2025 CVEs (page 127)
Page 127 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10922 | High | 7.8 | 2025-10-29 | GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-10921 | High | 7.8 | 2025-10-29 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-10920 | High | 7.8 | 2025-10-29 | GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2025-64104 | High | 7.3 | 2025-10-29 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGr… |
CVE-2025-64103 | Critical | 9.8 | 2025-10-29 | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMF… |
CVE-2025-64102 | Critical | 9.8 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP… |
CVE-2025-64101 | High | 8.1 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mecha… |
CVE-2025-61876 | Medium | 5.0 | 2025-10-29 | Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to… |
CVE-2025-64100 | Medium | 6.1 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attac… |
CVE-2025-62797 | | 2025-10-29 | FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based w… | |
CVE-2025-57227 | High | 7.8 | 2025-10-29 | An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted executable file into… |
CVE-2025-11232 | High | 7.5 | 2025-10-29 | To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-… |
CVE-2025-62792 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match(… |
CVE-2025-62791 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the… |
CVE-2025-62790 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_fetch_attributes_state() implementation does… |
CVE-2025-62789 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_alert() implementation does not check whethe… |
CVE-2025-62788 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, w_copy_event_for_log() references memory (initia… |
CVE-2025-62787 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when… |
CVE-2025-61234 | High | 7.5 | 2025-10-29 | Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows a… |
CVE-2025-60595 | High | 8.2 | 2025-10-29 | SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. |
CVE-2025-56558 | Low | 3.0 | 2025-10-29 | The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_… |
CVE-2025-1549 | | 2025-10-29 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elev… | |
CVE-2025-12479 | High | 8.8 | 2025-10-29 | Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12478 | Critical | 9.8 | 2025-10-29 | Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12477 | Critical | 9.8 | 2025-10-29 | Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12476 | Critical | 9.8 | 2025-10-29 | Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-62786 | High | 8.1 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based out-of-bounds WRITE occurs in decode_win_permissions… |
CVE-2025-62785 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. fillData() implementation does not check whether value is NULL or… |
CVE-2025-60898 | Medium | 5.8 | 2025-10-29 | An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the se… |
CVE-2025-60542 | Medium | 6.5 | 2025-10-29 | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjec… |
CVE-2025-54384 | Medium | 6.3 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() functio… |
CVE-2025-12148 | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fie… | |
CVE-2025-12147 | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule… | |
CVE-2025-63622 | Critical | 9.8 | 2025-10-29 | A vulnerability was found in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/admin/subcategory.php. This m… |
CVE-2025-61429 | High | 8.8 | 2025-10-29 | An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request. |
CVE-2025-61156 | High | 7.8 | 2025-10-29 | Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via… |
CVE-2025-10932 | High | 8.2 | 2025-10-29 | Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, fro… |
CVE-2025-64150 | Medium | 5.4 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2025-64149 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2025-64148 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-64147 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and c… |
CVE-2025-64146 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with It… |
CVE-2025-64145 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe… |
CVE-2025-64144 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi… |
CVE-2025-64143 | Medium | 4.3 | 2025-10-29 | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b… |
CVE-2025-64142 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2025-64141 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2025-64140 | High | 8.8 | 2025-10-29 | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permiss… |
CVE-2025-64139 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-… |
CVE-2025-64138 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specif… |
CVE-2025-64137 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP se… |
CVE-2025-64136 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2025-64135 | Medium | 5.9 | 2025-10-29 | Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value… |
CVE-2025-64134 | High | 7.1 | 2025-10-29 | Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external en… |
CVE-2025-64133 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandb… |
CVE-2025-64132 | Medium | 5.4 | 2025-10-29 | Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and ob… |
CVE-2025-64131 | High | 7.5 | 2025-10-29 | Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentica… |
CVE-2025-61161 | High | 8.4 | 2025-10-29 | DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search path (C:\ProgramData\… |
CVE-2025-40085 | | 2025-10-29 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_ca… | |
CVE-2025-40084 | High | 7.1 | 2025-10-29 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() deref… |
CVE-2025-40083 | | 2025-10-29 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_deq… | |
CVE-2025-11632 | Medium | 4.3 | 2025-10-29 | The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability c… |
CVE-2025-11587 | Medium | 4.3 | 2025-10-29 | The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2025-12142 | Medium | 6.1 | 2025-10-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.3… |
CVE-2025-12461 | | 2025-10-29 | This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this… | |
CVE-2025-12450 | Medium | 6.1 | 2025-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insuffic… |
CVE-2025-64291 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allow… |
CVE-2025-64290 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This i… |
CVE-2025-64289 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premme… |
CVE-2025-64288 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a throu… |
CVE-2025-64286 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a thro… |
CVE-2025-64285 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrec… |
CVE-2025-64284 | High | 7.5 | 2025-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support maje… |
CVE-2025-64283 | Medium | 6.5 | 2025-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-64234 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Acce… |
CVE-2025-64229 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64228 | Medium | 4.3 | 2025-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded… |
CVE-2025-64226 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: fro… |
CVE-2025-64220 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issu… |
CVE-2025-64219 | Medium | 4.3 | 2025-10-29 | Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64216 | High | 7.5 | 2025-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows… |
CVE-2025-64212 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configur… |
CVE-2025-64211 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly C… |
CVE-2025-64210 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Acce… |
CVE-2025-64208 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-… |
CVE-2025-64204 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This iss… |
CVE-2025-64202 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue aff… |
CVE-2025-64201 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Pod… |
CVE-2025-64200 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2025-64199 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-64197 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affe… |
CVE-2025-64195 | High | 7.5 | 2025-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local… |
CVE-2025-64194 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affect… |
CVE-2025-60075 | High | 7.1 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin… |
CVE-2025-58939 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super… |
CVE-2025-58711 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue af… |
CVE-2025-12058 | | 2025-10-29 | The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading… | |
CVE-2025-11702 | High | 8.5 | 2025-10-29 | GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an auth… |
CVE-2025-9544 | Medium | 6.5 | 2025-10-29 | The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result… |
CVE-2025-62776 | High | 7.8 | 2025-10-29 | The installer of WTW EAGLE (for Windows) 3.0.8.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a… |