CVE-2025-68xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

888 records · Page 5 of 9

• CVE-2025-68551: WordPress VPSUForm plugin <= 3.2.24 - Sensitive Data Exposure vulnerability 6.5 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through <= 3.2.24.

  Updated 2026-04-28
• CVE-2025-68550: WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows Blind SQL Injection.This issue affects WPBulky: from n/a through <= 1.1.13.

  Updated 2026-04-28
• CVE-2025-68549: WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Wiguard wiguard allows Upload a Web Shell to a Web Server.This issue affects Wiguard: from n/a through < 2.0.1.

  Updated 2026-04-28
• CVE-2025-68548: WordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Stored XSS.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.2.

  Updated 2026-04-28
• CVE-2025-68547: WordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerability 7.5 High

  Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Follow My Blog Post: from n/a through <= 2.4.0.

  Updated 2026-04-28
• CVE-2025-68546: WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

  Updated 2026-04-28
• CVE-2025-68545: WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

  Updated 2026-04-28
• CVE-2025-68544: WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

  Updated 2026-04-28
• CVE-2025-68543: WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

  Updated 2026-04-28
• CVE-2025-68542: WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-68541: WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.

  Updated 2026-04-28
• CVE-2025-68540: WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.

  Updated 2026-04-28
• CVE-2025-68539: WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.

  Updated 2026-04-28
• CVE-2025-68538: WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.

  Updated 2026-04-28
• CVE-2025-68537: WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.

  Updated 2026-04-28
• CVE-2025-68536: WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.

  Updated 2026-04-28
• CVE-2025-68535: WordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.

  Updated 2026-04-28
• CVE-2025-68534: WordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 6.3.0.

  Updated 2026-04-28
• CVE-2025-68533: WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0.

  Updated 2026-04-28
• CVE-2025-68532: WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

  Updated 2026-04-28
• CVE-2025-68531: WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injection.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

  Updated 2026-04-28
• CVE-2025-68530: WordPress Bookory theme <= 2.2.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Bookory bookory allows PHP Local File Inclusion.This issue affects Bookory: from n/a through <= 2.2.7.

  Updated 2026-04-28
• CVE-2025-68529: WordPress WP Email Capture plugin <= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.

  Updated 2026-04-28
• CVE-2025-68528: WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.9.

  Updated 2026-04-28
• CVE-2025-68527: WordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This issue affects Academy LMS: from n/a through <= 3.4.0.

  Updated 2026-04-28
• CVE-2025-68526: WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n/a through <= 1.6.1.

  Updated 2026-04-28
• CVE-2025-68525: WordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-68524: WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

  Updated 2026-06-17
• CVE-2025-68523: WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.

  Updated 2026-04-28
• CVE-2025-68522: WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

  Updated 2026-04-28
• CVE-2025-68521: WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

  Updated 2026-04-28
• CVE-2025-68520: WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.

  Updated 2026-04-28
• CVE-2025-68519: WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Blind SQL Injection.This issue affects Brands for WooCommerce: from n/a through <= 3.8.6.3.

  Updated 2026-04-28
• CVE-2025-68518: WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.

  Updated 2026-04-28
• CVE-2025-68517: WordPress Tablesome plugin <= 1.1.35.1 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.1.

  Updated 2026-04-28
• CVE-2025-68516: WordPress Tablesome plugin <= 1.1.35.1 - Sensitive Data Exposure vulnerability 5.0 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.

  Updated 2026-04-28
• CVE-2025-68515: WordPress WP Booking System plugin <= 2.0.19.12 - Sensitive Data Exposure vulnerability 5.8 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This issue affects WP Booking System: from n/a through <= 2.0.19.12.

  Updated 2026-04-29
• CVE-2025-68514: WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.

  Updated 2026-04-29
• CVE-2025-68513: WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2025-68512: WordPress Real 3D FlipBook plugin <= 4.11.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Stored XSS.This issue affects Real 3D FlipBook: from n/a through <= 4.11.4.

  Updated 2026-04-28
• CVE-2025-68511: WordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.3.1.

  Updated 2026-04-28
• CVE-2025-68510: WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.

  Updated 2026-04-28
• CVE-2025-68509: WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.

  Updated 2026-04-28
• CVE-2025-68508: WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through <= 0.8.3.

  Updated 2026-04-28
• CVE-2025-68507: WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.

  Updated 2026-04-28
• CVE-2025-68506: WordPress Docket Cache plugin <= 24.07.03 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.03.

  Updated 2026-04-28
• CVE-2025-68505: WordPress H5P plugin <= 1.16.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.

  Updated 2026-04-28
• CVE-2025-68504: WordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16.

  Updated 2026-04-28
• CVE-2025-68503: WordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7.

  Updated 2026-04-28
• CVE-2025-68502: WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.

  Updated 2026-04-28
• CVE-2025-68501: WordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.

  Updated 2026-04-28
• CVE-2025-68500: WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Side Request Forgery.This issue affects Prime Slider – Addons For Elementor: from n/a through <= 4.0.10.

  Updated 2026-04-28
• CVE-2025-68499: WordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.

  Updated 2026-04-28
• CVE-2025-68498: WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.

  Updated 2026-04-28
• CVE-2025-68497: WordPress Astra Widgets plugin <= 1.2.16 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.16.

  Updated 2026-04-28
• CVE-2025-68496: WordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

  Updated 2026-04-28
• CVE-2025-68495: WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.

  Updated 2026-04-28
• CVE-2025-68494: WordPress Premium Addons for Elementor plugin <= 4.11.53 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.

  Updated 2026-04-28
• CVE-2025-68493: Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component 8.1 High

  Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

  Updated 2026-09-14
• CVE-2025-68492: Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread owne 2.3 Low

  Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

  Updated 2026-01-15
• CVE-2025-68491: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68490: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68489: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68488: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68487: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68486: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68485: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68484: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68483: Not used Rejected

  Not used

  Updated 2025-12-19 · Rejected record
• CVE-2025-68482: A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 6.3 Medium

  A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow a re

  Updated 2026-03-10
• CVE-2025-68481: FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO 5.9 Medium

  FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only

  Updated 2025-12-19
• CVE-2025-68480: Marshmallow has DoS in Schema.load(many) 5.3 Medium

  Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.

  Updated 2025-12-22
• CVE-2025-68479: Discourse subscriptions are susceptible to takeover 7.1 High

  Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

  Updated 2026-01-29
• CVE-2025-68478: Langflow Vulnerable to External Control of File Name or Path 7.1 High

  Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as i

  Updated 2025-12-19
• CVE-2025-68477: Langflow vulnerable to Server-Side Request Forgery 7.7 High

  Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127[.]0

  Updated 2025-12-19
• CVE-2025-68476: KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential 8.2 High

  KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token spec

  Updated 2025-12-22
• CVE-2025-68475: Fedify has ReDoS Vulnerability in HTML Parsing Regex 7.5 High

  Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciou

  Updated 2025-12-22
• CVE-2025-68474: ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling 6.1 Medium

  ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written

  Updated 2025-12-29
• CVE-2025-68473: ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling 0.0 None

  ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible f

  Updated 2025-12-29
• CVE-2025-68472: MindsDB has improper sanitation of filepath that leads to information disclosure and DOS 8.1 High

  MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body i

  Updated 2026-02-20
• CVE-2025-68471: Avahi has a reachable assertion in lookup_start 6.5 Medium

  Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

  Updated 2026-01-12
• CVE-2025-68470: React Router has unexpected external redirect via untrusted paths 6.5 Medium

  React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This

  Updated 2026-01-12
• CVE-2025-68469: ImageMagick vulnerable to heap-buffer-overflow 2.0 Low

  ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.

  Updated 2025-12-18
• CVE-2025-68468: Avahi has a reachable assertion in lookup_multicast_callback 6.5 Medium

  Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.

  Updated 2026-01-12
• CVE-2025-68467: Dark Reader gives users the ability to request style sheets from local web servers 3.4 Low

  Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by analyzing the colors of web pages found in CSS style sheet files. In order to analyze cross-origin style sheets (stored on websites different from the original web page), Dark Reader requests such files via a background worker, ensuring the request is performe

  Updated 2026-03-10
• CVE-2025-68463: Bio.Entrez in Biopython through 186 allows doctype XXE. 4.9 Medium

  Bio.Entrez in Biopython through 186 allows doctype XXE.

  Updated 2026-05-08
• CVE-2025-68462: Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. 3.2 Low

  Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.

  Updated 2025-12-18
• CVE-2025-68461: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. 7.2 High

  Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

  Updated 2026-10-01
• CVE-2025-68460: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. 7.2 High

  Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

  Updated 2025-12-18
• CVE-2025-68459: RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed 8.6 High

  RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.

  Updated 2025-12-18
• CVE-2025-68458: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior 3.7 Low

  Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks a

  Updated 2026-02-06
• CVE-2025-68457: Orejime has executable code in HTML attributes 0.6 Low

  Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embedding `javascript:` code within data attributes. When consenting to the related purpose, Orejime would turn data attributes into unprefixed ones (i.e. `data-href` into `href`), thus executing the code. This shouldn't have any impact on most set

  Updated 2026-01-13
• CVE-2025-68456: Unauthenticated Craft CMS users can trigger a database backup 7.0 High

  Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the

  Updated 2026-01-06
• CVE-2025-68455: Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior 8.6 High

  Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

  Updated 2026-01-06
• CVE-2025-68454: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI 5.2 Medium

  Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternat

  Updated 2026-01-06
• CVE-2025-68438: Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated 7.5 High

  In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and

  Updated 2026-01-16
• CVE-2025-68437: Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation 5.0 Medium

  Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper

  Updated 2026-01-06
• CVE-2025-68436: Craft CMS vulnerable to potential information disclosure via unchecked asset relocation 4.9 Medium

  Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

  Updated 2026-01-06
• CVE-2025-68435: Zerobyte has Authentication Bypass by Primary Weakness 9.1 Critical

  Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix h

  Updated 2025-12-18
• CVE-2025-68434: opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation 8.8 High

  Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests

  Updated 2025-12-18

Search a CVE ID or check dependency files →