Latest Security Vulnerabilities

Saturday December 13, 2025

 

Unclassified

CVE-2025-14542 OpenAI Manual Spec Manipulation Remote Code Execution Risk
CVE-2025-14288 Gallery Blocks with Lightbox 3.3.0 Unauthorized Settings Modification via AJAX
CVE-2025-12512 GenerateBlocks 2.1.2 Info Exposure via missing REST auth checks
CVE-2025-11970 Emplibot WP Plugin <=1.0.9 SSRF via webhook functions
CVE-2025-13094 WP3D Model Import Viewer v1.0.7 Plugin AFU via handle_import_file()
CVE-2025-14475 Extensive VC Addons LFI via shortcode_name <=1.9.1
CVE-2025-7058 Kingcabs WP Theme 1.1.9: Stored XSS via progressbarLayout (Contributor+)
CVE-2025-14508 MediaCommander <2.3.1: Unauth Folder Deletion via Missing Cap on import-csv API
CVE-2025-11707 WP Plugin Login Lockdown & Protection IP Block Bypass v2.14
And others...

Mycred

CVE-2025-12362 Missing Auth in myCred WP Plugin v<=2.9.7 Allows Withdrawal Abuse

Brizy Page Builder

CVE-2025-0969 Brizy Page Builder <2.7.16: Sensitive Info Exposure via get_users()

Ays Pro

CVE-2025-14454 WordPress Ays Image Slider: XSRF Bulk Delete (2.7.0)

Yithemes

CVE-2025-8617 Stored XSS in YITH WooCommerce Quick View <=2.7.0 via yith_quick_view shortcode

F1logic

CVE-2025-12077 WP to LinkedIn Auto Publish <=1.9.8 Reflected XSS via PostMessage
CVE-2025-12076 Reflected XSS in Social Media Auto Publish WP Plugin up to v3.6.5

Templateinvaders Ti Woocommerce Wishlist

CVE-2025-9207 TI WooWishlist Plugin WP: HTML Injection (<=2.10.0)

Themelooks

CVE-2025-8687 Enter Addons WP Stored XSS (2.2.7) via Countdown/Image Widgets

Livemesh

CVE-2025-8780 Livemesh SiteOrigin Widgets v3.9.1 Stored XSS via Hero/Price widgets

Offis Dcmtk

CVE-2025-14607 OFFIS DCMTK 3.6.9 Memory Corruption in dcmdata::DcmByteString

Webdevstudios

CVE-2025-14056 Custom Post Type UI WP <=1.18.1 XSS via 'label' import

A3rev

CVE-2025-9873 Stored XSS in a3 Lazy Load <=2.7.5 via unsanitized attributes

Rtcamp

CVE-2025-9218 Info Disclosure in rtMedia WP 4.7.x via Godam plugin

Extendthemes Colibri Page Builder

CVE-2025-11376 Colibri Page Builder <=1.0.335 XSS via colibri_loop shortcode

Villatheme

CVE-2025-14581 Authorization Bypass in HAPPY Helpdesk WP Plugin (1.0.9)

Totolink X5000r Firmware

CVE-2025-14586 Cmd Injection via snprintf in TOTOLINK X5000R 9.1.0 (exportOvpn)

Code Projects

CVE-2025-14620 SQLi in code-projects Student File Management System 1.0 /admin/login_query.php
CVE-2025-14590 Prison Management System 2.0 SQLi via keyname in /admin/search1.php
CVE-2025-14619 SQLi in Student File Management System 1.0 via login_query.php (stu_no)
CVE-2025-14589 Prison Management System 2.0 Remote SQLi via /admin/search.php

Ghozylab

CVE-2025-14446 Easy Notify Lite WP: Auth Data Mod via Missing Capability (1.1.37)

Itsourcecode

CVE-2025-14587 Itsourcecode OPM System 1.0 Remote SQLi via /pet1/available.php
CVE-2025-14588 SQLi in itsourcecode Student Management System 1.0 via /update_program.php

Friday December 12, 2025

Apple Ios And Ipados

CVE-2025-43437 Info Disclosure in Apple iOS 26.1/iPadOS 26.1 Allowing User Fingerprinting

Apple iOS

CVE-2025-43532 Memory Corruption via Bounds Check, macOS Sonoma 14.8.3 / Sequoia 15.7.3
CVE-2025-46287 macOS FaceTime Caller ID Spoof Before 14.8.3/15.7.3
CVE-2025-46276 macOS Info-Disclosure via Privacy Controls (Sonoma<14.8.3/Sequoia<15.7.3)
CVE-2025-43511 Use-After-Free Crash via Web Content in iOS+iPadOS (fixed in 18.7.2)
CVE-2025-43539 macOS File Processing Memory Corruption (Fixed 14.8.3/15.7.3)
CVE-2025-43530 Apple macOS Sonoma/Sequoia Sensitive Data Access CVE202543530
CVE-2025-46285 Apple macOS Integer Overflow Root Escalation Fixed in 14.8.3/15.7.3
CVE-2025-43512 macOS PrivEsc: Logic Issue Fixed in 14.8.3/15.7.3
CVE-2025-43538 macOS Sonoma 14.x log data redaction flaw exposes sensitive data
And others...

