE-2025-68772Linux kernel f2fs compression writeback vulnerability–0.2%2026-01-13Fix
CVE-2025-68771Linux kernel OCFS2 suballocator denial of service–0.2%2026-01-13Fix
CVE-2025-68770Linux kernel bnxt_en XDP transmit path vulnerability7.5CNA v3.10.4%2026-01-13Fix
CVE-2025-68769Linux kernel f2fs fsync recovery denial of service–0.2%2026-01-13Fix
CVE-2025-68768Linux kernel IP fragment reassembly deadlock–0.2%2026-01-13Fix
CVE-2025-68767In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted. According to [1], the permis–0.2%2026-01-13Fix
CVE-2025-68707Tycc Tongyu AX1800 An authentication bypass8.8CISA ADP v3.10.5%2026-01-13
CVE-2025-68704Jervis has a Weak Random for Timing Attack Mitigation8.2CNA v4.00.3%2026-01-13Fix
CVE-2025-68703Jervis has a Salt for PBKDF2 derived from password8.7CNA v4.00.1%2026-01-13Fix
CVE-2025-68702Jervis has a SHA-256 Hex String Padding Bug8.7CNA v4.00.2%2026-01-13Fix
CVE-2025-68701Jervis has Deterministic AES IV Derivation from Passphrase8.7CNA v4.00.2%2026-01-13Fix
CVE-2025-68698Jervis has an RSA PKCS#1 Padding vulnerability8.7CNA v4.00.1%2026-01-13Fix
CVE-2025-68658Open Source Point of Sale stored XSS in Configuration Company Name field4.3CNA v3.10.2%2026-01-13Fix
CVE-2025-68271OpenC3 cosmos unauthenticated remote code execution in openc3-api10.0CNA v3.10.6%2026-01-13Fix
CVE-2025-67685Fortinet FortiSandbox server-side request forgery3.4CNA v3.10.4%2026-01-13Fix
CVE-2025-66698Semantic-machines VEDA improper authentication8.6CISA ADP v3.10.5%2026-01-13
CVE-2025-66177Hikvision DS-96xxxNI-Hx device Search and Discovery feature buffer overflow8.8CNA v3.10.4%2026-01-13Exploit code
CVE-2025-66176Hikvision DS-K1T331 device Search and Discovery feature buffer overflow8.8CNA v3.10.5%2026-01-13Fix
CVE-2025-65784Hubert Hub insecure permissions6.5CISA ADP v3.10.4%2026-01-13
CVE-2025-65783Hubert Hub /utils/uploadFile component arbitrary file upload9.8CISA ADP v3.10.5%2026-01-13
CVE-2025-64155Fortinet FortiSIEM OS command injection9.4CNA v3.142.5%2026-01-13Reported exploitedEmerging ThreatsExploit codeFix
CVE-2025-62182Adobe Pega Customer Service Framework arbitrary file upload5.3CNA v4.00.3%2026-01-13Fix
CVE-2025-59922Fortinet FortiClientEMS SQL injection6.8CNA v3.17.8%2026-01-13Fix
CVE-2025-59022TYPO3 CMS allows broken access control in Recycler module7.1CNA v4.00.4%2026-01-13Fix
CVE-2025-59021TYPO3 CMS allows broken access control in Redirects module5.3CNA v4.00.3%2026-01-13Fix
CVE-2025-59020TYPO3 CMS allows broken access control in Edit Document controller5.3CNA v4.00.3%2026-01-13Fix
CVE-2025-58693Fortinet FortiVoice path traversal5.7CNA v3.10.7%2026-01-13Fix
CVE-2025-58411Imagination Technologies Graphics DDK GPU freelist reference counting use-after-free8.8CISA ADP v3.10.2%2026-01-13Fix
CVE-2025-58409Imagination Technologies Graphics DDK GPU freelist buffer handling vulnerability3.5CISA ADP v3.10.2%2026-01-13Fix
CVE-2025-55462Eramba permissive cross-domain policy6.5CISA ADP v3.10.4%2026-01-13Fix
CVE-2025-47855Fortinet FortiFone information disclosure9.3CNA v3.10.9%2026-01-13Fix
CVE-2025-46685Dell SupportAssist OS Recovery insecure temporary file7.5CNA v3.10.1%2026-01-13Fix
CVE-2025-46684Dell SupportAssist OS Recovery insecure temporary file6.6CNA v3.10.1%2026-01-13Fix
CVE-2025-41717Phoenix Contact TC ROUTER 3002T-3G config-upload code injection8.8CNA v3.10.6%2026-01-13Fix
CVE-2025-40944Siemens SIMATIC ET 200AL IM 157-1 PN resource exhaustion8.7CNA v4.00.4%2026-01-13Fix
CVE-2025-40942Siemens TeleControl Server Basic execution with unnecessary privileges7.3CNA v4.00.2%2026-01-13Fix
CVE-2025-40805Siemens Industrial Edge Cloud Device (IECD) insecure direct object reference10.0CNA v4.00.7%2026-01-13Fix
CVE-2025-37186HPE Virtual Intranet Access (VIA) Linux client privilege escalation7.8CNA v3.10.2%2026-01-13
CVE-2025-37179HPE ArubaOS out-of-bounds read vulnerabilities leading to Process crash in AOS-8 Operating System5.3CNA v3.10.4%2026-01-13Fix
CVE-2025-37178HPE ArubaOS out-of-bounds read vulnerabilities leading to Process crash in AOS-8 Operating System5.3CNA v3.10.4%2026-01-13Fix
CVE-2025-37177HPE ArubaOS command line interface arbitrary file deletion6.5CNA v3.10.4%2026-01-13Fix
CVE-2025-37176HPE ArubaOS (AOS) AOS-8 command injection6.5CNA v3.11.4%2026-01-13Fix
CVE-2025-37175HPE ArubaOS (AOS) arbitrary file upload7.2CNA v3.10.5%2026-01-13Fix
CVE-2025-37174Authenticated arbitrary file write vulnerability in AOS 10 and AOS-8 Web-Based Management interface7.2CNA v3.10.6%2026-01-13Fix
CVE-2025-37173HPE ArubaOS Improper Input Handling vulnerability in Authenticated Configuration API Endpoint7.2CNA v3.10.4%2026-01-13Fix
CVE-2025-37172HPE ArubaOS authenticated command injection vulnerabilities in AOS-8 Web-Based Management interface7.2CNA v3.11.3%2026-01-13Fix
CVE-2025-37171HPE ArubaOS authenticated command injection vulnerabilities in AOS-8 Web-Based Management interface7.2CNA v3.11.4%2026-01-13Fix
CVE-2025-37170HPE ArubaOS authenticated command injection vulnerabilities in AOS-8 Web-Based Management interface7.2CNA v3.11.3%2026-01-13Fix
CVE-2025-37169HPE ArubaOS (AOS) stack overflow vulnerability in AOS-10 Web-Based Management interface7.2CNA v3.10.6%2026-01-13Fix
CVE-2025-37168HPE ArubaOS (AOS) unauthenticated arbitrary file deletion vulnerability in AOS-8 Operating System8.2CNA v3.10.4%2026-01-13Fix
CVE-2025-37166Unexpected shutdown in HPE Instant ON Access Points after processing specific packets7.5CNA v3.10.5%2026-01-13
CVE-2025-37165HPE Instant ON exposure of VLAN information in unintended network interfaces7.5CNA v3.10.4%2026-01-13
CVE-2025-36640Tenable Nessus Agent local privilege escalation7.3CNA v4.00.1%2026-01-13Fix
CVE-2025-25652Eptura Archibus path traversal7.5CISA ADP v3.10.8%2026-01-13
CVE-2025-25249Fortinet Multiple Products heap-based buffer overflow7.4CNA v3.13.8%2026-01-13KEVFix
CVE-2025-25176GPU Ddk GPU Register value contents leaked from secure workloads to non-secure world9.1CISA ADP v3.10.4%2026-01-13Fix
CVE-2025-15056Quill Lack of data validation in HTML export allowing XSS6.1v3.10.3%2026-01-13
CVE-2025-14829E-xact WordPress plugin arbitrary file deletion9.1CISA ADP v3.10.3%2026-01-13
CVE-2025-14507EventPrime WordPress plugin information disclosure5.3CNA v3.10.4%2026-01-13Fix
CVE-2025-14001WP Duplicate Page WordPress plugin missing authorization authenticated arbitrary post Duplication5.4CNA v3.10.2%2026-01-13Fix
CVE-2025-13774SQL injection leading to privilege escalation in Progress Flowmon ADS8.8CNA v3.10.5%2026-01-13Fix
CVE-2025-13447OS command injection remote code execution vulnerability in Progress LoadMaster8.4CNA v3.127.2%2026-01-13Fix
CVE-2025-13444OS command injection remote code execution vulnerability in Progress LoadMaster8.4CNA v3.127.2%2026-01-13Fix
CVE-2025-12548Eclipse Che machine-exec API missing authentication9.0CNA v3.11.3%2026-01-13Reported exploitedMetasploitExploit codeFix
CVE-2025-11669Broken access control8.1CNA v3.10.8%2026-01-13Fix
CVE-2025-11250Zoho ManageEngine ADSelfService Plus authentication bypass9.1CNA v3.11.6%2026-01-13Fix
CVE-2025-10915Dreamer Blog WordPress theme Subscriber+ arbitrary plugin installation9.8CISA ADP v3.10.3%2026-01-13
CVE-2025-10865GPU Ddk DevmemIntGetReservationData does not ref the PMR it returns7.8CISA ADP v3.10.1%2026-01-13Fix
CVE-2025-9435Zoho ManageEngine ADManager Plus path traversal5.5CNA v3.10.6%2026-01-13Fix
CVE-2025-9427Lemonsoft WordPress add-on admin reflected XSS8.4CNA v4.00.4%2026-01-13
CVE-2025-8090BlackBerry QNX Software Development Platform MsgRegisterEvent system call null pointer dereference6.2CNA v3.10.1%2026-01-13Fix
CVE-2025-71063mrvladus Errands improper certificate validation7.5v3.10.1%2026-01-12Fix
CVE-2025-69276Broadcom DX NetOps Spectrum deserialization of untrusted data2.3CNA v4.00.3%2026-01-12Fix
CVE-2025-69275Spectrum outdated java library in class-path7.1CNA v4.00.1%2026-01-12Fix
CVE-2025-69274Spectrum broken authorization scheme2.3CNA v4.00.3%2026-01-12Fix
CVE-2025-69273Spectrum broken authentication8.7CNA v4.00.4%2026-01-12Fix
CVE-2025-69272Spectrum password returned in clear5.3CNA v4.00.2%2026-01-12Fix
CVE-2025-69271Spectrum basic authentication in use2.3CNA v4.00.2%2026-01-12Fix
CVE-2025-69270Spectrum session token in URL2.3CNA v4.00.3%2026-01-12Fix
CVE-2025-69269Spectrum command injection in NCM service7.1CNA v4.00.9%2026-01-12Fix
CVE-2025-69268Spectrum reflected XSS5.3CNA v4.00.2%2026-01-12Fix
CVE-2025-69267Spectrum directory path traversal8.8CNA v4.00.3%2026-01-12Fix
CVE-2025-68657Espressif/usb_host_hid double free race condition in USB Host HID Device Close Path6.4CNA v3.10.2%2026-01-12Fix
CVE-2025-68656Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor use-after-free6.8CNA v3.10.2%2026-01-12Fix
CVE-2025-68622Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing6.8CNA v3.10.2%2026-01-12Fix
CVE-2025-68472MindsDB has improper sanitation of filepath that leads to information disclosure and DOS8.1CNA v3.120.3%2026-01-12Reported exploitedEmerging ThreatsFix
CVE-2025-68471Avahi has a reachable assertion in lookup_start6.5CNA v3.10.4%2026-01-12Fix
CVE-2025-68468Avahi has a reachable assertion in lookup_multicast_callback6.5CNA v3.10.4%2026-01-12Fix
CVE-2025-68276Avahi has a reachable assertion in avahi_wide_area_scan_cache5.5CNA v3.10.2%2026-01-12Fix
CVE-2025-67813Quest Kace Desktop Authority incorrect default permissions5.3CISA ADP v3.10.2%2026-01-12Emerging ThreatsFix
CVE-2025-67147amansuryawanshi Gym-Management-System-PHP Multiple SQL injection9.8CISA ADP v3.10.4%2026-01-12
CVE-2025-67146Abhishekmali21 Gym Management System Multiple SQL injection9.4CISA ADP v3.10.6%2026-01-12
CVE-2025-66939Altumcode 66biolinks cross-site scripting5.4v3.10.2%2026-01-12
CVE-2025-66802Covid-19 Contact Tracing System unrestricted file upload9.8CISA ADP v3.10.9%2026-01-12Exploit code
CVE-2025-66689Busymac Pal MCP Server Zen MCP Server path traversal6.5CISA ADP v3.10.6%2026-01-12
CVE-2025-65553D3D Security Xz-g12 authentication bypass by replay6.5CISA ADP v3.10.2%2026-01-12
CVE-2025-65552D3D Security Zx-g12 authentication bypass by replay9.8CISA ADP v3.10.4%2026-01-12
CVE-2025-63314Ddsn CM3 Acora Cms weak password recovery10.0CISA ADP v3.10.3%2026-01-12
CVE-2025-52694Advantech IoTSuite and IoT Edge Products execution of arbitrary SQL commands9.8v3.140.4%2026-01-12NucleiEmerging ThreatsExploit codeFix
CVE-2025-51567Jayesh Online Exam System /exam/user/profile.php page of kashipara SQL injection9.1CISA ADP v3.10.4%2026-01-12
CVE-2025-46070Automai Botmanager improper certificate validation9.8CISA ADP v3.10.5%2026-01-12
CVE-2025-46068Automai Director unrestricted file upload8.8CISA ADP v3.10.5%2026-01-12
CVE-2025-46067Automai Director hard-coded password8.2CISA ADP v3.10.3%2026-01-12
CVE-2025-46066Automai Director improper handling of insufficient permissions9.9CISA ADP v3.10.3%2026-01-12
CVE-2025-41078Viafirma Documents user management feature incorrect authorization8.1v3.10.2%2026-01-12Fix
CVE-2025-41077Viafirma Inbox user listing feature insecure direct object reference8.1v3.10.2%2026-01-12Fix
CVE-2025-41006Multiple vulnerabilities in Imaster products Open configuration options9.3CNA v4.00.3%2026-01-12
CVE-2025-41005Multiple vulnerabilities in Imaster products Open configuration options8.7CNA v4.00.3%2026-01-12
CVE-2025-41004Multiple vulnerabilities in Imaster products Open configuration options8.7CNA v4.00.3%2026-01-12
CVE-2025-41003Multiple vulnerabilities in Imaster products Open configuration options5.1CNA v4.00.3%2026-01-12
CVE-2025-40978WorkDo eCommerceGo SaaS WorkDo's stored cross-site scripting5.1CNA v4.00.3%2026-01-12
CVE-2025-40977WorkDo eCommerceGo SaaS WorkDo's stored cross-site scripting5.1CNA v4.00.3%2026-01-12
CVE-2025-40976WorkDo TicketGo WorkDo's stored cross-site scripting5.1CNA v4.00.3%2026-01-12
CVE-2025-40975WorkDo HRMGo stored cross-site scripting5.1CNA v4.00.3%2026-01-12
CVE-2025-29329Sagemcom F@st 3686 ippprint buffer overflow9.8CISA ADP v3.11.0%2026-01-12
CVE-2025-15514Ollama Multi-Modal Model Image Processing null pointer dereference7.5v3.10.8%2026-01-12
CVE-2025-14579Quiz Maker WordPress plugin Admin+ stored XSS4.8CISA ADP v3.10.2%2026-01-12Fix
CVE-2025-14279MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation8.1CNA v3.00.2%2026-01-12Fix
CVE-2025-12420Unauthenticated privilege escalation in ServiceNow AI Platform9.3CNA v4.053.2%2026-01-12Emerging ThreatsFix
CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component8.1v3.145.8%2026-01-11Reported exploitedNucleiEmerging ThreatsExploit codeFix
CVE-2025-15506AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-bounds4.8CNA v4.00.2%2026-01-11Fix
CVE-2025-15505Luxul XWR-600 Web Administration cross-site scripting4.8CNA v4.00.2%2026-01-11
CVE-2025-68470remix-run react-router react Router has unexpected external redirect via untrusted paths6.5CNA v3.10.5%2026-01-10Fix
CVE-2025-65091XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService10.0CNA v3.10.3%2026-01-10Fix
CVE-2025-65090XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService5.3CNA v3.10.3%2026-01-10Fix
CVE-2025-62235Apache Mynewt NimBLE: Incorrect handling of SMP Security request could lead to undesirable pairing8.1CISA ADP v3.10.4%2026-01-10Fix
CVE-2025-61686remix-run react-router React Router has path traversal in File Session Storage9.1CNA v3.117.6%2026-01-10Exploit codeFix
CVE-2025-61676October CMS vulnerable to stored XSS via Branding Styles6.1CNA v3.10.3%2026-01-10Fix
CVE-2025-61674October CMS vulnerable to stored XSS via Editor and Branding Styles6.1CNA v3.10.3%2026-01-10Fix
CVE-2025-59057React Router has XSS7.6CNA v3.10.5%2026-01-10Exploit codeFix
CVE-2025-53477Apache Mynewt NimBLE: Null pointer dereference in NimBLE host HCI layer7.5CISA ADP v3.10.8%2026-01-10Fix
CVE-2025-53470Apache Mynewt NimBLE: Out-of-bounds write vulnerability in NimBLE HCI H4 driver3.1CISA ADP v3.10.3%2026-01-10Fix
CVE-2025-52435Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller7.5CISA ADP v3.10.2%2026-01-10Fix
CVE-2025-15504lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference5.5v3.10.3%2026-01-10Fix
