| CVE-2025-55182 |
|
03.12.2025 |
10 |
| CVE-2025-57199 |
|
03.12.2025 |
|
| CVE-2025-7044 |
Privilege Escalation in MAAS via Websocket Request Manipulation |
03.12.2025 |
7.7 |
| CVE-2025-57198 |
|
03.12.2025 |
|
| CVE-2025-57201 |
|
03.12.2025 |
|
| CVE-2025-57200 |
|
03.12.2025 |
|
| CVE-2025-65267 |
|
03.12.2025 |
|
| CVE-2025-53841 |
|
03.12.2025 |
7.8 |
| CVE-2025-13948 |
opsre go-ldap-admin JWT docker-compose.yaml hard-coded key |
03.12.2025 |
|
| CVE-2025-13949 |
ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload |
03.12.2025 |
|
| CVE-2025-13354 |
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation |
03.12.2025 |
4.3 |
| CVE-2025-13359 |
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection |
03.12.2025 |
6.5 |
| CVE-2025-13390 |
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover |
03.12.2025 |
10 |
| CVE-2025-13401 |
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting |
03.12.2025 |
6.4 |
| CVE-2025-13756 |
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management |
03.12.2025 |
4.3 |
| CVE-2025-12358 |
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation |
03.12.2025 |
4.3 |
| CVE-2025-12887 |
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update |
03.12.2025 |
5.4 |
| CVE-2025-13109 |
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query' |
03.12.2025 |
4.3 |
| CVE-2025-13342 |
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update |
03.12.2025 |
9.8 |
| CVE-2025-39665 |
Livestatus Injection in dynmaps |
03.12.2025 |
|
| CVE-2025-13947 |
Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop |
03.12.2025 |
|
| CVE-2025-13472 |
Missing authorization in BlazeMeter Jenkins Plugin |
03.12.2025 |
|
| CVE-2025-12744 |
Abrt: command-injection in abrt leading to local privilege escalation |
03.12.2025 |
|
| CVE-2025-29864 |
|
03.12.2025 |
|
| CVE-2025-13945 |
Improperly Controlled Sequential Memory Allocation in Wireshark |
03.12.2025 |
5.5 |
| CVE-2025-13946 |
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark |
03.12.2025 |
5.5 |
| CVE-2025-13486 |
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form |
03.12.2025 |
9.8 |
| CVE-2025-12954 |
Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR |
03.12.2025 |
|
| CVE-2025-10304 |
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure |
03.12.2025 |
5.3 |
| CVE-2025-12585 |
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure |
03.12.2025 |
5.3 |
| CVE-2025-13495 |
FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter |
03.12.2025 |
4.9 |
| CVE-2025-13448 |
CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute |
03.12.2025 |
6.4 |
| CVE-2025-13645 |
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion |
03.12.2025 |
7.2 |
| CVE-2025-13646 |
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition |
03.12.2025 |
7.5 |