2025 CVEs (page 109)
Page 109 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12762 | Critical | 9.1 | 2025-11-13 | pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLA… |
CVE-2025-12377 | Medium | 4.3 | 2025-11-13 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-7704 | Medium | 5.4 | 2025-11-13 | Supermicro BMC Insyde SMASH shell program has a stacked-based overflow vulnerability |
CVE-2025-64384 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-64383 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue aff… |
CVE-2025-64382 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-64381 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This… |
CVE-2025-64380 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allo… |
CVE-2025-64379 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-64370 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Pol… |
CVE-2025-64369 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-64292 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PascalBajorat Analytics Germanized for Google Analytics g… |
CVE-2025-64277 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-64276 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-64275 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored X… |
CVE-2025-64274 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly Configured Access… |
CVE-2025-64271 | Medium | 4.3 | 2025-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin… |
CVE-2025-64269 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-64267 | Medium | 4.3 | 2025-11-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultima… |
CVE-2025-64265 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64264 | Medium | 5.9 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-fo… |
CVE-2025-64263 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-64262 | Medium | 6.5 | 2025-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in ramon fincken Auto Prune Posts auto-prune-posts allows Cross Site Request Forgery.This issue affects Auto Pr… |
CVE-2025-64261 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64259 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-8397 | Medium | 6.4 | 2025-11-13 | The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, an… |
CVE-2025-12015 | Medium | 4.3 | 2025-11-13 | The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorize… |
CVE-2025-11769 | Medium | 6.4 | 2025-11-13 | The WordPress Content Flipper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' shortcode attribute of the 'flipper_front' sh… |
CVE-2025-11260 | Medium | 5.3 | 2025-11-13 | The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the… |
CVE-2025-10295 | Medium | 6.4 | 2025-11-13 | The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting the profile media uploader in all version… |
CVE-2025-12844 | High | 7.1 | 2025-11-13 | The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserializati… |
CVE-2025-12681 | Medium | 5.3 | 2025-11-13 | The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0… |
CVE-2025-12620 | Medium | 4.9 | 2025-11-13 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the ‘filterbyauthor’ parameter in a… |
CVE-2025-12891 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endp… |
CVE-2025-12979 | Medium | 5.3 | 2025-11-13 | The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all… |
CVE-2025-12892 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() fu… |
CVE-2025-12733 | High | 8.8 | 2025-11-13 | The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and inclu… |
CVE-2025-12536 | Medium | 5.3 | 2025-11-13 | The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notificati… |
CVE-2025-12366 | Medium | 4.3 | 2025-11-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… |
CVE-2025-12089 | Medium | 6.5 | 2025-11-13 | The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache… |
CVE-2025-11923 | High | 8.8 | 2025-11-13 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not prope… |
CVE-2025-64716 | | 2025-11-13 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when… | |
CVE-2025-64711 | Low | 3.9 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whos… |
CVE-2025-64710 | | 2025-11-13 | Bitplatform Boilerplate is a Visual studio and .NET project template. Versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in th… | |
CVE-2025-59367 | Critical | 9.8 | 2025-11-13 | An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec… |
CVE-2025-64707 | Medium | 5.4 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a rol… |
CVE-2025-64705 | Medium | 4.3 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access… |
CVE-2025-64523 | High | 8.8 | 2025-11-12 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions pri… |
CVE-2025-13076 | Medium | 4.7 | 2025-11-12 | A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing man… |
CVE-2025-13075 | Medium | 4.7 | 2025-11-12 | A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing mani… |
CVE-2025-64517 | Medium | 4.4 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target ac… |
CVE-2025-64503 | Medium | 4.0 | 2025-11-12 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-fi… |
CVE-2025-64500 | High | 7.3 | 2025-11-12 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented… |
CVE-2025-64482 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347… |
CVE-2025-64429 | Medium | 6.5 | 2025-11-12 | DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issue… |
CVE-2025-64345 | Low | 1.8 | 2025-11-12 | Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where… |
CVE-2025-63645 | Medium | 5.4 | 2025-11-12 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message c… |
CVE-2025-40208 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed… | |
CVE-2025-40207 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_c… | |
CVE-2025-40206 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy s… |
CVE-2025-40205 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh()… |
CVE-2025-40204 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be c… |
CVE-2025-40203 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make s… |
CVE-2025-40202 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a n… |
CVE-2025-40201 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths … |
CVE-2025-40200 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNIN… | |
CVE-2025-40199 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that… |
CVE-2025-40198 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other str… |
CVE-2025-40197 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared af… | |
CVE-2025-40196 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due… | |
CVE-2025-40195 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release(… | |
CVE-2025-40194 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu… | |
CVE-2025-40193 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: add input size check in proc_write_simdisk A malicious user could pass a… | |
CVE-2025-40192 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: Revert "ipmi: fix msg stack when IPMI is disconnected" This reverts commit c608966f3f9c2d… | |
CVE-2025-40191 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid… | |
CVE-2025-40190 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path wh… |
CVE-2025-40189 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eepr… | |
CVE-2025-40188 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_… | |
CVE-2025-40187 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->pe… |
CVE-2025-40186 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat… |
CVE-2025-40185 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() f… | |
CVE-2025-40184 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transp… | |
CVE-2025-40183 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway fe… |
CVE-2025-40182 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize… |
CVE-2025-40181 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an… | |
CVE-2025-40180 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop wa… | |
CVE-2025-40179 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily… | |
CVE-2025-40178 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pi… | |
CVE-2025-33119 | Medium | 6.5 | 2025-11-12 | IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. |
CVE-2025-64186 | High | 8.7 | 2025-11-12 | Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-g… |
CVE-2025-64170 | Low | 3.8 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a pass… |
CVE-2025-63396 | Low | 3.3 | 2025-11-12 | An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finaliz… |
CVE-2025-46608 | Critical | 9.1 | 2025-11-12 | Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potent… |
CVE-2025-36223 | Medium | 5.4 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to c… |
CVE-2025-13063 | High | 7.3 | 2025-11-12 | A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack m… |
CVE-2025-13061 | Medium | 6.3 | 2025-11-12 | A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing m… |
CVE-2025-8485 | High | 7.3 | 2025-11-12 | An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges dur… |
CVE-2025-8421 | Medium | 6.6 | 2025-11-12 | An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticat… |
CVE-2025-64117 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675… |
CVE-2025-46428 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vul… |