2025 CVEs (page 126)
Page 126 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12515 | Critical | 9.8 | 2025-10-30 | Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-11998 | | 2025-10-30 | The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited und… | |
CVE-2025-5347 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. |
CVE-2025-5343 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. |
CVE-2025-5342 | Medium | 4.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. |
CVE-2025-50574 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary… |
CVE-2025-46423 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-46422 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43942 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43027 | Critical | 9.8 | 2025-10-30 | A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to t… |
CVE-2025-50739 | Critical | 9.8 | 2025-10-30 | iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization. |
CVE-2025-50736 | Medium | 6.1 | 2025-10-30 | An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arb… |
CVE-2025-43941 | High | 7.2 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43940 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43939 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-63608 | Medium | 5.4 | 2025-10-30 | A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form… |
CVE-2025-10348 | | 2025-10-30 | URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a ma… | |
CVE-2025-10317 | | 2025-10-30 | Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by t… | |
CVE-2025-53883 | | 2025-10-30 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS… | |
CVE-2025-53880 | | 2025-10-30 | A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the… | |
CVE-2025-39663 | High | 8.4 | 2025-10-30 | Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service output… |
CVE-2025-62503 | Medium | 4.6 | 2025-10-30 | User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action. |
CVE-2025-62402 | Medium | 5.4 | 2025-10-30 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Da… |
CVE-2025-54941 | Medium | 4.6 | 2025-10-30 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on w… |
CVE-2025-54471 | Medium | 6.5 | 2025-10-30 | NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used… |
CVE-2025-54470 | High | 8.6 | 2025-10-30 | This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends an… |
CVE-2025-54469 | Critical | 9.9 | 2025-10-30 | A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be ex… |
CVE-2025-40105 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on so… |
CVE-2025-40104 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backwa… |
CVE-2025-40103 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues… | |
CVE-2025-40102 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug… | |
CVE-2025-40101 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the en… | |
CVE-2025-40100 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, w… | |
CVE-2025-40099 | Critical | 9.4 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send i… |
CVE-2025-40098 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return… | |
CVE-2025-40097 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __compone… | |
CVE-2025-40096 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding d… |
CVE-2025-40095 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the… |
CVE-2025-40094 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_acm: Refactor bind path to use __free() After an bind/unbind cycle, the ac… |
CVE-2025-40093 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ec… |
CVE-2025-40092 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the nc… |
CVE-2025-40091 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in… | |
CVE-2025-40090 | High | 7.5 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ("ksmbd… |
CVE-2025-40089 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Add check for no entries in cxl_feature_info cxl EDAC calls cxl_feature_inf… | |
CVE-2025-40088 | High | 7.1 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() The hfsplus_strcasecmp() log… |
CVE-2025-40087 | High | 7.5 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS cl… |
CVE-2025-40086 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds An array of VM binds… | |
CVE-2025-11906 | Medium | 6.7 | 2025-10-30 | A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with… |
CVE-2025-11881 | Medium | 5.3 | 2025-10-30 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify… |
CVE-2025-62230 | High | 7.3 | 2025-10-30 | A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures with… |
CVE-2025-62229 | High | 7.3 | 2025-10-30 | A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation c… |
CVE-2025-11627 | Medium | 6.5 | 2025-10-30 | The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, a… |
CVE-2025-10636 | Low | 3.5 | 2025-10-30 | The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2025-10008 | Medium | 5.3 | 2025-10-30 | The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '… |
CVE-2025-62231 | High | 7.3 | 2025-10-30 | A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned… |
CVE-2025-12475 | Medium | 6.4 | 2025-10-30 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versio… |
CVE-2025-9954 | High | 7.5 | 2025-10-30 | Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5. |
CVE-2025-62257 | Medium | 5.3 | 2025-10-30 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023… |
CVE-2025-12466 | High | 7.5 | 2025-10-30 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue… |
CVE-2025-12083 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripti… |
CVE-2025-12082 | High | 7.5 | 2025-10-30 | Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 befor… |
CVE-2025-10931 | Low | 3.8 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS)… |
CVE-2025-10930 | Medium | 4.3 | 2025-10-30 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0. |
CVE-2025-10929 | Medium | 5.3 | 2025-10-30 | Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects R… |
CVE-2025-10928 | Medium | 6.3 | 2025-10-30 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-10927 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XS… |
CVE-2025-10926 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This… |
CVE-2025-61725 | High | 7.5 | 2025-10-29 | The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, thi… |
CVE-2025-61724 | Medium | 5.3 | 2025-10-29 | The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large… |
CVE-2025-61723 | High | 7.5 | 2025-10-29 | The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM… |
CVE-2025-58189 | Medium | 5.3 | 2025-10-29 | When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escap… |
CVE-2025-58188 | High | 7.5 | 2025-10-29 | Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method… |
CVE-2025-58187 | High | 7.5 | 2025-10-29 | Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate… |
CVE-2025-58186 | Medium | 5.3 | 2025-10-29 | Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such… |
CVE-2025-58185 | Medium | 5.3 | 2025-10-29 | Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. |
CVE-2025-58183 | Medium | 4.3 | 2025-10-29 | tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a l… |
CVE-2025-54549 | Medium | 5.9 | 2025-10-29 | Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO |
CVE-2025-54548 | Medium | 4.3 | 2025-10-29 | On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) |
CVE-2025-54547 | Medium | 5.3 | 2025-10-29 | On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could per… |
CVE-2025-54546 | High | 7.5 | 2025-10-29 | On affected platforms, restricted users could use SSH port forwarding to access host-internal services |
CVE-2025-54545 | High | 7.8 | 2025-10-29 | On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. |
CVE-2025-47912 | Medium | 5.3 | 2025-10-29 | The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 address… |
CVE-2025-61959 | Medium | 5.3 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framew… |
CVE-2025-54459 | High | 7.5 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote at… |
CVE-2025-9871 | High | 7.8 | 2025-10-29 | Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on aff… |
CVE-2025-9870 | High | 7.8 | 2025-10-29 | Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-9869 | High | 7.8 | 2025-10-29 | Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2025-60320 | Medium | 6.7 | 2025-10-29 | memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The affected service is… |
CVE-2025-11466 | Medium | 4.9 | 2025-10-29 | Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2025-11465 | High | 7.8 | 2025-10-29 | Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-11464 | High | 7.8 | 2025-10-29 | Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-11463 | High | 7.8 | 2025-10-29 | Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-11203 | Low | 3.5 | 2025-10-29 | LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affect… |
CVE-2025-11202 | Critical | 9.8 | 2025-10-29 | win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-11201 | Critical | 9.8 | 2025-10-29 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-11200 | Critical | 9.8 | 2025-10-29 | MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2025-10934 | High | 7.8 | 2025-10-29 | GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-10925 | High | 7.8 | 2025-10-29 | GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-10924 | High | 7.8 | 2025-10-29 | GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2025-10923 | High | 7.8 | 2025-10-29 | GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i… |