2025 CVEs (page 10)
Page 10 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67888 | High | 7.3 | 2026-05-08 | An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" paramet… |
CVE-2025-67887 | Critical | 9.8 | 2026-05-08 | 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code b… |
CVE-2025-67886 | Medium | 6.3 | 2026-05-08 | Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by… |
CVE-2025-55449 | High | 7.3 | 2026-05-08 | AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT. |
CVE-2025-65122 | High | 7.5 | 2026-05-07 | Regex Denial of Service in youtube-regex npm package through version 1.0.5. |
CVE-2025-63704 | Critical | 9.8 | 2026-05-07 | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges th… |
CVE-2025-63703 | Critical | 9.8 | 2026-05-07 | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). |
CVE-2025-4397 | Medium | 6.8 | 2026-05-07 | Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encr… |
CVE-2025-4386 | Medium | 6.8 | 2026-05-07 | Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART termin… |
CVE-2025-67202 | Medium | 6.1 | 2026-05-07 | Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended… |
CVE-2025-63706 | Critical | 9.8 | 2026-05-07 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. |
CVE-2025-63705 | High | 8.8 | 2026-05-07 | NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js. |
CVE-2025-14341 | High | 8.3 | 2026-05-07 | Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDriv… |
CVE-2025-68604 | Medium | 5.4 | 2026-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3. |
CVE-2025-68060 | High | 7.6 | 2026-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member allows Blind SQL Injection. This issu… |
CVE-2025-66105 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-62127 | Medium | 5.9 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Logo Slider allows DOM-Based XSS. This is… |
CVE-2025-2514 | Medium | 5.3 | 2026-05-07 | Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F70… |
CVE-2025-1978 | High | 8.3 | 2026-05-07 | Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700… |
CVE-2025-9661 | High | 8.1 | 2026-05-07 | OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue aff… |
CVE-2025-31974 | Low | 3.9 | 2026-05-06 | HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintend… |
CVE-2025-31960 | Medium | 5.3 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that suppl… |
CVE-2025-52613 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the… |
CVE-2025-31984 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31983 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-31975 | Low | 2.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software ve… |
CVE-2025-31959 | Low | 3.5 | 2026-05-06 | HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sens… |
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2025-71295 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buff… |
CVE-2025-71294 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix NULL pointer issue buffer funcs If SDMA block not enabled, buffer_funcs w… |
CVE-2025-71293 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: Move ras data alloc before bad page check In the rare event if eeprom has… |
CVE-2025-71292 | High | 7.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside tha… |
CVE-2025-71291 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() In the function bcm… |
CVE-2025-71290 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: misc: ti_fpc202: fix a potential memory leak in probe function Use for_each_child_of_node… |
CVE-2025-71289 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails wh… |
CVE-2025-71288 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leaks on common probe Make sure to drop the reference taken w… |
CVE-2025-71287 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leak on larb probe Make sure to drop the reference taken when… |
CVE-2025-71286 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls The size of the… |
CVE-2025-71285 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI stack offers the 'aut… |
CVE-2025-71274 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_s… |
CVE-2025-71273 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify the code by using de… |
CVE-2025-71272 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths The function most_re… |
CVE-2025-71271 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was converted to the new… |
CVE-2025-62345 | Low | 2.7 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input… |
CVE-2025-31951 | High | 8.8 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identif… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2025-59853 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an… |
CVE-2025-59852 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which… |
CVE-2025-59851 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which… |
CVE-2025-31970 | Medium | 5.3 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for… |
CVE-2025-71256 | High | 7.5 | 2026-05-06 | In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71255 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71254 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71253 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71252 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71251 | High | 7.5 | 2026-05-06 | In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges… |
CVE-2025-66369 | High | 7.5 | 2026-05-05 | An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-61669 | Medium | 6.1 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficie… |
CVE-2025-52206 | Medium | 4.7 | 2026-05-05 | ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. |
CVE-2025-42611 | Medium | 6.5 | 2026-05-05 | RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communication… |
CVE-2025-13618 | Critical | 9.8 | 2026-05-05 | The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly re… |
CVE-2025-67796 | High | 8.1 | 2026-05-04 | IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API doe… |
CVE-2025-47408 | High | 7.8 | 2026-05-04 | Memory corruption when another driver calls an IOCTL with invalid input/output buffer. |
CVE-2025-47407 | High | 7.8 | 2026-05-04 | Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level. |
CVE-2025-47406 | Medium | 6.1 | 2026-05-04 | Information Disclosure while processing IOCTL handler callbacks without verifying buffer size. |
CVE-2025-47405 | High | 7.8 | 2026-05-04 | Memory corruption when processing camera sensor input/output control codes with invalid output buffers. |
CVE-2025-47404 | Medium | 6.5 | 2026-05-04 | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
CVE-2025-47403 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. |
CVE-2025-47401 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing target power rate tables during channel configuration. |
CVE-2025-70071 | Medium | 5.9 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() |
CVE-2025-70072 | Medium | 6.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components |
CVE-2025-70070 | Medium | 6.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry() |
CVE-2025-13605 | | 2026-05-04 | 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the con… | |
CVE-2025-70069 | High | 7.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method |
CVE-2025-70067 | Critical | 9.8 | 2026-05-04 | Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a pro… |
CVE-2025-58074 | High | 8.8 | 2026-05-04 | A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during… |
CVE-2025-14320 | Critical | 9.8 | 2026-05-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited… |
CVE-2025-14726 | Medium | 6.5 | 2026-05-02 | The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check… |
CVE-2025-52347 | High | 7.8 | 2026-05-01 | An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows att… |
CVE-2025-69606 | Medium | 6.1 | 2026-05-01 | Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gateways.php/error` endpoin… |
CVE-2025-63548 | High | 7.5 | 2026-05-01 | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to bear a non-valid valu… |
CVE-2025-63547 | High | 7.5 | 2026-05-01 | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field |
CVE-2025-36335 | Medium | 6.2 | 2026-04-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user. |
CVE-2025-36180 | Medium | 5.3 | 2026-04-30 | IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pod… |
CVE-2025-36122 | Medium | 6.5 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-14688 | Medium | 5.3 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-56568 | High | 7.5 | 2026-04-30 | Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Open5GS before v2.7.5… |
CVE-2025-46115 | High | 7.5 | 2026-04-30 | An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request |
CVE-2025-71284 | Critical | 9.8 | 2026-04-30 | Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiu… |
CVE-2025-51846 | High | 7.5 | 2026-04-30 | CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a Crypt… |
CVE-2025-14543 | Critical | 9.1 | 2026-04-30 | Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.This i… |
CVE-2025-14576 | High | 7.8 | 2026-04-30 | Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage co… |
CVE-2025-13030 | High | 7.1 | 2026-04-30 | All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload… |
CVE-2025-50328 | High | 7.3 | 2026-04-29 | A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections. When an archi… |
CVE-2025-56537 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-56536 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay… |
CVE-2025-56535 | Medium | 6.1 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload in… |