2025 CVEs (page 113)
Page 113 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12901 | Medium | 4.3 | 2025-11-12 | The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce va… |
CVE-2025-12833 | Medium | 4.3 | 2025-11-12 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2025-12087 | Medium | 4.3 | 2025-11-12 | The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1… |
CVE-2025-54983 | Medium | 5.2 | 2025-11-12 | A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released a… |
CVE-2025-40111 | High | 7.8 | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates ha… |
CVE-2025-40110 | | 2025-11-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is… | |
CVE-2025-43205 | Medium | 4.0 | 2025-11-12 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4… |
CVE-2025-64531 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61835 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-61834 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61833 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-41116 | | 2025-11-11 | When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the… | |
CVE-2025-40827 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected applica… |
CVE-2025-40817 | Medium | 6.5 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40816 | High | 7.6 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40815 | High | 7.2 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40763 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environment variables when loa… |
CVE-2025-40760 | Medium | 5.5 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sen… |
CVE-2025-40744 | High | 7.5 | 2025-11-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates… |
CVE-2025-3717 | | 2025-11-11 | When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the… | |
CVE-2025-12748 | Medium | 5.5 | 2025-11-11 | A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A m… |
CVE-2025-61845 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61844 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61843 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61842 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vu… |
CVE-2025-61841 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61840 | Medium | 5.5 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage th… |
CVE-2025-61839 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past th… |
CVE-2025-61838 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-61837 | High | 7.8 | 2025-11-11 | Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-61830 | High | 7.1 | 2025-11-11 | Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass securit… |
CVE-2025-62453 | Medium | 5.0 | 2025-11-11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2025-62452 | High | 8.0 | 2025-11-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-62449 | Medium | 6.8 | 2025-11-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to by… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-62220 | High | 8.8 | 2025-11-11 | Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network. |
CVE-2025-62219 | High | 7.0 | 2025-11-11 | Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62218 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized atta… |
CVE-2025-62217 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-62216 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62215 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2025-62214 | Medium | 6.7 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
CVE-2025-62213 | High | 7.0 | 2025-11-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-62211 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62210 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62209 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62208 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62206 | Medium | 6.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-62205 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62204 | High | 8.0 | 2025-11-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-62203 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62202 | High | 7.1 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-62201 | High | 7.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62200 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62199 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-61836 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61831 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-61829 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-61828 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-61827 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-61826 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61820 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-61819 | High | 7.8 | 2025-11-11 | Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2025-60728 | Medium | 4.3 | 2025-11-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2025-60727 | High | 7.8 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-60726 | High | 7.1 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-60724 | Critical | 9.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-60723 | Medium | 6.3 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service ov… |
CVE-2025-60722 | Medium | 6.5 | 2025-11-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over… |
CVE-2025-60721 | High | 7.8 | 2025-11-11 | Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. |
CVE-2025-60720 | High | 7.8 | 2025-11-11 | Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. |
CVE-2025-60719 | High | 7.0 | 2025-11-11 | Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-60718 | High | 7.8 | 2025-11-11 | Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. |
CVE-2025-60717 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-60716 | High | 7.0 | 2025-11-11 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-60715 | High | 8.0 | 2025-11-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-60714 | High | 7.8 | 2025-11-11 | Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. |
CVE-2025-60713 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-60710 | High | 7.8 | 2025-11-11 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. |
CVE-2025-60709 | High | 7.8 | 2025-11-11 | Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-60708 | Medium | 6.5 | 2025-11-11 | Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. |
CVE-2025-60707 | High | 7.8 | 2025-11-11 | Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-60706 | Medium | 5.5 | 2025-11-11 | Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2025-60705 | High | 7.8 | 2025-11-11 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-60704 | High | 7.5 | 2025-11-11 | Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-60703 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2025-59515 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59514 | High | 7.8 | 2025-11-11 | Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59513 | Medium | 5.5 | 2025-11-11 | Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. |
CVE-2025-59512 | High | 7.8 | 2025-11-11 | Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59511 | High | 7.8 | 2025-11-11 | External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59510 | Medium | 5.5 | 2025-11-11 | Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny servic… |
CVE-2025-59509 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. |
CVE-2025-59508 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileg… |
CVE-2025-59507 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileg… |
CVE-2025-59506 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privile… |
CVE-2025-59505 | High | 7.8 | 2025-11-11 | Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
CVE-2025-59504 | High | 7.3 | 2025-11-11 | Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. |
CVE-2025-59499 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-59240 | Medium | 5.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |