2025 CVEs (page 101)
Page 101 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65493 | High | 7.5 | 2025-11-24 | NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection tha… |
CVE-2025-41017 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera… | |
CVE-2025-41016 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events thr… | |
CVE-2025-40212 | Critical | 9.8 | 2025-11-24 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" w… |
CVE-2025-12628 | Medium | 6.3 | 2025-11-24 | The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them |
CVE-2025-41729 | High | 7.5 | 2025-11-24 | An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. |
CVE-2025-41087 | | 2025-11-24 | Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the att… | |
CVE-2025-12741 | | 2025-11-24 | A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious comma… | |
CVE-2025-12740 | | 2025-11-24 | A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious co… | |
CVE-2025-12739 | | 2025-11-24 | An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Explo… | |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-13588 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Per… |
CVE-2025-13586 | Medium | 4.7 | 2025-11-24 | A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipu… |
CVE-2025-13585 | High | 7.3 | 2025-11-24 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of… |
CVE-2025-12629 | High | 7.1 | 2025-11-24 | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2025-12569 | Medium | 4.7 | 2025-11-24 | The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, lead… |
CVE-2025-12394 | Medium | 5.9 | 2025-11-24 | The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users… |
CVE-2025-7402 | High | 7.5 | 2025-11-24 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in… |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13583 | High | 7.3 | 2025-11-24 | A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST… |
CVE-2025-13589 | | 2025-11-24 | FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitra… | |
CVE-2025-13582 | High | 7.3 | 2025-11-24 | A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the com… |
CVE-2025-13581 | Medium | 6.3 | 2025-11-24 | A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule… |
CVE-2025-13580 | Medium | 6.3 | 2025-11-24 | A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID… |
CVE-2025-13579 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID re… |
CVE-2025-13578 | High | 7.3 | 2025-11-24 | A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipul… |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-13576 | Medium | 6.3 | 2025-11-24 | A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation result… |
CVE-2025-13575 | Medium | 6.3 | 2025-11-24 | A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php o… |
CVE-2025-13574 | Medium | 4.7 | 2025-11-24 | A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.p… |
CVE-2025-13573 | Medium | 6.3 | 2025-11-24 | A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php… |
CVE-2025-13572 | High | 7.3 | 2025-11-23 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipul… |
CVE-2025-12800 | Medium | 6.4 | 2025-11-23 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 vi… |
CVE-2025-13571 | Medium | 6.3 | 2025-11-23 | A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.ph… |
CVE-2025-13570 | Medium | 6.3 | 2025-11-23 | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state… |
CVE-2025-13569 | Medium | 6.3 | 2025-11-23 | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of t… |
CVE-2025-13568 | Medium | 6.3 | 2025-11-23 | A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the arg… |
CVE-2025-13567 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulati… |
CVE-2025-13566 | Low | 3.3 | 2025-11-23 | A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of th… |
CVE-2025-13565 | Medium | 5.3 | 2025-11-23 | A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPass… |
CVE-2025-13564 | Medium | 5.4 | 2025-11-23 | A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/Filehel… |
CVE-2025-54515 | | 2025-11-23 | The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands… | |
CVE-2025-13562 | High | 7.3 | 2025-11-23 | A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument serv… |
CVE-2025-13561 | High | 7.3 | 2025-11-23 | A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulati… |
CVE-2025-48507 | | 2025-11-23 | The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memorie… | |
CVE-2025-13560 | High | 7.3 | 2025-11-23 | A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of th… |
CVE-2025-13557 | High | 7.3 | 2025-11-23 | A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The m… |
CVE-2025-13556 | High | 7.3 | 2025-11-23 | A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Exe… |
CVE-2025-13555 | High | 7.3 | 2025-11-23 | A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Per… |
CVE-2025-13554 | High | 7.3 | 2025-11-23 | A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the componen… |
CVE-2025-13553 | High | 8.8 | 2025-11-23 | A weakness has been identified in D-Link DWR-M920 1.1.50. This affects the function sub_41C7FC of the file /boafrm/formPinManageSetup. This manipulation of the… |
CVE-2025-13552 | High | 8.8 | 2025-11-23 | A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function of the file /boafrm… |
CVE-2025-13551 | High | 8.8 | 2025-11-23 | A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The affected element is an unknown function of the file /boafrm/form… |
CVE-2025-13550 | High | 8.8 | 2025-11-23 | A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Impacted is an unknown function of the file /boafrm/formVpnConfigSet… |
CVE-2025-13549 | High | 8.8 | 2025-11-23 | A vulnerability was found in D-Link DIR-822K 1.00. This issue affects the function sub_455524 of the file /boafrm/formNtp. Performing manipulation of the argum… |
CVE-2025-13548 | High | 8.8 | 2025-11-23 | A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFire… |
CVE-2025-13547 | High | 8.8 | 2025-11-23 | A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This affects an unknown part of the file /boafrm/formDdns. This manipulation… |
CVE-2025-13546 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality… |
CVE-2025-13545 | Medium | 4.7 | 2025-11-23 | A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an u… |
CVE-2025-13544 | Medium | 6.3 | 2025-11-23 | A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /custo… |
CVE-2025-13526 | High | 7.5 | 2025-11-22 | The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order… |
CVE-2025-13318 | Medium | 5.3 | 2025-11-22 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to miss… |
CVE-2025-13136 | Medium | 4.3 | 2025-11-22 | The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-s… |
CVE-2025-13384 | High | 7.5 | 2025-11-22 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the pl… |
CVE-2025-13317 | Medium | 5.3 | 2025-11-22 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the p… |
CVE-2025-12877 | Medium | 5.3 | 2025-11-22 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capa… |
CVE-2025-12752 | Medium | 5.3 | 2025-11-22 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due… |
CVE-2025-11186 | Medium | 6.4 | 2025-11-22 | The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in… |
CVE-2025-12889 | Medium | 5.4 | 2025-11-22 | With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. |
CVE-2025-65947 | | 2025-11-21 | thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on… | |
CVE-2025-65946 | High | 8.1 | 2025-11-21 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo… |
CVE-2025-12888 | High | 7.5 | 2025-11-21 | Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limit… |
CVE-2025-11936 | Medium | 5.3 | 2025-11-21 | Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a deni… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-11933 | Medium | 6.5 | 2025-11-21 | Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to p… |
CVE-2025-11932 | Medium | 4.3 | 2025-11-21 | The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder |
CVE-2025-11931 | High | 8.2 | 2025-11-21 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
CVE-2025-65111 | Medium | 5.3 | 2025-11-21 | SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes th… |
CVE-2025-65109 | | 2025-11-21 | Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0… | |
CVE-2025-65108 | Critical | 10.0 | 2025-11-21 | md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that cont… |
CVE-2025-65107 | Medium | 6.5 | 2025-11-21 | Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provi… |
CVE-2025-65106 | | 2025-11-21 | LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerabilit… | |
CVE-2025-65102 | | 2025-11-21 | PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, w… | |
CVE-2025-65092 | | 2025-11-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder… | |
CVE-2025-43374 | Medium | 4.3 | 2025-11-21 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31266 | Medium | 4.3 | 2025-11-21 | A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5… |
CVE-2025-31248 | Medium | 5.5 | 2025-11-21 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.3… |
CVE-2025-31216 | Low | 2.4 | 2025-11-21 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may… |
CVE-2025-11935 | High | 7.5 | 2025-11-21 | With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with… |
CVE-2025-0504 | Medium | 5.4 | 2025-11-21 | Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with… |
CVE-2025-11087 | High | 8.8 | 2025-11-21 | The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due t… |
CVE-2025-36149 | Medium | 6.3 | 2025-11-21 | IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. |
CVE-2025-13524 | Medium | 5.7 | 2025-11-21 | Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call participant to conti… |
CVE-2025-64767 | Critical | 9.1 | 2025-11-21 | hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a… |
CVE-2025-64169 | Medium | 4.9 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fim_alert() implementation d… |
CVE-2025-62626 | | 2025-11-21 | Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially… | |
CVE-2025-62609 | High | 7.5 | 2025-11-21 | MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading… |
CVE-2025-62608 | Critical | 9.1 | 2025-11-21 | MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing mal… |
CVE-2025-54866 | Medium | 5.5 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program… |
CVE-2025-48502 | Medium | 5.5 | 2025-11-21 | Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service. |