EUVD-2025-37600

The Posts Navigation Links for Sections and Headings – Free by WP Masters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'wpmnavigationlinkssettings' page. This makes it...

EUVD-2025-37589

The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on th tbnajaxadd function. This makes it possible for unauthenticated attackers to update the plugin's setting...

EUVD-2025-37585

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalationonly if chained...

EUVD-2025-37624

The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the updatewpglobalscreenoptions action handler. This makes it possible for unauthenticated attackers to modify global...

EUVD-2025-37621

The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the labelpluginsoptions function. This makes it possible for unauthenticated attackers to update settings and injec...

EUVD-2025-37622

The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as oth...

EUVD-2025-37623

The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on the ViaAdspluginHandler function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie...

EUVD-2025-37613

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan...

EUVD-2025-37606

Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing...

EUVD-2025-37611

Memory corruption while accessing a buffer during IOCTL processing...

EUVD-2025-37615

Memory corruption while processing large input data from a remote source via a communication interface...

EUVD-2025-37610

Memory corruption when triggering a subsystem crash with an out-of-range identifier...

EUVD-2025-37614

Memory corruption while processing client message during device management...

EUVD-2025-37619

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions...

EUVD-2025-37616

Memory corruption while processing request sent from GVM...

EUVD-2025-37618

Memory corruption while processing audio streaming operations...

EUVD-2025-37607

Memory corruption while processing a GP command response...

EUVD-2025-37620

Memory corruption while performing encryption and decryption commands...

EUVD-2025-37617

Information disclosure while registering commands from clients with diag through diagHal...

EUVD-2025-37626

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's table shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...