Total
7601 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-59536 | 1 Anthropic | 1 Claude Code | 2026-10-12 | N/A | 8.8 HIGH |
| Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111. | |||||
| CVE-2025-58673 | 2026-10-11 | N/A | 5.4 MEDIUM | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12. | |||||
| CVE-2025-10945 | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW | ||
| A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php. Such manipulation of the argument hm leads to cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. | |||||
| CVE-2025-10949 | 2026-10-11 | 3.3 LOW | 2.4 LOW | ||
| A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10943 | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW | ||
| A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function valid of the file wx.php. The manipulation of the argument echostr results in cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10940 | 1 Totaljs | 1 Total.js | 2026-10-11 | 3.3 LOW | 2.4 LOW |
| A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10944 | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW | ||
| A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10827 | 1 Phpjabbers | 1 Restaurant Menu Maker | 2026-10-11 | 5.0 MEDIUM | 4.3 MEDIUM |
| A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. | |||||
| CVE-2025-9321 | 2026-10-11 | N/A | 9.8 CRITICAL | ||
| The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code. | |||||
| CVE-2025-11278 | 2026-10-11 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2025-10837 | 1 Fabian | 1 Simple Food Ordering System | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW |
| A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2025-10946 | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php. Performing manipulation of the argument hm results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. | |||||
| CVE-2025-15095 | 2026-10-11 | 4.0 MEDIUM | 3.5 LOW | ||
| A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2025-60114 | 2026-10-11 | N/A | 6.6 MEDIUM | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1. | |||||
| CVE-2025-59823 | 2026-10-11 | N/A | 9.9 CRITICAL | ||
| Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0. | |||||
| CVE-2025-8787 | 1 Portabilis | 1 I-diario | 2026-10-10 | 4.0 MEDIUM | 3.5 LOW |
| A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /registros-de-conteudos-por-disciplina/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 821342cd8d952e8bd214cb16145da785a92f5681. A patch should be applied to remediate this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text." | |||||
| CVE-2025-8786 | 1 Portabilis | 1 I-diario | 2026-10-10 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was identified in Portabilis i-Diario up to 1.5.0. Impacted is an unknown function of the file /registros-de-conteudos-por-areas-de-conhecimento/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text." | |||||
| CVE-2025-8511 | 1 Portabilis | 1 I-diario | 2026-10-10 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in Portabilis i-Diario 1.5.0. Impacted is an unknown function of the file /diario-de-observacoes/ of the component Observações. Performing a manipulation of the argument Descrição results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text." | |||||
| CVE-2026-11888 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-10-10 | N/A | 6.4 MEDIUM |
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack. | |||||
| CVE-2013-4444 | 1 Apache | 1 Tomcat | 2026-10-09 | 6.8 MEDIUM | N/A |
| Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. | |||||