2025 CVEs (page 111)
Page 111 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40125 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_m… | |
CVE-2025-40124 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Anthony… |
CVE-2025-40123 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently repor… |
CVE-2025-40122 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, s… | |
CVE-2025-40121 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passe… | |
CVE-2025-40120 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM… | |
CVE-2025-40119 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4_mb_init() In ext4_mb_init(), ext4_mb_avg_fragment_… | |
CVE-2025-40118 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi… |
CVE-2025-40117 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Commit eefb8379… |
CVE-2025-40116 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run()… | |
CVE-2025-40115 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_tran… | |
CVE-2025-40113 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separat… | |
CVE-2025-40112 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara The referenced… |
CVE-2025-11994 | High | 7.2 | 2025-11-12 | The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1… |
CVE-2025-11454 | Medium | 6.5 | 2025-11-12 | The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplic… |
CVE-2025-64407 | Medium | 5.3 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-61623 | Medium | 6.5 | 2025-11-12 | Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 2… |
CVE-2025-59118 | High | 7.3 | 2025-11-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upg… |
CVE-2025-37734 | Medium | 4.3 | 2025-11-12 | Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. |
CVE-2025-12382 | High | 8.8 | 2025-11-12 | Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to… |
CVE-2025-11962 | High | 7.3 | 2025-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital C… |
CVE-2025-64406 | Medium | 4.3 | 2025-11-12 | An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other… |
CVE-2025-64405 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64404 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a documen… |
CVE-2025-64403 | High | 8.1 | 2025-11-12 | Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache Op… |
CVE-2025-64402 | Medium | 6.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64401 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-12903 | High | 7.5 | 2025-11-12 | The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/… |
CVE-2025-12732 | Medium | 4.3 | 2025-11-12 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing aut… |
CVE-2025-12872 | Medium | 5.4 | 2025-11-12 | The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing ma… |
CVE-2025-12871 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and us… |
CVE-2025-12870 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administr… |
CVE-2025-12869 | Medium | 4.8 | 2025-11-12 | The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent Ja… |
CVE-2025-12633 | High | 7.5 | 2025-11-12 | The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-12113 | Medium | 4.3 | 2025-11-12 | The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c… |
CVE-2025-12018 | Medium | 4.4 | 2025-11-12 | The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to… |
CVE-2025-11560 | High | 7.1 | 2025-11-12 | The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cr… |
CVE-2025-12901 | Medium | 4.3 | 2025-11-12 | The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce va… |
CVE-2025-12833 | Medium | 4.3 | 2025-11-12 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2025-12087 | Medium | 4.3 | 2025-11-12 | The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1… |
CVE-2025-54983 | Medium | 5.2 | 2025-11-12 | A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released a… |
CVE-2025-40111 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates ha… |
CVE-2025-40110 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is… | |
CVE-2025-43205 | Medium | 4.0 | 2025-11-12 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4… |
CVE-2025-64531 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61835 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-61834 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61833 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-41116 | | 2025-11-11 | When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the… | |
CVE-2025-40827 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected applica… |
CVE-2025-40817 | Medium | 6.5 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40816 | High | 7.6 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40815 | High | 7.2 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40763 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environment variables when loa… |
CVE-2025-40760 | Medium | 5.5 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sen… |
CVE-2025-40744 | High | 7.5 | 2025-11-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates… |
CVE-2025-3717 | | 2025-11-11 | When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the… | |
CVE-2025-12748 | Medium | 5.5 | 2025-11-11 | A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A m… |
CVE-2025-61845 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61844 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61843 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61842 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vu… |
CVE-2025-61841 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61840 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61839 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past th… |
CVE-2025-61838 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-61837 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-61830 | High | 7.1 | 2025-11-11 | Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass securit… |
CVE-2025-62453 | Medium | 5.0 | 2025-11-11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2025-62452 | High | 8.0 | 2025-11-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-62449 | Medium | 6.8 | 2025-11-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to by… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-62220 | High | 8.8 | 2025-11-11 | Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network. |
CVE-2025-62219 | High | 7.0 | 2025-11-11 | Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62218 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized atta… |
CVE-2025-62217 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-62216 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62215 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2025-62214 | Medium | 6.7 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
CVE-2025-62213 | High | 7.0 | 2025-11-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-62211 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62210 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62209 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62208 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62206 | Medium | 6.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-62205 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62204 | High | 8.0 | 2025-11-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-62203 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62202 | High | 7.1 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-62201 | High | 7.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62200 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62199 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-61836 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61831 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-61829 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-61828 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-61827 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-61826 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61820 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-61819 | High | 7.8 | 2025-11-11 | Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |