2025 CVEs (page 113)
Page 113 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24512 | Medium | 5.6 | 2025-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of… |
CVE-2025-24491 | Medium | 6.7 | 2025-11-11 | Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.1465 within Ring 3: User Applications may… |
CVE-2025-24327 | Medium | 6.7 | 2025-11-11 | Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application before version 20.0.1021 within Ring 3: User Applications may allow an es… |
CVE-2025-24314 | Low | 2.2 | 2025-11-11 | Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure… |
CVE-2025-24307 | Low | 2.0 | 2025-11-11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of pri… |
CVE-2025-24299 | High | 8.8 | 2025-11-11 | Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privile… |
CVE-2025-23361 | High | 7.8 | 2025-11-11 | NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code g… |
CVE-2025-23357 | High | 7.8 | 2025-11-11 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A succ… |
CVE-2025-22391 | Medium | 6.7 | 2025-11-11 | Improper access control for some SigTest before version 6.1.10 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adv… |
CVE-2025-20622 | Low | 3.8 | 2025-11-11 | Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User… |
CVE-2025-20614 | Medium | 6.7 | 2025-11-11 | External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalatio… |
CVE-2025-20065 | Medium | 6.7 | 2025-11-11 | Uncontrolled search path for some Display Virtualization for Windows OS software before version 1797 within Ring 2: Device Drivers may allow an escalation of p… |
CVE-2025-20056 | Medium | 4.4 | 2025-11-11 | Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileg… |
CVE-2025-20050 | Medium | 6.7 | 2025-11-11 | Uncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privileg… |
CVE-2025-20010 | High | 7.8 | 2025-11-11 | Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow… |
CVE-2025-13032 | Critical | 9.9 | 2025-11-11 | Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow. |
CVE-2025-12944 | High | 8.8 | 2025-11-11 | Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially exe… |
CVE-2025-12943 | High | 7.5 | 2025-11-11 | Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band… |
CVE-2025-12942 | High | 7.5 | 2025-11-11 | Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attac… |
CVE-2025-12940 | Medium | 5.5 | 2025-11-11 | Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Man… |
CVE-2025-9408 | High | 8.1 | 2025-11-11 | System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace proce… |
CVE-2025-64773 | Low | 2.7 | 2025-11-11 | In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit |
CVE-2025-13027 | High | 8.1 | 2025-11-11 | Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-13026 | Critical | 9.8 | 2025-11-11 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13025 | High | 7.5 | 2025-11-11 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13024 | Critical | 9.8 | 2025-11-11 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13023 | Critical | 9.8 | 2025-11-11 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13022 | Critical | 9.8 | 2025-11-11 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13021 | Critical | 9.8 | 2025-11-11 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
CVE-2025-13020 | High | 8.8 | 2025-11-11 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13019 | High | 8.1 | 2025-11-11 | Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13018 | High | 8.1 | 2025-11-11 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13017 | High | 8.1 | 2025-11-11 | Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird… |
CVE-2025-13016 | High | 7.5 | 2025-11-11 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Th… |
CVE-2025-13015 | Low | 3.4 | 2025-11-11 | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. |
CVE-2025-13014 | High | 8.8 | 2025-11-11 | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbi… |
CVE-2025-13013 | Medium | 6.1 | 2025-11-11 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and T… |
CVE-2025-13012 | High | 7.5 | 2025-11-11 | Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird… |
CVE-2025-10918 | High | 7.1 | 2025-11-11 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files any… |
CVE-2025-10905 | Medium | 4.4 | 2025-11-11 | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disabl… |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-9227 | Medium | 6.5 | 2025-11-11 | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. |
CVE-2025-9223 | High | 8.8 | 2025-11-11 | Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper config… |
CVE-2025-12101 | | 2025-11-11 | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy… | |
CVE-2025-11862 | | 2025-11-11 | A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API. | |
CVE-2025-11697 | | 2025-11-11 | A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to… | |
CVE-2025-11696 | | 2025-11-11 | A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows u… | |
CVE-2025-11085 | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, a… | |
CVE-2025-11084 | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing t… | |
CVE-2025-8324 | Critical | 9.8 | 2025-11-11 | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. |
CVE-2025-41106 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41105 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41104 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41103 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-10161 | High | 7.3 | 2025-11-11 | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision… |
CVE-2025-41102 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41101 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-11960 | Medium | 6.1 | 2025-11-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET… |
CVE-2025-7633 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. |
CVE-2025-7632 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. |
CVE-2025-7430 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. |
CVE-2025-12953 | Medium | 4.3 | 2025-11-11 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-12846 | High | 8.8 | 2025-11-11 | The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to in… |
CVE-2025-12788 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment byp… |
CVE-2025-12787 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, an… |
CVE-2025-12539 | Critical | 10.0 | 2025-11-11 | The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due… |
CVE-2025-9524 | Medium | 4.3 | 2025-11-11 | The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be explo… |
CVE-2025-9055 | Medium | 6.4 | 2025-11-11 | The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can onl… |
CVE-2025-8998 | Low | 3.1 | 2025-11-11 | It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be… |
CVE-2025-7429 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. |
CVE-2025-5317 | Medium | 5.5 | 2025-11-11 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative p… |
CVE-2025-10714 | High | 8.4 | 2025-11-11 | AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6779 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can o… |
CVE-2025-6571 | Medium | 6.0 | 2025-11-11 | A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. |
CVE-2025-6298 | Medium | 6.7 | 2025-11-11 | ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be ex… |
CVE-2025-5718 | Medium | 6.8 | 2025-11-11 | The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is config… |
CVE-2025-5454 | Medium | 6.4 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulner… |
CVE-2025-5452 | Medium | 6.6 | 2025-11-11 | A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege es… |
CVE-2025-4645 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-11855 | High | 7.5 | 2025-11-11 | The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated… |
CVE-2025-11307 | High | 8.8 | 2025-11-11 | The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated user… |
CVE-2025-11237 | Medium | 5.3 | 2025-11-11 | The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing… |
CVE-2025-12880 | Medium | 5.4 | 2025-11-11 | The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2025-12813 | Critical | 9.8 | 2025-11-11 | The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parame… |
CVE-2025-12754 | Medium | 6.4 | 2025-11-11 | The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and… |
CVE-2025-12753 | Medium | 6.4 | 2025-11-11 | The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. T… |
CVE-2025-12711 | Medium | 6.4 | 2025-11-11 | The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and in… |
CVE-2025-12672 | Medium | 6.4 | 2025-11-11 | The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions… |
CVE-2025-12671 | Medium | 6.4 | 2025-11-11 | The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, a… |
CVE-2025-12668 | Medium | 6.4 | 2025-11-11 | The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all… |
CVE-2025-12667 | Medium | 6.4 | 2025-11-11 | The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up t… |
CVE-2025-12665 | Medium | 4.3 | 2025-11-11 | The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja… |
CVE-2025-12663 | Medium | 6.4 | 2025-11-11 | The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions… |
CVE-2025-12662 | Medium | 6.4 | 2025-11-11 | The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to… |
CVE-2025-12658 | Medium | 6.4 | 2025-11-11 | The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortco… |
CVE-2025-12652 | Medium | 6.4 | 2025-11-11 | The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all… |
CVE-2025-12651 | Medium | 6.4 | 2025-11-11 | The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the li… |
CVE-2025-12644 | Medium | 6.4 | 2025-11-11 | The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode i… |
CVE-2025-12637 | High | 8.8 | 2025-11-11 | The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in… |