2025 CVEs (page 111)
Page 111 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12536 | Medium | 5.3 | 2025-11-13 | The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notificati… |
CVE-2025-12366 | Medium | 4.3 | 2025-11-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… |
CVE-2025-12089 | Medium | 6.5 | 2025-11-13 | The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache… |
CVE-2025-11923 | High | 8.8 | 2025-11-13 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not prope… |
CVE-2025-64716 | | 2025-11-13 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when… | |
CVE-2025-64711 | Low | 3.9 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whos… |
CVE-2025-64710 | | 2025-11-13 | Bitplatform Boilerplate is a Visual studio and .NET project template. Versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in th… | |
CVE-2025-59367 | Critical | 9.8 | 2025-11-13 | An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec… |
CVE-2025-64707 | Medium | 5.4 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a rol… |
CVE-2025-64705 | Medium | 4.3 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access… |
CVE-2025-64523 | High | 8.8 | 2025-11-12 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions pri… |
CVE-2025-13076 | Medium | 4.7 | 2025-11-12 | A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing man… |
CVE-2025-13075 | Medium | 4.7 | 2025-11-12 | A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing mani… |
CVE-2025-64517 | Medium | 4.4 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target ac… |
CVE-2025-64503 | Medium | 4.0 | 2025-11-12 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-fi… |
CVE-2025-64500 | High | 7.3 | 2025-11-12 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented… |
CVE-2025-64482 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347… |
CVE-2025-64429 | Medium | 6.5 | 2025-11-12 | DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issue… |
CVE-2025-64345 | Low | 1.8 | 2025-11-12 | Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where… |
CVE-2025-63645 | Medium | 5.4 | 2025-11-12 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message c… |
CVE-2025-40208 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed… | |
CVE-2025-40207 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_c… | |
CVE-2025-40206 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy s… |
CVE-2025-40205 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh()… |
CVE-2025-40204 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be c… |
CVE-2025-40203 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make s… |
CVE-2025-40202 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a n… |
CVE-2025-40201 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths … |
CVE-2025-40200 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNIN… | |
CVE-2025-40199 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that… |
CVE-2025-40198 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other str… |
CVE-2025-40197 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared af… | |
CVE-2025-40196 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due… | |
CVE-2025-40195 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release(… | |
CVE-2025-40194 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu… | |
CVE-2025-40193 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: add input size check in proc_write_simdisk A malicious user could pass a… | |
CVE-2025-40192 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: Revert "ipmi: fix msg stack when IPMI is disconnected" This reverts commit c608966f3f9c2d… | |
CVE-2025-40191 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid… | |
CVE-2025-40190 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path wh… |
CVE-2025-40189 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eepr… | |
CVE-2025-40188 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_… | |
CVE-2025-40187 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->pe… |
CVE-2025-40186 | High | 8.1 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat… |
CVE-2025-40185 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() f… | |
CVE-2025-40184 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transp… | |
CVE-2025-40183 | High | 7.5 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway fe… |
CVE-2025-40182 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize… |
CVE-2025-40181 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an… | |
CVE-2025-40180 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop wa… | |
CVE-2025-40179 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily… | |
CVE-2025-40178 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pi… | |
CVE-2025-33119 | Medium | 6.5 | 2025-11-12 | IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. |
CVE-2025-64186 | High | 8.7 | 2025-11-12 | Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-g… |
CVE-2025-64170 | Low | 3.8 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a pass… |
CVE-2025-63396 | Low | 3.3 | 2025-11-12 | An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finaliz… |
CVE-2025-46608 | Critical | 9.1 | 2025-11-12 | Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potent… |
CVE-2025-36223 | Medium | 5.4 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to c… |
CVE-2025-13063 | High | 7.3 | 2025-11-12 | A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack m… |
CVE-2025-13061 | Medium | 6.3 | 2025-11-12 | A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing m… |
CVE-2025-8485 | High | 7.3 | 2025-11-12 | An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges dur… |
CVE-2025-8421 | Medium | 6.6 | 2025-11-12 | An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticat… |
CVE-2025-64117 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675… |
CVE-2025-46428 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vul… |
CVE-2025-46427 | High | 8.8 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vuln… |
CVE-2025-27368 | Medium | 4.3 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points u… |
CVE-2025-13060 | High | 7.3 | 2025-11-12 | A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such… |
CVE-2025-13059 | Medium | 6.3 | 2025-11-12 | A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This… |
CVE-2025-13058 | Low | 3.5 | 2025-11-12 | A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The mani… |
CVE-2025-12048 | High | 7.5 | 2025-11-12 | An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execut… |
CVE-2025-12047 | Medium | 5.3 | 2025-11-12 | A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an att… |
CVE-2025-10495 | High | 7.5 | 2025-11-12 | A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certa… |
CVE-2025-64099 | | 2025-11-12 | Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it i… | |
CVE-2025-63929 | High | 7.5 | 2025-11-12 | A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via… |
CVE-2025-63927 | Medium | 4.0 | 2025-11-12 | A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_S… |
CVE-2025-63679 | High | 7.5 | 2025-11-12 | free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashe… |
CVE-2025-61667 | | 2025-11-12 | The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through… | |
CVE-2025-60646 | Medium | 6.1 | 2025-11-12 | A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2025-57812 | Low | 3.7 | 2025-11-12 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2025-57310 | High | 8.8 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to e… |
CVE-2025-56385 | Critical | 9.8 | 2025-11-12 | A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input… |
CVE-2025-13057 | Medium | 6.3 | 2025-11-12 | A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_studen… |
CVE-2025-65002 | High | 7.5 | 2025-11-12 | Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters. |
CVE-2025-65001 | High | 8.2 | 2025-11-12 | Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability. |
CVE-2025-63811 | High | 7.5 | 2025-11-12 | An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE)… |
CVE-2025-60645 | Medium | 6.5 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request. |
CVE-2025-25236 | Medium | 5.3 | 2025-11-12 | Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as t… |
CVE-2025-20379 | Low | 3.5 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2… |
CVE-2025-20378 | Low | 3.1 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unaut… |
CVE-2025-63419 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filena… |
CVE-2025-59491 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields. |
CVE-2025-59089 | Medium | 5.9 | 2025-11-12 | If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcpr… |
CVE-2025-59088 | High | 8.6 | 2025-11-12 | If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS… |
CVE-2025-52331 | Medium | 6.1 | 2025-11-12 | Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the… |
CVE-2025-2843 | High | 8.8 | 2025-11-12 | A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resou… |
CVE-2025-13042 | High | 8.8 | 2025-11-12 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-11797 | High | 7.8 | 2025-11-12 | A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerabili… |
CVE-2025-11795 | High | 7.8 | 2025-11-12 | A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulne… |
CVE-2025-9316 | | 2025-11-12 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. | |
CVE-2025-64293 | High | 7.6 | 2025-11-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Inject… |
CVE-2025-64281 | Critical | 9.8 | 2025-11-12 | An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials. |