2025 CVEs (page 110)
Page 110 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46427 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vuln… |
CVE-2025-27368 | Medium | 4.3 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points u… |
CVE-2025-13060 | High | 7.3 | 2025-11-12 | A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such… |
CVE-2025-13059 | Medium | 6.3 | 2025-11-12 | A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This… |
CVE-2025-13058 | Low | 3.5 | 2025-11-12 | A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The mani… |
CVE-2025-12048 | High | 7.5 | 2025-11-12 | An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execut… |
CVE-2025-12047 | Medium | 5.3 | 2025-11-12 | A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an att… |
CVE-2025-10495 | High | 7.5 | 2025-11-12 | A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certa… |
CVE-2025-64099 | | 2025-11-12 | Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it i… | |
CVE-2025-63929 | High | 7.5 | 2025-11-12 | A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via… |
CVE-2025-63927 | Medium | 4.0 | 2025-11-12 | A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_S… |
CVE-2025-63679 | High | 7.5 | 2025-11-12 | free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashe… |
CVE-2025-61667 | | 2025-11-12 | The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through… | |
CVE-2025-60646 | Medium | 6.1 | 2025-11-12 | A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2025-57812 | Low | 3.7 | 2025-11-12 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2025-57310 | High | 8.8 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to e… |
CVE-2025-56385 | Critical | 9.8 | 2025-11-12 | A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input… |
CVE-2025-13057 | Medium | 6.3 | 2025-11-12 | A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_studen… |
CVE-2025-65002 | High | 7.5 | 2025-11-12 | Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters. |
CVE-2025-65001 | High | 8.2 | 2025-11-12 | Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability. |
CVE-2025-63811 | High | 7.5 | 2025-11-12 | An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE)… |
CVE-2025-60645 | Medium | 6.5 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request. |
CVE-2025-25236 | Medium | 5.3 | 2025-11-12 | Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as t… |
CVE-2025-20379 | Low | 3.5 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2… |
CVE-2025-20378 | Low | 3.1 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unaut… |
CVE-2025-63419 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filena… |
CVE-2025-59491 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields. |
CVE-2025-59089 | Medium | 5.9 | 2025-11-12 | If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcpr… |
CVE-2025-59088 | High | 8.6 | 2025-11-12 | If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS… |
CVE-2025-52331 | Medium | 6.1 | 2025-11-12 | Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the… |
CVE-2025-2843 | High | 8.8 | 2025-11-12 | A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resou… |
CVE-2025-13042 | High | 8.8 | 2025-11-12 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-11797 | High | 7.8 | 2025-11-12 | A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerabili… |
CVE-2025-11795 | High | 7.8 | 2025-11-12 | A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulne… |
CVE-2025-9316 | | 2025-11-12 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. | |
CVE-2025-64293 | High | 7.6 | 2025-11-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Inject… |
CVE-2025-64281 | Critical | 9.8 | 2025-11-12 | An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials. |
CVE-2025-64280 | Critical | 9.8 | 2025-11-12 | A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field. |
CVE-2025-63353 | Critical | 9.8 | 2025-11-12 | A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSI… |
CVE-2025-63289 | Critical | 9.1 | 2025-11-12 | Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart fi… |
CVE-2025-11700 | High | 7.5 | 2025-11-12 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure |
CVE-2025-11367 | Critical | 9.8 | 2025-11-12 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization |
CVE-2025-11366 | Critical | 9.8 | 2025-11-12 | N-central < 2025.4 is vulnerable to authentication bypass via path traversal |
CVE-2025-63667 | High | 7.5 | 2025-11-12 | Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints wi… |
CVE-2025-63666 | Critical | 9.8 | 2025-11-12 | Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the… |
CVE-2025-11567 | | 2025-11-12 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. | |
CVE-2025-11566 | | 2025-11-12 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the… | |
CVE-2025-11565 | | 2025-11-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web… | |
CVE-2025-62876 | | 2025-11-12 | A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-gr… | |
CVE-2025-12998 | | 2025-11-12 | Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5… | |
CVE-2025-40177 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receiv… | |
CVE-2025-40176 | Critical | 9.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls… |
CVE-2025-40175 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, on… | |
CVE-2025-40174 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix SMP ordering in switch_mm_irqs_off() Stephen noted that it is possible to not… |
CVE-2025-40173 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version up… |
CVE-2025-40172 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find… |
CVE-2025-40171 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async… |
CVE-2025-40170 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk… |
CVE-2025-40169 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op()… |
CVE-2025-40168 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() i… |
CVE-2025-40167 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in e… |
CVE-2025-40166 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation… |
CVE-2025-40165 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: m2m: Fix streaming cleanup on release If streamon/streamoff calls a… |
CVE-2025-40164 | Medium | 5.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the fol… |
CVE-2025-40163 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warnin… | |
CVE-2025-40162 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may re… | |
CVE-2025-40161 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs S… | |
CVE-2025-40160 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VI… | |
CVE-2025-40159 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid val… |
CVE-2025-40158 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to pr… |
CVE-2025-40157 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_… | |
CVE-2025-40156 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_r… | |
CVE-2025-40155 | High | 7.3 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ign… |
CVE-2025-40154 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passe… | |
CVE-2025-40153 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect()… | |
CVE-2025-40152 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo()… | |
CVE-2025-40151 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: No support of struct argument in trampoline programs The current implemen… |
CVE-2025-40150 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid migrating empty section It reports a bug from device w/ zufs: F2FS-fs… | |
CVE-2025-40149 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock()… |
CVE-2025-40148 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The func… | |
CVE-2025-40147 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we… | |
CVE-2025-40146 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while… | |
CVE-2025-40145 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_actio… | |
CVE-2025-40143 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot genera… | |
CVE-2025-40142 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group… | |
CVE-2025-40141 | High | 8.0 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sc… |
CVE-2025-40140 | High | 8.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WAR… |
CVE-2025-40139 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is… |
CVE-2025-40138 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot repo… | |
CVE-2025-40137 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as… | |
CVE-2025-40136 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interru… | |
CVE-2025-40135 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to preven… |
CVE-2025-40134 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm d… | |
CVE-2025-40133 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable… |
CVE-2025-40132 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() c… | |
CVE-2025-40131 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deli… | |
CVE-2025-40130 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos… | |
CVE-2025-40129 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_… |
CVE-2025-40127 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_i… | |
CVE-2025-40126 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referen… |