2025 CVEs (page 120)
Page 120 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56231 | Critical | 9.1 | 2025-11-05 | Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. |
CVE-2025-10907 | High | 8.4 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin servic… |
CVE-2025-10713 | Medium | 6.5 | 2025-11-05 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-suppli… |
CVE-2025-63248 | High | 7.5 | 2025-11-05 | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire c… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2025-57244 | Medium | 5.4 | 2025-11-05 | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags a… |
CVE-2025-46424 | Medium | 6.7 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged attacker could pot… |
CVE-2025-46366 | Medium | 6.7 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the da… |
CVE-2025-46365 | Medium | 5.3 | 2025-11-05 | Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection… |
CVE-2025-46364 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control o… |
CVE-2025-45379 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell… |
CVE-2025-45378 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of Cl… |
CVE-2025-43990 | High | 7.3 | 2025-11-05 | Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local… |
CVE-2025-30479 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. |
CVE-2025-20377 | Medium | 4.3 | 2025-11-05 | A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an… |
CVE-2025-20376 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20375 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20374 | Medium | 4.9 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resource… |
CVE-2025-20358 | Critical | 9.4 | 2025-11-05 | A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentic… |
CVE-2025-20354 | Critical | 9.8 | 2025-11-05 | A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary fil… |
CVE-2025-20343 | High | 8.6 | 2025-11-05 | A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthe… |
CVE-2025-20305 | Medium | 4.3 | 2025-11-05 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affect… |
CVE-2025-20304 | Medium | 5.4 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-20303 | Medium | 5.4 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-20289 | Medium | 4.8 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-63601 | Critical | 9.9 | 2025-11-05 | Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing… |
CVE-2025-61304 | Critical | 9.8 | 2025-11-05 | OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. |
CVE-2025-60753 | Medium | 5.5 | 2025-11-05 | An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution ru… |
CVE-2025-57130 | High | 8.3 | 2025-11-05 | An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their… |
CVE-2025-64459 | Critical | 9.1 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get… |
CVE-2025-64458 | High | 7.5 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `djan… |
CVE-2025-61084 | High | 7.1 | 2025-11-05 | MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can cra… |
CVE-2025-52602 | Medium | 4.2 | 2025-11-05 | HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses… |
CVE-2025-47151 | Critical | 9.8 | 2025-11-05 | A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML res… |
CVE-2025-46784 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML… |
CVE-2025-46705 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion… |
CVE-2025-46404 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML res… |
CVE-2025-3125 | Medium | 6.7 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An au… |
CVE-2025-12497 | High | 8.1 | 2025-11-05 | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the… |
CVE-2025-11745 | Medium | 6.4 | 2025-11-05 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter'… |
CVE-2025-58337 | Medium | 5.4 | 2025-11-05 | An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have… |
CVE-2025-12469 | Medium | 4.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all v… |
CVE-2025-12468 | Medium | 5.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-12192 | Medium | 5.3 | 2025-11-05 | The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares t… |
CVE-2025-11987 | Medium | 6.4 | 2025-11-05 | The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and… |
CVE-2025-11820 | Medium | 6.4 | 2025-11-05 | The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to… |
CVE-2025-55108 | Critical | 10.0 | 2025-11-05 | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS… |
CVE-2025-12677 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route()… |
CVE-2025-12676 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a har… |
CVE-2025-12675 | Medium | 4.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all… |
CVE-2025-12674 | Critical | 9.8 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versio… |
CVE-2025-10622 | High | 8.0 | 2025-11-05 | A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary… |
CVE-2025-64151 | Medium | 6.7 | 2025-11-05 | Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the r… |
CVE-2025-62225 | Medium | 6.7 | 2025-11-05 | Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root… |
CVE-2025-12388 | Medium | 6.4 | 2025-11-05 | The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including… |
CVE-2025-12384 | High | 8.6 | 2025-11-05 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all ver… |
CVE-2025-12139 | High | 7.5 | 2025-11-05 | The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions… |
CVE-2025-11917 | Medium | 6.4 | 2025-11-05 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico… |
CVE-2025-11373 | Medium | 4.3 | 2025-11-05 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-6027 | Medium | 6.3 | 2025-11-05 | The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, all… |
CVE-2025-21079 | High | 7.1 | 2025-11-05 | Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Sams… |
CVE-2025-21078 | High | 8.8 | 2025-11-05 | Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. |
CVE-2025-21077 | Low | 3.3 | 2025-11-05 | Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege. |
CVE-2025-21076 | Medium | 5.5 | 2025-11-05 | Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Acc… |
CVE-2025-21075 | Medium | 4.3 | 2025-11-05 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21074 | Medium | 4.3 | 2025-11-05 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21073 | Medium | 6.8 | 2025-11-05 | Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interactio… |
CVE-2025-21071 | Medium | 5.7 | 2025-11-05 | Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-11749 | Critical | 9.8 | 2025-11-05 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoi… |
CVE-2025-11072 | Medium | 5.3 | 2025-11-05 | The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated… |
CVE-2025-10873 | Medium | 5.3 | 2025-11-05 | The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missi… |
CVE-2025-10567 | Medium | 6.3 | 2025-11-05 | The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing atta… |
CVE-2025-12197 | High | 7.5 | 2025-11-05 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient esca… |
CVE-2025-11162 | Medium | 6.4 | 2025-11-05 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all… |
CVE-2025-12580 | Medium | 6.1 | 2025-11-05 | The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1… |
CVE-2025-11835 | Medium | 5.3 | 2025-11-05 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2025-8871 | Medium | 5.6 | 2025-11-05 | The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted… |
CVE-2025-12582 | Medium | 4.3 | 2025-11-05 | The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endp… |
CVE-2025-12735 | Critical | 9.8 | 2025-11-05 | The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However… |
CVE-2025-64110 | High | 7.5 | 2025-11-05 | Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should b… |
CVE-2025-64109 | High | 8.8 | 2025-11-05 | Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code… |
CVE-2025-64108 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent s… |
CVE-2025-64107 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipu… |
CVE-2025-64106 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables speci… |
CVE-2025-62722 | Medium | 5.4 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scr… |
CVE-2025-59596 | Medium | 6.5 | 2025-11-04 | CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local net… |
CVE-2025-59595 | High | 7.5 | 2025-11-04 | CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially craf… |
CVE-2025-62721 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to im… |
CVE-2025-62720 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from al… |
CVE-2025-62719 | Medium | 4.3 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts u… |
CVE-2025-62715 | Medium | 5.4 | 2025-11-04 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s… |
CVE-2025-62520 | Medium | 4.3 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with a… |
CVE-2025-62507 | High | 8.8 | 2025-11-04 | Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigg… |
CVE-2025-62369 | High | 7.2 | 2025-11-04 | Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerabil… |
CVE-2025-56230 | High | 7.5 | 2025-11-04 | Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. |
CVE-2025-54526 | High | 7.8 | 2025-11-04 | Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may allow an attacker… |
CVE-2025-54496 | High | 7.8 | 2025-11-04 | A maliciously crafted project file may cause a heap-based buffer overflow in Fuji Electric Monitouch V-SFT-6, which may allow the attacker to execute arbitra… |
CVE-2025-55155 | Medium | 5.4 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, th… |
CVE-2025-54335 | Medium | 6.5 | 2025-11-04 | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclipse GPU Driver. |
CVE-2025-52910 | Critical | 9.8 | 2025-11-04 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to priv… |