Search
98,287 CVEs
CVEs (98,287, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 98,287 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2025-11257 | MEDIUM | 4.3 | 2025-10-24 | The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpo… | |
| CVE-2025-11504 | HIGH | 7.5 | 2025-10-24 | The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcrea… | |
| CVE-2025-11887 | MEDIUM | 4.3 | 2025-10-24 | The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, an… | |
| CVE-2025-11889 | HIGH | 7.2 | 2025-10-24 | The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in a… | |
| CVE-2025-11992 | MEDIUM | 6.1 | 2025-10-24 | The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incor… | |
| CVE-2025-12014 | MEDIUM | 4.3 | 2025-10-24 | The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-up… | |
| CVE-2025-12016 | MEDIUM | 4.4 | 2025-10-24 | The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and including, 1.0.0 … | |
| CVE-2025-12017 | MEDIUM | 6.1 | 2025-10-24 | The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due t… | |
| CVE-2025-12028 | HIGH | 8.8 | 2025-10-24 | The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the… | |
| CVE-2025-12072 | MEDIUM | 4.3 | 2025-10-24 | The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to … | |
| CVE-2025-12096 | MEDIUM | 6.4 | 2025-10-24 | The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up to, and includ… | |
| CVE-2025-10680 | HIGH | 8.8 | 2025-10-24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use | |
| CVE-2025-12134 | MEDIUM | 5.3 | 2025-10-24 | The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification o… | |
| CVE-2025-12136 | MEDIUM | 6.8 | 2025-10-24 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This i… | |
| CVE-2025-36361 | MEDIUM | Patched | 6.3 | 2025-10-24 | IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined … |
| CVE-2025-5350 | MEDIUM | 5.9 | 2025-10-24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature… | |
| CVE-2025-5605 | MEDIUM | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request U… | |
| CVE-2023-53733 | HIGH | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we … | |
| CVE-2025-10861 | HIGH | Patched | 7.5 | 2025-10-24 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in … |
| CVE-2025-40018 | HIGH | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() ma… | |
| CVE-2025-40019 | NONE | — | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start i… | |
| CVE-2025-11576 | MEDIUM | 4.3 | 2025-10-24 | The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5.… | |
| CVE-2025-40020 | NONE | — | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits… | |
| CVE-2025-40021 | NONE | — | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs … | |
| CVE-2025-40022 | NONE | — | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Dis… |