2025 CVEs (page 12)
Page 12 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2025-71295 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buff… |
CVE-2025-71294 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix NULL pointer issue buffer funcs If SDMA block not enabled, buffer_funcs w… |
CVE-2025-71293 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: Move ras data alloc before bad page check In the rare event if eeprom has… |
CVE-2025-71292 | High | 7.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside tha… |
CVE-2025-71291 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() In the function bcm… |
CVE-2025-71290 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: misc: ti_fpc202: fix a potential memory leak in probe function Use for_each_child_of_node… |
CVE-2025-71289 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails wh… |
CVE-2025-71288 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leaks on common probe Make sure to drop the reference taken w… |
CVE-2025-71287 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leak on larb probe Make sure to drop the reference taken when… |
CVE-2025-71286 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls The size of the… |
CVE-2025-71285 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI stack offers the 'aut… |
CVE-2025-71274 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_s… |
CVE-2025-71273 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify the code by using de… |
CVE-2025-71272 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths The function most_re… |
CVE-2025-71271 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was converted to the new… |
CVE-2025-62345 | Low | 2.7 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input… |
CVE-2025-31951 | High | 8.8 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identif… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2025-59853 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an… |
CVE-2025-59852 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which… |
CVE-2025-59851 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which… |
CVE-2025-31970 | Medium | 5.3 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for… |
CVE-2025-71256 | High | 7.5 | 2026-05-06 | In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71255 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71254 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71253 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71252 | High | 7.5 | 2026-05-06 | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. |
CVE-2025-71251 | High | 7.5 | 2026-05-06 | In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges… |
CVE-2025-66369 | High | 7.5 | 2026-05-05 | An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-61669 | Medium | 6.1 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficie… |
CVE-2025-52206 | Medium | 4.7 | 2026-05-05 | ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. |
CVE-2025-42611 | Medium | 6.5 | 2026-05-05 | RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communication… |
CVE-2025-13618 | Critical | 9.8 | 2026-05-05 | The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly re… |
CVE-2025-67796 | High | 8.1 | 2026-05-04 | IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API doe… |
CVE-2025-47408 | High | 7.8 | 2026-05-04 | Memory corruption when another driver calls an IOCTL with invalid input/output buffer. |
CVE-2025-47407 | High | 7.8 | 2026-05-04 | Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level. |
CVE-2025-47406 | Medium | 6.1 | 2026-05-04 | Information Disclosure while processing IOCTL handler callbacks without verifying buffer size. |
CVE-2025-47405 | High | 7.8 | 2026-05-04 | Memory corruption when processing camera sensor input/output control codes with invalid output buffers. |
CVE-2025-47404 | Medium | 6.5 | 2026-05-04 | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
CVE-2025-47403 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. |
CVE-2025-47401 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing target power rate tables during channel configuration. |
CVE-2025-70071 | Medium | 5.9 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() |
CVE-2025-70072 | Medium | 6.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components |
CVE-2025-70070 | Medium | 6.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry() |
CVE-2025-13605 | | 2026-05-04 | 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the con… | |
CVE-2025-70069 | High | 7.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method |
CVE-2025-70067 | Critical | 9.8 | 2026-05-04 | Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a pro… |
CVE-2025-58074 | High | 8.8 | 2026-05-04 | A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during… |
CVE-2025-14320 | Critical | 9.8 | 2026-05-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited… |
CVE-2025-14726 | Medium | 6.5 | 2026-05-02 | The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check… |
CVE-2025-52347 | High | 7.8 | 2026-05-01 | An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows att… |
CVE-2025-69606 | Medium | 6.1 | 2026-05-01 | Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gateways.php/error` endpoin… |
CVE-2025-63548 | High | 7.5 | 2026-05-01 | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to bear a non-valid valu… |
CVE-2025-63547 | High | 7.5 | 2026-05-01 | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field |
CVE-2025-36335 | Medium | 6.2 | 2026-04-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user. |
CVE-2025-36180 | Medium | 5.3 | 2026-04-30 | IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pod… |
CVE-2025-36122 | Medium | 6.5 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-14688 | Medium | 5.3 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-56568 | High | 7.5 | 2026-04-30 | Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Open5GS before v2.7.5… |
CVE-2025-46115 | High | 7.5 | 2026-04-30 | An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request |
CVE-2025-71284 | Critical | 9.8 | 2026-04-30 | Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiu… |
CVE-2025-51846 | High | 7.5 | 2026-04-30 | CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a Crypt… |
CVE-2025-14543 | Critical | 9.1 | 2026-04-30 | Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking. This… |
CVE-2025-14576 | High | 7.8 | 2026-04-30 | Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage co… |
CVE-2025-13030 | High | 7.1 | 2026-04-30 | All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload… |
CVE-2025-50328 | High | 7.3 | 2026-04-29 | A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections. When an archi… |
CVE-2025-56537 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-56536 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay… |
CVE-2025-56535 | Medium | 6.1 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload in… |
CVE-2025-56534 | Medium | 6.1 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2025-10503 | Medium | 6.1 | 2026-04-29 | The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This al… |
CVE-2025-60889 | Critical | 9.8 | 2026-04-28 | Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecif… |
CVE-2025-60887 | Medium | 5.3 | 2026-04-28 | An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addres… |
CVE-2025-67223 | High | 7.5 | 2026-04-28 | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly acc… |
CVE-2025-48431 | High | 7.5 | 2026-04-28 | Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are rec… |
CVE-2025-10539 | Medium | 4.8 | 2026-04-28 | Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path… |
CVE-2025-69428 | High | 7.5 | 2026-04-27 | An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories. |
CVE-2025-69689 | High | 8.8 | 2026-04-27 | The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with e… |
CVE-2025-54505 | | 2026-04-27 | A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially re… | |
CVE-2025-15626 | | 2026-04-27 | Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application | |
CVE-2025-67259 | Medium | 6.5 | 2026-04-24 | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level i… |
CVE-2025-59308 | Medium | 4.7 | 2026-04-24 | In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as a… |
CVE-2025-61872 | Medium | 6.1 | 2026-04-24 | Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search si… |
CVE-2025-62233 | Medium | 6.3 | 2026-04-24 | Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3… |
CVE-2025-11762 | Medium | 4.3 | 2026-04-24 | The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2025-62373 | Critical | 9.8 | 2026-04-23 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerabili… |
CVE-2025-50229 | Critical | 9.8 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. |
CVE-2025-70994 | High | 7.3 | 2026-04-23 | Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV15… |
CVE-2025-66286 | Medium | 4.7 | 2026-04-23 | An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Application… |
CVE-2025-13763 | Medium | 5.7 | 2026-04-23 | Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB… |
CVE-2025-62110 | Medium | 6.5 | 2026-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This is… |
CVE-2025-62104 | Medium | 4.3 | 2026-04-23 | Missing Authorization vulnerability in Navneil Naicker ACF Galerie 4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-10549 | Medium | 5.1 | 2026-04-23 | EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker… |
CVE-2025-36074 | Medium | 5.5 | 2026-04-23 | IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating… |
CVE-2025-9957 | Low | 2.7 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certai… |
CVE-2025-6016 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have al… |
CVE-2025-3922 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2025-0186 | Medium | 6.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2025-58922 | Medium | 4.3 | 2026-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2. |