CVE-2025-15503Sangfor Operation and Maintenance Management System common.jsp unrestricted upload9.8v3.12.1%2026-01-10Nuclei
CVE-2025-15502Sangfor Operation and Maintenance Management System session SessionController os command injection9.8v3.16.1%2026-01-10
CVE-2025-14976User Registration and Membership WordPress plugin cross-site request forgery5.4CNA v3.10.1%2026-01-10Fix
CVE-2025-14948miniOrange OTP Verification and SMS Notification for WooCommerce missing authorization5.3CNA v3.10.3%2026-01-10Fix
CVE-2025-14943Blog2Social: Social Media Auto Post and Scheduler WordPress plugin information disclosure4.3CNA v3.10.2%2026-01-10Fix
CVE-2025-14555Countdown Timer - Widget Countdown WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-10Fix
CVE-2025-14506ConvertForce Popup Builder WordPress plugin stored cross-site scripting via entrance_animation6.4CNA v3.10.2%2026-01-10Fix
CVE-2025-13457WooCommerce Square WordPress plugin insecure direct object reference7.5CNA v3.10.3%2026-01-10Fix
CVE-2025-13393Featured Image from URL (FIFU) WordPress plugin server-side request forgery4.3CNA v3.10.3%2026-01-10Fix
CVE-2025-12379Shortcodes and extra features for Phlox WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-10Fix
CVE-2025-70974Fastjson Includes Functionality from Untrusted Control Sphere10.0CNA v3.10.8%2026-01-09Fix
CVE-2025-70161Edimax BR-6208AC command injection9.8CISA ADP v3.127.1%2026-01-09Emerging Threats
CVE-2025-69542D-Link Dir-895la1 command injection9.8CISA ADP v3.19.7%2026-01-09
CVE-2025-69426Ruckus vRIoT IoT Controller Hard-coded SSH Credentials RCE10.0CNA v4.00.4%2026-01-09Fix
CVE-2025-69425Ruckus vRIoT IoT Controller hard-coded tokens RCE10.0CNA v4.00.9%2026-01-09Fix
CVE-2025-69195Wget2: GNU wget2: Memory corruption and crash8.8NVD v3.10.3%2026-01-09Fix
CVE-2025-69194Wget2: Arbitrary file write via metalink path traversal in GNU wget29.8NVD v3.10.8%2026-01-09Exploit codeFix
CVE-2025-67811AREA9LYCEUM Rhapsode SQL injection6.5CISA ADP v3.10.3%2026-01-09Fix
CVE-2025-67810AREA9LYCEUM Rhapsode out-of-bounds read6.5CISA ADP v3.10.4%2026-01-09Fix
CVE-2025-67282TIM Solutions TIM Flow authentication bypass5.4CISA ADP v3.10.2%2026-01-09Fix
CVE-2025-67281TIM Solutions TIM Flow SQL injection5.4CISA ADP v3.10.2%2026-01-09Fix
CVE-2025-67280TIM Solutions TIM Flow injection5.4CISA ADP v3.10.2%2026-01-09Fix
CVE-2025-67279TIM Solutions TIM Flow incorrect privilege assignment5.3CISA ADP v3.10.3%2026-01-09Fix
CVE-2025-67278TIM Solutions TIM Flow incorrect privilege assignment6.5CISA ADP v3.10.3%2026-01-09Fix
CVE-2025-67133Heromotocorp Vida V1 Pro denial of service7.5CISA ADP v3.10.5%2026-01-09
CVE-2025-67070Intelbras CFTV IP NVD password recovery process authentication bypass8.2CISA ADP v3.10.4%2026-01-09Exploit code
CVE-2025-67004CouchCMS path traversal6.5CISA ADP v3.16.1%2026-01-09Emerging Threats
CVE-2025-66744Yonyou YonBIP LoginWithV8 interface path traversal7.5CISA ADP v3.11.5%2026-01-09Nuclei
CVE-2025-66715Axtion Odis DLL hijacking6.5CISA ADP v3.10.2%2026-01-09
CVE-2025-66315ZTE MF258K Pro Version Server has a Configuration Defect vulnerability4.3CNA v3.10.3%2026-01-09Fix
CVE-2025-66052Command injection in Vivotek IP7137 cameras7.2v3.11.5%2026-01-09
CVE-2025-66051Path traversal in Vivotek IP7137 cameras6.5v3.10.8%2026-01-09
CVE-2025-66050No password set for administrative account in Vivotek IP7137 cameras9.8v3.10.4%2026-01-09
CVE-2025-66049Unprotected RTSP stream in Vivotek IP7137 cameras7.5v3.10.4%2026-01-09
CVE-2025-64093Zenitel ICX500 unauthenticated remote code execution via the device hostname9.8NVD v3.10.8%2026-01-09Fix
CVE-2025-64092Zenitel ICX500 unauthenticated SQL injection via GET request parameters7.5CNA v3.10.4%2026-01-09Fix
CVE-2025-64091Zenitel TCIS-3+ authenticated remote code execution in the NTP-configuration8.8NVD v3.10.4%2026-01-09Fix
CVE-2025-64090Zenitel TCIS-3+ authenticated remote code execution in device hostname8.8NVD v3.10.4%2026-01-09Fix
CVE-2025-62487Palantir Gotham Dossier file uploads incorrect authorization3.5CNA v3.10.2%2026-01-09Fix
CVE-2025-60538Shiori is vulnerable to authentication bypass via a brute force attack6.5CISA ADP v3.10.4%2026-01-09
CVE-2025-56225fluidsynth null pointer dereference7.5CISA ADP v3.10.5%2026-01-09Fix
CVE-2025-51626Xiaoliuchu Pss.sale.com SQL injection6.5v3.10.2%2026-01-09
CVE-2025-46676Dell PowerProtect Data Domain information disclosure2.7CNA v3.10.3%2026-01-09Fix
CVE-2025-46645Dell PowerProtect Data Domain OS command injection6.5CNA v3.11.5%2026-01-09Fix
CVE-2025-46644Dell PowerProtect Data Domain OS command injection6.0CNA v3.10.6%2026-01-09Fix
CVE-2025-46643Dell PowerProtect Data Domain heap-based buffer overflow2.3CNA v3.10.2%2026-01-09Fix
CVE-2025-46299Apple Safari improper access control4.3CISA ADP v3.10.3%2026-01-09Fix
CVE-2025-46298Apple Safari crash6.5CISA ADP v3.10.4%2026-01-09Fix
CVE-2025-46297Apple macOS insecure permissions5.5CISA ADP v3.10.1%2026-01-09Fix
CVE-2025-46286Apple iOS and iPadOS authentication bypass4.3CISA ADP v3.10.2%2026-01-09Fix
CVE-2025-15501Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection9.3CNA v4.06.9%2026-01-09
CVE-2025-15500Sangfor Operation and Maintenance Management System HTTP POST request getHis os command injection9.3CNA v4.06.1%2026-01-09
CVE-2025-15499Sangfor Operation and Maintenance Management System file upload feature OS command injection9.8v3.15.8%2026-01-09
CVE-2025-15496guchengwuyue yshopmall jobs getPage SQL injection9.8v3.10.4%2026-01-09
CVE-2025-15495BiggiDroid Simple PHP CMS editsite.php unrestricted upload7.2v3.10.5%2026-01-09Exploit code
CVE-2025-15494RainyGao DocSys UserMapper.xml SQL injection8.8v3.10.4%2026-01-09
CVE-2025-15493RainyGao DocSys ReposAuthMapper.xml SQL injection9.8v3.10.4%2026-01-09
CVE-2025-15492RainyGao DocSys GroupMemberMapper.xml SQL injection8.8v3.10.4%2026-01-09
CVE-2025-15057SlimStat Analytics WordPress plugin unauthenticated stored cross-site scripting via fh parameter7.2CNA v3.10.3%2026-01-09Fix
CVE-2025-15055SlimStat Analytics WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-01-09Fix
CVE-2025-15035Arbitrary file deletion vulnerability in TP-Link Archer AXE756.9CNA v4.00.3%2026-01-09Fix
CVE-2025-15019BIALTY WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09Fix
CVE-2025-14980BetterDocs WordPress plugin authenticated (Contributor+) sensitive information exposure6.5CNA v3.10.4%2026-01-09Fix
CVE-2025-14937Frontend Admin by DynamiApps WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-01-09Fix
CVE-2025-14893IndieWeb WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09Exploit codeFix
CVE-2025-14886Japanized for WooCommerce WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-09Fix
CVE-2025-14803Nex-Forms Express WP Form Builder WordPress plugin authenticated stored XSS6.8CISA ADP v3.10.3%2026-01-09Fix
CVE-2025-14782Forminator Forms WordPress plugin authorization bypass5.3CNA v3.10.3%2026-01-09Fix
CVE-2025-14741Frontend Admin by DynamiApps WordPress plugin missing authorization9.1CNA v3.10.4%2026-01-09Fix
CVE-2025-14736Frontend Admin by DynamiApps WordPress plugin unauthenticated privilege escalation to Administrator9.8CNA v3.10.7%2026-01-09Exploit codeFix
CVE-2025-14720Booking for Appointments and Events Calendar WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-09Fix
CVE-2025-14718Schedule Post Changes With PublishPress Future WordPress plugin authorization bypass5.4CNA v3.10.3%2026-01-09Fix
CVE-2025-14657Eventin WordPress plugin unauthorized access7.2CNA v3.10.3%2026-01-09Fix
CVE-2025-14598BeeS Software Solutions BET ePortal login function SQL injection9.8CISA ADP v3.10.7%2026-01-09Exploit codeFix
CVE-2025-14574weDocs WordPress plugin information disclosure5.3CNA v3.10.4%2026-01-09Fix
CVE-2025-14172WP Page Permalink Extension WordPress plugin missing authorization6.5CNA v3.10.4%2026-01-09
CVE-2025-14146Booking Calendar WordPress plugin unauthenticated sensitive information exposure5.3CNA v3.10.4%2026-01-09Fix
CVE-2025-13967Woodpecker for WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09
CVE-2025-13935themeum Tutor LMS course completion handler missing authorization4.3CNA v3.10.2%2026-01-09Fix
CVE-2025-13934themeum Tutor LMS course enrollment handler missing authorization4.3CNA v3.10.2%2026-01-09Fix
CVE-2025-13908The Tooltip WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13903PullQuote WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13900WP Popup Magic WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09
CVE-2025-13897Client Testimonial Slider WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13895Top Position Google Finance WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-01-09
CVE-2025-13893Lesson Plan Book WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-01-09
CVE-2025-13892MG AdvancedOptions WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-01-09
CVE-2025-13862Menu Card WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13854Curved Text WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13853Nearby Now Reviews WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09
CVE-2025-13852Debt.com Business in a Box WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09
CVE-2025-13781Missing authorization in GitLab6.5CNA v3.10.4%2026-01-09Fix
CVE-2025-13772Missing authorization in GitLab7.1CNA v3.10.4%2026-01-09Fix
CVE-2025-13761Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.0CNA v3.10.7%2026-01-09Fix
CVE-2025-13753WP Table Builder WordPress plugin incorrect authorization to authenticated arbitrary Table creation4.3CNA v3.10.3%2026-01-09Fix
CVE-2025-13749Clearfy WordPress plugin cross-site request forgery to update Notification tampering4.3CNA v3.10.2%2026-01-09Fix
CVE-2025-13729Entry Views WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode6.4CNA v3.10.2%2026-01-09
CVE-2025-13717Contact Form vCard Generator WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-09
CVE-2025-13704Autogen Headers Menu WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-09
CVE-2025-13701Shabat Keeper WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-01-09
CVE-2025-13628Tutor LMS WordPress plugin unauthorized access4.3CNA v3.10.2%2026-01-09Fix
CVE-2025-11453Header and Footer Scripts WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2026-01-09Fix
CVE-2025-11246Insufficient granularity of access control in GitLab5.4CNA v3.10.4%2026-01-09Fix
CVE-2025-10569Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.5%2026-01-09Fix
CVE-2025-9222Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.4%2026-01-09Fix
CVE-2025-7072Hard-coded credentials in KAON CG3000T/CG3000CT routers9.3CNA v4.00.6%2026-01-09Fix
CVE-2025-3950Exposure of private personal information to an unauthorized actor in GitLab3.5CNA v3.10.3%2026-01-09Fix
CVE-2025-69260Trend Micro Apex Central message out-of-bounds read7.5CNA v3.11.6%2026-01-08Fix
CVE-2025-69259Trend Micro Apex Central buffer overflow7.5CNA v3.11.6%2026-01-08Fix
CVE-2025-69258Trend Micro Apex Central buffer overflow9.8CNA v3.13.6%2026-01-08Fix
CVE-2025-69169Easy Media Download WordPress plugin CSS injection5.4CNA v3.10.3%2026-01-08Fix
CVE-2025-68892Scroll rss excerpt WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68891WP App Bar WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68890e-shops WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68889Pinpoll WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68887WP-BusinessDirectory WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68875Flaming Password Reset WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-08
CVE-2025-68874Visitor Stats Widget WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68873PRIMER by chloédigital WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-68867Effect Maker WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-08
CVE-2025-68719Kaysus Ks-wr3600 files accessible to external parties8.8CISA ADP v3.10.5%2026-01-08
CVE-2025-68718Kaysus Ks-wr1200 hard-coded credentials5.4CISA ADP v3.10.3%2026-01-08
CVE-2025-68717Kaysus Ks-wr3600 improper authentication9.4CISA ADP v3.10.6%2026-01-08
CVE-2025-68716Kaysus Ks-wr3600 missing authentication8.4CISA ADP v3.10.2%2026-01-08
CVE-2025-68715Pandawireless PWRU01 missing authentication9.1CISA ADP v3.10.7%2026-01-08
CVE-2025-68158Authlib: 1-click account takeover5.7CNA v3.10.3%2026-01-08Fix
CVE-2025-68151CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS6.6CNA v4.00.5%2026-01-08Fix
CVE-2025-67937Hendon WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-67936Curly WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-67935Optimize WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-67934Wellspring WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-67933Taskbuilder WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67932Listeo Core WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67931BulletProof Security WordPress plugin sensitive data exposure7.5CISA ADP v3.10.3%2026-01-08Fix
CVE-2025-67930eHive Search WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67928Automotive Listings WordPress theme SQL injection9.3CNA v3.10.3%2026-01-08Fix
CVE-2025-67927Link Whisper Free WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67926Fluent Support WordPress plugin broken access control6.5CNA v3.10.3%2026-01-08Fix
CVE-2025-67925Corpkit WordPress theme local file inclusion7.5CNA v3.10.5%2026-01-08Fix
CVE-2025-67924Corpkit WordPress theme arbitrary file upload9.9CNA v3.10.4%2026-01-08Fix
CVE-2025-67922Grand Restaurant WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67921Lobo WordPress theme SQL injection8.5CNA v3.10.3%2026-01-08Fix
CVE-2025-67920Neo Ocular WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-67919Woffice Core WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.3%2026-01-08Fix
CVE-2025-67918Woffice WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67917Traveler WordPress theme broken access control6.5CNA v3.10.3%2026-01-08Fix
CVE-2025-67916Jobify WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08Fix
CVE-2025-67915Timetics WordPress plugin broken authentication8.8CNA v3.10.4%2026-01-08Fix
CVE-2025-67914VidMov WordPress theme path traversal7.7CNA v3.10.3%2026-01-08Fix
CVE-2025-67913Aruba HiSpeed Cache WordPress plugin broken access control6.5CNA v3.10.3%2026-01-08Fix
CVE-2025-67911Newsletters WordPress plugin PHP object injection9.8CNA v3.10.5%2026-01-08Fix
CVE-2025-67910Contentstudio WordPress plugin arbitrary file upload9.1CNA v3.10.4%2026-01-08Fix
CVE-2025-67858https://github.com/FoobarOy/ Foomuuri improper neutralization7.0CNA v4.00.2%2026-01-08Fix
CVE-2025-67825Gonitro Nitro PDF Pro origin validation error5.5CISA ADP v3.10.1%2026-01-08Fix
CVE-2025-67603https://github.com/FoobarOy/ Foomuuri improper authorization5.1CNA v4.00.2%2026-01-08Fix
CVE-2025-67325Webkul QloApps hotel review feature arbitrary file upload9.8CISA ADP v3.10.9%2026-01-08Exploit code
CVE-2025-67091GL.iNet AX1800 missing brute-force protection6.5CISA ADP v3.13.3%2026-01-08Emerging Threats
CVE-2025-67090GL.iNet AX1800 missing brute-force protection5.1CISA ADP v3.10.2%2026-01-08
CVE-2025-67089GL.iNet GL-AXT1800 command injection8.1CISA ADP v3.11.6%2026-01-08
CVE-2025-66916dromara RuoYi-Vue-Plus code injection9.4CISA ADP v3.10.7%2026-01-08
CVE-2025-66913Jeecg JimuReport code injection9.8CISA ADP v3.11.1%2026-01-08
CVE-2025-66003Local users can perform a local root exploit via smb4k mounthelper7.3CNA v4.00.1%2026-01-08Fix
CVE-2025-66002Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation6.9CNA v4.00.2%2026-01-08Fix
CVE-2025-66001NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)8.8CNA v3.10.4%2026-01-08Fix
CVE-2025-65731D-Link DIR-605L missing authentication6.8CISA ADP v3.10.4%2026-01-08
CVE-2025-65518WebPros Plesk Obsidian unchecked loop condition7.5CISA ADP v3.10.6%2026-01-08Fix
CVE-2025-63611PHPGurukul Hostel Management System cross-site scripting8.7CISA ADP v3.10.3%2026-01-08
CVE-2025-62877Harvest may expose OS default SSH login password via SUSE Virtualization Interactive Installer9.8CNA v3.10.5%2026-01-08
CVE-2025-61550Edubusinesssolutions Print Shop Pro Webdesk cross-site scripting5.4CISA ADP v3.10.2%2026-01-08
CVE-2025-61549Edubusinesssolutions Print Shop Pro Webdesk cross-site scripting6.1CISA ADP v3.10.3%2026-01-08
CVE-2025-61548Edubusinesssolutions Print Shop Pro Webdesk SQL injection9.8CISA ADP v3.10.6%2026-01-08
CVE-2025-61547Edubusinesssolutions Print Shop Pro Webdesk cross-site request forgery6.8CISA ADP v3.10.2%2026-01-08
CVE-2025-61546Edubusinesssolutions Print Shop Pro Webdesk improper input validation9.1CISA ADP v3.10.5%2026-01-08
CVE-2025-61246Indieka900 Online Shopping System SQL injection9.8CISA ADP v3.10.4%2026-01-08Exploit code
CVE-2025-59470Veeam Backup and Recovery command injection9.0CNA v3.11.5%2026-01-08Exploit codeFix
CVE-2025-59469Veeam Backup and Recovery information disclosure9.0CNA v3.10.6%2026-01-08Fix
CVE-2025-59468Veeam Backup and Recovery command injection9.1NVD v3.11.2%2026-01-08Fix
CVE-2025-56425Optimal-systems Enaio command injection9.1CISA ADP v3.10.7%2026-01-08
CVE-2025-56424Insiders-technologies E-invoice Pro denial of service7.5CISA ADP v3.10.6%2026-01-08
CVE-2025-55125Veeam Backup and Recovery command injection9.8NVD v3.10.9%2026-01-08Fix
CVE-2025-50334Technitium DNS Server resource exhaustion7.5CISA ADP v3.11.1%2026-01-08
CVE-2025-27004Famous - Responsive Image And Video Grid Gallery WordPress plugin reflected cross-site scripting7.1CNA v3.10.3%2026-01-08
CVE-2025-27002CountDown With Image or Video Background WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-23993Felan Framework WordPress plugin SQL injection9.3CNA v3.10.4%2026-01-08
CVE-2025-23504Felan Framework WordPress plugin account takeover9.8CNA v3.10.5%2026-01-08
CVE-2025-22728Workreap (theme's plugin) WordPress plugin SQL injection8.5CNA v3.10.4%2026-01-08
CVE-2025-22726nK Themes Helper WordPress plugin server side request forgery (SSRF)6.4CNA v3.10.2%2026-01-08
CVE-2025-22725WP Virtual Assistant WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-01-08
CVE-2025-22715WP Attractive Donations System WordPress plugin loopus missing authorization7.5CNA v3.10.4%2026-01-08
CVE-2025-22713WooCommerce Orders and Customers Exporter WordPress plugin SQL injection8.5CNA v3.10.4%2026-01-08
CVE-2025-22712Typify WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-22708Mitech WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-22707Moody WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-22509Atlas WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-15464KL-001-2026-01: Yintibao Fun Print Mobile unauthorized access via Context Hijacking7.5CISA ADP v3.10.5%2026-01-08
CVE-2025-15346wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement9.3CNA v4.00.3%2026-01-08Fix
CVE-2025-15224curl libssh key passphrase bypass without agent set3.1CISA ADP v3.10.5%2026-01-08Fix
CVE-2025-15079curl libssh global known_hosts override5.3CISA ADP v3.10.6%2026-01-08Fix
CVE-2025-14984Gutenverse Form WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-08Fix
CVE-2025-14819curl OpenSSL partial chain store policy bypass5.3CISA ADP v3.10.8%2026-01-08Fix
CVE-2025-14524curl bearer token leak on cross-protocol redirect5.3CISA ADP v3.10.7%2026-01-08Fix
CVE-2025-14505Elliptic Uses a Cryptographic Primitive with a Risky Implementation5.6CNA v3.10.2%2026-01-08Fix
CVE-2025-14436Brevo for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-01-08Fix
CVE-2025-14431Navian WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08
CVE-2025-14430Brook - Agency Business Creative WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08
CVE-2025-14429AeroLand WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08
CVE-2025-14360Blockons WordPress plugin broken access control7.5CNA v3.10.3%2026-01-08
CVE-2025-14359Oshine WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-08Fix
CVE-2025-14358REHub Framework WordPress plugin broken access control7.5CNA v3.10.3%2026-01-08Fix
CVE-2025-14275Jeg Elementor Kit WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-08Fix
CVE-2025-14025Red Hat Ansible Automation Platform gateway API tokens vulnerability8.5CNA v3.10.4%2026-01-08Fix
CVE-2025-14017curl broken TLS options for threaded LDAPS6.3CISA ADP v3.10.1%2026-01-08Fix
CVE-2025-13679Tutor LMS WordPress plugin missing authorization authenticated sensitive information exposure6.5CNA v3.10.2%2026-01-08Fix
CVE-2025-13504Real Estate Pro WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-01-08
CVE-2025-13034curl no QUIC certificate pinning with GnuTLS5.9CISA ADP v3.10.2%2026-01-08Fix
CVE-2025-12640premio Folders media upload handler missing authorization4.3CNA v3.10.2%2026-01-08Fix
CVE-2025-12551ListingHub WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-08
CVE-2025-12550OchaHouse WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-12549Rozy - Flower Shop WordPress theme local file inclusion8.1CNA v3.10.6%2026-01-08
CVE-2025-8307Recoverable passwords in Asseco InfoMedica Plus5.9CNA v4.00.1%2026-01-08Fix
CVE-2025-8306Improper access control in Asseco InfoMedica Plus5.1CNA v4.00.2%2026-01-08Fix
CVE-2025-4596Information disclosure via IDOR in Asseco AMDX5.3CNA v4.00.3%2026-01-08Fix
CVE-2025-69344Oneline Lite WordPress theme broken access control4.3CNA v3.10.2%2026-01-07Fix
CVE-2025-69333JetEngine WordPress plugin broken access control4.3CNA v3.10.2%2026-01-07Fix
CVE-2025-69264pnpm v10+ Bypass Dependency lifecycle scripts execution disabled by default8.8CNA v3.11.0%2026-01-07Fix
CVE-2025-69263pnpm Lockfile Integrity Bypass allows Remote Dynamic Dependencies7.5CNA v3.10.5%2026-01-07Fix
CVE-2025-69262pnpm vulnerable to command injection via environment variable substitution7.6CNA v3.11.0%2026-01-07Fix
CVE-2025-69255RustFS gRPC GetMetrics deserialization panic enables remote DoS5.5CNA v4.00.3%2026-01-07Fix
CVE-2025-69222LibreChat is vulnerable to server-side request forgery due to missing restrictions9.1CNA v3.14.6%2026-01-07Fix
CVE-2025-69221LibreChat has insufficient access control for Agent Permission Queries4.3CNA v3.10.3%2026-01-07Fix
CVE-2025-69220LibreChat has insufficient access control for agent files7.1CNA v3.10.3%2026-01-07Fix
CVE-2025-69082Arlo WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-07
CVE-2025-69081Hope WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-07
CVE-2025-69080Gecko WordPress theme local file inclusion8.1CNA v3.10.5%2026-01-07
CVE-2025-68705RustFS path traversal8.8CNA v4.07.3%2026-01-07Fix
CVE-2025-68637Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP client9.1CISA ADP v3.10.3%2026-01-07Fix
CVE-2025-67366Sylphx Filesystem MCP relative path traversal7.5CISA ADP v3.10.6%2026-01-07
CVE-2025-67364fast-filesystem-mcp has a path traversal7.5CISA ADP v3.10.6%2026-01-07
CVE-2025-66838Softwareag Aris resource exhaustion6.5CISA ADP v3.10.4%2026-01-07
CVE-2025-66837Softwareag Aris file upload6.8CISA ADP v3.10.3%2026-01-07
CVE-2025-66786Openairinterface Oai-cn5g-amf denial of service7.5CISA ADP v3.10.4%2026-01-07
CVE-2025-66686Grabaperch Perch stored cross-site scripting6.1CISA ADP v3.10.2%2026-01-07
CVE-2025-66620Columbia Weather Systems MicroServer Command Shell in Externally Accessible Directory7.2NVD v3.10.5%2026-01-07Fix
CVE-2025-66560Quarkus REST HTTP response writer resource exhaustion5.9CNA v3.10.4%2026-01-07Fix
CVE-2025-65805Openairinterface Oai-cn5g-amf stack-based buffer overflow7.5CISA ADP v3.10.4%2026-01-07
CVE-2025-64305Columbia Weather Systems MicroServer cleartext storage in a file or on disk7.1CNA v4.00.1%2026-01-07Fix
CVE-2025-62327HCL DevOps Deploy is susceptible to insufficiently protected credentials4.9CNA v3.10.3%2026-01-07Fix
CVE-2025-62224Microsoft Edge (Chromium-based) for Android spoofing5.5CNA v3.10.3%2026-01-07Fix
CVE-2025-61939Columbia Weather Systems MicroServer reverse SSH connection improper channel restriction4.4NVD v3.10.3%2026-01-07Fix
CVE-2025-61782open redirect in OpenCTI's SAML Authentication Flow5.4CNA v3.10.3%2026-01-07Fix
CVE-2025-61492Terminal-controller-mcp vulnerable to command injection10.0CISA ADP v3.12.1%2026-01-07
CVE-2025-61489sonirico mcp-shell shell_exec function command injection6.5v3.10.9%2026-01-07
CVE-2025-58441Knowage is vulnerable to blind server-side request forgery (SSRF)6.3CNA v4.00.2%2026-01-07Fix
CVE-2025-49335External Media WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.1%2026-01-07
CVE-2025-47552DZS Video Gallery WordPress plugin PHP object injection9.8CNA v3.10.4%2026-01-07Fix
CVE-2025-47396Qualcomm Snapdragon double free in Graphics7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47395Buffer over-read in WLAN Firmware6.5CNA v3.10.1%2026-01-07Fix
CVE-2025-47394Qualcomm Snapdragon buffer copy without checking size of input in DSP service7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47393Qualcomm Snapdragon improper validation of array index in Automotive Linux OS7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47388Qualcomm Snapdragon buffer copy without checking size of input in DSP service7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47380Qualcomm Snapdragon untrusted pointer dereference in Camera7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47369Qualcomm Snapdragon information exposure in Computer Vision5.5CNA v3.10.1%2026-01-07Fix
CVE-2025-47356Qualcomm Snapdragon double free in Video7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47348Qualcomm Snapdragon use of uninitialized variable in HLOS7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47346Qualcomm Snapdragon out-of-bounds write in HLOS7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47345Qualcomm Snapdragon reusing a nonce, key pair in encryption in Automotive Platform8.4CNA v3.10.1%2026-01-07Fix
CVE-2025-47344Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47343Qualcomm Snapdragon untrusted pointer dereference in Video7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47339Qualcomm Snapdragon use-after-free in HLOS7.8CNA v3.10.1%2026-01-07Fix
CVE-2025-47337Qualcomm Snapdragon use-after-free in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47336Qualcomm Snapdragon use-after-free in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47335Qualcomm Snapdragon buffer copy without checking size of input in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47334Qualcomm Snapdragon buffer copy without checking size of input in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47333Qualcomm Snapdragon use-after-free in HLOS6.6CNA v3.10.1%2026-01-07Fix
CVE-2025-47332Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in Camera driver6.7CNA v3.10.1%2026-01-07Fix
CVE-2025-47331Qualcomm Snapdragon buffer over-read in Video6.1CNA v3.10.1%2026-01-07Fix
CVE-2025-47330Qualcomm Snapdragon buffer over-read in Video5.5CNA v3.10.1%2026-01-07Fix
CVE-2025-46494WidgetKit Pro WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-07
CVE-2025-46434The Plus Addons for Elementor Pro WordPress plugin broken access control6.5CNA v3.10.2%2026-01-07Fix
CVE-2025-46256Advanced Database Cleaner PRO WordPress plugin limited .txt path traversal6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-32303WPCHURCH WordPress plugin SQL injection9.3CNA v3.10.3%2026-01-07
CVE-2025-32300DZS Video Gallery WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-07Fix
CVE-2025-31964HCL BigFix IVR is impacted by an improper service binding configuration2.2CNA v3.10.3%2026-01-07Fix
CVE-2025-31963HCL BigFix IVR is impacted by improper authentication and missing CSRF protection2.9CNA v3.10.1%2026-01-07Fix
CVE-2025-31962HCL BigFix IVR is impacted by an insufficient session expiration2.0CNA v3.10.2%2026-01-07Fix
CVE-2025-31643WPCHURCH WordPress plugin privilege escalation8.8CNA v3.10.3%2026-01-07
CVE-2025-31642WPCHURCH WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-07
CVE-2025-31051Plant - Gardening and Houseplants WordPress theme sensitive data exposure5.3CNA v3.10.2%2026-01-07
CVE-2025-15479NGSurvey Enterprise incorrect authorization exposes other users’ API keys and personal data5.4NVD v3.10.2%2026-01-07Fix
CVE-2025-15474AuntyFey Smart Combination Lock BLE Connection Flood DoS5.3CNA v4.00.3%2026-01-07Exploit code
CVE-2025-15472TRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection8.6CNA v4.022.4%2026-01-07
CVE-2025-15471TRENDnet TEW-713RE formFSrvX os command injection9.3CNA v4.013.7%2026-01-07Emerging Threats
CVE-2025-15158WP Enable WebP WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.10.5%2026-01-07
CVE-2025-15058Responsive Pricing Table WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-15018Optional Email WordPress plugin unauthenticated privilege escalation to account takeover9.8CNA v3.10.3%2026-01-07
CVE-2025-15000Page Keys WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-07Fix
CVE-2025-14999Latest Tabs WordPress plugin cross-site request forgery to Plugin's settings update4.3CNA v3.10.1%2026-01-07
CVE-2025-14904Newsletter Email Subscribe WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.1%2026-01-07
CVE-2025-14901Bit Form Contact Form WordPress plugin missing authorization to unauthenticated Workflow Replay6.5CNA v3.10.4%2026-01-07Fix
CVE-2025-14891Customer Reviews for WooCommerce WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-14888Simple User Meta Editor WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-07
CVE-2025-14887twinklesmtp Email Service Provider For WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-07
CVE-2025-14875HBLPAY Payment Gateway for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-01-07Fix
CVE-2025-14867Flashcard Plugin for WordPress authenticated (Contributor+) arbitrary file read via path traversal6.5CNA v3.10.4%2026-01-07
CVE-2025-14845NS IE Compatibility Fixer WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.2%2026-01-07
CVE-2025-14842Drag and Drop Multiple File Upload for Contact Form 7 unrestricted file upload6.1CNA v3.10.4%2026-01-07Fix
CVE-2025-14835WP Photo Album Plus WordPress plugin reflected cross-site scripting7.1CNA v3.10.3%2026-01-07Fix
CVE-2025-14804Frontend File Manager WordPress plugin Subscriber+ arbitrary file deletion7.7CISA ADP v3.10.3%2026-01-07Fix
CVE-2025-14802LearnPress WordPress plugin file deletion5.4CNA v3.10.3%2026-01-07Fix
CVE-2025-14796My Album Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14792Key Figures WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-07
CVE-2025-14719Relevanssi SQL injection4.9CISA ADP v3.10.3%2026-01-07Fix
CVE-2025-14631Null pointer dereference vulnerability in Malformed 802.11 Frame of TP-Link Archer BE4007.1CNA v4.00.2%2026-01-07Fix
CVE-2025-14626QR Code for WooCommerce order emails WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14625Quartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14614Quartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14612Quartus Prime Pro Edition Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14605Quartus Prime Pro Edition Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14599Quartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14596Quartus Prime Pro Edition Installer Advisory5.4CNA v4.00.1%2026-01-07Fix
CVE-2025-14468AMP for WP WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-01-07Fix
CVE-2025-14465Sticky Action Buttons WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.1%2026-01-07
CVE-2025-14460enartia Piraeus Bank WooCommerce Payment Gateway payment callback endpoint missing authorization5.3CNA v3.10.4%2026-01-07Fix
CVE-2025-14453My Album Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-07
CVE-2025-14370Quote Comments WordPress plugin missing authorization authenticated arbitrary plugin settings update4.3CNA v3.10.2%2026-01-07
CVE-2025-14352Awesome Hotel Booking WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-07Fix
CVE-2025-14147Easy GitHub Gist Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-07
CVE-2025-14145Niche Hero Beautifully-designed blocks in seconds WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14144Mstoic Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14131WP Widget Changer WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-01-07
CVE-2025-14130Post Like Dislike WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-01-07
CVE-2025-14128Stumble! for WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-01-07
CVE-2025-14127Testimonial Master WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.4%2026-01-07
CVE-2025-14122AD Sliding FAQ WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-14121EDD Download Info WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-07
CVE-2025-14118Starred Review WordPress plugin reflected cross-site scripting via PHP_SELF Variable6.1CNA v3.10.4%2026-01-07
CVE-2025-141141180px Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14113Viitor Button Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-07
CVE-2025-14112Snillrik Restaurant WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-14110WP Js List Pages Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14109AH Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14077Simcast WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-01-07
CVE-2025-14070Reviewify WordPress plugin missing authorization authenticated arbitrary WooCommerce Coupon creation7.5CNA v3.10.4%2026-01-07Fix
CVE-2025-14059EmailKit WordPress plugin authenticated (Author+) arbitrary file read via path traversal6.5CNA v3.10.3%2026-01-07Fix
CVE-2025-14057Multi-column Tag Map WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-01-07
CVE-2025-14053Travel Bucket List WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-14028Contact Us Simple Form WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-01-07
CVE-2025-13990Mamurjor Employee Info WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-01-07
CVE-2025-13974Email Customizer for WooCommerce WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-01-07Fix
CVE-2025-13887AI BotKit WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-07Fix
CVE-2025-13849Cool YT Player WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-13848STM Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-13847PhotoFade WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-13841Smart App Banners WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-13801Yoco Payments WordPress plugin unauthenticated arbitrary file read7.5CNA v3.11.8%2026-01-07NucleiFix
CVE-2025-13722Fluent Forms WordPress plugin missing authorization authenticated arbitrary form creation5.3CNA v3.10.2%2026-01-07Fix
CVE-2025-13694AA Block country WordPress plugin unauthenticated IP Address spoofing via X-Forwarded-For Header5.3CNA v3.10.2%2026-01-07
CVE-2025-13667WP Recipe Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07
CVE-2025-13657HelpDesk contact form WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-01-07Fix
CVE-2025-13531Stylish Order Form Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-13529Unify WordPress plugin missing authorization unauthenticated option deletion5.3CNA v3.10.3%2026-01-07Fix
CVE-2025-13527xShare WordPress plugin cross-site request forgery to rs_plugin_reset parameter4.3CNA v3.10.2%2026-01-07
CVE-2025-13521WP Status Notifier WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-01-07
CVE-2025-13520MTCaptcha WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-01-07
CVE-2025-13519SVG Map Plugin WordPress plugin cross-site request forgery6.1CNA v3.10.1%2026-01-07Fix
CVE-2025-13497Recras WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-07Fix
CVE-2025-13496Moosend Landing Pages WordPress plugin missing authorization authenticated option deletion5.3CNA v3.10.3%2026-01-07
CVE-2025-13493webrndexperts Latest Registered Users missing authorization7.5CNA v3.10.3%2026-01-07
CVE-2025-13419Guest posting / Frontend Posting / Front Editor WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-07Fix
CVE-2025-13418Responsive Pricing Table WordPress plugin authenticated (Author+) stored cross-site scripting6.4CNA v3.10.6%2026-01-07NucleiFix
CVE-2025-13371Money Space WordPress plugin unauthenticated sensitive information exposure8.6CNA v3.10.4%2026-01-07Fix
CVE-2025-13369Premmerce WooCommerce Customers Manager WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-01-07Fix
CVE-2025-13151GnuTLS libtasn1 stack-based buffer overflow7.5CISA ADP v3.11.2%2026-01-07Fix
CVE-2025-12958Rankology SEO and Analytics Tool WordPress plugin unauthorized access2.7CNA v3.10.2%2026-01-07Fix
CVE-2025-12776Commvault WebConsole stored cross-site scripting1.8CNA v4.00.2%2026-01-07Fix
CVE-2025-12648WP-Members Membership WordPress plugin unauthenticated information exposure via Unprotected files5.3CNA v3.10.3%2026-01-07Fix
CVE-2025-12543Red Hat build of Apache Camel improper input validation9.6CNA v3.11.3%2026-01-07Fix
CVE-2025-12540ShareThis Dashboard for Google Analytics WordPress plugin information disclosure4.7CNA v3.10.3%2026-01-07
CVE-2025-12449aBlocks WordPress Gutenberg Blocks plugin missing authorization authenticated settings modification5.4CNA v3.10.2%2026-01-07Fix
CVE-2025-12030ACF to REST API WordPress plugin insecure direct object reference4.3CNA v3.10.4%2026-01-07Exploit code
CVE-2025-11877User Activity Log WordPress plugin unauthenticated limited options update via Failed login7.5CNA v3.10.4%2026-01-07
CVE-2025-11235Progress MOVEit Transfer unverified password change3.7CNA v3.10.2%2026-01-07Fix
CVE-2025-9611Microsoft Playwright MCP Server DNS Rebinding via Missing Origin Header Validation7.2CNA v4.01.2%2026-01-07Fix
CVE-2025-6225Command injection in Kieback&Peter Neutrino-GLT6.9CNA v4.01.1%2026-01-07Fix
CVE-2025-4677ABB WebPro SNMP Card PowerValue idle session timeout is not configured for multiple open ports7.1CNA v4.00.2%2026-01-07Fix
CVE-2025-4676ABB WebPro SNMP Card PowerValue authentication bypass by brute forcing Authentication headers8.4CNA v4.00.3%2026-01-07Fix
CVE-2025-4675ABB WebPro SNMP Card PowerValue improper implementation of Modbus protocol leading to DOS attack7.1CNA v4.00.2%2026-01-07Fix
CVE-2025-0980JSON RPC authentication bypass in Nokia SR Linux6.4CISA ADP v3.10.2%2026-01-07Fix
CVE-2025-69364Breeze WordPress plugin broken access control5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-69363Responsive Addons for Elementor WordPress plugin broken access control6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69362UiChemy WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-01-06Fix
CVE-2025-69361Post Expirator WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69360TheGem Theme Elements (for WPBakery) WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69359Creator LMS WordPress plugin broken access control5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-69357TheGem Theme Elements (for Elementor) WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69356TheGem Theme Elements (for Elementor) WordPress plugin local file inclusion7.5CNA v3.10.4%2026-01-06Fix
CVE-2025-69355Tickera WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69354Better Business Reviews WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69353Proxy and VPN Blocker WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69352The Events Calendar WordPress plugin broken access control5.4CNA v3.10.2%2026-01-06Fix
CVE-2025-69351Ninja Tables WordPress plugin SQL injection8.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69350Accordion WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-01-06Fix
CVE-2025-69349RSS Feed Widget WordPress plugin broken access control5.4CNA v3.10.2%2026-01-06Fix
CVE-2025-69348The Events Calendar Countdown Addon WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69346AffiliateX WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69345Post and Page Builder by BoldGrid WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69342Calafate WordPress theme local file inclusion7.5CNA v3.10.4%2026-01-06Fix
CVE-2025-69341WeDesignTech Ultimate Booking Addon WordPress plugin broken access control5.4CNA v3.10.2%2026-01-06Fix
CVE-2025-69336Ultimate Store Kit Elementor Addons WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69335Team Showcase WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69334Wishlist for WooCommerce WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-69331Theater for WordPress plugin broken access control4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-69327Car Rental Manager WordPress plugin broken access control4.3CNA v3.10.3%2026-01-06Fix
CVE-2025-69230Aiohttp vulnerable to Cookie Parser Warning Storm2.7CNA v4.00.4%2026-01-06Fix
CVE-2025-69229Aiohttp vulnerable to DoS through chunked messages6.6CNA v4.00.4%2026-01-06Fix
CVE-2025-69228Aiohttp vulnerable to denial of service through large payloads6.6CNA v4.00.4%2026-01-06Fix
CVE-2025-69227Aiohttp vulnerable to DoS when bypassing asserts6.6CNA v4.00.4%2026-01-06Fix
CVE-2025-69225Aiohttp Regex Mismatch allows Unicode in ASCII-Only protocol fields2.7CNA v4.00.3%2026-01-06Fix
CVE-2025-69197Pterodactyl TOTPs can be reused during validity window6.5CNA v3.10.4%2026-01-06Fix
CVE-2025-69086Issabella WordPress theme local file inclusion8.1CNA v3.10.4%2026-01-06
CVE-2025-69085JobBank WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-06
CVE-2025-69084Photo Gallery WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-01-06Fix
CVE-2025-69083Frappé WordPress theme local file inclusion8.1CNA v3.10.4%2026-01-06
CVE-2025-68954Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced7.5CNA v4.00.2%2026-01-06Fix
CVE-2025-65212Njhyst HY511 cookie reliance without validation9.8CISA ADP v3.15.4%2026-01-06
CVE-2025-63083Joomla! Core [20260102] XSS vector in the pagebreak plugin5.9CNA v4.00.2%2026-01-06Fix
CVE-2025-63082Joomla! Core [20260101] Inadequate content filtering for data URLs5.9CNA v4.00.2%2026-01-06Fix
CVE-2025-60534Blueaccesstech Cobalt X1 improper authentication9.8CISA ADP v3.10.7%2026-01-06
CVE-2025-60262H3C Magic BA1500L incorrect default permissions9.8CISA ADP v3.10.6%2026-01-06
CVE-2025-59379Dwyeromega Isensix Advanced Remote Monitoring System SQL injection7.5CISA ADP v3.10.4%2026-01-06
CVE-2025-47553DZS Video Gallery WordPress plugin PHP object injection8.8CNA v3.10.3%2026-01-06Fix
CVE-2025-46696Dell Secure Connect Gateway (SCG) Appliance execution with unnecessary privileges6.4CNA v3.10.1%2026-01-06Fix