2025 CVEs (page 53)
Page 53 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11157 | High | 7.8 | 2026-01-01 | A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast… |
CVE-2025-13820 | Medium | 5.3 | 2026-01-01 | The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to a… |
CVE-2025-69413 | Medium | 5.3 | 2026-01-01 | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. |
CVE-2025-69412 | Low | 3.4 | 2026-01-01 | KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing… |
CVE-2025-67711 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67710 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67709 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67708 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67707 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67706 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67705 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67704 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67703 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-69288 | Critical | 9.1 | 2025-12-31 | Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the dat… |
CVE-2025-69286 | Critical | 9.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API… |
CVE-2025-68700 | High | 8.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account)… |
CVE-2025-34469 | High | 7.5 | 2025-12-31 | Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default… |
CVE-2025-15398 | Low | 3.7 | 2025-12-31 | A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthControll… |
CVE-2025-53235 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Social easy-social-media allows Reflected… |
CVE-2025-66148 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-66146 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66145 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-66144 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-52739 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala… |
CVE-2025-50053 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobil… |
CVE-2025-47566 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSo… |
CVE-2025-31054 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8. |
CVE-2025-30628 | High | 8.5 | 2025-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder… |
CVE-2025-28973 | Medium | 6.5 | 2025-12-31 | Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Wa… |
CVE-2025-28949 | High | 8.5 | 2025-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allo… |
CVE-2025-23757 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proloy Chakroborty ZD Scribd iPaper zd-scribd-ipaper allo… |
CVE-2025-23719 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget zhina-twitter-widget allows Re… |
CVE-2025-23707 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse en-masse-wp allows Reflected XSS.This is… |
CVE-2025-23705 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-… |
CVE-2025-23667 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill custom-post-edit front-end-post-edi… |
CVE-2025-66153 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-66152 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-66151 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-66150 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects A… |
CVE-2025-66149 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-34468 | Critical | 9.8 | 2025-12-31 | libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostn… |
CVE-2025-34467 | Medium | 4.3 | 2025-12-31 | ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined… |
CVE-2025-15394 | Medium | 4.7 | 2025-12-31 | A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handle… |
CVE-2025-15393 | Medium | 6.3 | 2025-12-31 | A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/mo… |
CVE-2025-62989 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affe… |
CVE-2025-59135 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powe… |
CVE-2025-49355 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ikaes Accessibility Press ilogic-accessibility allows Sto… |
CVE-2025-49337 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows S… |
CVE-2025-23608 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XS… |
CVE-2025-15392 | Medium | 6.3 | 2025-12-31 | A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php o… |
CVE-2025-15391 | Medium | 6.3 | 2025-12-31 | A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation caus… |
CVE-2025-66160 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Select Graphist for Elementor Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configu… |
CVE-2025-66159 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66158 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66157 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66156 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66155 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-66154 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-63038 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured A… |
CVE-2025-63021 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based X… |
CVE-2025-62874 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-62123 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: fr… |
CVE-2025-62115 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-62113 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This i… |
CVE-2025-62101 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht… |
CVE-2025-62099 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Acc… |
CVE-2025-62088 | Medium | 5.4 | 2025-12-31 | Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side R… |
CVE-2025-62083 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs a… |
CVE-2025-62078 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configur… |
CVE-2025-59138 | Medium | 4.9 | 2025-12-31 | Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through <= 1.6… |
CVE-2025-49352 | Medium | 4.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows… |
CVE-2025-49340 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embed… |
CVE-2025-49339 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-64699 | High | 7.8 | 2025-12-31 | An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Sec… |
CVE-2025-63040 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: f… |
CVE-2025-63014 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia P… |
CVE-2025-63004 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Skynet Technologies USA LLC All in One Accessibility all-in-one-accessibility allows Exploiting Incorrectly Configured A… |
CVE-2025-62755 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-62751 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vire… |
CVE-2025-62747 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-62154 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant a… |
CVE-2025-62150 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-62148 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Eugen Bobrowski Robots.txt rewrite robotstxt-rewrite allows Cross Site Request Forgery.This issue affects Ro… |
CVE-2025-62143 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allow… |
CVE-2025-62133 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/… |
CVE-2025-62132 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-62131 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-62130 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in wpdiscover Accordion Slider Gallery accordion-slider-gallery allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-62129 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-62126 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-62122 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configure… |
CVE-2025-62116 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-62114 | Medium | 5.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows… |
CVE-2025-62092 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Wiremo Wiremo woo-reviews-by-wiremo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-62089 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pac… |
CVE-2025-62087 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-62084 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This is… |
CVE-2025-62080 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross… |
CVE-2025-62079 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Damian WP Export Categories & Taxonomies wp-export-categories-taxonomies allows Exploiting Incorrectly Configured Access… |
CVE-2025-61037 | High | 7.0 | 2025-12-31 | A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-Use (TOCTOU) race cond… |