2025 CVEs (page 10)
Page 10 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32745 | Medium | 4.2 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network acce… |
CVE-2025-26483 | Medium | 6.1 | 2026-05-22 | Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerabi… |
CVE-2025-71217 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges… |
CVE-2025-71216 | High | 7.8 | 2026-05-21 | A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affect… |
CVE-2025-71215 | High | 7.0 | 2026-05-21 | A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate… |
CVE-2025-71214 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected… |
CVE-2025-71213 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2025-71212 | High | 7.8 | 2026-05-21 | A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2025-71211 | Critical | 9.8 | 2026-05-21 | A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installa… |
CVE-2025-71210 | Critical | 9.8 | 2026-05-21 | A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installa… |
CVE-2025-13479 | High | 7.5 | 2026-05-21 | Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifi… |
CVE-2025-13477 | High | 7.1 | 2026-05-21 | Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiB… |
CVE-2025-32750 | High | 7.5 | 2026-05-20 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with rem… |
CVE-2025-11954 | High | 8.0 | 2026-05-20 | Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery. This issue affect… |
CVE-2025-31985 | Low | 3.7 | 2026-05-20 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31973 | Medium | 4.0 | 2026-05-20 | HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introd… |
CVE-2025-33255 | High | 7.5 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this v… |
CVE-2025-15369 | Medium | 5.3 | 2026-05-20 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the g… |
CVE-2025-15645 | Medium | 4.6 | 2026-05-19 | Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handl… |
CVE-2025-57798 | Medium | 5.5 | 2026-05-19 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service… |
CVE-2025-70950 | High | 7.3 | 2026-05-19 | An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request. |
CVE-2025-51427 | High | 7.3 | 2026-05-19 | An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) u… |
CVE-2025-40904 | Medium | 6.5 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40903 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authent… |
CVE-2025-40902 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with ad… |
CVE-2025-40901 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticate… |
CVE-2025-40900 | Medium | 4.6 | 2026-05-19 | An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-14575 | | 2026-05-19 | An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a… | |
CVE-2025-15609 | High | 7.5 | 2026-05-19 | The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retri… |
CVE-2025-65954 | Medium | 6.1 | 2026-05-18 | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint… |
CVE-2025-57282 | High | 8.8 | 2026-05-18 | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. |
CVE-2025-56352 | High | 7.5 | 2026-05-18 | In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT packet parsing. When receivi… |
CVE-2025-4202 | Medium | 4.3 | 2026-05-16 | The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap… |
CVE-2025-67031 | Medium | 6.3 | 2026-05-15 | ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field… |
CVE-2025-67437 | Medium | 6.5 | 2026-05-15 | Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset. |
CVE-2025-14972 | | 2026-05-15 | * Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. * KSU keys using SYMCRYPTO… | |
CVE-2025-54518 | High | 7.0 | 2026-05-15 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a dif… |
CVE-2025-52532 | | 2026-05-15 | A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioc… | |
CVE-2025-66664 | | 2026-05-15 | Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_LOAD_GFX_IP_FW SR-… | |
CVE-2025-66660 | | 2026-05-15 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cause incorrect shar… | |
CVE-2025-54517 | | 2026-05-15 | Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution. | |
CVE-2025-54511 | | 2026-05-15 | Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficie… | |
CVE-2025-48516 | | 2026-05-15 | Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotec… | |
CVE-2025-48513 | | 2026-05-15 | Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in los… | |
CVE-2025-29944 | | 2026-05-15 | A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting in denial of servi… | |
CVE-2025-29938 | | 2026-05-15 | An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denia… | |
CVE-2025-29937 | | 2026-05-15 | An out of bounds read within the AMD Platform Management Framework (PMF) could allow an attacker to trigger a read of an arbitrary memory location potentially… | |
CVE-2025-29936 | | 2026-05-15 | Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting inte… | |
CVE-2025-29935 | | 2026-05-15 | An out of bounds write within the AMD Platform Management Framework (PMF) could allow an attacker to execute arbitrary code at an elevated privilege level pote… | |
CVE-2025-0044 | | 2026-05-15 | An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentialit… | |
CVE-2025-0040 | | 2026-05-15 | Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read… | |
CVE-2025-0028 | | 2026-05-15 | An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially result… | |
CVE-2025-52540 | | 2026-05-15 | An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out-of-Bounds, potenti… | |
CVE-2025-48521 | | 2026-05-15 | Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially re… | |
CVE-2025-48520 | | 2026-05-15 | An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-of-Bounds potential… | |
CVE-2025-48519 | | 2026-05-15 | An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or write Out-of-Bounds… | |
CVE-2025-48512 | | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privi… | |
CVE-2025-0045 | | 2026-05-15 | Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting… | |
CVE-2025-64526 | Medium | 5.3 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin deri… |
CVE-2025-15024 | High | 8.8 | 2026-05-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry a… |
CVE-2025-15023 | High | 8.8 | 2026-05-14 | Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation S… |
CVE-2025-62317 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through bro… |
CVE-2025-62316 | Low | 2.3 | 2026-05-14 | HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce t… |
CVE-2025-62313 | Medium | 5.4 | 2026-05-14 | HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attemp… |
CVE-2025-62312 | Low | 3.0 | 2026-05-14 | HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credenti… |
CVE-2025-62311 | Medium | 4.3 | 2026-05-14 | HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to… |
CVE-2025-62310 | Medium | 5.4 | 2026-05-14 | HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to… |
CVE-2025-62309 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be store… |
CVE-2025-62308 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal syste… |
CVE-2025-62305 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensit… |
CVE-2025-69443 | Medium | 6.3 | 2026-05-14 | Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, contro… |
CVE-2025-62628 | | 2026-05-14 | Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arb… | |
CVE-2025-62625 | | 2026-05-14 | Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in un… | |
CVE-2025-62619 | | 2026-05-14 | Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, p… | |
CVE-2025-15025 | High | 8.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade… |
CVE-2025-12008 | High | 8.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Media App allows Accessing Functionality N… |
CVE-2025-68421 | | 2026-05-14 | Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to… | |
CVE-2025-68420 | | 2026-05-14 | Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible f… | |
CVE-2025-11024 | Critical | 9.8 | 2026-05-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2025-15345 | Medium | 6.1 | 2026-05-14 | The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in… |
CVE-2025-14870 | High | 7.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2025-14869 | High | 7.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2025-13874 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2025-12669 | Medium | 5.4 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2025-27853 | High | 7.3 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication wit… |
CVE-2025-27852 | Medium | 5.0 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local… |
CVE-2025-27851 | Critical | 9.3 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes W… |
CVE-2025-27850 | High | 7.5 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, t… |
CVE-2025-32425 | Medium | 5.5 | 2026-05-13 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, th… |
CVE-2025-29338 | Medium | 5.6 | 2026-05-13 | NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the mod_para parameter… |
CVE-2025-28344 | High | 7.5 | 2026-05-13 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack. |
CVE-2025-28343 | High | 7.5 | 2026-05-13 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons. |
CVE-2025-14767 | Medium | 5.5 | 2026-05-13 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2025-14033 | Medium | 5.3 | 2026-05-13 | The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_tick… |
CVE-2025-11159 | Critical | 9.1 | 2026-05-13 | Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution wh… |
CVE-2025-9989 | Medium | 4.4 | 2026-05-13 | The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insuff… |
CVE-2025-9988 | Medium | 4.3 | 2026-05-13 | The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all version… |
CVE-2025-9987 | Medium | 5.3 | 2026-05-13 | The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta()… |
CVE-2025-14755 | Medium | 5.3 | 2026-05-13 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all version… |
CVE-2025-62627 | | 2026-05-13 | An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located… |