93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,701–7,750 of 8,161 in High · page 155 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2025-12062 | CVE-2025-12062 CVSS 8.8 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all vers… |
| CVE-2025-12061 | CVE-2025-12061 CVSS 8.6 | The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import… |
| CVE-2025-1206 | CVE-2025-1206 CVSS 8.8 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/… |
| CVE-2025-12036 | CVE-2025-12036 CVSS 8.8google | Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML … |
| CVE-2025-12029 | CVE-2025-12029 CVSS 8.0 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, und… |
| CVE-2025-12028 | CVE-2025-12028 CVSS 8.8 | The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verifi… |
| CVE-2025-12008 | CVE-2025-12008 CVSS 8.8 | Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Media App allows Accessing Functionality N… |
| CVE-2025-12007 | CVE-2025-12007 CVSS 8.4 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a special… |
| CVE-2025-1200 | CVE-2025-1200 CVSS 8.8 | A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been declared as critical. This vulnerability affects unknown code of t… |
| CVE-2025-11989 | CVE-2025-11989 CVSS 8.1 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowe… |
| CVE-2025-11985 | CVE-2025-11985 CVSS 8.8 | The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability che… |
| CVE-2025-11959 | CVE-2025-11959 CVSS 8.1 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
| CVE-2025-11957 | CVE-2025-11957 CVSS 8.4devolutions | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or app… |
| CVE-2025-11956 | CVE-2025-11956 CVSS 8.9 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Info… |
| CVE-2025-11954 | CVE-2025-11954 CVSS 8.0 | Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery. This issue affect… |
| CVE-2025-11941 | CVE-2025-11941 CVSS 5.4e107 | A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the compone… |
| CVE-2025-11938 | CVE-2025-11938 CVSS 8.1 | A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of t… |
| CVE-2025-11931 | CVE-2025-11931 CVSS 8.2 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
| CVE-2025-1193 | CVE-2025-1193 CVSS 8.1 | Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker t… |
| CVE-2025-11923 | CVE-2025-11923 CVSS 8.8 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not prope… |
| CVE-2025-11920 | CVE-2025-11920 CVSS 8.8 | The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its… |
| CVE-2025-1192 | CVE-2025-1192 CVSS 8.8 | A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0. It has been classified as critical. Affected is an unknown function … |
| CVE-2025-11912 | CVE-2025-11912 CVSS 6.3streamax | A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This mani… |
| CVE-2025-11911 | CVE-2025-11911 CVSS 6.3streamax | A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. T… |
| CVE-2025-11910 | CVE-2025-11910 CVSS 6.3streamax | A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?A… |
| CVE-2025-1191 | CVE-2025-1191 CVSS 8.8 | A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0 and classified as critical. This issue affects some unknown processin… |
| CVE-2025-11909 | CVE-2025-11909 CVSS 6.3streamax | A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.… |
| CVE-2025-11908 | CVE-2025-11908 CVSS 6.3streamax | A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir… |
| CVE-2025-11905 | CVE-2025-11905 CVSS 6.3chancms | A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather… |
| CVE-2025-11899 | CVE-2025-11899 CVSS 8.1 | Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to… |
| CVE-2025-1189 | CVE-2025-1189 CVSS 8.8 | A vulnerability, which was classified as critical, was found in 1000 Projects Attendance Tracking Management System 1.0. This affects an unknown part of the fi… |
| CVE-2025-11853 | CVE-2025-11853 CVSS 8.1 | A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a m… |
| CVE-2025-1185 | CVE-2025-1185 CVSS 8.8 | A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor… |
| CVE-2025-1184 | CVE-2025-1184 CVSS 8.8 | A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax… |
| CVE-2025-11787 | CVE-2025-11787 CVSS 8.8circutor | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
| CVE-2025-11774 | CVE-2025-11774 CVSS 8.2 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referre… |
| CVE-2025-11756 | CVE-2025-11756 CVSS 8.8google | Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perf… |
| CVE-2025-11755 | CVE-2025-11755 CVSS 8.8 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing rec… |
| CVE-2025-11746 | CVE-2025-11746 CVSS 8.8 | The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() functi… |
| CVE-2025-11724 | CVE-2025-11724 CVSS 8.8 | The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. T… |
| CVE-2025-11720 | CVE-2025-11720 CVSS 8.1mozilla | The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted… |
| CVE-2025-1172 | CVE-2025-1172 CVSS 8.8 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
| CVE-2025-11715 | CVE-2025-11715 CVSS 8.8 | Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruptio… |
| CVE-2025-11714 | CVE-2025-11714 CVSS 8.8 | Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence… |
| CVE-2025-11713 | CVE-2025-11713 CVSS 8.1 | Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the app… |
| CVE-2025-11702 | CVE-2025-11702 CVSS 8.8 | GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an auth… |
| CVE-2025-11690 | CVE-2025-11690 CVSS 8.5 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other user… |
| CVE-2025-11669 | CVE-2025-11669 CVSS 8.1 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an … |
| CVE-2025-11667 | CVE-2025-11667 CVSS 6.3fabian | A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candi… |
| CVE-2025-1166 | CVE-2025-1166 CVSS 8.8 | A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |