112 CVEs tracked today. 11 Critical, 21 High, 67 Medium, 11 Low.
-
CVE-2025-64328
HIGH
CVSS 8.6
FreePBX Endpoint Manager contains a post-authentication command injection via the testconnection/check_ssh_connect function, allowing authenticated users to execute OS commands.
Command Injection
Firestore
-
CVE-2025-63691
CRITICAL
CVSS 9.6
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass
Pig
-
CVE-2025-63690
CRITICAL
CVSS 9.1
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RCE
Java
Tomcat
Pig
-
CVE-2025-63689
CRITICAL
CVSS 10.0
Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQLi
RCE
Money Pos
-
CVE-2025-34299
CRITICAL
CVSS 9.3
Monsta FTP web-based file manager versions 2.11 and earlier allow unauthenticated arbitrary file uploads. The vulnerability enables attackers to upload malicious files from a compromised FTP server, which are then executed on the Monsta FTP server, achieving remote code execution.
File Upload
RCE
Monsta Ftp
-
CVE-2025-64180
CRITICAL
CVSS 10.0
Manager-io/Manager is accounting software. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-52425
CRITICAL
CVSS 9.5
An SQL injection vulnerability has been reported to affect QuMagie. Rated critical severity (CVSS 9.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQLi
Qumagie
-
CVE-2025-12352
CRITICAL
CVSS 9.8
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
File Upload
RCE
WordPress
PHP
-
CVE-2025-11546
CRITICAL
CVSS 9.3
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command Injection
-
CVE-2025-10870
CRITICAL
CVSS 9.3
SQL injection vulnerability in DIAL's CentrosNet v2.64. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQLi
PHP
-
CVE-2025-10230
CRITICAL
CVSS 10.0
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command Injection
Redhat
Suse
-
CVE-2025-3222
CRITICAL
CVSS 9.3
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.3.3 and prior versions for Linux, and 5.3.4. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Microsoft
Authentication Bypass
Windows
-
CVE-2025-64442
HIGH
CVSS 7.1
HumHub is an Open Source Enterprise Social Network. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
XSS
Humhub
-
CVE-2025-64439
HIGH
CVSS 7.4
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization
RCE
-
CVE-2025-64431
HIGH
CVSS 8.7
Zitadel is an open source identity management platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-64430
HIGH
CVSS 7.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Node.js
SSRF
File Upload
-
CVE-2025-64347
HIGH
CVSS 7.5
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2025-64343
HIGH
CVSS 7.8
(conda) Constructor is a tool that enables users to create installers for conda package collections. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2025-64339
HIGH
CVSS 7.2
ClipBucket v5 is an open source video sharing platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XSS
Clipbucket
-
CVE-2025-64336
HIGH
CVSS 7.2
ClipBucket v5 is an open source video sharing platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XSS
Clipbucket
-
CVE-2025-64184
HIGH
CVSS 8.8
Dosage is a comic strip downloader and archiver. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal
-
CVE-2025-63783
HIGH
CVSS 7.6
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Onlook
-
CVE-2025-60574
HIGH
CVSS 7.5
A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path Traversal
Tquadra Cms
-
CVE-2025-58464
HIGH
CVSS 7.8
A relative path traversal vulnerability has been reported to affect QuMagie. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal
Qumagie
-
CVE-2025-57698
HIGH
CVSS 7.5
AstrBot Project v3.5.22 contains a directory traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path Traversal
Astrbot
-
CVE-2025-54167
HIGH
CVSS 7.2
A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
-
CVE-2025-37736
HIGH
CVSS 8.8
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Elastic
Authentication Bypass
Privilege Escalation
Elastic Cloud Enterprise
-
CVE-2025-36186
HIGH
CVSS 7.4
IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Microsoft
Privilege Escalation
IBM
Db2
Windows
-
CVE-2025-10968
HIGH
CVSS 8.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQLi
-
CVE-2025-9458
HIGH
CVSS 7.8
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
RCE
Heap Overflow
Shared Components
-
CVE-2025-5483
HIGH
CVSS 8.1
The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1.2.10 to 1.3.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
WordPress
PHP
Authentication Bypass
Privilege Escalation
-
CVE-2025-4519
HIGH
CVSS 8.8
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
WordPress
Authentication Bypass
Privilege Escalation
Idonate
PHP
-
CVE-2025-64437
MEDIUM
CVSS 5.0
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code available.
Information Disclosure
Kubernetes
Kubevirt
Redhat
Suse
-
CVE-2025-64436
MEDIUM
CVSS 6.9
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Kubernetes
Privilege Escalation
Kubevirt
Redhat
Suse
-
CVE-2025-64435
MEDIUM
CVSS 5.3
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.
