206 CVEs tracked today. 14 Critical, 49 High, 104 Medium, 37 Low.
-
CVE-2025-52053
CRITICAL
CVSS 9.8
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74 function via the file_name parameter. Remote attackers can execute arbitrary commands on the router without authentication through crafted HTTP requests.
Command Injection
X6000r Firmware
TOTOLINK
-
CVE-2025-59361
CRITICAL
CVSS 9.8
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RCE
Command Injection
Suse
Chaos Mesh
-
CVE-2025-59360
CRITICAL
CVSS 9.8
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RCE
Command Injection
Suse
Chaos Mesh
-
CVE-2025-59359
CRITICAL
CVSS 9.8
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RCE
Command Injection
Suse
Chaos Mesh
-
CVE-2025-57174
CRITICAL
CVSS 9.8
An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RCE
-
CVE-2025-57118
CRITICAL
CVSS 9.8
An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Privilege Escalation
Online Library Management System
-
CVE-2025-46408
CRITICAL
CVSS 9.8
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass
Eagleeyes Lite
-
CVE-2025-43362
CRITICAL
CVSS 9.8
The issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43359
CRITICAL
CVSS 9.8
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43347
CRITICAL
CVSS 9.8
This issue was addressed by removing the vulnerable code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43343
CRITICAL
CVSS 9.8
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Apple
Red Hat
Suse
-
CVE-2025-43342
CRITICAL
CVSS 9.8
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Apple
Red Hat
Suse
-
CVE-2025-31255
CRITICAL
CVSS 9.8
An authorization issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-10452
CRITICAL
CVSS 9.3
Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-59375
HIGH
CVSS 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial Of Service
-
CVE-2025-59358
HIGH
CVSS 7.5
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication Bypass
Denial Of Service
Kubernetes
Suse
Chaos Mesh
-
CVE-2025-59332
HIGH
CVSS 8.6
3DAlloy is a lightWeight 3D-viewer for MediaWiki. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-59331
HIGH
CVSS 8.8
is-arrayish checks if an object can be used like an Array. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59330
HIGH
CVSS 8.8
error-ex allows error subclassing and stack customization. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59162
HIGH
CVSS 8.8
color-convert provides plain color conversion functions in JavaScript. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59145
HIGH
CVSS 8.8
color-name is a JSON with CSS color names. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59144
HIGH
CVSS 8.8
debug is a JavaScript debugging utility. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59143
HIGH
CVSS 8.8
color is a Javascript color conversion and manipulation library. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59142
HIGH
CVSS 8.8
color-string is a parser and generator for CSS color strings. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59141
HIGH
CVSS 8.8
simple-swizzle swizzles function arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-59140
HIGH
CVSS 8.8
backlash parses collected strings with escapes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Node.js
Red Hat
-
CVE-2025-58748
HIGH
CVSS 8.7
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
RCE
Deserialization
Dataease
-
CVE-2025-58046
HIGH
CVSS 8.7
Dataease is an open-source data visualization and analysis platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
RCE
Deserialization
Dataease
-
CVE-2025-58045
HIGH
CVSS 7.1
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
RCE
Deserialization
SSRF
Dataease
-
CVE-2025-57248
HIGH
CVSS 7.3
A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial Of Service
Null Pointer Dereference
Sumatrapdf
-
CVE-2025-56710
HIGH
CVSS 7.3
A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
CSRF
Student Result Management System
-
CVE-2025-56274
HIGH
CVSS 8.1
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high privileged (such as admin) sessions and. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass
-
CVE-2025-50944
HIGH
CVSS 8.8
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Eagleeyes Lite
-
CVE-2025-50110
HIGH
CVSS 8.8
An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2025-43372
HIGH
CVSS 7.8
The issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43371
HIGH
CVSS 8.2
This issue was addressed with improved checks. Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Xcode
-
CVE-2025-43358
HIGH
CVSS 8.8
A permissions issue was addressed with additional sandbox restrictions. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43341
HIGH
CVSS 7.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43340
HIGH
CVSS 7.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43333
HIGH
CVSS 7.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Privilege Escalation
Apple
macOS
-
CVE-2025-43330
HIGH
CVSS 8.2
This issue was addressed by removing the vulnerable code. Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43329
HIGH
CVSS 8.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43316
HIGH
CVSS 7.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-43304
HIGH
CVSS 7.0
A race condition was addressed with improved state handling. Rated high severity (CVSS 7.0). No vendor patch available.