Apple macOS

CVE-2025-43494 Apple Mail Header Parsing DoS in iOS/macOS/watchOS (26.1)
CVE-2025-43482 Apple macOS DoS via Input Validation Bug in Sonoma 14.8.3/Sequoia 15.7.3
CVE-2025-43464 macOS Tahoe 26.1 DoS via WebKit Input Validation Flaw
CVE-2025-43404 macOS Tahoe 26.1 Sandbox Restriction Improper Access Vulnerability
CVE-2025-43516 macOS Voice Control session mgmt flaw (pre-14.8.3/15.7.3)
CVE-2025-43351 macOS Tahoe 26.1 Permissions Issue Allowing App Access to Protected Data
CVE-2025-43473 macOS Tahoe 26.1 State-Mgmt Flaw Allows Sensitive Data Access
CVE-2025-43497 macOS Sandbox Escape in Tahoe before 26.1 CVE-2025-43497
CVE-2025-43527 macOS Sequoia 15.7.3 root privilege escalation via permissions issue
And others...

Google Chrome

CVE-2025-14372 UAF in Chrome Password Manager <143.0.7499.110 sandbox escape
CVE-2025-14174 Out-of-Bounds in ANGLE, Google Chrome <143.0.7499.110, Mac
CVE-2025-14373 Chrome Android <143.0.7499.110 Domain Spoof via Toolbar (Chromium)

Linux Kernel

CVE-2025-40345 Linux Kernel USB Storage sddr55 OOB PBA Write Heap Corruption
 

Unclassified

CVE-2025-14542 OpenAI Manual Spec Manipulation Remote Code Execution Risk
CVE-2025-14288 Gallery Blocks with Lightbox 3.3.0 Unauthorized Settings Modification via AJAX
CVE-2025-12512 GenerateBlocks 2.1.2 Info Exposure via missing REST auth checks
CVE-2025-11970 Emplibot WP Plugin <=1.0.9 SSRF via webhook functions
CVE-2025-13094 WP3D Model Import Viewer v1.0.7 Plugin AFU via handle_import_file()
CVE-2025-14475 Extensive VC Addons LFI via shortcode_name <=1.9.1
CVE-2025-7058 Kingcabs WP Theme 1.1.9: Stored XSS via progressbarLayout (Contributor+)
CVE-2025-14508 MediaCommander <2.3.1: Unauth Folder Deletion via Missing Cap on import-csv API
CVE-2025-11707 WP Plugin Login Lockdown & Protection IP Block Bypass v2.14
And others...

Ami Aptio V

CVE-2025-58770 APTIOV BIOS: Local Permission Escalation via BIOS Vulnerability

Bannersky

CVE-2025-4970 WordPress BSK PDF Manager 3.7.1 Stored XSS via SVG Uploads

Wpusermanager

CVE-2025-13320 WP User Manager <=2.9.12 Arbitrary File Deletion via Avatar

Altera Quartus Prime Standard

CVE-2025-13665 DLL Planting Vulnerability in Windows System Console Utility

Plesk

CVE-2025-66430 Plesk 18.0 Incorrect Access Control CVE-2025-66430

Nextcloud Server

CVE-2025-64011 Nextcloud Server 30.0.0 IDOR via /core/preview fileId

Wpjobportal Wp Job Portal

CVE-2025-14467 WP Job Portal <=2.3.9 Stored XSS via Job Description

Radykal Fancy Product Designer

CVE-2025-12570 Stored XSS in Fancy Product Designer <=6.4.8 via SVG uploads (data-to-image.php)

Wpchill

CVE-2025-13891 WordPress Modula <=2.13.3 Path Traversal via modula_list_folders AJAX

Frappe Lms

CVE-2025-67730 Frappe LMS <2.42.0 Authenticated XSS via Description Fields (CVE-2025-67730)
CVE-2025-67734 Frappe LMS XSS via Company Website Field < 2.42.0

Ays Pro Secure Copy Content Protection Content Locking

CVE-2025-14442 WP Secure Copy Content Protection v4.9.2 CSV Sensitive Info Exposure

Typora

CVE-2024-14010 Typora 1.7.4 Cmd Injection via PDF Export 'run command' RCE

Cisa

CVE-2025-67634 CISA Supplier Response Web Tool XSS via JSON Import

Apache Streampark

CVE-2025-54981 Apache StreamPark <2.1.7: Weak AES-ECB Encryption Exposes JWT

Boldthemes

CVE-2025-14032 Bold Timeline Lite <=1.2.7 Stored XSS via title in shortcode

Groupsession

CVE-2025-61950 GroupSession Auth Bypass in Circular Notice Memo (5.3.3)

Premmerce

CVE-2025-13440 Missing Auth in Premmerce Wishlist <1.1.10 Allows Subscriber Deletes