Browse All CVEs
50,472 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-56154 |
medium | 6.1 | 0.0032 | 2026-11-05 | htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of | |
CVE-2025-61096 |
medium | 6.5 | 0.0026 | 2026-11-05 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping | |
CVE-2025-61087 |
medium | 6.1 | 0.0024 | 2026-11-05 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting | |
CVE-2025-60782 |
medium | 5.4 | 0.0023 | 2026-11-05 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site S | |
CVE-2025-57443 |
medium | 5.1 | 0.0014 | 2026-11-05 | FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environm | |
CVE-2025-56381 |
medium | 6.5 | 0.0031 | 2026-11-05 | 1 PoC | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the / |
CVE-2025-56380 |
medium | 6.5 | 0.0031 | 2026-11-05 | 1 PoC | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the |
CVE-2025-56379 |
medium | 5.4 | 0.0042 | 2026-11-05 | 1 PoC | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15. |
CVE-2025-57389 |
medium | 5.4 | 0.0019 | 2026-11-05 | 1 PoC | A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoin |
CVE-2025-61188 |
medium | 6.3 | 0.0026 | 2026-11-05 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This | |
CVE-2025-57444 |
medium | 6.1 | 0.0021 | 2026-11-05 | An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface | |
CVE-2025-56588 |
high | 8.8 | 0.0050 | 2026-11-05 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulner | |
CVE-2025-46205 |
high | 8.1 | 0.0040 | 2026-11-05 | A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0 | |
CVE-2025-60991 |
high | 8.8 | 0.0037 | 2026-11-05 | A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to | |
CVE-2025-57393 |
high | 8.8 | 0.0034 | 2026-11-05 | A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Version | |
CVE-2025-28357 |
high | 8.8 | 0.0044 | 2026-11-05 | A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to e | |
CVE-2025-56515 |
high | 8.8 | 0.0052 | 2026-11-05 | 1 PoC | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload funct |
CVE-2025-56514 |
medium | 5.4 | 0.0029 | 2026-11-05 | 1 PoC | Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes a |
CVE-2025-61045 |
critical | 9.8 | 0.0154 | 2026-11-05 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnera | |
CVE-2025-61044 |
critical | 9.8 | 0.0102 | 2026-11-05 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnera | |
CVE-2025-59687 |
medium | 4.3 | 0.0022 | 2026-11-05 | IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the use | |
CVE-2025-59686 |
medium | 6.5 | 0.0021 | 2026-11-05 | Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order | |
CVE-2025-59685 |
medium | 5.3 | 0.0032 | 2026-11-05 | Kazaar 1.25.12 allows a JWT with none in the alg field. | |
CVE-2025-59684 |
high | 8.8 | 0.0058 | 2026-11-05 | DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking. | |
CVE-2025-57275 |
medium | 5.5 | 0.0033 | 2026-11-05 | Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the N | |
CVE-2025-52042 |
high | 8.2 | 0.0033 | 2026-11-05 | In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/do | |
CVE-2025-52041 |
high | 8.2 | 0.0034 | 2026-11-05 | In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/s | |
CVE-2025-52040 |
high | 8.2 | 0.0033 | 2026-11-05 | In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/querie | |
CVE-2025-52039 |
high | 8.2 | 0.0034 | 2026-11-05 | In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpne | |
CVE-2025-57266 |
critical | 9.8 | 0.0037 | 2026-11-05 | An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5 | |
CVE-2025-56764 |
medium | 5.3 | 0.0026 | 2026-11-05 | 1 PoC | Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a userna |
CVE-2025-57424 |
high | 7.3 | 0.0028 | 2026-11-05 | A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application wi | |
CVE-2025-57483 |
high | 8.1 | 0.0029 | 2026-11-05 | 1 PoC | A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows a |
CVE-2025-57516 |
high | 8.2 | 0.0115 | 2026-11-05 | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.20 | |
CVE-2025-56449 |
high | 8.2 | 0.0038 | 2026-11-05 | A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. | |
CVE-2025-57428 |
medium | 6.5 | 0.0021 | 2026-11-05 | 1 PoC | Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.201 |
CVE-2025-57692 |
medium | 6.8 | 0.0033 | 2026-11-05 | PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archi | |
CVE-2025-58384 |
critical | 10.0 | 0.0072 | 2026-11-05 | In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remot | |
CVE-2025-56383 |
high | 8.4 | 0.0038 | 2026-11-05 | 2 PoC | Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL fil |
CVE-2025-55847 |
high | 8.8 | 0.0226 | 2026-11-05 | Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllS | |
CVE-2025-45994 |
high | 7.5 | 0.0040 | 2026-11-05 | An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in | |
CVE-2025-55848 |
high | 8.8 | 0.0041 | 2026-11-05 | An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the | |
CVE-2025-26258 |
medium | 6.1 | 0.0020 | 2026-11-05 | Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) | |
CVE-2025-59362 |
medium | 4.0 | 0.0039 | 2026-11-05 | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_ob | |
CVE-2025-58385 |
high | 7.1 | 0.0014 | 2026-11-05 | In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active | |
CVE-2025-56463 |
medium | 6.8 | 0.0020 | 2026-11-05 | Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private | |
CVE-2025-57292 |
medium | 6.1 | 0.0024 | 2026-11-05 | Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upl | |
CVE-2025-55187 |
critical | 9.9 | 0.0046 | 2026-11-05 | In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attacke | |
CVE-2025-56769 |
medium | 6.5 | 0.0034 | 2026-11-05 | An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute | |
CVE-2025-59408 |
high | 7.3 | 0.0025 | 2026-11-05 | Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boo |