Information Disclosure
Apple
Race Condition
-
CVE-2025-43298
HIGH
CVSS 7.8
A parsing issue in the handling of directory paths was addressed with improved path validation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43287
HIGH
CVSS 7.1
The issue was addressed with improved memory handling. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Apple
macOS
-
CVE-2025-43286
HIGH
CVSS 7.8
A permissions issue was addressed with additional restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43263
HIGH
CVSS 7.1
The issue was addressed with improved checks. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Xcode
-
CVE-2025-43204
HIGH
CVSS 7.8
This issue was addressed by removing the vulnerable code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-39804
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Information Disclosure
Linux
Red Hat
Linux Kernel
Suse
-
CVE-2025-39803
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() The UIC completion interrupt may be disabled while an UIC. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Information Disclosure
Linux
Red Hat
Linux Kernel
Suse
-
CVE-2025-39802
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Information Disclosure
Linux
Red Hat
Linux Kernel
Suse
-
CVE-2025-31271
HIGH
CVSS 7.5
This issue was addressed through improved state management. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-24088
HIGH
CVSS 7.5
The issue was addressed by adding additional logic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-10491
HIGH
CVSS 7.8
The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking.0 version. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Windows
Authentication Bypass
Microsoft
-
CVE-2025-10443
HIGH
CVSS 7.4
A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Buffer Overflow
Tenda
Ac15 Firmware
Ac9 Firmware
-
CVE-2025-10432
HIGH
CVSS 8.9
A vulnerability was found in Tenda AC1206 15.03.06.23. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer Overflow
Tenda
Ac1206 Firmware
-
CVE-2025-10203
HIGH
CVSS 8.5
Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
RCE
Path Traversal
-
CVE-2025-9826
HIGH
CVSS 7.0
Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Hubshare
-
CVE-2025-9072
HIGH
CVSS 7.6
Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Open Redirect
Mattermost Server
Suse
-
CVE-2025-6202
HIGH
CVSS 7.1
Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. Rated high severity (CVSS 7.1). No vendor patch available.
Information Disclosure
-
CVE-2025-3025
HIGH
CVSS 7.3
Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Windows
Information Disclosure
Path Traversal
Microsoft
-
CVE-2023-53232
HIGH
CVSS 7.1
A null pointer dereference vulnerability exists in the Linux kernel's MT7921 wireless driver where the driver attempts to access unallocated eeprom.data memory during firmware initialization, resulting in a kernel panic and system crash. This affects Linux kernel versions running the mt7921 wireless driver for MediaTek MT7921 WiFi chipsets. An attacker with local access and low privileges can trigger a denial of service condition causing system instability, though the EPSS score of 0.01% (1st percentile) indicates this vulnerability is not actively exploited in the wild and no public proof-of-concept is widely circulated.
Denial Of Service
Linux
Memory Corruption
Null Pointer Dereference
Red Hat
-
CVE-2025-59397
MEDIUM
CVSS 5.0
Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP
SQLi
-
CVE-2025-59378
MEDIUM
CVSS 5.7
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Suse
-
CVE-2025-59328
MEDIUM
CVSS 6.5
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Apache
Deserialization
Fory
-
CVE-2025-59155
MEDIUM
CVSS 6.9
hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SSRF
-
CVE-2025-59154
MEDIUM
CVSS 5.9
Openfire is an XMPP server licensed under the Open Source Apache License. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Authentication Bypass
Apache
-
CVE-2025-59056
MEDIUM
CVSS 6.6
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal
Freepbx
-
CVE-2025-58177
MEDIUM
CVSS 5.4
n8n is an open source workflow automation platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
XSS
Information Disclosure
AI / ML
Langchain
N8n
-
CVE-2025-58172
MEDIUM
CVSS 5.3
drawnix is an all in one open-source whiteboard tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-57176
MEDIUM
CVSS 6.5
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
File Upload
-
CVE-2025-57117
MEDIUM
CVSS 5.4
A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
XSS
Employee Management System
-
CVE-2025-57104
MEDIUM
CVSS 5.4
Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQLi
Teampel
-
CVE-2025-56448
MEDIUM
CVSS 6.8
The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Px360Bt Firmware
-
CVE-2025-56252
MEDIUM
CVSS 6.1
Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
RCE
Servitiumcrm
-
CVE-2025-55211
MEDIUM
CVSS 6.3
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command Injection
Freepbx
-
CVE-2025-52344
MEDIUM
CVSS 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
XSS
Blue
-
CVE-2025-52048
MEDIUM
CVSS 6.5
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
Frappe
-
CVE-2025-49089
MEDIUM
CVSS 6.3
wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal
Moneyprinterturbo
-
CVE-2025-45091
MEDIUM
CVSS 5.4
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-43802
MEDIUM
CVSS 4.8
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Digital Experience Platform
Liferay Portal
-
CVE-2025-43800
MEDIUM
CVSS 4.8
Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Digital Experience Platform
Liferay Portal
-
CVE-2025-43799
MEDIUM
CVSS 6.9
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Digital Experience Platform
Liferay Portal
-
CVE-2025-43797
MEDIUM
CVSS 5.3
In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information Disclosure
Digital Experience Platform
Liferay Portal
-
CVE-2025-43794
MEDIUM
CVSS 4.6
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Digital Experience Platform
Liferay Portal
-
CVE-2025-43793
MEDIUM
CVSS 6.9
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Digital Experience Platform
Liferay Portal
-
CVE-2025-43791
MEDIUM
CVSS 4.8
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Digital Experience Platform
Liferay Portal
-
CVE-2025-43375
MEDIUM
CVSS 5.5
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Xcode
-
CVE-2025-43370
MEDIUM
CVSS 4.0
A path handling issue was addressed with improved validation. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Xcode
-
CVE-2025-43369
MEDIUM
CVSS 5.5
This issue was addressed with improved handling of symlinks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43368
MEDIUM
CVSS 4.3
A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Use After Free
Memory Corruption
Apple
-
CVE-2025-43367
MEDIUM
CVSS 5.5
A privacy issue was addressed by moving sensitive data. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43366
MEDIUM
CVSS 5.5
An out-of-bounds read was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Apple
macOS
-
CVE-2025-43356
MEDIUM
CVSS 6.5
The issue was addressed with improved handling of caches. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
Red Hat
Suse
-
CVE-2025-43355
MEDIUM
CVSS 5.5
A type confusion issue was addressed with improved memory handling. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Memory Corruption
Apple
-
CVE-2025-43354
MEDIUM
CVSS 5.5
A logging issue was addressed with improved data redaction. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43353
MEDIUM
CVSS 5.5
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Memory Corruption
Apple
-
CVE-2025-43346
MEDIUM
CVSS 5.5
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Apple
-
CVE-2025-43337
MEDIUM
CVSS 5.5
An access issue was addressed with additional sandbox restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43332
MEDIUM
CVSS 5.2
A file quarantine bypass was addressed with additional checks. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43331
MEDIUM
CVSS 4.0
A downgrade issue was addressed with additional code-signing restrictions. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43327
MEDIUM
CVSS 6.5
The issue was addressed by adding additional logic. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43326
MEDIUM
CVSS 5.5
An out-of-bounds read was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Apple
-
CVE-2025-43325
MEDIUM
CVSS 5.5
An access issue was addressed with additional sandbox restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43321
MEDIUM
CVSS 5.5
The issue was resolved by blocking unsigned services from launching on Intel Macs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
Intel
-
CVE-2025-43319
MEDIUM
CVSS 5.5
This issue was addressed by removing the vulnerable code. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43318
MEDIUM
CVSS 6.2
This issue was addressed with additional entitlement checks. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43317
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43315
MEDIUM
CVSS 5.5
This issue was addressed by removing the vulnerable code. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Information Disclosure
Apple
-
CVE-2025-43314
MEDIUM
CVSS 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Path Traversal
Apple
-
CVE-2025-43312
MEDIUM
CVSS 5.5
A buffer overflow was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Apple
-
CVE-2025-43311
MEDIUM
CVSS 5.1
This issue was addressed with additional entitlement checks. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43310
MEDIUM
CVSS 4.4
A configuration issue was addressed with additional restrictions. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43308
MEDIUM
CVSS 5.3
This issue was addressed with additional entitlement checks. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43307
MEDIUM
CVSS 4.0
This issue was addressed with improved checks to prevent unauthorized actions. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43305
MEDIUM
CVSS 5.5
A logic issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43303
MEDIUM
CVSS 5.5
A logging issue was addressed with improved data redaction. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43302
MEDIUM
CVSS 5.5
An out-of-bounds write issue was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Memory Corruption
Apple
-
CVE-2025-43299
MEDIUM
CVSS 5.5
A denial-of-service issue was addressed with improved validation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43297
MEDIUM
CVSS 6.2
A type confusion issue was addressed with improved memory handling. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Memory Corruption
Apple
macOS
-
CVE-2025-43295
MEDIUM
CVSS 5.5
A denial-of-service issue was addressed with improved validation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Apple
-
CVE-2025-43293
MEDIUM
CVSS 5.5
The issue was addressed with improved input validation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43292
MEDIUM
CVSS 5.5
A race condition was addressed with improved state handling. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
Race Condition
-
CVE-2025-43291
MEDIUM
CVSS 5.5
A permissions issue was addressed by removing the vulnerable code. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43285
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43279
MEDIUM
CVSS 6.2
A privacy issue was addressed with improved private data redaction for log entries. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
macOS
-
CVE-2025-43272
MEDIUM
CVSS 6.5
The issue was addressed with improved memory handling. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Apple
Red Hat
Suse
-
CVE-2025-43262
MEDIUM
CVSS 5.1
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
macOS
-
CVE-2025-43231
MEDIUM
CVSS 5.5
A logic issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Information Disclosure
Apple
macOS
-
CVE-2025-43208
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43207
MEDIUM
CVSS 5.5
This issue was addressed with improved entitlements. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Information Disclosure
Apple
macOS
-
CVE-2025-43203
MEDIUM
CVSS 4.0
The issue was addressed with improved handling of caches. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43190
MEDIUM
CVSS 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Path Traversal
Apple
-
CVE-2025-41713
MEDIUM
CVSS 6.5
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-39801
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
Samsung
-
CVE-2025-39800
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
-
CVE-2025-36082
MEDIUM
CVSS 4.0
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
IBM
Openpages
-
CVE-2025-31270
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-31269
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-31268
MEDIUM
CVSS 5.5
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-31254
MEDIUM
CVSS 5.4
This issue was addressed with improved URL validation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
iOS
Ipados
Iphone Os
-
CVE-2025-30468
MEDIUM
CVSS 6.5
This issue was addressed through improved state management. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
iOS
Ipados
Iphone Os
-
CVE-2025-24197
MEDIUM
CVSS 5.5
A logic issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-10482
MEDIUM
CVSS 5.5
A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10479
MEDIUM
CVSS 5.5
A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10475
MEDIUM
CVSS 5.4
A weakness has been identified in SpyShelter up to 15.4.0.1015. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Denial Of Service
-
CVE-2025-10472
MEDIUM
CVSS 5.5
A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path Traversal
Moneyprinterturbo
-
CVE-2025-10459
MEDIUM
CVSS 5.5
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10453
MEDIUM
CVSS 6.9
O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SSRF
-
CVE-2025-10448
MEDIUM
CVSS 5.5
A flaw has been found in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10447
MEDIUM
CVSS 5.5
A vulnerability was detected in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10446
MEDIUM
CVSS 5.5
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10445
MEDIUM
CVSS 5.5
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10444
MEDIUM
CVSS 5.5
A security flaw has been discovered in Campcodes Online Job Finder System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10436
MEDIUM
CVSS 5.5
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10435
MEDIUM
CVSS 5.5
A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10426
MEDIUM
CVSS 5.5
A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10425
MEDIUM
CVSS 5.5
A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10424
MEDIUM
CVSS 5.5
