2025 CVEs (page 108)
Page 108 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64749 | Medium | 4.3 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API… |
CVE-2025-64748 | Medium | 6.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to sea… |
CVE-2025-64747 | Medium | 5.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2025-47913 | High | 7.5 | 2025-11-13 | SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. |
CVE-2025-36251 | Critical | 9.6 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to imprope… |
CVE-2025-36250 | Critical | 10.0 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary c… |
CVE-2025-36236 | High | 8.2 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directorie… |
CVE-2025-36096 | Critical | 9.0 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access… |
CVE-2025-13131 | High | 7.8 | 2025-11-13 | A vulnerability was found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the co… |
CVE-2025-13130 | High | 7.8 | 2025-11-13 | A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of… |
CVE-2025-64746 | Medium | 4.6 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level perm… |
CVE-2025-64745 | Low | 2.7 | 2025-11-13 | Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's develop… |
CVE-2025-64744 | Low | 3.5 | 2025-11-13 | OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name… |
CVE-2025-4619 | | 2025-11-13 | A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially c… | |
CVE-2025-47222 | Medium | 6.5 | 2025-11-13 | A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class pa… |
CVE-2025-47221 | Medium | 5.3 | 2025-11-13 | An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCH… |
CVE-2025-47220 | Medium | 5.3 | 2025-11-13 | A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSi… |
CVE-2025-64726 | | 2025-11-13 | Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Fi… | |
CVE-2025-64709 | Critical | 9.6 | 2025-11-13 | Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP R… |
CVE-2025-60702 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` f… |
CVE-2025-60699 | Medium | 6.5 | 2025-11-13 | A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` funct… |
CVE-2025-60679 | High | 8.8 | 2025-11-13 | A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which ha… |
CVE-2025-59840 | High | 8.1 | 2025-11-13 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, appl… |
CVE-2025-55810 | Medium | 6.8 | 2025-11-13 | A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, which allows physical… |
CVE-2025-46370 | Low | 3.3 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker with local access cou… |
CVE-2025-46369 | High | 7.8 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local… |
CVE-2025-46368 | Medium | 6.6 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local… |
CVE-2025-46367 | High | 7.8 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged at… |
CVE-2025-46362 | Medium | 6.6 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged attacker with local a… |
CVE-2025-63406 | High | 8.8 | 2025-11-13 | An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in… |
CVE-2025-60676 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSett… |
CVE-2025-60675 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-60674 | Medium | 6.8 | 2025-11-13 | A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module. The vulnerabi… |
CVE-2025-60673 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDMZSettings… |
CVE-2025-60672 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSS… |
CVE-2025-43515 | High | 8.8 | 2025-11-13 | The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a… |
CVE-2025-13123 | Medium | 6.3 | 2025-11-13 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Exe… |
CVE-2025-64706 | Medium | 5.0 | 2025-11-13 | Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists… |
CVE-2025-60701 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_433188` func… |
CVE-2025-60700 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. The `sub_4455B… |
CVE-2025-60698 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` func… |
CVE-2025-60697 | High | 7.3 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` func… |
CVE-2025-60693 | Medium | 6.5 | 2025-11-13 | A stack-based buffer overflow exists in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The… |
CVE-2025-60671 | Medium | 5.4 | 2025-11-13 | A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which p… |
CVE-2025-59480 | Medium | 6.1 | 2025-11-13 | Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instanc… |
CVE-2025-13122 | High | 7.3 | 2025-11-13 | A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of… |
CVE-2025-12785 | High | 7.5 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-12784 | Medium | 4.9 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-11777 | Low | 3.1 | 2025-11-13 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows user… |
CVE-2025-60696 | High | 8.4 | 2025-11-13 | A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup fun… |
CVE-2025-60695 | Medium | 5.9 | 2025-11-13 | A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). The function sub_4045A8 reads up to 25… |
CVE-2025-60694 | High | 7.5 | 2025-11-13 | A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.g… |
CVE-2025-60692 | High | 8.4 | 2025-11-13 | A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The fu… |
CVE-2025-60691 | High | 8.8 | 2025-11-13 | A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The apply_cgi and block_cgi functi… |
CVE-2025-60690 | High | 8.8 | 2025-11-13 | A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). T… |
CVE-2025-20355 | Medium | 4.7 | 2025-11-13 | A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a… |
CVE-2025-20353 | Medium | 6.1 | 2025-11-13 | A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scriptin… |
CVE-2025-20349 | Medium | 6.3 | 2025-11-13 | A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container… |
CVE-2025-20346 | Medium | 4.3 | 2025-11-13 | A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The… |
CVE-2025-20341 | High | 8.8 | 2025-11-13 | A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected… |
CVE-2025-13121 | High | 7.3 | 2025-11-13 | A security vulnerability has been detected in cameasy Liketea 1.0.0. Impacted is the function list of the file laravel/app/Http/Controllers/Front/StoreControll… |
CVE-2025-11538 | Medium | 6.8 | 2025-11-13 | A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol… |
CVE-2025-64718 | Medium | 5.3 | 2025-11-13 | js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a pa… |
CVE-2025-64717 | Critical | 9.8 | 2025-11-13 | ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL'… |
CVE-2025-64714 | Medium | 5.8 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated L… |
CVE-2025-64703 | Medium | 6.3 | 2025-11-13 | MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although… |
CVE-2025-64525 | Medium | 6.5 | 2025-11-13 | Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forw… |
CVE-2025-64511 | High | 7.4 | 2025-11-13 | MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python c… |
CVE-2025-62484 | High | 8.1 | 2025-11-13 | Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of… |
CVE-2025-60689 | Medium | 5.4 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001… |
CVE-2025-60688 | Medium | 6.5 | 2025-11-13 | A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the… |
CVE-2025-60687 | Medium | 6.5 | 2025-11-13 | An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41… |
CVE-2025-60686 | Medium | 5.1 | 2025-11-13 | A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200… |
CVE-2025-60685 | Medium | 5.1 | 2025-11-13 | A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads t… |
CVE-2025-60684 | Medium | 6.5 | 2025-11-13 | A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the… |
CVE-2025-60683 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4… |
CVE-2025-60682 | Medium | 6.5 | 2025-11-13 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the… |
CVE-2025-52186 | Medium | 6.5 | 2025-11-13 | Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export… |
CVE-2025-13120 | Medium | 5.3 | 2025-11-13 | A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use a… |
CVE-2025-64741 | High | 8.1 | 2025-11-13 | Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via… |
CVE-2025-64740 | High | 7.5 | 2025-11-13 | Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escal… |
CVE-2025-64739 | Medium | 4.3 | 2025-11-13 | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2025-64738 | Medium | 5.0 | 2025-11-13 | External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information… |
CVE-2025-62483 | Medium | 5.3 | 2025-11-13 | Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of informatio… |
CVE-2025-62482 | Medium | 4.3 | 2025-11-13 | Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access. |
CVE-2025-30669 | Medium | 4.8 | 2025-11-13 | Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access. |
CVE-2025-30662 | Medium | 6.6 | 2025-11-13 | Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tr… |
CVE-2025-13119 | Medium | 4.3 | 2025-11-13 | A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forge… |
CVE-2025-13118 | Medium | 6.3 | 2025-11-13 | A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipul… |
CVE-2025-13117 | Medium | 5.4 | 2025-11-13 | A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the fil… |
CVE-2025-41069 | | 2025-11-13 | Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resource… | |
CVE-2025-13116 | Medium | 5.4 | 2025-11-13 | A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Exec… |
CVE-2025-13115 | Medium | 4.3 | 2025-11-13 | A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component… |
CVE-2025-13114 | Medium | 6.3 | 2025-11-13 | A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation lead… |
CVE-2025-40681 | | 2025-11-13 | Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the vic… | |
CVE-2025-12818 | Medium | 5.9 | 2025-11-13 | Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an al… |
CVE-2025-12817 | Low | 3.1 | 2025-11-13 | Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creati… |
CVE-2025-12765 | High | 7.5 | 2025-11-13 | pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification. |
CVE-2025-12764 | High | 7.5 | 2025-11-13 | pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the… |
CVE-2025-12763 | Medium | 6.8 | 2025-11-13 | pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup… |