2025 CVEs (page 127)
Page 127 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48980 | Medium | 6.5 | 2025-10-31 | In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect th… |
CVE-2025-27208 | Medium | 6.1 | 2025-10-31 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the us… |
CVE-2025-34298 | High | 8.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own em… |
CVE-2025-34287 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-… |
CVE-2025-34286 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/e… |
CVE-2025-34284 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an… |
CVE-2025-34283 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user witho… |
CVE-2025-34280 | High | 7.2 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal o… |
CVE-2025-34278 | Medium | 5.4 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator men… |
CVE-2025-34277 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before bei… |
CVE-2025-34274 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the r… |
CVE-2025-34273 | Medium | 6.5 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards… |
CVE-2025-34272 | Medium | 6.5 | 2025-10-30 | In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an emp… |
CVE-2025-34271 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes o… |
CVE-2025-34270 | Medium | 4.9 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field dur… |
CVE-2025-34135 | Medium | 4.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit… |
CVE-2025-34134 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validat… |
CVE-2025-8850 | High | 8.8 | 2025-10-30 | In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA… |
CVE-2025-63423 | High | 7.5 | 2025-10-30 | Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password. |
CVE-2025-61498 | High | 7.5 | 2025-10-30 | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet. |
CVE-2025-61141 | High | 7.5 | 2025-10-30 | sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and con… |
CVE-2025-3356 | High | 8.6 | 2025-10-30 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a spe… |
CVE-2025-3355 | High | 7.5 | 2025-10-30 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a spe… |
CVE-2025-63422 | High | 7.5 | 2025-10-30 | Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitr… |
CVE-2025-63298 | High | 8.2 | 2025-10-30 | A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authen… |
CVE-2025-62265 | Medium | 5.4 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4… |
CVE-2025-57109 | Medium | 6.5 | 2025-10-30 | Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene… |
CVE-2025-52180 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript vi… |
CVE-2025-52179 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2025-36137 | High | 7.2 | 2025-10-30 | IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns… |
CVE-2025-64118 | | 2025-10-30 | node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file… | |
CVE-2025-64116 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validatio… |
CVE-2025-64115 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly… |
CVE-2025-64112 | High | 8.0 | 2025-10-30 | Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with… |
CVE-2025-62266 | Medium | 6.1 | 2025-10-30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10… |
CVE-2025-56313 | Medium | 6.1 | 2025-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote at… |
CVE-2025-64096 | High | 8.8 | 2025-10-30 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-63885 | Medium | 6.1 | 2025-10-30 | A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-62795 | High | 7.1 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged auth… |
CVE-2025-62726 | High | 8.8 | 2025-10-30 | n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both… |
CVE-2025-61196 | High | 8.8 | 2025-10-30 | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. |
CVE-2025-61121 | High | 7.5 | 2025-10-30 | Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerabi… |
CVE-2025-61120 | High | 7.5 | 2025-10-30 | AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabi… |
CVE-2025-61119 | High | 7.5 | 2025-10-30 | Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain… |
CVE-2025-61114 | High | 7.5 | 2025-10-30 | 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulner… |
CVE-2025-60950 | Medium | 6.1 | 2025-10-30 | An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG… |
CVE-2025-60319 | Medium | 6.5 | 2025-10-30 | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.j… |
CVE-2025-12060 | | 2025-10-30 | The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Pyth… | |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2025-61118 | High | 7.5 | 2025-10-30 | mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers ma… |
CVE-2025-61117 | High | 7.5 | 2025-10-30 | Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By ex… |
CVE-2025-61116 | High | 7.5 | 2025-10-30 | AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control… |
CVE-2025-61115 | High | 7.5 | 2025-10-30 | ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an impr… |
CVE-2025-61113 | High | 7.5 | 2025-10-30 | TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain se… |
CVE-2025-46363 | Medium | 4.3 | 2025-10-30 | Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG… |
CVE-2025-36592 | Medium | 5.4 | 2025-10-30 | Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Gener… |
CVE-2025-12517 | Medium | 5.3 | 2025-10-30 | Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12516 | Critical | 9.8 | 2025-10-30 | Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12515 | Critical | 9.8 | 2025-10-30 | Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-11998 | | 2025-10-30 | The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited und… | |
CVE-2025-5347 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. |
CVE-2025-5343 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. |
CVE-2025-5342 | Medium | 4.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. |
CVE-2025-50574 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary… |
CVE-2025-46423 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-46422 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43942 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43027 | Critical | 9.8 | 2025-10-30 | A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to t… |
CVE-2025-50739 | Critical | 9.8 | 2025-10-30 | iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization. |
CVE-2025-50736 | Medium | 6.1 | 2025-10-30 | An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arb… |
CVE-2025-43941 | High | 7.2 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43940 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-43939 | High | 7.8 | 2025-10-30 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-63608 | Medium | 5.4 | 2025-10-30 | A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form… |
CVE-2025-10348 | | 2025-10-30 | URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a ma… | |
CVE-2025-10317 | | 2025-10-30 | Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by t… | |
CVE-2025-53883 | | 2025-10-30 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS… | |
CVE-2025-53880 | | 2025-10-30 | A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the… | |
CVE-2025-39663 | High | 8.4 | 2025-10-30 | Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service output… |
CVE-2025-62503 | Medium | 4.6 | 2025-10-30 | User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action. |
CVE-2025-62402 | Medium | 5.4 | 2025-10-30 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Da… |
CVE-2025-54941 | Medium | 4.6 | 2025-10-30 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on w… |
CVE-2025-54471 | Medium | 6.5 | 2025-10-30 | NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used… |
CVE-2025-54470 | High | 8.6 | 2025-10-30 | This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends an… |
CVE-2025-54469 | Critical | 9.9 | 2025-10-30 | A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be ex… |
CVE-2025-40105 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on so… |
CVE-2025-40104 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backwa… |
CVE-2025-40103 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues… | |
CVE-2025-40102 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug… | |
CVE-2025-40101 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the en… | |
CVE-2025-40100 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, w… | |
CVE-2025-40099 | Critical | 9.4 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send i… |
CVE-2025-40098 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return… | |
CVE-2025-40097 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __compone… | |
CVE-2025-40096 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding d… |
CVE-2025-40095 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the… |
CVE-2025-40094 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_acm: Refactor bind path to use __free() After an bind/unbind cycle, the ac… |
CVE-2025-40093 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ec… |
CVE-2025-40092 | High | 7.8 | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the nc… |
CVE-2025-40091 | | 2025-10-30 | In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in… |