A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10417
MEDIUM
CVSS 5.5
A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10416
MEDIUM
CVSS 5.5
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-9078
MEDIUM
CVSS 4.3
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass
Mattermost Server
Suse
-
CVE-2025-9076
MEDIUM
CVSS 6.5
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass
Mattermost Server
Suse
-
CVE-2025-8396
MEDIUM
CVSS 6.9
Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.26.3, 1.27.3, and 1.28.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Suse
-
CVE-2025-6999
MEDIUM
CVSS 6.9
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
Request Smuggling
-
CVE-2025-6947
MEDIUM
CVSS 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-59399
LOW
CVSS 3.1
libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
Denial Of Service
-
CVE-2025-59398
LOW
CVSS 3.1
The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255> object is created with StringTooLarge. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
Denial Of Service
-
CVE-2025-59377
LOW
CVSS 3.7
feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Kubernetes
Command Injection
Mcp Kubernetes Server
-
CVE-2025-59376
LOW
CVSS 3.7
feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod". Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Kubernetes
Command Injection
Mcp Kubernetes Server
-
CVE-2025-55777
None
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Information Disclosure
-
CVE-2025-43798
LOW
CVSS 2.1
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Information Disclosure
Digital Experience Platform
-
CVE-2025-43792
LOW
CVSS 2.3
Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35,. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Information Disclosure
Digital Experience Platform
Liferay Portal
-
CVE-2025-43357
LOW
CVSS 3.3
This issue was addressed with improved redaction of sensitive information. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43349
LOW
CVSS 2.8
An out-of-bounds write issue was addressed with improved input validation. Rated low severity (CVSS 2.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Memory Corruption
Apple
-
CVE-2025-43344
LOW
CVSS 3.3
An out-of-bounds access issue was addressed with improved bounds checking. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Apple
-
CVE-2025-43328
LOW
CVSS 3.3
A permissions issue was addressed with additional restrictions. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
macOS
-
CVE-2025-43301
LOW
CVSS 3.3
A privacy issue was addressed with improved private data redaction for log entries. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Apple
-
CVE-2025-43294
LOW
CVSS 3.3
An issue existed in the handling of environment variables. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Authentication Bypass
Apple
-
CVE-2025-43283
LOW
CVSS 3.3
An out-of-bounds read was addressed with improved bounds checking. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Apple
macOS
-
CVE-2025-24133
None
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
Information Disclosure
-
CVE-2025-10485
LOW
CVSS 2.1
A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-10483
LOW
CVSS 2.1
A flaw has been found in SourceCodester Online Student File Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10481
LOW
CVSS 2.1
A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10480
LOW
CVSS 2.1
A weakness has been identified in SourceCodester Online Student File Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10477
LOW
CVSS 2.1
A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP
SQLi
-
CVE-2025-10473
LOW
CVSS 2.1
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Java
SQLi
-
CVE-2025-10471
LOW
CVSS 2.1
A vulnerability was detected in ZKEACMS 4.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SSRF
-
CVE-2025-10442
LOW
CVSS 2.1
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command Injection
Tenda
-
CVE-2025-10441
LOW
CVSS 2.1
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command Injection
D-Link
-
CVE-2025-10440
LOW
CVSS 2.1
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command Injection
D-Link
-
CVE-2025-10434
LOW
CVSS 1.9
A vulnerability was identified in IbuyuCMS up to 2.6.3. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP
XSS
-
CVE-2025-10433
LOW
CVSS 2.1
A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization
-
CVE-2025-10431
LOW
CVSS 2.1
A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10430
LOW
CVSS 2.1
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10429
LOW
CVSS 2.1
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10428
LOW
CVSS 2.1
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10427
LOW
CVSS 2.1
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Authentication Bypass
File Upload
-
CVE-2025-10423
LOW
CVSS 2.9
A vulnerability was found in newbee-mall 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Authentication Bypass
-
CVE-2025-10422
LOW
CVSS 2.1
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
-
CVE-2025-10421
LOW
CVSS 2.1
A flaw has been found in SourceCodester Student Grading System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10420
LOW
CVSS 2.1
A vulnerability was detected in SourceCodester Student Grading System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10419
LOW
CVSS 2.1
A security vulnerability has been detected in SourceCodester Student Grading System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-10418
LOW
CVSS 2.1
A weakness has been identified in SourceCodester Student Grading System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
SQLi
-
CVE-2025-9084
LOW
CVSS 3.1
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Open Redirect
Mattermost Server