CVE-2025-10005 | Medium | 4.3 | 2026-08-16 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2025-7639 | | | 2026-08-14 | The vulnerability, if exploited, could allow an authenticated miscreant
with "DNA Authority - Operator" privilege to tamper with serialized
data, potentially… |
CVE-2025-71405 | | | 2026-08-14 | chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect UR… |
CVE-2025-10308 | Medium | 4.3 | 2026-08-14 | The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing n… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2025-62315 | Low | 3.4 | 2026-08-13 | HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be a… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2025-52640 | Medium | 4.7 | 2026-08-13 | HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes shar… |
CVE-2025-9486 | Low | 3.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2025-59324 | Critical | 9.1 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity c… |
CVE-2025-59323 | High | 8.4 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing… |
CVE-2025-59322 | High | 7.5 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext. |
CVE-2025-59321 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to b… |
CVE-2025-59320 | Medium | 4.6 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker wit… |
CVE-2025-59319 | High | 7.2 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matc… |
CVE-2025-59327 | High | 7.5 | 2026-08-12 | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro… |
CVE-2025-59326 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be… |
CVE-2025-59325 | | | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2025-41770 | High | 7.5 | 2026-08-12 | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via th… |
CVE-2025-41769 | Critical | 9.8 | 2026-08-12 | The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could… |
CVE-2025-15687 | Medium | 4.3 | 2026-08-12 | A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handl… |
CVE-2025-15686 | Medium | 4.3 | 2026-08-12 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation o… |
CVE-2025-15685 | Medium | 6.3 | 2026-08-12 | A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation cause… |
CVE-2025-15684 | Medium | 5.3 | 2026-08-12 | A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler… |
CVE-2025-54512 | | | 2026-08-11 | A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulti… |
CVE-2025-0046 | | | 2026-08-11 | Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution. |
CVE-2025-8087 | | | 2026-08-11 | A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, pote… |
CVE-2025-61970 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resu… |
CVE-2025-48506 | | | 2026-08-11 | Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulti… |
CVE-2025-48505 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentia… |
CVE-2025-35987 | | | 2026-08-11 | Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a deni… |
CVE-2025-35973 | | | 2026-08-11 | Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized a… |
CVE-2025-31938 | | | 2026-08-11 | Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclos… |
CVE-2025-31936 | | | 2026-08-11 | Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation… |
CVE-2025-31356 | | | 2026-08-11 | Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disc… |
CVE-2025-0041 | | | 2026-08-11 | Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrar… |
CVE-2025-31114 | | | 2026-08-11 | Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval w… |
CVE-2025-30241 | | | 2026-08-10 | Certain web
interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before
passing it to system-level… |
CVE-2025-30240 | | | 2026-08-10 | The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage
devices. By placing a crafted symbolic link on supp… |
CVE-2025-30239 | | | 2026-08-10 | In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker… |
CVE-2025-30238 | | | 2026-08-10 | In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
… |
CVE-2025-30237 | | | 2026-08-10 | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication
checks are not consistently enforced on certain endpoin… |
CVE-2025-32736 | | | 2026-08-10 | Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actio… |
CVE-2025-15683 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can inv… |
CVE-2025-15682 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT… |
CVE-2025-15681 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated… |
CVE-2025-15680 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect… |
CVE-2025-13294 | | | 2026-08-10 | An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controll… |
CVE-2025-13293 | | | 2026-08-10 | A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the d… |
CVE-2025-71413 | Medium | 5.3 | 2026-08-07 | Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload a… |
CVE-2025-71412 | High | 7.1 | 2026-08-07 | Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flig… |
CVE-2025-71411 | Medium | 5.3 | 2026-08-07 | Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack… |
CVE-2025-71410 | Medium | 5.3 | 2026-08-07 | Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requ… |
CVE-2025-71409 | High | 7.1 | 2026-08-07 | Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading cle… |
CVE-2025-63235 | High | 7.5 | 2026-08-07 | In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid… |
CVE-2025-6508 | Medium | 4.3 | 2026-08-06 | The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API d… |
CVE-2025-15674 | Low | 2.7 | 2026-08-06 | The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected con… |
CVE-2025-14561 | Critical | 9.0 | 2026-08-06 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil… |
CVE-2025-12317 | Medium | 5.0 | 2026-08-06 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with… |
CVE-2025-49506 | High | 7.5 | 2026-08-06 | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaki… |
CVE-2025-9266 | Medium | 4.3 | 2026-08-06 | The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in al… |
CVE-2025-15028 | High | 7.2 | 2026-08-06 | The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |
CVE-2025-14779 | Low | 3.8 | 2026-08-06 | The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails… |
CVE-2025-13909 | Medium | 4.3 | 2026-08-06 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-fact… |
CVE-2025-13736 | Low | 3.7 | 2026-08-06 | When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and… |
CVE-2025-13394 | Medium | 5.4 | 2026-08-06 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2025-11850 | Medium | 4.3 | 2026-08-06 | When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user… |
CVE-2025-15678 | Medium | 6.1 | 2026-08-06 | The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by defau… |
CVE-2025-63823 | Critical | 9.8 | 2026-08-05 | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and… |
CVE-2025-63822 | High | 8.1 | 2026-08-05 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass a… |
CVE-2025-70962 | High | 7.5 | 2026-08-05 | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. A… |
CVE-2025-15677 | Low | 3.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing hi… |
CVE-2025-29296 | Critical | 9.8 | 2026-08-04 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A
cryptographic weakness exists in affected Omada devices where site credentials
are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race
condition exists in the cloud-based Omada device adoption process when an
attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic
weakness exists in the Omada adoption protocol where session encryption keys
used to protect communications between controllers and managed dev… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected
Omada devices rely on embedded certificates that are shared across deployments
to establish trust between controllers and managed devices.
An… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic
weakness exists in the Omada adoption protocol.
The protocol relies on hard-coded cryptographic keys to establish trust and
protect authentica… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic
weakness exists in the Omada device adoption process. During adoption, authentication credentials associated
with site management are transmit… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A
certification validation weakness exists in communication between affected
Omada devices and cloud controllers. Certificate identity verification does not
ad… |
CVE-2025-15673 | Medium | 4.9 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowin… |
CVE-2025-15672 | High | 8.1 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2025-71400 | High | 7.1 | 2026-08-02 | better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated… |
CVE-2025-71399 | High | 8.6 | 2026-08-02 | Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path… |
CVE-2025-15675 | Medium | 4.8 | 2026-08-02 | The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, a… |
CVE-2025-71404 | | | 2026-08-01 | better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value o… |
CVE-2025-71403 | High | 7.1 | 2026-08-01 | better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers ca… |
CVE-2025-71402 | | | 2026-08-01 | better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-se… |
CVE-2025-14073 | Medium | 5.3 | 2026-08-01 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2025-69948 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. |
CVE-2025-69946 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and wa… |
CVE-2025-62347 | Medium | 4.3 | 2026-07-31 | HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was… |
CVE-2025-67651 | | | 2026-07-31 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attribut… |
CVE-2025-67650 | | | 2026-07-31 | An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated… |