Latest Vulnerabilities

CVE ID : CVE-2025-13757 Published : Nov. 27, 2025, 4:15 p.m. | 27 minutes ago Description : SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13758 Published : Nov. 27, 2025, 4:15 p.m. | 27 minutes ago Description : Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13765 Published : Nov. 27, 2025, 4:15 p.m. | 27 minutes ago Description : Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-12419 Published : Nov. 27, 2025, 4:15 p.m. | 27 minutes ago Description : Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation or admin privileges to take over any user account via manipulation of authentication data during the OAuth completion flow Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-8890 Published : Nov. 27, 2025, 2:15 p.m. | 2 hours, 27 minutes ago Description : Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploit this vulnerability, an attacker has to log in to the router’s administrative portal, which by default is reachable only via LAN ports. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13692 Published : Nov. 27, 2025, 2:15 p.m. | 2 hours, 27 minutes ago Description : The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. A form with a file upload field must be created with the premium version of the plugin in order to exploit the vulnerability. However, once the form exists, the vulnerability is exploitable even if the premium version is deactivated and/or uninstalled. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-12140 Published : Nov. 27, 2025, 2:15 p.m. | 2 hours, 27 minutes ago Description : The application contains an insecure ‘redirectToUrl’ mechanism that incorrectly processes the value of the ‘redirectUrlParameter’ parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353 Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-12971 Published : Nov. 27, 2025, 1:15 p.m. | 3 hours, 27 minutes ago Description : The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the ‘wcp_change_post_folder’ function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-54057 Published : Nov. 27, 2025, 12:15 p.m. | 4 hours, 27 minutes ago Description : Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-59302 Published : Nov. 27, 2025, 12:15 p.m. | 4 hours, 27 minutes ago Description : In Apache CloudStack improper control of generation of code (‘Code Injection’) vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-59454 Published : Nov. 27, 2025, 12:15 p.m. | 4 hours, 27 minutes ago Description : In Apache CloudStack, a gap in access control checks affected the APIs – createNetworkACL – listNetworkACLs – listResourceDetails – listVirtualMachinesUsageHistory – listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-59890 Published : Nov. 27, 2025, 11:15 a.m. | 5 hours, 27 minutes ago Description : Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13742 Published : Nov. 27, 2025, 11:15 a.m. | 5 hours, 27 minutes ago Description : Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer’s name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing. Severity: 2.4 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-10476 Published : Nov. 27, 2025, 11:15 a.m. | 5 hours, 27 minutes ago Description : The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate several database fix actions. This only affects sites with premium activated. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-59026 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13381 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ‘ays_chatgpt_save_wp_media’ function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-30186 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-30190 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-59025 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-12584 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the ‘wqv_popup_content’ AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13378 Published : Nov. 27, 2025, 10:15 a.m. | 6 hours, 27 minutes ago Description : The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.0 via the ays_chatgpt_pinecone_upsert function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13536 Published : Nov. 27, 2025, 9:15 a.m. | 7 hours, 27 minutes ago Description : The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the ‘powerpress_edit_post’ function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13441 Published : Nov. 27, 2025, 7:15 a.m. | 9 hours, 27 minutes ago Description : The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This makes it possible for unauthenticated attackers to flush the site’s object cache via forged requests, potentially degrading site performance. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13157 Published : Nov. 27, 2025, 7:15 a.m. | 9 hours, 27 minutes ago Description : The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the ‘qode_wishlist_for_woocommerce_wishlist_table_item_callback’ function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update the public view of arbitrary wishlists. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-13525 Published : Nov. 27, 2025, 6:15 a.m. | 10 hours, 27 minutes ago Description : The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘order_by’ parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…