Latest Security Vulnerabilities
Saturday November 22, 2025
Unclassified
CVE-2025-11186 WordPress Cookie Notice Plugin <=2.5.8 Stored XSS via cookies_accepted shortcodeCVE-2025-11456 ELEX WordPress HelpDesk ARFU v3.3.1
CVE-2025-11808 Stored XSS in WP Google Street View Plugin 'streetview' Shortcode v0.5.7
CVE-2025-10054 ELEX WP HelpDesk <=3.3.1: Unauthorized removal via elex_crm_remove_agent
CVE-2025-12935 FluentCRM WP Plugin Stored XSS via fluentcrm_content Shortcode <=2.9.84
CVE-2025-64310 BruteForce via Excessive Auth Attempts in EPSON WebConfig for SEIKO Projectors
CVE-2025-11802 WordPress Bulma Shortcodes v1.0 Stored XSS via type attr.
CVE-2025-12022 ELEX WP HelpDesk <=3.3.1 missing capability check lets Subscriber restore tickets
CVE-2025-12169 ELEX WP HelpDesk: AuthZ Bypass on wp_ajax_eh_crm_sched_empty (3.3.0)
And others...
Friday November 21, 2025
Linux Kernel
CVE-2025-40209 Linux Kernel Btrfs Mem Leak CVE-2025-40209CVE-2025-40211 Linux Kernel ACPI Video Use-After-Free in switch_brightness()
CVE-2025-40210 Linux Kernel NFSd op-count overflow via NFSv4 COMPOUND
Wolfssl
CVE-2025-11932 OpenSSL TLS1.3 PSK binder timing info leak (pre-3.2)CVE-2025-12889 OpenSSL TLS1.2: Client Can Use Weak Digest in CertificateRequest
CVE-2025-12888 ESP32 X25519 Timing Side-Channel Vulnerability
CVE-2025-11933 wolfSSL 5.8.2 TLS1.3 CKS Extension Duplicate DoS via Input Validation
CVE-2025-11936 wolfSSL 5.8.2 TLS1.3 KeyShare DDOS CVE-2025-11936
CVE-2025-11935 TLS 1.3 PSK PFS Bypass CVE202511935
CVE-2025-11934 wolfSSL <=5.8.2: Improper TLS1.3 CertVerify SigAlg Negotiation (Downgrade)
CVE-2025-11931 wolfSSL XChaCha20-Poly1305 Integer Underflow OOB
AMD
CVE-2025-29934 AMD SEVSNP stale TLB bug allows admin to run guestCVE-2025-62626 AMD CPU RDSEED Entropy Issue Enables Local Randomness Manipulation
Apple macOS
CVE-2025-31248 Directory Path Parsing CVE in macOS OS Fixed 13.7.3/15.5/14.7.3CVE-2025-43374 Apple OS Kernel OOB Read via Bounds Check - Fixed in iOS 18.5
CVE-2025-31266 Safari 18.5 Domain Name Spoofing in Popup Titles
Unclassified
CVE-2025-11186 WordPress Cookie Notice Plugin <=2.5.8 Stored XSS via cookies_accepted shortcodeCVE-2025-11456 ELEX WordPress HelpDesk ARFU v3.3.1
CVE-2025-11808 Stored XSS in WP Google Street View Plugin 'streetview' Shortcode v0.5.7
CVE-2025-10054 ELEX WP HelpDesk <=3.3.1: Unauthorized removal via elex_crm_remove_agent
CVE-2025-12935 FluentCRM WP Plugin Stored XSS via fluentcrm_content Shortcode <=2.9.84
CVE-2025-64310 BruteForce via Excessive Auth Attempts in EPSON WebConfig for SEIKO Projectors
CVE-2025-11802 WordPress Bulma Shortcodes v1.0 Stored XSS via type attr.
CVE-2025-12022 ELEX WP HelpDesk <=3.3.1 missing capability check lets Subscriber restore tickets
CVE-2025-12169 ELEX WP HelpDesk: AuthZ Bypass on wp_ajax_eh_crm_sched_empty (3.3.0)
And others...
Wazuh
CVE-2025-64483 Wazuh API/Agent Config: Read-Only Users Leak Enrollment Credentials 4.12.9CVE-2025-64169 Wazuh fim_alert Null Pointer Deref Causing Crash (v3.7.0-4.12.0)
CVE-2025-30201 NTLM Relay via Malicious UNC Paths in Wazuh Agent <4.13.0
CVE-2025-54866 Wazuh ACL Misconfig on authd.pass Exposed to Authenticated Users (4.3.04.12.x)
Thursday November 20, 2025
Unclassified
CVE-2025-11186 WordPress Cookie Notice Plugin <=2.5.8 Stored XSS via cookies_accepted shortcodeCVE-2025-11456 ELEX WordPress HelpDesk ARFU v3.3.1
CVE-2025-11808 Stored XSS in WP Google Street View Plugin 'streetview' Shortcode v0.5.7
CVE-2025-10054 ELEX WP HelpDesk <=3.3.1: Unauthorized removal via elex_crm_remove_agent
CVE-2025-12935 FluentCRM WP Plugin Stored XSS via fluentcrm_content Shortcode <=2.9.84
CVE-2025-64310 BruteForce via Excessive Auth Attempts in EPSON WebConfig for SEIKO Projectors
CVE-2025-11802 WordPress Bulma Shortcodes v1.0 Stored XSS via type attr.
CVE-2025-12022 ELEX WP HelpDesk <=3.3.1 missing capability check lets Subscriber restore tickets
CVE-2025-12169 ELEX WP HelpDesk: AuthZ Bypass on wp_ajax_eh_crm_sched_empty (3.3.0)
And others...
Limesurvey
CVE-2025-41074 LimeSurvey 6.13 Infinite Redirect DoS via /optout EndpointCVE-2025-41076 LimeSurvey 6.13.0 Session Cookie Exploits Internal Info Leak


