İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2025: sömürülen ve yeni ciddi CVE kayıtları

217 kayıt · 23 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 3

  • CVE-2025-13796
    8İzleyin

    deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    deco-cx · apps1 Ara 2025

  • CVE-2025-8045
    16İzleyin

    Mali GPU Kernel Driver allows improper GPU processing operations

    OrtaCVSS 4,0Kavram kanıtıEPSS %0

    arm · 5th gen gpu architecture kernel driver1 Ara 2025

  • CVE-2025-3500
    39İzleyin

    Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    avast · antivirus1 Ara 2025

  • CVE-2025-57489
    32İzleyin

    Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to t

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    shirt-pocket · superduper\!1 Ara 2025

  • CVE-2025-61228
    31İzleyin

    An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    shirt-pocket · superduper\!1 Ara 2025

  • CVE-2025-61229
    31İzleyin

    An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    shirt-pocket · superduper\!1 Ara 2025

  • CVE-2025-51683
    40Planlayın

    A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    mjobtime · mjobtime1 Ara 2025

  • CVE-2025-55749
    34İzleyin

    The XWiki Jetty package (XJetty) allows accessing any application file through URL

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    xwiki · xwiki1 Ara 2025

  • CVE-2025-66294
    40Planlayın

    Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

    YüksekCVSS 8,7SilahlaştırılmışEPSS %2

    getgrav · grav1 Ara 2025

  • CVE-2025-66301
    40Planlayın

    Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

    YüksekCVSS 8,6SilahlaştırılmışEPSS %1

    getgrav · grav1 Ara 2025

  • CVE-2025-58044
    22İzleyin

    JumpServer has an Open Redirect Vulnerability

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    fit2cloud · jumpserver1 Ara 2025

  • CVE-2025-65858
    14İzleyin

    A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'

    DüşükCVSS 3,5Kavram kanıtıEPSS %0

    janeczku · calibre-web2 Ara 2025

  • CVE-2025-60854
    39İzleyin

    A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    dlink · r15 firmware2 Ara 2025

  • CVE-2025-60736
    39İzleyin

    code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    anisha · online medicine guide2 Ara 2025

  • CVE-2025-66399
    32İzleyin

    SNMP Command Injection leads to RCE in Cacti

    YüksekCVSS 7,4İstismar yokEPSS %10

    cacti · cacti2 Ara 2025

  • CVE-2025-12585
    21İzleyin

    MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    mxchat · mxchat – ai chatbot & content generation for wordpress3 Ara 2025

  • CVE-2025-13486
    60Bu hafta

    Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

    KritikCVSS 9,8SilahlaştırılmışEPSS %67

    hwk-fr · advanced custom fields: extended3 Ara 2025

  • CVE-2025-12744
    35İzleyin

    Abrt: command-injection in abrt leading to local privilege escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 63 Ara 2025

  • CVE-2025-13947
    29İzleyin

    Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

    YüksekCVSS 7,4Kavram kanıtıEPSS %0

    the webkitgtk team · webkitgtk3 Ara 2025

  • CVE-2025-57199
    36İzleyin

    AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    avtech · dgm1104 firmware3 Ara 2025

  • CVE-2025-57201
    40Planlayın

    AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i

    YüksekCVSS 8,8İstismar yokEPSS %17

    avtech · dgm1104 firmware3 Ara 2025

  • CVE-2025-65320
    30İzleyin

    Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    abacre · restaurant point of sale3 Ara 2025

  • CVE-2024-32641
    43Planlayın

    Masa CMS Vulnerable to Pre-Auth RCE via JSON API

    KritikCVSS 9,8İstismar yokEPSS %12

    masacms · masacms3 Ara 2025

  • CVE-2025-20384
    21İzleyin

    Unauthenticated Log Injection in Splunk Enterprise

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    splunk · splunk3 Ara 2025

  • CVE-2025-13342
    40Planlayın

    Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    shabti · frontend admin by dynamiapps3 Ara 2025

  • CVE-2025-13390
    40Planlayın

    WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    wpdirectorykit · wp directory kit3 Ara 2025

  • CVE-2025-13401
    25İzleyin

    Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    optimizingmatters · autoptimize3 Ara 2025

  • CVE-2025-50360
    33İzleyin

    A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    dannyvankooten · pepper3 Ara 2025

  • CVE-2025-55182
    100Hemen

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    facebook · react3 Ara 2025

  • CVE-2025-50361
    20İzleyin

    Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    smallbasic · smallbasic3 Ara 2025

  • CVE-2025-65027
    30İzleyin

    RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    romm.app · romm3 Ara 2025

  • CVE-2025-65345
    26İzleyin

    alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    alexusmai · laravel file manager3 Ara 2025

  • CVE-2025-65346
    36İzleyin

    alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    alexusmai · laravel file manager4 Ara 2025

  • CVE-2025-61148
    26İzleyin

    An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    edupluscampus · edupluscampus4 Ara 2025

  • CVE-2025-66516
    66Bu hafta

    Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

    KritikCVSS 9,8SilahlaştırılmışEPSS %88

    apache · tika4 Ara 2025

  • CVE-2025-65637
    30İzleyin

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    turbopuffer · logrus4 Ara 2025

  • CVE-2025-63499
    24İzleyin

    Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    alinto · sogo4 Ara 2025

  • CVE-2025-1910
    25İzleyin

    WatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Package

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    watchguard · mobile vpn with ssl client4 Ara 2025

  • CVE-2025-65899
    21İzleyin

    Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    difuse · kalmia4 Ara 2025

  • CVE-2025-65900
    26İzleyin

    Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    difuse · kalmia4 Ara 2025

  • CVE-2025-65945
    30İzleyin

    auth0/node-jws improper HMAC signature verification vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    auth0 · node-jws4 Ara 2025

  • CVE-2025-12097
    34İzleyin

    Relative Path Traversal Vulnerability in NI System Web Server

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    ni · labview4 Ara 2025

  • CVE-2025-13543
    35İzleyin

    PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    rtowebsites · postgallery4 Ara 2025

  • CVE-2025-12163
    25İzleyin

    Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    omnipressteam · omnipress5 Ara 2025

  • CVE-2025-12189
    35İzleyin

    Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upl

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    breadbutter · bread & butter5 Ara 2025

  • CVE-2025-13528
    21İzleyin

    Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    nedwp · feedback modal for website5 Ara 2025

  • CVE-2025-58098
    33İzleyin

    Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

    YüksekCVSS 8,3Kavram kanıtıEPSS %1

    apache · http server5 Ara 2025

  • CVE-2025-66644
    70Bu hafta

    Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %3

    arraynetworks · arrayos ag5 Ara 2025

  • CVE-2025-14092
    13İzleyin

    Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection

    DüşükCVSS 2,0İstismar yokEPSS %16

    edimax · br-6478ac v3 firmware5 Ara 2025

  • CVE-2025-14093
    14İzleyin

    Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection

    DüşükCVSS 2,0İstismar yokEPSS %19

    edimax · br-6478ac v3 firmware5 Ara 2025

  • CVE-2025-14094
    14İzleyin

    Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection

    DüşükCVSS 2,0İstismar yokEPSS %20

    edimax · br-6478ac v3 firmware5 Ara 2025

  • CVE-2025-14106
    33İzleyin

    ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection

    YüksekCVSS 7,4İstismar yokEPSS %12

    zspace · q2c nas firmware5 Ara 2025

  • CVE-2025-14107
    33İzleyin

    ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection

    YüksekCVSS 7,4İstismar yokEPSS %12

    zspace · q2c nas firmware5 Ara 2025

  • CVE-2025-14108
    32İzleyin

    ZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injection

    YüksekCVSS 7,4İstismar yokEPSS %10

    zspace · q2c nas firmware5 Ara 2025

  • CVE-2025-34291
    95Hemen

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    KritikCVSS 9,4KEVSilahlaştırılmışEPSS %92

    langflow · langflow5 Ara 2025

  • CVE-2025-12673
    39İzleyin

    Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    ajitdas · flex qr code generator6 Ara 2025

  • CVE-2025-12720
    21İzleyin

    g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    garidium · g-ffl cockpit6 Ara 2025

  • CVE-2025-12721
    21İzleyin

    g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    garidium · g-ffl cockpit6 Ara 2025

  • CVE-2025-13065
    39İzleyin

    Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

    YüksekCVSS 8,8İstismar yokEPSS %13

    brainstormforce · starter templates – ai-powered templates for elementor & gutenberg6 Ara 2025

  • CVE-2025-40271
    31İzleyin

    fs/proc: fix uaf in proc_readdir_de()

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux6 Ara 2025

  • CVE-2025-14221
    8İzleyin

    SourceCodester Online Banking System page cross site scripting

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    oretnom23 · banking system8 Ara 2025

  • CVE-2025-48572
    61Bu hafta

    In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    google · android8 Ara 2025

  • CVE-2025-48633
    52Planlayın

    In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %0

    google · android8 Ara 2025

  • CVE-2025-65271
    35İzleyin

    Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the c

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    azuriom · azuriom8 Ara 2025

  • CVE-2025-65964
    37İzleyin

    n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    n8n · n8n9 Ara 2025

  • CVE-2025-66204
    25İzleyin

    WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    wbce · wbce cms9 Ara 2025

  • CVE-2025-66470
    24İzleyin

    NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    zauberzeug · nicegui9 Ara 2025

  • CVE-2025-59718
    89Hemen

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %68

    fortinet · fortiproxy9 Ara 2025

  • CVE-2025-59719
    48Planlayın

    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t

    KritikCVSS 9,8İstismar yokEPSS %29

    fortinet · fortiweb9 Ara 2025

  • CVE-2025-62221
    62Bu hafta

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 18099 Ara 2025

  • CVE-2025-62454
    32İzleyin

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    microsoft · windows 10 18099 Ara 2025

  • CVE-2025-65300
    21İzleyin

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    coohom · coohom9 Ara 2025

  • CVE-2025-65741
    39İzleyin

    Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    sublimetext · sublime text 39 Ara 2025

  • CVE-2025-10573
    34İzleyin

    Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript

    OrtaCVSS 6,1İstismar yokEPSS %33

    ivanti · endpoint manager9 Ara 2025

  • CVE-2025-14321
    39İzleyin

    Use-after-free in the WebRTC: Signaling component

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    mozilla · firefox9 Ara 2025

  • CVE-2025-14325
    29İzleyin

    JIT miscompilation in the JavaScript Engine: JIT component

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    mozilla · firefox9 Ara 2025

  • CVE-2025-67586
    18İzleyin

    WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    ronald huereca · highlight and share9 Ara 2025

  • CVE-2025-67588
    17İzleyin

    WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

    OrtaCVSS 4,3İstismar yokEPSS %0

    elementor · elementor website builder9 Ara 2025

  • CVE-2025-34401
    21İzleyin

    MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspx

    OrtaCVSS 5,3İstismar yokEPSS %0

    mailenable · mailenable9 Ara 2025

  • CVE-2025-53679
    32İzleyin

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    YüksekCVSS 7,2İstismar yokEPSS %12

    fortinet · fortisandbox9 Ara 2025

  • CVE-2025-53949
    40Planlayın

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    YüksekCVSS 8,8İstismar yokEPSS %17

    fortinet · fortisandbox9 Ara 2025

  • CVE-2025-54100
    32İzleyin

    PowerShell Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    microsoft · windows 10 16079 Ara 2025

  • CVE-2025-62470
    31İzleyin

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 16079 Ara 2025

  • CVE-2025-66039
    60Bu hafta

    FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

    KritikCVSS 9,3SilahlaştırılmışEPSS %3

    sangoma · freepbx9 Ara 2025

  • CVE-2025-61808
    39İzleyin

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    KritikCVSS 9,1İstismar yokEPSS %10

    adobe · coldfusion9 Ara 2025

  • CVE-2025-66645
    30İzleyin

    NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    zauberzeug · nicegui9 Ara 2025

  • CVE-2025-67494
    34İzleyin

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    zitadel · zitadel9 Ara 2025

  • CVE-2025-13339
    31İzleyin

    Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    hippooo · hippoo mobile app for woocommerce10 Ara 2025

  • CVE-2025-13184
    42Planlayın

    Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password

    KritikCVSS 9,8İstismar yokEPSS %11

    totolink · x5000r firmware10 Ara 2025

  • CVE-2025-8110
    90Hemen

    File overwrite in file update API in Gogs

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %85

    gogs · gogs10 Ara 2025

  • CVE-2025-65754
    24İzleyin

    Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    algernon project · algernon10 Ara 2025

  • CVE-2025-63895
    30İzleyin

    An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    jxlindia · jxl 9 inch car android double din player firmware10 Ara 2025

  • CVE-2025-34392
    47Planlayın

    Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

    KritikCVSS 10,0İstismar yokEPSS %24

    barracuda · rmm10 Ara 2025

  • CVE-2020-36884
    27İzleyin

    BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    brightsign, llc · brightsign digital signage diagnostic web server10 Ara 2025

  • CVE-2025-65950
    37İzleyin

    WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    wbce · wbce cms10 Ara 2025

  • CVE-2025-66472
    26İzleyin

    XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    xwiki · xwiki10 Ara 2025

  • CVE-2025-66628
    30İzleyin

    ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    imagemagick · imagemagick10 Ara 2025

  • CVE-2025-67511
    39İzleyin

    Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

    KritikCVSS 9,6Kavram kanıtıEPSS %2

    aliasrobotics · cybersecurity ai11 Ara 2025

  • CVE-2025-67644
    32İzleyin

    LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    langchain · langgraph-checkpoint-sqlite11 Ara 2025

  • CVE-2025-14528
    23İzleyin

    D-Link DIR-803 Configuration getcfg.php information disclosure

    OrtaCVSS 5,5Kavram kanıtıEPSS %3

    dlink · dir-803 firmware11 Ara 2025