2025 CVEs (page 121)
Page 121 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48884 | Medium | 6.1 | 2025-11-04 | Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-… |
CVE-2025-48076 | Medium | 5.4 | 2025-11-04 | Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS… |
CVE-2025-47776 | Critical | 9.1 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code… |
CVE-2025-32786 | High | 7.5 | 2025-11-04 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerab… |
CVE-2025-27374 | Medium | 5.3 | 2025-11-04 | An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 1080, 1280, 2200, 133… |
CVE-2025-61431 | Medium | 6.1 | 2025-11-04 | A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 an… |
CVE-2025-54327 | Medium | 6.5 | 2025-11-04 | An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the… |
CVE-2025-49494 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 5123. Mishandling of… |
CVE-2025-33176 | Medium | 6.2 | 2025-11-04 | NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adjacent network. A s… |
CVE-2025-23358 | High | 8.2 | 2025-11-04 | NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue. A successful exploit of this… |
CVE-2025-64322 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files… |
CVE-2025-64321 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration File… |
CVE-2025-64320 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentfo… |
CVE-2025-64319 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fi… |
CVE-2025-64318 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration… |
CVE-2025-54334 | High | 7.5 | 2025-11-04 | An issue was discovered in the NPU driver in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500. There is a NULL Pointer Dereference of h… |
CVE-2025-52513 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in an out-of-bounds write, leading to a… |
CVE-2025-52512 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in out-of-bounds memory access, leading… |
CVE-2025-12108 | | 2025-11-04 | The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login pro… | |
CVE-2025-10875 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mul… |
CVE-2025-54333 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Invalid Pointer Dereference of node in the get_vs4l_profi… |
CVE-2025-54325 | Medium | 5.3 | 2025-11-04 | An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000. A r… |
CVE-2025-61956 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify co… |
CVE-2025-61945 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker c… |
CVE-2025-60925 | Medium | 5.3 | 2025-11-04 | codeshare v1.0.0 was discovered to contain an information leakage vulnerability. |
CVE-2025-54863 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely… |
CVE-2025-54332 | High | 7.5 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is a NULL Pointer Dereference of profiler.node in the npu_verte… |
CVE-2025-54331 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Untrusted Pointer Dereference of src_hdr in the copy_ncp_… |
CVE-2025-54330 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Out-of-bounds Read of q->bufs[] in the __is_done_for_me f… |
CVE-2025-54329 | High | 7.5 | 2025-11-04 | An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-54323 | High | 7.5 | 2025-11-04 | An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debu… |
CVE-2025-63294 | Medium | 6.5 | 2025-11-04 | WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf… |
CVE-2025-12184 | Medium | 4.4 | 2025-11-04 | The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insuffic… |
CVE-2025-41345 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41344 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41343 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41342 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41341 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41340 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41339 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41338 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41337 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41336 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41335 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12695 | Medium | 5.9 | 2025-11-04 | The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input a… |
CVE-2025-12682 | Critical | 9.8 | 2025-11-04 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_… |
CVE-2025-41114 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41113 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41112 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41111 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12493 | Critical | 9.8 | 2025-11-04 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Loc… |
CVE-2025-12045 | Medium | 6.4 | 2025-11-04 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2025-11690 | High | 8.5 | 2025-11-04 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other user… |
CVE-2025-20749 | Medium | 6.7 | 2025-11-04 | In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20748 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20747 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20746 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20745 | Medium | 4.2 | 2025-11-04 | In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20744 | Medium | 4.2 | 2025-11-04 | In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20743 | Medium | 4.2 | 2025-11-04 | In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20742 | High | 8.0 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privil… |
CVE-2025-20741 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20740 | Medium | 4.7 | 2025-11-04 | In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with User execution privile… |
CVE-2025-20739 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20738 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20737 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20736 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20735 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20734 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20733 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20732 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20731 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20730 | Medium | 6.7 | 2025-11-04 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious act… |
CVE-2025-20729 | Medium | 4.2 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20728 | High | 7.8 | 2025-11-04 | In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execut… |
CVE-2025-20727 | High | 8.1 | 2025-11-04 | In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2025-20726 | High | 7.5 | 2025-11-04 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to… |
CVE-2025-20725 | High | 7.5 | 2025-11-04 | In ims service, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected… |
CVE-2025-12683 | | 2025-11-04 | The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL a… | |
CVE-2025-12456 | Medium | 6.1 | 2025-11-04 | The Centangle-Team plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or inco… |
CVE-2025-12452 | Medium | 6.1 | 2025-11-04 | The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the… |
CVE-2025-12416 | Medium | 6.1 | 2025-11-04 | The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5… |
CVE-2025-12415 | Medium | 6.1 | 2025-11-04 | The MapMap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonc… |
CVE-2025-12413 | Medium | 5.4 | 2025-11-04 | The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to… |
CVE-2025-12412 | Medium | 6.1 | 2025-11-04 | The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or… |
CVE-2025-12410 | Medium | 6.1 | 2025-11-04 | The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or… |
CVE-2025-12403 | Medium | 6.1 | 2025-11-04 | The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing… |
CVE-2025-12402 | Medium | 6.1 | 2025-11-04 | The LinkedIn Resume plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.00. This is due to missing or inco… |
CVE-2025-12400 | Medium | 6.1 | 2025-11-04 | The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due to missing or incor… |
CVE-2025-12396 | Medium | 4.4 | 2025-11-04 | The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficie… |
CVE-2025-12393 | Medium | 4.4 | 2025-11-04 | The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insu… |
CVE-2025-12389 | Medium | 4.3 | 2025-11-04 | The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_setti… |
CVE-2025-12371 | Medium | 4.4 | 2025-11-04 | The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to… |
CVE-2025-12369 | Medium | 6.4 | 2025-11-04 | The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and i… |
CVE-2025-12350 | Medium | 5.3 | 2025-11-04 | The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action A… |
CVE-2025-12188 | Medium | 4.3 | 2025-11-04 | The Posts Navigation Links for Sections and Headings – Free by WP Masters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… |
CVE-2025-12158 | Critical | 9.8 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() func… |
CVE-2025-12157 | Medium | 5.3 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_r… |
CVE-2025-12156 | Medium | 4.3 | 2025-11-04 | The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-12065 | Medium | 4.4 | 2025-11-04 | The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including… |