2025 CVEs (page 123)
Page 123 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41336 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41335 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12695 | Medium | 5.9 | 2025-11-04 | The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input a… |
CVE-2025-12682 | Critical | 9.8 | 2025-11-04 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_… |
CVE-2025-41114 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41113 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41112 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-41111 | High | 7.5 | 2025-11-04 | A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sendi… |
CVE-2025-12493 | Critical | 9.8 | 2025-11-04 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Loc… |
CVE-2025-12045 | Medium | 6.4 | 2025-11-04 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2025-11690 | High | 8.5 | 2025-11-04 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other user… |
CVE-2025-20749 | Medium | 6.7 | 2025-11-04 | In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20748 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20747 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20746 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20745 | Medium | 4.2 | 2025-11-04 | In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20744 | Medium | 4.2 | 2025-11-04 | In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20743 | Medium | 4.2 | 2025-11-04 | In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20742 | High | 8.0 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privil… |
CVE-2025-20741 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20740 | Medium | 4.7 | 2025-11-04 | In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with User execution privile… |
CVE-2025-20739 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20738 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20737 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20736 | Medium | 6.7 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20735 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20734 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20733 | High | 7.8 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20732 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20731 | Medium | 5.3 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20730 | Medium | 6.7 | 2025-11-04 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious act… |
CVE-2025-20729 | Medium | 4.2 | 2025-11-04 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2025-20728 | High | 7.8 | 2025-11-04 | In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execut… |
CVE-2025-20727 | High | 8.1 | 2025-11-04 | In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2025-20726 | High | 7.5 | 2025-11-04 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to… |
CVE-2025-20725 | High | 7.5 | 2025-11-04 | In ims service, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected… |
CVE-2025-12683 | | 2025-11-04 | The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL a… | |
CVE-2025-12456 | Medium | 6.1 | 2025-11-04 | The Centangle-Team plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or inco… |
CVE-2025-12452 | Medium | 6.1 | 2025-11-04 | The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the… |
CVE-2025-12416 | Medium | 6.1 | 2025-11-04 | The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5… |
CVE-2025-12415 | Medium | 6.1 | 2025-11-04 | The MapMap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonc… |
CVE-2025-12413 | Medium | 5.4 | 2025-11-04 | The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to… |
CVE-2025-12412 | Medium | 6.1 | 2025-11-04 | The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or… |
CVE-2025-12410 | Medium | 6.1 | 2025-11-04 | The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or… |
CVE-2025-12403 | Medium | 6.1 | 2025-11-04 | The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing… |
CVE-2025-12402 | Medium | 6.1 | 2025-11-04 | The LinkedIn Resume plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.00. This is due to missing or inco… |
CVE-2025-12400 | Medium | 6.1 | 2025-11-04 | The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due to missing or incor… |
CVE-2025-12396 | Medium | 4.4 | 2025-11-04 | The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficie… |
CVE-2025-12393 | Medium | 4.4 | 2025-11-04 | The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insu… |
CVE-2025-12389 | Medium | 4.3 | 2025-11-04 | The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_setti… |
CVE-2025-12371 | Medium | 4.4 | 2025-11-04 | The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to… |
CVE-2025-12369 | Medium | 6.4 | 2025-11-04 | The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and i… |
CVE-2025-12350 | Medium | 5.3 | 2025-11-04 | The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action A… |
CVE-2025-12188 | Medium | 4.3 | 2025-11-04 | The Posts Navigation Links for Sections and Headings – Free by WP Masters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… |
CVE-2025-12158 | Critical | 9.8 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() func… |
CVE-2025-12157 | Medium | 5.3 | 2025-11-04 | The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_r… |
CVE-2025-12156 | Medium | 4.3 | 2025-11-04 | The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-12065 | Medium | 4.4 | 2025-11-04 | The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including… |
CVE-2025-11890 | High | 7.5 | 2025-11-04 | The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This i… |
CVE-2025-11812 | Medium | 6.4 | 2025-11-04 | The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to… |
CVE-2025-11758 | Medium | 6.5 | 2025-11-04 | The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and includ… |
CVE-2025-11753 | Medium | 4.4 | 2025-11-04 | The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a… |
CVE-2025-11733 | High | 7.2 | 2025-11-04 | The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due t… |
CVE-2025-11724 | High | 8.8 | 2025-11-04 | The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. T… |
CVE-2025-11704 | High | 7.5 | 2025-11-04 | The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the… |
CVE-2025-10896 | High | 8.8 | 2025-11-04 | Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary… |
CVE-2025-47370 | Medium | 6.5 | 2025-11-04 | Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. |
CVE-2025-47368 | High | 7.8 | 2025-11-04 | Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. |
CVE-2025-47367 | High | 7.8 | 2025-11-04 | Memory corruption while accessing a buffer during IOCTL processing. |
CVE-2025-47365 | High | 7.8 | 2025-11-04 | Memory corruption while processing large input data from a remote source via a communication interface. |
CVE-2025-47362 | Medium | 6.1 | 2025-11-04 | Information disclosure while processing message from client with invalid payload. |
CVE-2025-47361 | High | 7.8 | 2025-11-04 | Memory corruption when triggering a subsystem crash with an out-of-range identifier. |
CVE-2025-47360 | High | 7.8 | 2025-11-04 | Memory corruption while processing client message during device management. |
CVE-2025-47357 | High | 8.0 | 2025-11-04 | Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions. |
CVE-2025-47353 | High | 7.8 | 2025-11-04 | Memory corruption while processing request sent from GVM. |
CVE-2025-47352 | High | 7.8 | 2025-11-04 | Memory corruption while processing audio streaming operations. |
CVE-2025-27074 | High | 8.8 | 2025-11-04 | Memory corruption while processing a GP command response. |
CVE-2025-27070 | High | 7.8 | 2025-11-04 | Memory corruption while performing encryption and decryption commands. |
CVE-2025-27064 | Medium | 6.1 | 2025-11-04 | Information disclosure while registering commands from clients with diag through diagHal. |
CVE-2025-12401 | Medium | 6.1 | 2025-11-04 | The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorre… |
CVE-2025-12070 | Medium | 4.3 | 2025-11-04 | The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validatio… |
CVE-2025-12069 | Medium | 4.3 | 2025-11-04 | The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing… |
CVE-2025-11008 | Critical | 9.8 | 2025-11-04 | The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it… |
CVE-2025-11007 | Critical | 9.8 | 2025-11-04 | The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_si… |
CVE-2025-12324 | Medium | 6.4 | 2025-11-04 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes… |
CVE-2025-11841 | Medium | 6.4 | 2025-11-04 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versi… |
CVE-2025-43507 | Medium | 6.5 | 2025-11-04 | A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, vision… |
CVE-2025-43505 | High | 8.8 | 2025-11-04 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to… |
CVE-2025-43504 | Medium | 4.9 | 2025-11-04 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause… |
CVE-2025-43503 | Medium | 4.3 | 2025-11-04 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 a… |
CVE-2025-43502 | High | 7.5 | 2025-11-04 | A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app… |
CVE-2025-43500 | High | 7.5 | 2025-11-04 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, wat… |
CVE-2025-43499 | Medium | 5.5 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, ma… |
CVE-2025-43498 | Medium | 5.5 | 2025-11-04 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2… |
CVE-2025-43496 | High | 7.5 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS… |
CVE-2025-43495 | Medium | 5.4 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to monitor keys… |
CVE-2025-43493 | Medium | 4.3 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, vis… |
CVE-2025-43481 | Medium | 5.2 | 2025-11-04 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-43480 | High | 8.1 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS… |
CVE-2025-43479 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may… |