Information Disclosure
Kubernetes
Kubevirt
Redhat
Suse
-
CVE-2025-64434
MEDIUM
CVSS 4.7
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
Kubernetes
Authentication Bypass
Kubevirt
Redhat
Suse
-
CVE-2025-64433
MEDIUM
CVSS 6.5
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Path Traversal
Kubernetes
Kubevirt
Redhat
Suse
-
CVE-2025-64432
MEDIUM
CVSS 4.7
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
Kubernetes
Authentication Bypass
Kubevirt
Redhat
Suse
-
CVE-2025-64346
MEDIUM
CVSS 6.0
archives is a Go library for extracting archives (tar, zip, etc.). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal
-
CVE-2025-64338
MEDIUM
CVSS 5.1
ClipBucket v5 is an open source video sharing platform. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XSS
Clipbucket
-
CVE-2025-64329
MEDIUM
CVSS 6.9
containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
Information Disclosure
Containerd
Redhat
Suse
-
CVE-2025-64323
MEDIUM
CVSS 5.3
kgateway is a Cloud-Native API and AI Gateway. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
Authentication Bypass
-
CVE-2025-64187
MEDIUM
CVSS 4.6
OctoPrint provides a web interface for controlling consumer 3D printers. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity.
XSS
Octoprint
-
CVE-2025-63785
MEDIUM
CVSS 6.1
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Onlook
-
CVE-2025-63784
MEDIUM
CVSS 6.5
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Open Redirect
Onlook
-
CVE-2025-63718
MEDIUM
CVSS 6.5
A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
Patients Waiting Area Queue Management System
-
CVE-2025-63717
MEDIUM
CVSS 6.5
The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
CSRF
Pet Grooming Management Software
-
CVE-2025-63716
MEDIUM
CVSS 6.5
The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CSRF
Leads Manager Tool
-
CVE-2025-63714
MEDIUM
CVSS 6.1
Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Modern User Account Generator
-
CVE-2025-63713
MEDIUM
CVSS 6.1
Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Matching Type Test
-
CVE-2025-63687
MEDIUM
CVSS 6.5
An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Java
Authentication Bypass
Forest
-
CVE-2025-63686
MEDIUM
CVSS 6.5
There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document query function under the Download Center. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass
Personmanage
-
CVE-2025-63640
MEDIUM
CVSS 6.1
Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Upcoming Reminder", allowing an attacker. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Medicine Reminder App
-
CVE-2025-63639
MEDIUM
CVSS 6.1
The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Faq Bot With Ai Assistant
-
CVE-2025-63638
MEDIUM
CVSS 6.1
Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Ai Powered To Do List App
-
CVE-2025-63544
MEDIUM
CVSS 6.1
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Techstore
-
CVE-2025-63543
MEDIUM
CVSS 6.1
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Techstore
-
CVE-2025-63420
MEDIUM
CVSS 4.1
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Crushftp
-
CVE-2025-61261
MEDIUM
CVSS 5.4
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RCE
XSS
Angular
Ckeditor5
-
CVE-2025-57712
MEDIUM
CVSS 4.0
A path traversal vulnerability has been reported to affect Qsync Central. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal
Qsync Central
-
CVE-2025-57697
MEDIUM
CVSS 6.5
AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer Overflow
Information Disclosure
Astrbot
-
CVE-2025-53413
MEDIUM
CVSS 4.9
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
File Station
-
CVE-2025-53410
MEDIUM
CVSS 4.9
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
File Station
-
CVE-2025-53409
MEDIUM
CVSS 4.9
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
File Station
-
CVE-2025-52662
MEDIUM
CVSS 6.9
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
XSS
Devtools
-
CVE-2025-47207
MEDIUM
CVSS 5.3
A NULL pointer dereference vulnerability has been reported to affect several product versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Null Pointer Dereference
File Station
-
CVE-2025-46413
MEDIUM
CVSS 5.3
Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2025-36185
MEDIUM
CVSS 6.2
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Microsoft
Nosql Injection
IBM
Db2
-
CVE-2025-36136
MEDIUM
CVSS 5.1
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
Denial Of Service
Microsoft
IBM
Db2
Windows
-
CVE-2025-36135
MEDIUM
CVSS 5.4
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
IBM
Sterling B2b Integrator
Sterling File Gateway
-
CVE-2025-36131
MEDIUM
CVSS 4.6
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Microsoft
IBM
Db2
Windows
-
CVE-2025-36008
MEDIUM
CVSS 6.5
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Microsoft
IBM
Db2
Windows
-
CVE-2025-36006
MEDIUM
CVSS 6.5
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information Disclosure
Microsoft
IBM
Db2
Windows
-
CVE-2025-33012
MEDIUM
CVSS 6.3
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information Disclosure
IBM
Db2
-
CVE-2025-12902
MEDIUM
CVSS 4.4
Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked Storage Device or create a Denial of. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Denial Of Service
-
CVE-2025-12896
MEDIUM
CVSS 4.4
Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked storage device. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2025-12890
MEDIUM
CVSS 6.5
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
-
CVE-2025-12875
MEDIUM
CVSS 4.8
A weakness has been identified in mruby 3.4.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Buffer Overflow
Mruby
Suse
-
CVE-2025-12873
MEDIUM
CVSS 5.1
A security flaw has been discovered in Campcodes School File Management 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
School File Management System
-
CVE-2025-12862
MEDIUM
CVSS 5.3
A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
File Upload
PHP
Authentication Bypass
Online Notes Sharing Platform
-
CVE-2025-12861
MEDIUM
CVSS 5.1
A vulnerability was determined in DedeBIZ up to 6.3.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQLi
PHP
Dedebiz
-
CVE-2025-12860
MEDIUM
CVSS 5.1
A vulnerability was found in DedeBIZ up to 6.3.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQLi
PHP
Dedebiz
-
CVE-2025-12859
MEDIUM
CVSS 5.1
A vulnerability has been found in DedeBIZ up to 6.3.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQLi
PHP
Dedebiz
-
CVE-2025-12857
MEDIUM
CVSS 5.1
A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
Responsive Hotel Site
-
CVE-2025-12856
MEDIUM
CVSS 5.1
A weakness has been identified in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
Responsive Hotel Site
-
CVE-2025-12855
MEDIUM
CVSS 5.1
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
Responsive Hotel Site
-
CVE-2025-12854
MEDIUM
CVSS 6.3
A vulnerability was identified in newbee-mall-plus up to 2.4.1. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Authentication Bypass
-
CVE-2025-12853
MEDIUM
CVSS 5.1
A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQLi
PHP
Best House Rental Management System
-
CVE-2025-12829
MEDIUM
CVSS 6.9
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
-
CVE-2025-12789
MEDIUM
CVSS 6.1
A flaw was found in Red Hat Single Sign-On. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirect
Redhat
-
CVE-2025-12527
MEDIUM
CVSS 4.3
The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WordPress
Authentication Bypass
PHP
-
CVE-2025-12520
MEDIUM
CVSS 4.0
The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable. No vendor patch available.
WordPress
XSS
PHP
-
CVE-2025-12418
MEDIUM
CVSS 5.6
Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. Rated medium severity (CVSS 5.6), this vulnerability is low attack complexity. No vendor patch available.
Denial Of Service
-
CVE-2025-10966
MEDIUM
CVSS 4.3
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Information Disclosure
Curl
Redhat
Suse
-
CVE-2025-7719
MEDIUM
CVSS 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova Smallworld on Windows, Linux allows File Manipulation.3.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal
Microsoft
Windows
-
CVE-2025-7700
MEDIUM
CVSS 5.3
A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Null Pointer Dereference
Redhat
Suse
-
CVE-2025-4522
MEDIUM
CVSS 6.5
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
WordPress
Authentication Bypass
Idonate
PHP
-
CVE-2025-2534
MEDIUM
CVSS 5.3
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Denial Of Service
Microsoft
IBM
Db2
Windows
-
CVE-2024-47118
MEDIUM
CVSS 6.5
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stack Overflow
Buffer Overflow
IBM
Microsoft
Denial Of Service
-
CVE-2025-64481
LOW
CVSS 2.7
Datasette is an open source multi-tool for exploring and publishing data. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirect
-
CVE-2025-58469
LOW
CVSS 1.2
A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CSRF
Qulog Center
-
CVE-2025-58465
LOW
CVSS 2.2
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Download Station
-
CVE-2025-58463
LOW
CVSS 2.3
A relative path traversal vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal
Download Station
-
CVE-2025-57706
LOW
CVSS 2.2
A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
File Station
-
CVE-2025-54168
LOW
CVSS 2.2
A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XSS
Qulog Center
-
CVE-2025-53412
LOW
CVSS 0.6
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 0.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Null Pointer Dereference
File Station
-
CVE-2025-53411
LOW
CVSS 1.2
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
File Station
-
CVE-2025-53408
LOW
CVSS 1.3
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Null Pointer Dereference
File Station
-
CVE-2025-52865
LOW
CVSS 1.3
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial Of Service
Null Pointer Dereference
File Station
-
CVE-2025-48985
LOW
CVSS 3.7
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Authentication Bypass
Ai
-
CVE-2025-12863
None
Rejected reason: This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. No vendor patch available.
Information Disclosure
Gitlab
-
CVE-2025-12858
None
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Information Disclosure