2025 CVEs (page 122)
Page 122 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12468 | Medium | 5.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-12192 | Medium | 5.3 | 2025-11-05 | The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares t… |
CVE-2025-11987 | Medium | 6.4 | 2025-11-05 | The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and… |
CVE-2025-11820 | Medium | 6.4 | 2025-11-05 | The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to… |
CVE-2025-55108 | Critical | 10.0 | 2025-11-05 | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS… |
CVE-2025-12677 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route()… |
CVE-2025-12676 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a har… |
CVE-2025-12675 | Medium | 4.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all… |
CVE-2025-12674 | Critical | 9.8 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versio… |
CVE-2025-10622 | High | 8.0 | 2025-11-05 | A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary… |
CVE-2025-64151 | Medium | 6.7 | 2025-11-05 | Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the r… |
CVE-2025-62225 | Medium | 6.7 | 2025-11-05 | Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root… |
CVE-2025-12388 | Medium | 6.4 | 2025-11-05 | The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including… |
CVE-2025-12384 | High | 8.6 | 2025-11-05 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all ver… |
CVE-2025-12139 | High | 7.5 | 2025-11-05 | The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions… |
CVE-2025-11917 | Medium | 6.4 | 2025-11-05 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico… |
CVE-2025-11373 | Medium | 4.3 | 2025-11-05 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-6027 | Medium | 6.3 | 2025-11-05 | The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, all… |
CVE-2025-21079 | High | 7.1 | 2025-11-05 | Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Sams… |
CVE-2025-21078 | High | 8.8 | 2025-11-05 | Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. |
CVE-2025-21077 | Low | 3.3 | 2025-11-05 | Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege. |
CVE-2025-21076 | Medium | 5.5 | 2025-11-05 | Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Acc… |
CVE-2025-21075 | Medium | 4.3 | 2025-11-05 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21074 | Medium | 4.3 | 2025-11-05 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-21073 | Medium | 6.8 | 2025-11-05 | Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interactio… |
CVE-2025-21071 | Medium | 5.7 | 2025-11-05 | Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-11749 | Critical | 9.8 | 2025-11-05 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoi… |
CVE-2025-11072 | Medium | 5.3 | 2025-11-05 | The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated… |
CVE-2025-10873 | Medium | 5.3 | 2025-11-05 | The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missi… |
CVE-2025-10567 | Medium | 6.3 | 2025-11-05 | The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing atta… |
CVE-2025-12197 | High | 7.5 | 2025-11-05 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient esca… |
CVE-2025-11162 | Medium | 6.4 | 2025-11-05 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all… |
CVE-2025-12580 | Medium | 6.1 | 2025-11-05 | The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1… |
CVE-2025-11835 | Medium | 5.3 | 2025-11-05 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2025-8871 | Medium | 5.6 | 2025-11-05 | The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted… |
CVE-2025-12582 | Medium | 4.3 | 2025-11-05 | The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endp… |
CVE-2025-12735 | Critical | 9.8 | 2025-11-05 | The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However… |
CVE-2025-64110 | High | 7.5 | 2025-11-05 | Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should b… |
CVE-2025-64109 | High | 8.8 | 2025-11-05 | Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code… |
CVE-2025-64108 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent s… |
CVE-2025-64107 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipu… |
CVE-2025-64106 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables speci… |
CVE-2025-62722 | Medium | 5.4 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scr… |
CVE-2025-59596 | Medium | 6.5 | 2025-11-04 | CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local net… |
CVE-2025-59595 | High | 7.5 | 2025-11-04 | CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially craf… |
CVE-2025-62721 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to im… |
CVE-2025-62720 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from al… |
CVE-2025-62719 | Medium | 4.3 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts u… |
CVE-2025-62715 | Medium | 5.4 | 2025-11-04 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s… |
CVE-2025-62520 | Medium | 4.3 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with a… |
CVE-2025-62507 | High | 8.8 | 2025-11-04 | Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigg… |
CVE-2025-62369 | High | 7.2 | 2025-11-04 | Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerabil… |
CVE-2025-56230 | High | 7.5 | 2025-11-04 | Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. |
CVE-2025-54526 | High | 7.8 | 2025-11-04 | Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may allow an attacker… |
CVE-2025-54496 | High | 7.8 | 2025-11-04 | A maliciously crafted project file may cause a heap-based buffer overflow in Fuji Electric Monitouch V-SFT-6, which may allow the attacker to execute arbitra… |
CVE-2025-55155 | Medium | 5.4 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, th… |
CVE-2025-54335 | Medium | 6.5 | 2025-11-04 | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclipse GPU Driver. |
CVE-2025-52910 | Critical | 9.8 | 2025-11-04 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to priv… |
CVE-2025-48884 | Medium | 6.1 | 2025-11-04 | Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-… |
CVE-2025-48076 | Medium | 5.4 | 2025-11-04 | Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS… |
CVE-2025-47776 | Critical | 9.1 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code… |
CVE-2025-32786 | High | 7.5 | 2025-11-04 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerab… |
CVE-2025-27374 | Medium | 5.3 | 2025-11-04 | An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 1080, 1280, 2200, 133… |
CVE-2025-61431 | Medium | 6.1 | 2025-11-04 | A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 an… |
CVE-2025-54327 | Medium | 6.5 | 2025-11-04 | An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the… |
CVE-2025-49494 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 5123. Mishandling of… |
CVE-2025-33176 | Medium | 6.2 | 2025-11-04 | NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adjacent network. A s… |
CVE-2025-23358 | High | 8.2 | 2025-11-04 | NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue. A successful exploit of this… |
CVE-2025-64322 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files… |
CVE-2025-64321 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration File… |
CVE-2025-64320 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentfo… |
CVE-2025-64319 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fi… |
CVE-2025-64318 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration… |
CVE-2025-54334 | High | 7.5 | 2025-11-04 | An issue was discovered in the NPU driver in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500. There is a NULL Pointer Dereference of h… |
CVE-2025-52513 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in an out-of-bounds write, leading to a… |
CVE-2025-52512 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in out-of-bounds memory access, leading… |
CVE-2025-12108 | | 2025-11-04 | The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login pro… | |
CVE-2025-10875 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mul… |
CVE-2025-54333 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Invalid Pointer Dereference of node in the get_vs4l_profi… |
CVE-2025-54325 | Medium | 5.3 | 2025-11-04 | An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000. A r… |
CVE-2025-61956 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify co… |
CVE-2025-61945 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker c… |
CVE-2025-60925 | Medium | 5.3 | 2025-11-04 | codeshare v1.0.0 was discovered to contain an information leakage vulnerability. |
CVE-2025-54863 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely… |
CVE-2025-54332 | High | 7.5 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is a NULL Pointer Dereference of profiler.node in the npu_verte… |
CVE-2025-54331 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Untrusted Pointer Dereference of src_hdr in the copy_ncp_… |
CVE-2025-54330 | Medium | 5.3 | 2025-11-04 | An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Out-of-bounds Read of q->bufs[] in the __is_done_for_me f… |
CVE-2025-54329 | High | 7.5 | 2025-11-04 | An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-54323 | High | 7.5 | 2025-11-04 | An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debu… |
CVE-2025-63294 | Medium | 6.5 | 2025-11-04 | WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf… |
CVE-2025-12184 | Medium | 4.4 | 2025-11-04 | The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insuffic… |
CVE-2025-41345 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41344 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41343 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41342 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41341 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41340 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41339 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41338 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41337 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |