2025 CVEs (page 117)
Page 117 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53413 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53412 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-53411 | Medium | 4.9 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-53410 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53409 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53408 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-52865 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-52425 | Critical | 9.8 | 2025-11-07 | An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. … |
CVE-2025-47207 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-12861 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipul… |
CVE-2025-12860 | Medium | 4.7 | 2025-11-07 | A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderb… |
CVE-2025-12859 | Medium | 4.7 | 2025-11-07 | A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argum… |
CVE-2025-34299 | Critical | 9.8 | 2025-11-07 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitra… |
CVE-2025-12857 | Medium | 4.7 | 2025-11-07 | A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook… |
CVE-2025-12856 | Medium | 4.7 | 2025-11-07 | A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulatio… |
CVE-2025-12855 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php… |
CVE-2025-12854 | Low | 3.7 | 2025-11-07 | A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The mani… |
CVE-2025-12853 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php… |
CVE-2025-10968 | High | 8.8 | 2025-11-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Se… |
CVE-2025-10870 | | 2025-11-07 | SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests w… | |
CVE-2025-46413 | Medium | 4.3 | 2025-11-07 | Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-… |
CVE-2025-10966 | Medium | 4.3 | 2025-11-07 | curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevent… |
CVE-2025-64346 | | 2025-11-07 | archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the l… | |
CVE-2025-64343 | High | 7.8 | 2025-11-07 | (conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory… |
CVE-2025-64339 | Medium | 5.4 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scrip… |
CVE-2025-12527 | Medium | 4.3 | 2025-11-07 | The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashb… |
CVE-2025-12520 | Medium | 4.0 | 2025-11-07 | The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due… |
CVE-2025-64338 | Critical | 9.0 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose C… |
CVE-2025-64336 | Medium | 5.4 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scriptin… |
CVE-2025-64329 | Medium | 5.5 | 2025-11-07 | containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2… |
CVE-2025-4522 | Medium | 6.5 | 2025-11-07 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_don… |
CVE-2025-4519 | High | 8.8 | 2025-11-07 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check… |
CVE-2025-12352 | Critical | 9.8 | 2025-11-07 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all ver… |
CVE-2025-64328 | High | 7.2 | 2025-11-07 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module w… |
CVE-2025-64323 | Medium | 5.3 | 2025-11-07 | kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with… |
CVE-2025-64187 | Medium | 4.4 | 2025-11-07 | OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arb… |
CVE-2025-64184 | High | 8.8 | 2025-11-07 | Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different as… |
CVE-2025-64180 | Critical | 10.0 | 2025-11-07 | Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access… |
CVE-2025-5483 | High | 8.1 | 2025-11-07 | The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1… |
CVE-2025-11546 | | 2025-11-07 | CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux… | |
CVE-2025-52662 | Medium | 6.9 | 2025-11-07 | A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurati… |
CVE-2025-48985 | Low | 3.7 | 2025-11-07 | A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitel… |
CVE-2025-12789 | Medium | 6.1 | 2025-11-07 | A flaw was found in Red Hat Single Sign-On. This issue is an Open Redirect vulnerability that occurs during the logout process. The redirect_uri parameter asso… |
CVE-2025-64302 | Medium | 6.4 | 2025-11-06 | Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipul… |
CVE-2025-62630 | High | 8.8 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution wit… |
CVE-2025-59171 | High | 7.5 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution wit… |
CVE-2025-58423 | High | 8.8 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories… |
CVE-2025-12636 | Medium | 6.5 | 2025-11-06 | The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would the… |
CVE-2025-12036 | High | 8.8 | 2025-11-06 | Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2025-11756 | High | 8.8 | 2025-11-06 | Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2025-11460 | High | 8.8 | 2025-11-06 | Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium secur… |
CVE-2025-11458 | High | 8.1 | 2025-11-06 | Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2025-64179 | Medium | 5.3 | 2025-11-06 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/… |
CVE-2025-64178 | | 2025-11-06 | Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, ac… | |
CVE-2025-64177 | Medium | 5.4 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (X… |
CVE-2025-64176 | Medium | 5.3 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish… |
CVE-2025-11219 | Low | 3.1 | 2025-11-06 | Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2025-11216 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video… |
CVE-2025-11215 | Medium | 4.3 | 2025-11-06 | Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chro… |
CVE-2025-11213 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-11212 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2025-11211 | High | 7.5 | 2025-11-06 | Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
CVE-2025-11210 | Medium | 5.4 | 2025-11-06 | Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2025-11209 | High | 8.2 | 2025-11-06 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-11208 | Medium | 6.3 | 2025-11-06 | Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-11207 | Medium | 6.5 | 2025-11-06 | Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write via a crafted HTM… |
CVE-2025-11206 | High | 7.1 | 2025-11-06 | Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2025-11205 | High | 8.8 | 2025-11-06 | Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2025-64327 | Medium | 5.3 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (… |
CVE-2025-64326 | Low | 2.6 | 2025-11-06 | Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in t… |
CVE-2025-64174 | Medium | 4.8 | 2025-11-06 | Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS… |
CVE-2025-64173 | High | 7.5 | 2025-11-06 | Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well a… |
CVE-2025-52881 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc… |
CVE-2025-33110 | Medium | 5.4 | 2025-11-06 | IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-12790 | High | 7.4 | 2025-11-06 | A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack. |
CVE-2025-12489 | High | 7.8 | 2025-11-06 | evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2025-12488 | Critical | 9.8 | 2025-11-06 | oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-12487 | Critical | 9.8 | 2025-11-06 | oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-12486 | High | 8.8 | 2025-11-06 | Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-52565 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4… |
CVE-2025-34247 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low… |
CVE-2025-34246 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated… |
CVE-2025-34245 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authent… |
CVE-2025-34244 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authent… |
CVE-2025-34243 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authen… |
CVE-2025-34242 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-pr… |
CVE-2025-34241 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated l… |
CVE-2025-34240 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticate… |
CVE-2025-34239 | High | 7.2 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenti… |
CVE-2025-34238 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileActi… |
CVE-2025-34237 | Medium | 5.4 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnCl… |
CVE-2025-34236 | Medium | 5.4 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficie… |
CVE-2025-12490 | High | 8.8 | 2025-11-06 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affecte… |
CVE-2025-63551 | High | 7.5 | 2025-11-06 | A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS… |
CVE-2025-60541 | High | 7.3 | 2025-11-06 | A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources vi… |
CVE-2025-31133 | High | 7.8 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 an… |
CVE-2025-22397 | Medium | 6.7 | 2025-11-06 | Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell… |
CVE-2025-27919 | High | 8.2 | 2025-11-06 | An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and… |
CVE-2025-27918 | Critical | 9.8 | 2025-11-06 | An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and… |
CVE-2025-27917 | High | 7.5 | 2025-11-06 | An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and… |