2025 CVEs (page 125)
Page 125 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64354 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matias Ventura Gutenberg gutenberg allows Stored XSS.This… |
CVE-2025-64353 | High | 8.8 | 2025-10-31 | Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3. |
CVE-2025-64352 | Low | 2.7 | 2025-10-31 | Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured… |
CVE-2025-64351 | Medium | 4.3 | 2025-10-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This is… |
CVE-2025-64350 | Low | 3.8 | 2025-10-31 | Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-58149 | High | 7.5 | 2025-10-31 | When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a doma… |
CVE-2025-58148 | High | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can… |
CVE-2025-58147 | High | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can… |
CVE-2025-40603 | Medium | 4.5 | 2025-10-31 | A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain… |
CVE-2025-11602 | | 2025-10-31 | Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previou… | |
CVE-2025-40106 | | 2025-10-31 | In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs… | |
CVE-2025-12115 | High | 7.5 | 2025-10-31 | The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This i… |
CVE-2025-12041 | Medium | 5.3 | 2025-10-31 | The ERI File Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'erifl_file' AJAX action in all… |
CVE-2025-11843 | | 2025-10-31 | Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malici… | |
CVE-2025-8383 | Medium | 4.3 | 2025-10-31 | The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect no… |
CVE-2025-62232 | High | 7.5 | 2025-10-31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is… |
CVE-2025-30191 | Medium | 5.4 | 2025-10-31 | Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information t… |
CVE-2025-30189 | High | 7.4 | 2025-10-31 | When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users… |
CVE-2025-30188 | High | 7.5 | 2025-10-31 | Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the w… |
CVE-2025-12175 | Medium | 4.3 | 2025-10-31 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in… |
CVE-2025-12094 | Medium | 5.3 | 2025-10-31 | The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up… |
CVE-2025-8385 | Medium | 6.8 | 2025-10-31 | The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in t… |
CVE-2025-6520 | Critical | 9.8 | 2025-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This… |
CVE-2025-10897 | High | 8.6 | 2025-10-31 | The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for… |
CVE-2025-8489 | Critical | 9.8 | 2025-10-31 | The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in ver… |
CVE-2025-7846 | High | 8.8 | 2025-10-31 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() fun… |
CVE-2025-63675 | Medium | 6.9 | 2025-10-31 | cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py. |
CVE-2025-5397 | Critical | 9.8 | 2025-10-31 | The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() fun… |
CVE-2025-58152 | Medium | 5.3 | 2025-10-31 | FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. Wi… |
CVE-2025-54763 | High | 7.2 | 2025-10-31 | FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the produ… |
CVE-2025-11191 | Medium | 5.3 | 2025-10-31 | The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails f… |
CVE-2025-11975 | Medium | 4.3 | 2025-10-31 | The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to… |
CVE-2025-11806 | Medium | 6.4 | 2025-10-31 | The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This… |
CVE-2025-23050 | Low | 3.1 | 2025-10-31 | QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5… |
CVE-2025-8849 | High | 7.5 | 2025-10-31 | LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `val… |
CVE-2025-6176 | High | 7.5 | 2025-10-31 | Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechan… |
CVE-2025-52665 | Critical | 10.0 | 2025-10-31 | A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a manag… |
CVE-2025-52664 | High | 8.8 | 2025-10-31 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
CVE-2025-52663 | High | 7.3 | 2025-10-31 | A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an… |
CVE-2025-48984 | High | 8.8 | 2025-10-31 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. |
CVE-2025-48983 | Critical | 9.9 | 2025-10-31 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authe… |
CVE-2025-48982 | High | 7.8 | 2025-10-31 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious f… |
CVE-2025-48980 | Medium | 6.5 | 2025-10-31 | In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect th… |
CVE-2025-27208 | Medium | 6.1 | 2025-10-31 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the us… |
CVE-2025-34298 | High | 8.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own em… |
CVE-2025-34287 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-… |
CVE-2025-34286 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/e… |
CVE-2025-34284 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an… |
CVE-2025-34283 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user witho… |
CVE-2025-34280 | High | 7.2 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal o… |
CVE-2025-34278 | Medium | 5.4 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator men… |
CVE-2025-34277 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before bei… |
CVE-2025-34274 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the r… |
CVE-2025-34273 | Medium | 6.5 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards… |
CVE-2025-34272 | Medium | 6.5 | 2025-10-30 | In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an emp… |
CVE-2025-34271 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes o… |
CVE-2025-34270 | Medium | 4.9 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field dur… |
CVE-2025-34135 | Medium | 4.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit… |
CVE-2025-34134 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validat… |
CVE-2025-8850 | High | 8.8 | 2025-10-30 | In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA… |
CVE-2025-63423 | High | 7.5 | 2025-10-30 | Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password. |
CVE-2025-61498 | High | 7.5 | 2025-10-30 | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet. |
CVE-2025-61141 | High | 7.5 | 2025-10-30 | sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and con… |
CVE-2025-3356 | High | 8.6 | 2025-10-30 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a spe… |
CVE-2025-3355 | High | 7.5 | 2025-10-30 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a spe… |
CVE-2025-63422 | High | 7.5 | 2025-10-30 | Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitr… |
CVE-2025-63298 | High | 8.2 | 2025-10-30 | A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authen… |
CVE-2025-62265 | Medium | 5.4 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4… |
CVE-2025-57109 | Medium | 6.5 | 2025-10-30 | Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene… |
CVE-2025-52180 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript vi… |
CVE-2025-52179 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2025-36137 | High | 7.2 | 2025-10-30 | IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns… |
CVE-2025-64118 | | 2025-10-30 | node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file… | |
CVE-2025-64116 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validatio… |
CVE-2025-64115 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly… |
CVE-2025-64112 | High | 8.0 | 2025-10-30 | Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with… |
CVE-2025-62266 | Medium | 6.1 | 2025-10-30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10… |
CVE-2025-56313 | Medium | 6.1 | 2025-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote at… |
CVE-2025-64096 | High | 8.8 | 2025-10-30 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-63885 | Medium | 6.1 | 2025-10-30 | A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-62795 | High | 7.1 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged auth… |
CVE-2025-62726 | High | 8.8 | 2025-10-30 | n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both… |
CVE-2025-61196 | High | 8.8 | 2025-10-30 | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. |
CVE-2025-61121 | High | 7.5 | 2025-10-30 | Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerabi… |
CVE-2025-61120 | High | 7.5 | 2025-10-30 | AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabi… |
CVE-2025-61119 | High | 7.5 | 2025-10-30 | Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain… |
CVE-2025-61114 | High | 7.5 | 2025-10-30 | 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulner… |
CVE-2025-60950 | Medium | 6.1 | 2025-10-30 | An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG… |
CVE-2025-60319 | Medium | 6.5 | 2025-10-30 | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.j… |
CVE-2025-12060 | | 2025-10-30 | The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Pyth… | |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2025-61118 | High | 7.5 | 2025-10-30 | mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers ma… |
CVE-2025-61117 | High | 7.5 | 2025-10-30 | Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By ex… |
CVE-2025-61116 | High | 7.5 | 2025-10-30 | AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control… |
CVE-2025-61115 | High | 7.5 | 2025-10-30 | ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an impr… |
CVE-2025-61113 | High | 7.5 | 2025-10-30 | TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain se… |
CVE-2025-46363 | Medium | 4.3 | 2025-10-30 | Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG… |
CVE-2025-36592 | Medium | 5.4 | 2025-10-30 | Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Gener… |
CVE-2025-12517 | Medium | 5.3 | 2025-10-30 | Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12516 | Critical | 9.8 | 2025-10-30 | Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |