CVE-2025 list

CVE-2025 records published after 2025

Page six of six: records 5,001 to 5,305 of the 5,305 published after 2025, newest first. The first page carries the figures for After 2025.

CVE-2025 records published after 2025, newest first: records 5,001 to 5,305 of 5,305
CVE Summary CVSS EPSS Published Signals
CVE-2025-39477InWave Jobs WordPress plugin broken access control9.8CNA v3.10.3%2026-01-06
CVE-2025-36589Dell Unisphere for PowerMax XML external entity injection7.6CNA v3.10.3%2026-01-06Fix
CVE-2025-32304WPCHURCH WordPress plugin local file inclusion8.1CNA v3.10.5%2026-01-06
CVE-2025-30996Arbitrary file upload vulnerability in WordPress themes by Themify9.9CNA v3.10.5%2026-01-06
CVE-2025-30631Reflected cross-site scripting (XSS) vulnerability in AA-Team WordPress plugins7.1CNA v3.10.2%2026-01-06
CVE-2025-29004Privilege escalation vulnerability in AA-Team WordPress plugins8.8CNA v3.10.3%2026-01-06
CVE-2025-20807MediaTek chipset integer overflow in dpe6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20806MediaTek chipset use-after-free in dpe6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20805MediaTek chipset use-after-free in dpe6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20804MediaTek chipset use-after-free in dpe6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20803MediaTek chipset integer overflow in dpe6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20802MediaTek chipset use-after-free in geniezone6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20801MediaTek chipset double free in seninf7.0CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20800MediaTek chipset out-of-bounds write in mminfra7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20799MediaTek chipset use-after-free in c2ps7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20798MediaTek chipset out-of-bounds write in battery7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20797MediaTek chipset stack overflow in battery7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20796MediaTek chipset specified index, position, or offset in imgsys7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20795MediaTek chipset out-of-bounds write in KeyInstall7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20794MediaTek chipset stack overflow in Modem6.5CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-20793MediaTek chipset null pointer dereference in Modem6.5CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-20787MediaTek chipset use-after-free in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20786MediaTek chipset double free in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20785MediaTek chipset use-after-free in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20784MediaTek chipset use of uninitialized variable in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20783MediaTek chipset out-of-bounds write in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20782MediaTek chipset out-of-bounds write in display6.7CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20781MediaTek chipset double free in display7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20780MediaTek chipset use-after-free in display7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20779MediaTek chipset use-after-free in display7.0CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20778MediaTek chipset out-of-bounds write in display7.8CISA ADP v3.10.1%2026-01-06Fix
CVE-2025-20762MediaTek chipset reachable assertion in Modem6.5CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-20761MediaTek chipset improper check for unusual or exceptional conditions in Modem6.5CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-20760MediaTek chipset reachable assertion in Modem6.5CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-15444Crypt::Sodium::XS module versions, for Perl, include a vulnerable version of libsodium9.8CISA ADP v3.10.3%2026-01-06Fix
CVE-2025-15385TECNO Mobile com.afmobi.boomplayer insufficient verification of data authenticity9.8CISA ADP v3.10.2%2026-01-06
CVE-2025-15382wolfSSL wolfSSH Client SCP Request Triggers buffer overread by 1 Byte5.1CNA v4.00.4%2026-01-06Fix
CVE-2025-15364Download Manager WordPress plugin unauthenticated limited privilege escalation via updatePassword7.3CNA v3.10.2%2026-01-06Fix
CVE-2025-15001FS Registration Password WordPress plugin unauthenticated privilege escalation via account takeover9.8CNA v3.10.4%2026-01-06Exploit codeFix
CVE-2025-14997BuddyPress Xprofile Custom Field Types WordPress plugin arbitrary file deletion8.8CNA v3.10.7%2026-01-06Fix
CVE-2025-14996AS Password Field In Default Registration Form WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.4%2026-01-06
CVE-2025-14979Eddie VPN local privilege escalation7.8NVD v3.10.2%2026-01-06Fix
CVE-2025-14942wolfSSL wolfSSH authentication bypass9.4CNA v4.00.4%2026-01-06Fix
CVE-2025-14552MediaPress WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-14441roxnor Popupkit subscribers REST endpoint missing authorization4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-14438Xagio SEO WordPress plugin authenticated (Subscriber+) server-side request forgery6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-14371TaxoPress WordPress plugin missing authorization authenticated arbitrary post Tag modification4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-14153Page Expire Popup/Redirection for WordPress plugin SQL injection6.5CNA v3.10.3%2026-01-06Fix
CVE-2025-14120URL Image Importer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-14034ilGhera Support System for WooCommerce WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-14026Vulnerable Python version used in Forcepoint One DLP client7.8CISA ADP v3.10.2%2026-01-06Fix
CVE-2025-13964LearnPress WordPress LMS plugin missing authentication to unauthenticated Course modification5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-13812GamiPress WordPress plugin unauthorized access4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-13766MasterStudy LMS WordPress Plugin WordPress plugin unauthorized access5.4CNA v3.10.2%2026-01-06Fix
CVE-2025-13746ForumWP Forum and Discussion Board WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-13744GitHub Enterprise Server search filter cross-site scripting8.4CNA v4.00.2%2026-01-06Fix
CVE-2025-13652CBX Bookmark and Favorite WordPress plugin SQL injection6.5CNA v3.11.2%2026-01-06NucleiFix
CVE-2025-13409Form Vibes Database Manager for Forms WordPress plugin authenticated (Admin+) SQL injection4.9CNA v3.10.3%2026-01-06Fix
CVE-2025-13215Shortcodes and extra features for Phlox theme WordPress plugin information disclosure5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-12793ASUS ASCI untrusted search path8.5CNA v4.00.1%2026-01-06
CVE-2025-12067Table Field Add-on for ACF and SCF WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-11723Appointment Booking Calendar WordPress plugin information disclosure6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-11370Depicter WordPress plugin missing authorization to unauthenticated Display Rule Updates5.3CNA v3.10.3%2026-01-06Fix
CVE-2025-9637Quiz and Survey Master (QSM) WordPress plugin unauthorized access6.5CNA v3.10.3%2026-01-06Fix
CVE-2025-9318Quiz and Survey Master (QSM) WordPress plugin SQL injection6.5CNA v3.10.3%2026-01-06Fix
CVE-2025-9294Quiz And Survey Master WordPress plugin missing authorization authenticated Quiz Results deletion4.3CNA v3.10.2%2026-01-06Fix
CVE-2025-7048Arista EOS MACsec process denial of service5.3CNA v4.00.2%2026-01-06Fix
CVE-2025-5919Appointment Booking and Scheduling Calendar Plugin WordPress plugin unauthorized access6.5CNA v3.10.2%2026-01-06Fix
CVE-2025-4776Phlox WordPress theme stored cross-site scripting6.4CNA v3.10.2%2026-01-06Fix
CVE-2025-69226Aiohttp allows for a brute-force leak of internal static filepath components6.3CNA v4.00.4%2026-01-05Fix
CVE-2025-69224Aiohttp's Unicode processing of header values could cause parsing discrepancies6.3CNA v4.00.3%2026-01-05Fix
CVE-2025-69223Aiohttp's HTTP parser auto_decompress feature is vulnerable to zip bomb7.5CNA v3.10.6%2026-01-05Fix
CVE-2025-69087FreeAgent WordPress theme local file inclusion8.1CNA v3.10.4%2026-01-05
CVE-2025-68953Certain Frappe requests are vulnerable to path traversal7.5CNA v3.10.4%2026-01-05Fix
CVE-2025-68865Infility Global WordPress plugin SQL injection9.3CNA v3.10.3%2026-01-05Fix
CVE-2025-68850Sell Downloads WordPress plugin broken access control7.5CNA v3.10.3%2026-01-05Fix
CVE-2025-68766Linux kernel irqchip/mchp-eic out-of-bounds access–0.2%2026-01-05Fix
CVE-2025-68765Linux kernel mt7615 Wi-Fi driver memory leak–0.2%2026-01-05Fix
CVE-2025-68764Linux kernel NFS automount vulnerability7.8CNA v3.10.1%2026-01-05Fix
CVE-2025-68763Linux kernel StarFive hash driver buffer overflow–0.2%2026-01-05Fix
CVE-2025-68762Linux kernel netpoll improper initialization–0.2%2026-01-05Fix
CVE-2025-68761Linux kernel HFS filesystem use-after-free7.8CNA v3.10.1%2026-01-05Fix
CVE-2025-68760Linux kernel AMD IOMMU debugfs interface out-of-bounds read–0.2%2026-01-05Fix
CVE-2025-68759Linux kernel rtl8180 Wi-Fi driver memory leak–0.2%2026-01-05Fix
CVE-2025-68758Linux kernel LED backlight driver vulnerability–0.2%2026-01-05Fix
CVE-2025-68757Linux kernel VGEM fence driver deadlock–0.2%2026-01-05Fix
CVE-2025-68756Linux kernel block multiqueue tag set quiesce vulnerability–0.2%2026-01-05Fix
CVE-2025-68755Linux kernel MOST I2C driver null pointer dereference–0.2%2026-01-05Fix
CVE-2025-68754Linux kernel Amlogic A4 RTC driver double free–0.2%2026-01-05Fix
CVE-2025-68753Linux kernel ALSA FireWire MOTU driver vulnerability7.1CNA v3.10.1%2026-01-05Fix
CVE-2025-68752Linux kernel iavf PTP clock driver null pointer dereference–0.2%2026-01-05Fix
CVE-2025-68751In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running ping command. An inline assembly instruction 'vstl' can write varied amount of bytes depending on value of 'index' arg–0.2%2026-01-05Fix
CVE-2025-68547Follow My Blog Post WordPress plugin arbitrary content deletion vulnerability7.5NVD v3.10.3%2026-01-05Fix
CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup7.0CNA v4.00.6%2026-01-05Fix
CVE-2025-68455Craft CMS vulnerable to potential authenticated remote code execution8.6CNA v4.01.0%2026-01-05Fix
CVE-2025-68454Craft CMS vulnerable to potential authenticated remote code execution via Twig SSTI5.2CNA v4.00.9%2026-01-05Fix
CVE-2025-68437Craft CMS vulnerable to server-side request forgery (SSRF) via GraphQL Asset Upload Mutation5.0CNA v4.00.5%2026-01-05Fix
CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocation4.9CNA v4.00.3%2026-01-05Fix
CVE-2025-68428jsPDF has local file inclusion/path traversal9.2CNA v4.02.2%2026-01-05Emerging ThreatsExploit codeFix
CVE-2025-68280Apache SIS: XML external entity (XXE)6.5CISA ADP v3.10.7%2026-01-05Fix
CVE-2025-68044Five Star Restaurant Reservations WordPress plugin insecure direct object references (IDOR)8.6CNA v3.10.3%2026-01-05Fix
CVE-2025-68033Custom Related Posts WordPress plugin sensitive data exposure7.5CNA v3.10.3%2026-01-05Fix
CVE-2025-68029Wallet System for WooCommerce WordPress plugin sensitive data exposure6.3CNA v3.00.2%2026-01-05Fix
CVE-2025-68014AweBooking WordPress plugin sensitive data exposure6.5CNA v3.10.3%2026-01-05
CVE-2025-67732Dify vulnerable to Plaintext API key exposure via Model Provider Configuration endpoint8.4CNA v4.00.4%2026-01-05Fix
CVE-2025-67427evershop Blind server-side request forgery6.5CISA ADP v3.10.2%2026-01-05
CVE-2025-67419evershop A denial of service7.5CISA ADP v3.10.3%2026-01-05
CVE-2025-67397Passy command injection9.1CISA ADP v3.10.8%2026-01-05
CVE-2025-67316Heytap Internet Browser cross-site scripting5.4CISA ADP v3.10.3%2026-01-05
CVE-2025-67303ComfyUI-Manager has an unprotected alternate channel7.5CISA ADP v3.11.4%2026-01-05Reported exploitedNucleiExploit codeKCVFix
CVE-2025-66648`Vega-functions` vulnerable to cross-site scripting via `setdata` function7.2CNA v3.10.2%2026-01-05Fix
CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalization8.8CNA v4.01.0%2026-01-05Fix
CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) cross-site scripting6.1NVD v3.120.2%2026-01-05KEVFix
CVE-2025-65922PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka application4.3CISA ADP v3.10.2%2026-01-05
CVE-2025-65328Mega-fence reliance on untrusted input in a security decision6.5CISA ADP v3.10.3%2026-01-05
CVE-2025-65110Vega cross-site scripting8.1CNA v3.10.5%2026-01-05Fix
CVE-2025-64425Coolify has host header injection in forgot password8.5CNA v4.00.4%2026-01-05
CVE-2025-64424coollabsio coolify colify has command injection vulnerability in project git source9.4CNA v4.02.1%2026-01-05Exploit code
CVE-2025-64423Coolify has a privilege escalation low privileged users can see and use admin invitation links7.7CNA v4.00.4%2026-01-05
CVE-2025-64422coollabsio coolify rate-limit bypass on login via X-Forwarded-Host header5.5CNA v4.00.3%2026-01-05
CVE-2025-64421Coolify has a privilege escalation low privileged user can invite themselves as an admin user8.7CNA v4.00.3%2026-01-05
CVE-2025-64420Coolify members can see private key of root user10.0CNA v3.10.5%2026-01-05
CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameters9.7CNA v3.10.7%2026-01-05Fix
CVE-2025-61916Spinnaker vulnerable to SSRF due to improper restrictions on HTTP from user input7.9CNA v3.10.2%2026-01-05Fix
CVE-2025-61781OpenCTI WorkspacePopoverDeletionMutation insecure direct object reference7.1CNA v3.10.2%2026-01-05Fix
CVE-2025-59955coolLabs Coolify team members API endpoint information disclosure5.7CNA v4.00.3%2026-01-05
CVE-2025-59467Ubiquiti UCRM Argentina AFIP invoices Plugin cross-site scripting9.6NVD v3.10.3%2026-01-05Fix
CVE-2025-59158Coolify has stored XSS in Project Name9.4CNA v4.00.5%2026-01-05Fix
CVE-2025-59157Coolify has Git Repository RCE10.0CNA v3.11.8%2026-01-05Fix
CVE-2025-59156Coolify has Docker Compose injection issue9.4CNA v4.01.0%2026-01-05Fix
CVE-2025-57836Samsung Magician uncontrolled search path7.8CISA ADP v3.10.1%2026-01-05Fix
CVE-2025-55204Muffon has One-click remote code execution via XSS and Custom URL Handling8.8CNA v3.10.7%2026-01-05Fix
CVE-2025-53966Samsung Exynos 1380 buffer overflow8.4CISA ADP v3.10.2%2026-01-05Fix
CVE-2025-53344Thim Core WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-01-05
CVE-2025-52519Samsung Exynos 1330 improper input validation7.1CISA ADP v3.10.1%2026-01-05Fix
CVE-2025-52517Samsung Exynos 1330 race condition5.9v3.10.2%2026-01-05Fix
CVE-2025-52516Samsung Exynos 1330 untrusted pointer dereference6.2CISA ADP v3.10.1%2026-01-05Fix
CVE-2025-52515Samsung Exynos 1330 race condition5.1CISA ADP v3.10.1%2026-01-05Fix
CVE-2025-49495Samsung Exynos 1380 buffer overflow8.4CISA ADP v3.10.2%2026-01-05Fix
CVE-2025-46255LoginWP - Pro WordPress plugin settings Change vulnerability7.5CNA v3.10.2%2026-01-05Fix
CVE-2025-43706Samsung Exynos 980 denial of service7.5CISA ADP v3.10.3%2026-01-05Fix
CVE-2025-39561LoginWP - Pro WordPress plugin broken access control6.5CNA v3.10.2%2026-01-05Fix
CVE-2025-39497Dokan Pro WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-05Fix
CVE-2025-39484Entrada WordPress theme SQL injection9.3CNA v3.10.3%2026-01-05
CVE-2025-31048WordPress Shopo theme arbitrary file upload9.9CNA v3.10.3%2026-01-05
CVE-2025-31047Themify Edmin WordPress theme PHP object injection8.8CNA v3.10.4%2026-01-05
CVE-2025-31046AnyWhere Elementor Pro WordPress theme broken access control4.3CNA v3.10.2%2026-01-05
CVE-2025-31044WordPress Premium SEO Pack plugin SQL injection8.5CNA v3.10.3%2026-01-05
CVE-2025-30633Amazon Native Shopping Recommendations WordPress plugin SQL injection9.3CNA v3.10.3%2026-01-05
CVE-2025-27807Samsung Exynos 980 out-of-bounds write9.1CISA ADP v3.10.4%2026-01-05Fix
CVE-2025-15462UTT 进取 520W ConfigAdvideo strcpy buffer overflow8.7CNA v4.00.9%2026-01-05
CVE-2025-15461UTT 进取 520W formTaskEdit strcpy buffer overflow8.7CNA v4.00.9%2026-01-05
CVE-2025-15460UTT 进取 520W formPptpClientConfig strcpy buffer overflow8.7CNA v4.00.6%2026-01-05
CVE-2025-15459UTT 进取 520W formUser strcpy buffer overflow8.7CNA v4.00.9%2026-01-05
CVE-2025-15458bg5sbk MiniCMS Article post-edit.php improper authentication9.8NVD v3.10.6%2026-01-05
CVE-2025-15457bg5sbk MiniCMS Trash File Restore post.php improper authentication9.8NVD v3.10.6%2026-01-05
CVE-2025-15456bg5sbk MiniCMS Publish page-edit.php improper authentication7.5NVD v3.10.4%2026-01-05
CVE-2025-15455bg5sbk MiniCMS File Recovery request page.php delete_page improper authentication6.5NVD v3.10.7%2026-01-05
CVE-2025-15454zhanglun lettura RSS ContentRender.tsx cross-site scripting2.3CNA v4.00.4%2026-01-05
CVE-2025-15453milvus HTTP endpoint expr.go expr.Exec deserialization5.3CNA v4.00.4%2026-01-05
CVE-2025-15452xnx3 wangmarket Backend Variable Search variableList.do variableList cross-site scripting4.8NVD v3.10.3%2026-01-05
CVE-2025-15451xnx3 wangmarket System variables variableSave.do cross-site scripting4.8NVD v3.10.3%2026-01-05
CVE-2025-15450sfturing hosp_order orderHos findOrderHosNum SQL injection5.3CNA v4.00.3%2026-01-05
CVE-2025-15449cld378632668 JavaMall MinioController.java delete path traversal9.1NVD v3.10.7%2026-01-05
CVE-2025-15448cld378632668 JavaMall MinioController.java upload unrestricted upload9.8NVD v3.10.4%2026-01-05
CVE-2025-15240Quanta Computer｜QOCA aim AI Medical Cloud Platform arbitrary file upload8.7CNA v4.00.5%2026-01-05Fix
CVE-2025-15239Quanta Computer｜QOCA aim AI Medical Cloud Platform SQL injection7.1CNA v4.00.3%2026-01-05Fix
CVE-2025-15238Quanta Computer｜QOCA aim AI Medical Cloud Platform SQL injection7.1CNA v4.00.3%2026-01-05Fix
CVE-2025-15237Quanta Computer｜QOCA aim AI Medical Cloud Platform path traversal5.3CNA v4.00.4%2026-01-05Fix
CVE-2025-15236Quanta Computer｜QOCA aim AI Medical Cloud Platform path traversal5.3CNA v4.00.4%2026-01-05Fix
CVE-2025-15235Quanta Computer｜QOCA aim AI Medical Cloud Platform missing authorization7.1CNA v4.00.3%2026-01-05Fix
CVE-2025-15029An unauthenticated user is able to introduce SQL injection using the Awie export module9.8CNA v3.113.0%2026-01-05Fix
CVE-2025-15026Unauthenticated configuration import allows administrative account creation using Awie component9.8CNA v3.10.4%2026-01-05Fix
CVE-2025-15022Vaadin cross-site scripting in action caption4.8CNA v4.00.3%2026-01-05Fix
CVE-2025-14346WHILL Model C2 Electric Wheelchair missing authentication9.3CNA v4.05.6%2026-01-05Fix
CVE-2025-14124Team WordPress plugin unauthenticated SQLi8.6CISA ADP v3.11.7%2026-01-05NucleiExploit codeFix
CVE-2025-13056Centreon Infra Monitoring administration ACL menu configuration stored cross-site scripting6.8CNA v3.10.2%2026-01-05Fix
CVE-2025-12519Centreon Infra Monitoring information disclosure on Administration parameters API endpoint5.3CNA v3.10.2%2026-01-05Fix
CVE-2025-12513Centreon Infra Monitoring Hosts configuration form stored cross-site scripting6.8CNA v3.10.2%2026-01-05Fix
CVE-2025-12511Centreon Infra Monitoring DSM extensions configuration page stored cross-site scripting6.8CNA v3.10.2%2026-01-05Fix
CVE-2025-10933Silicon Labs Z-Wave Protocol Controller integer underflow vulnerability leads to out-of-bounds read5.3CNA v4.00.3%2026-01-05Fix
CVE-2025-9543FlexTable Google Sheets Connector WordPress plugin Admin+ stored XSS3.5CISA ADP v3.10.2%2026-01-05Fix
CVE-2025-5965Centreon Infra Monitoring RCE via the backup feature available only to user with high privilege7.2CNA v3.128.2%2026-01-05Fix
CVE-2025-5591Stored cross-site scripting (XSS) in Kentico Xperience 135.4NVD v3.10.2%2026-01-05
CVE-2025-15443CRMEB product_export SQL injection7.2NVD v3.10.4%2026-01-04
CVE-2025-15442CRMEB product_list SQL injection7.2NVD v3.10.4%2026-01-04
CVE-2025-14830JFrog Artifactory cross-site scripting4.9CNA v3.10.3%2026-01-04
CVE-2025-64125Nuvation Energy nCloud VPN Service confused deputy9.4CNA v4.00.3%2026-01-03
CVE-2025-64124Nuvation Energy Multi-Stack Controller OS command injection8.8NVD v3.11.0%2026-01-03Fix
CVE-2025-34171CasaOS Unauthenticated file and Debug data exposure5.3NVD v3.10.7%2026-01-03Exploit code
CVE-2025-15115Petlibro Smart Pet Feeder Platform authentication bypass via API endpoint9.8NVD v3.10.3%2026-01-03
CVE-2025-3660Petlibro Smart Pet Feeder Platform broken access control via API endpoint8.2NVD v3.10.2%2026-01-03
CVE-2025-3654Petlibro Smart Pet Feeder Platform information disclosure via API endpoint9.8NVD v3.10.3%2026-01-03
CVE-2025-3653Petlibro Smart Pet Feeder Platform improper access control via API endpoint9.8NVD v3.10.3%2026-01-03
CVE-2025-3652Petlibro Smart Pet Feeder Platform Audio information disclosure via API endpoint6.9CNA v4.00.2%2026-01-03
CVE-2025-3646Petlibro Smart Pet Feeder Platform authorization bypass via Device Share API8.2NVD v3.10.2%2026-01-03
CVE-2025-69417plex.tv backend incorrect authorization4.3NVD v3.10.3%2026-01-02Fix
CVE-2025-69416plex.tv backend incorrect authorization4.3NVD v3.10.3%2026-01-02Fix
CVE-2025-69415Plex Media Server operation on a released resource7.1NVD v3.10.3%2026-01-02
CVE-2025-69414Plex Media Server incorrect authorization7.1NVD v3.10.3%2026-01-02
CVE-2025-69284makeplane plane in Plane.io, a Guest User to a Workspace can still be able to see list of members4.3CNA v3.10.2%2026-01-02Fix
CVE-2025-67269gpsd `nextstate` function in ` integer underflow7.5CISA ADP v3.10.6%2026-01-02Fix
CVE-2025-67268gpsd heap-based buffer overflow9.8CISA ADP v3.10.8%2026-01-02Fix
CVE-2025-67160Vatilon PA4 path traversal7.5CISA ADP v3.10.9%2026-01-02Exploit code
CVE-2025-67159Vatilon PA4 cleartext transmission of sensitive information7.5CISA ADP v3.10.3%2026-01-02Exploit code
CVE-2025-67158Revotech I6032w-fhw /cgi-bin/jvsweb.cgi endpoint authentication bypass7.5CISA ADP v3.10.5%2026-01-02Exploit code
CVE-2025-65125Gosaliajainam Online-movie-booking SQL injection9.8CISA ADP v3.10.4%2026-01-02
CVE-2025-64123Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access9.8NVD v3.10.3%2026-01-02
CVE-2025-64122Nuvation Energy Multi-Stack Controller Private Key Stored on Device5.5NVD v3.10.1%2026-01-02
CVE-2025-64121Nuvation Energy Multi-Stack Controller authentication bypass9.8NVD v3.10.4%2026-01-02Fix
CVE-2025-64120Nuvation Energy Multi-Stack Controller OS command injection8.8NVD v3.11.0%2026-01-02Fix
CVE-2025-64119Nuvation Energy BMS client-side authentication9.3CNA v4.00.5%2026-01-02
CVE-2025-62857QNAP QuMagie cross-site scripting2.2CNA v4.00.2%2026-01-02Fix
CVE-2025-62852QNAP QTS and QuTS hero stack-based buffer overflow1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-62842QNAP Systems HBS 3 Hybrid Backup Sync external control of a file path7.0CNA v4.00.3%2026-01-02Fix
CVE-2025-62840QNAP HBS 3 Hybrid Backup Sync error messages vulnerability7.0CNA v4.00.2%2026-01-02Fix
CVE-2025-59389QNAP Hyper Data Protector SQL injection8.1CNA v4.00.7%2026-01-02Fix
CVE-2025-59387MARS (Multi-Application Recovery service)8.1CNA v4.00.4%2026-01-02Fix
CVE-2025-59384QNAP Qfiling path traversal8.1CNA v4.00.5%2026-01-02Fix
CVE-2025-59381QNAP QTS and QuTS hero path traversal6.9CNA v4.00.5%2026-01-02Fix
CVE-2025-59380QNAP QTS and QuTS hero path traversal4.6CNA v4.00.6%2026-01-02Fix
CVE-2025-57705QNAP QTS and QuTS hero resource exhaustion4.6CNA v4.00.4%2026-01-02Fix
CVE-2025-54166QNAP QTS and QuTS hero out-of-bounds read4.6CNA v4.00.3%2026-01-02Fix
CVE-2025-54165QNAP QTS and QuTS hero out-of-bounds read4.6CNA v4.00.3%2026-01-02Fix
CVE-2025-54164QNAP QTS and QuTS hero out-of-bounds read4.6CNA v4.00.3%2026-01-02Fix
CVE-2025-53597QNAP License Center stack-based buffer overflow1.2CNA v4.00.6%2026-01-02Fix
CVE-2025-53596QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-53594QNAP Qfinder Pro, Qsync and QVPN Device Client path traversal4.4CNA v4.00.1%2026-01-02Fix
CVE-2025-53593QNAP QTS and QuTS hero stack-based buffer overflow1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-53592QNAP QTS and QuTS hero null pointer dereference1.3CNA v4.00.3%2026-01-02Fix
CVE-2025-53591QNAP QTS and QuTS hero format string1.2CNA v4.00.3%2026-01-02Fix
CVE-2025-53590QNAP QTS null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-53589QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-53414QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-53405QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-52872QNAP QTS and QuTS hero buffer overflow1.3CNA v4.00.4%2026-01-02Fix
CVE-2025-52871QNAP License Center out-of-bounds read1.3CNA v4.00.6%2026-01-02Fix
CVE-2025-52864QNAP QTS and QuTS hero buffer overflow1.3CNA v4.00.4%2026-01-02Fix
CVE-2025-52863QNAP QTS and QuTS hero buffer overflow1.3CNA v4.00.4%2026-01-02Fix
CVE-2025-52431QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-52430QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-52426QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-48721QNAP QTS and QuTS hero buffer overflow1.2CNA v4.00.4%2026-01-02Fix
CVE-2025-47208QNAP QTS and QuTS hero resource exhaustion4.9CNA v4.00.3%2026-01-02Fix
CVE-2025-45286Reflected XSS in Go-httpbin due to unrestricted client control over Content-Type6.1CISA ADP v3.10.3%2026-01-02Fix
CVE-2025-44013QNAP QTS and QuTS hero null pointer dereference1.3CNA v4.00.3%2026-01-02Fix
CVE-2025-15439Daptin Aggregate API resource_aggregate.go goqu.L SQL injection5.3CNA v4.00.3%2026-01-02
CVE-2025-15438PluXml Media Management medias.php __destruct deserialization7.2NVD v3.10.5%2026-01-02
CVE-2025-15437LigeroSmart Environment variable cross-site scripting5.4v3.10.3%2026-01-02Fix
CVE-2025-15436Yonyou KSOA work_edit.jsp SQL injection9.8NVD v3.10.4%2026-01-02
CVE-2025-15435Yonyou KSOA work_update.jsp SQL injection9.8NVD v3.10.4%2026-01-02
CVE-2025-15434Yonyou KSOA PrintZPYG.jsp SQL injection9.8NVD v3.10.4%2026-01-02
CVE-2025-15432carRental FileController downloadShowFile action path traversal7.5NVD v3.10.7%2026-01-02
CVE-2025-15431UTT 进取 512W formFtpServerDirConfig strcpy buffer overflow8.7CNA v4.00.8%2026-01-02
CVE-2025-15430UTT 进取 512W formFtpServerShareDirSelcet strcpy buffer overflow8.7CNA v4.00.8%2026-01-02
CVE-2025-15429UTT 进取 512W formConfigCliForEngineerOnly strcpy buffer overflow8.7CNA v4.00.9%2026-01-02
CVE-2025-15428UTT 进取 512W formRemoteControl strcpy buffer overflow8.7CNA v4.00.9%2026-01-02
CVE-2025-15426jackying H-ui.admin preview.php unrestricted upload6.9CNA v4.00.5%2026-01-02
CVE-2025-15425Yonyou KSOA HTTP GET parameter del_user.jsp SQL injection9.8NVD v3.10.5%2026-01-02
CVE-2025-15424Yonyou KSOA HTTP GET parameter agent_worksdel.jsp SQL injection9.8NVD v3.10.5%2026-01-02
CVE-2025-15423EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload8.8NVD v3.10.4%2026-01-02
CVE-2025-15422EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism7.5NVD v3.11.3%2026-01-02
CVE-2025-15421Yonyou KSOA HTTP GET parameter agent_worksadd.jsp SQL injection9.8NVD v3.10.5%2026-01-02
CVE-2025-15420Yonyou KSOA agent_work_report.jsp SQL injection9.8NVD v3.10.5%2026-01-02
CVE-2025-15419Open5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of service5.5NVD v3.10.2%2026-01-02
CVE-2025-15418Open5GS Bearer QoS IE Length types.c ogs_gtp2_parse_bearer_qos denial of service5.5NVD v3.10.2%2026-01-02
CVE-2025-14998Branda WordPress plugin privilege escalation9.8CNA v3.11.9%2026-01-02NucleiExploit codeFix
CVE-2025-14072Ninja Forms WordPress plugin unauthenticated Token Generation and Submission disclosure5.3CISA ADP v3.10.3%2026-01-02Fix
CVE-2025-14047wedevs User Frontend attachment deletion handler missing authorization5.3CNA v3.10.9%2026-01-02NucleiFix
CVE-2025-13456Shopbuilder WordPress plugin reflected XSS6.1CISA ADP v3.10.2%2026-01-02Fix
CVE-2025-13153Logo Slider WordPress plugin Contributor+ stored XSS6.1CISA ADP v3.10.2%2026-01-02Fix
CVE-2025-12685WPBookit customer deletion cross-site request forgery6.5CISA ADP v3.10.2%2026-01-02
CVE-2025-11837QNAP Malware Remover code injection8.1CNA v4.01.5%2026-01-02Emerging ThreatsFix
CVE-2025-9110QNAP QTS and QuTS hero information disclosure2.7CNA v4.00.5%2026-01-02Fix
CVE-2025-69413Gitea response discrepancy5.3CNA v3.10.4%2026-01-01Exploit codeFix
CVE-2025-69412KDE messagelib improper certificate validation3.4CNA v3.10.2%2026-01-01Fix
CVE-2025-69203signalk-server signal K Server vulnerable to access request spoofing6.3CNA v3.10.3%2026-01-01Fix
CVE-2025-68620Signal K Server WebSocket server events endpoint authentication bypass9.1CNA v3.10.5%2026-01-01Fix
CVE-2025-68619signalk-server signal K Server vulnerable to remote code execution via Malicious npm Package7.3CNA v4.00.7%2026-01-01Fix
CVE-2025-68273signalk-server signal K Server vulnerable to unauthenticated information disclosure5.3CNA v3.10.8%2026-01-01NucleiFix
CVE-2025-68272signalk-server Signal K Server vulnerable to denial of service7.5CNA v3.10.6%2026-01-01Fix
CVE-2025-66398signalk-server Signal K Server has Unauthenticated State Pollution leading to remote code execution9.7CNA v3.119.9%2026-01-01Exploit codeFix
CVE-2025-66023NanoMQ has use-after-free of malformed bridging message6.9CNA v4.00.4%2026-01-01Fix
CVE-2025-55065Kopek Reem ReKord client SQL injection7.5CNA v3.10.3%2026-01-01
CVE-2025-48769Apache NuttX RTOS: Fs/vfs/fs_rename: Use-after-free8.1NVD v3.11.6%2026-01-01Fix
CVE-2025-48768Apache NuttX RTOS: Fs/inode: Fs_inoderemove root inode removal6.5NVD v3.10.8%2026-01-01Fix
CVE-2025-47411Apache StreamPipes: Leverage of User ID for privilege escalation8.1CISA ADP v3.115.3%2026-01-01Fix
CVE-2025-15417Open5GS GTPv2-C F-TEID s11-handler.c sgwc_s11_handle_create_session_request denial of service5.5NVD v3.10.2%2026-01-01
CVE-2025-15416xnx3 wangmarket Add Global variable save.do cross-site scripting5.4NVD v3.10.3%2026-01-01
CVE-2025-15415xnx3 wangmarket XML file uploadImage.do uploadImage unrestricted upload5.4NVD v3.10.3%2026-01-01
CVE-2025-15414go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery5.1CNA v4.00.3%2026-01-01
CVE-2025-15413wasm3 m3_exec.h op_CallIndirect memory corruption7.8NVD v3.10.2%2026-01-01
CVE-2025-15412WebAssembly wabt wasm-decompile VarName out-of-bounds7.8NVD v3.10.2%2026-01-01
CVE-2025-15411WebAssembly wabt wasm-decompile InsertNode memory corruption7.8NVD v3.10.2%2026-01-01
CVE-2025-15410code-projects Online Guitar Store login.php SQL injection9.8NVD v3.10.4%2026-01-01
CVE-2025-15409code-projects Online Guitar Store Delete_product.php SQL injection9.8NVD v3.10.4%2026-01-01
CVE-2025-15408code-projects Online Guitar Store Create_product.php SQL injection9.8NVD v3.10.4%2026-01-01
CVE-2025-15407code-projects Online Guitar Store Create_category.php SQL injection9.8NVD v3.10.4%2026-01-01
CVE-2025-15406PHPGurukul Online Course Registration missing authorization8.8NVD v3.10.5%2026-01-01
CVE-2025-15405Phpems cross-site request forgery8.8NVD v3.10.3%2026-01-01
CVE-2025-15404Campcodes School File Management System save_file.php unrestricted upload8.8NVD v3.10.3%2026-01-01
CVE-2025-14627WP Import Ultimate CSV XML Importer for WordPress plugin server-side request forgery6.4CNA v3.10.3%2026-01-01Fix
CVE-2025-14428My Sticky Elements WordPress plugin missing authorization authenticated arbitrary Bulk Lead deletion4.3CNA v3.10.3%2026-01-01Fix
CVE-2025-13820Comments wpDiscuz WordPress plugin unauthenticated account takeover5.3CISA ADP v3.10.3%2026-01-01Fix
CVE-2025-11157Arbitrary code execution in feast-dev/feast7.8CNA v3.00.3%2026-01-01Fix