Browse All CVEs
50,473 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-60361 |
low | 3.3 | 0.0017 | 2026-11-05 | radare2 v5.9.8 and before contains a memory leak in the function bochs_open. | |
CVE-2025-60360 |
medium | 5.5 | 0.0017 | 2026-11-05 | radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init. | |
CVE-2025-60359 |
medium | 5.5 | 0.0017 | 2026-11-05 | radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new. | |
CVE-2025-61554 |
medium | 5.5 | 0.0016 | 2026-11-05 | A divide-by-zero in VirtIO network device emulation in BitVisor from commit 108df6 (2020-0 | |
CVE-2025-60358 |
medium | 5.5 | 0.0016 | 2026-11-05 | radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations. | |
CVE-2025-61553 |
high | 8.2 | 0.0021 | 2026-11-05 | An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 ( | |
CVE-2025-61514 |
medium | 6.5 | 0.0041 | 2026-11-05 | An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allow | |
CVE-2025-60855 |
medium | 5.1 | 0.0013 | 2026-11-05 | Reolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware u | |
CVE-2025-61330 |
medium | 6.5 | 0.0028 | 2026-11-05 | A hard-coded weak password vulnerability has been discovered in all Magic-branded devices | |
CVE-2025-60641 |
medium | 6.5 | 0.0042 | 2026-11-05 | The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unseriali | |
CVE-2025-60639 |
medium | 6.5 | 0.0033 | 2026-11-05 | Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26). | |
CVE-2025-56700 |
medium | 5.4 | 0.0026 | 2026-11-05 | Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Cent | |
CVE-2025-56699 |
medium | 5.4 | 0.0029 | 2026-11-05 | SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centra | |
CVE-2025-61543 |
high | 7.1 | 0.0031 | 2026-11-05 | A Host Header Injection vulnerability exists in the password reset functionality of CraftM | |
CVE-2025-61541 |
high | 7.1 | 0.0046 | 2026-11-05 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality | |
CVE-2025-61540 |
medium | 6.5 | 0.0029 | 2026-11-05 | SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpass | |
CVE-2025-61539 |
medium | 6.1 | 0.0027 | 2026-11-05 | Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parame | |
CVE-2025-61536 |
high | 8.2 | 0.0043 | 2026-11-05 | FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the u | |
CVE-2025-22381 |
high | 8.2 | 0.0065 | 2026-11-05 | 1 PoC | Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality |
CVE-2025-56749 |
critical | 9.4 | 0.0047 | 2026-11-05 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for | |
CVE-2025-56748 |
medium | 6.4 | 0.0022 | 2026-11-05 | Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens b | |
CVE-2025-56746 |
low | 2.2 | 0.0017 | 2026-11-05 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon suc | |
CVE-2025-60540 |
medium | 6.5 | 0.0036 | 2026-11-05 | karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF). | |
CVE-2025-60374 |
medium | 6.1 | 0.0034 | 2026-11-05 | 1 PoC | Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to i |
CVE-2025-60537 |
medium | 6.5 | 0.0046 | 2026-11-05 | Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafk | |
CVE-2025-60536 |
high | 7.5 | 0.0063 | 2026-11-05 | An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attack | |
CVE-2025-57618 |
high | 7.3 | 0.0072 | 2026-11-05 | A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to | |
CVE-2025-57563 |
medium | 6.5 | 0.0043 | 2026-11-05 | A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows un | |
CVE-2025-60535 |
high | 7.3 | 0.0015 | 2026-11-05 | A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallo | |
CVE-2025-54603 |
critical | 9.0 | 0.0076 | 2026-11-05 | An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can res | |
CVE-2025-56747 |
medium | 6.5 | 0.0029 | 2026-11-05 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerab | |
CVE-2025-55903 |
high | 8.3 | 0.0034 | 2026-11-05 | 1 PoC | A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanit |
CVE-2025-61505 |
medium | 6.5 | 0.0036 | 2026-11-05 | 1 PoC | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script |
CVE-2025-60880 |
high | 8.3 | 0.0041 | 2026-11-05 | 1 PoC | An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's produc |
CVE-2025-60838 |
medium | 6.5 | 0.0026 | 2026-11-05 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrar | |
CVE-2025-60268 |
medium | 6.5 | 0.0036 | 2026-11-05 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the l | |
CVE-2025-60308 |
medium | 4.1 | 0.0025 | 2026-11-05 | code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) | |
CVE-2025-60306 |
critical | 9.9 | 0.0040 | 2026-11-05 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privile | |
CVE-2025-60269 |
critical | 9.4 | 0.0033 | 2026-11-05 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the sr | |
CVE-2025-60307 |
critical | 9.8 | 0.0043 | 2026-11-05 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where ente | |
CVE-2025-60305 |
high | 8.8 | 0.0042 | 2026-11-05 | SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Contr | |
CVE-2025-60869 |
high | 7.3 | 0.0028 | 2026-11-05 | Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsaniti | |
CVE-2025-60378 |
high | 8.1 | 0.0110 | 2026-11-05 | 1 PoC | Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to |
CVE-2025-61319 |
medium | 6.1 | 0.0029 | 2026-11-05 | 1 PoC | ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in t |
CVE-2025-61152 |
medium | 6.5 | 0.0032 | 2026-11-05 | python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted withou | |
CVE-2025-60868 |
medium | 6.5 | 0.0023 | 2026-11-05 | The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string paramet | |
CVE-2025-60375 |
high | 7.3 | 0.0028 | 2026-11-05 | 2 PoC | The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login c |
CVE-2025-60316 |
critical | 9.4 | 0.0038 | 2026-11-05 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admi | |
CVE-2025-60267 |
medium | 6.5 | 0.0026 | 2026-11-05 | In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice | |
CVE-2025-60304 |
medium | 6.1 | 0.0023 | 2026-11-05 | code-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via |