2025 CVEs (page 129)
Page 129 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40058 | High | 8.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on… |
CVE-2025-40057 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This… | |
CVE-2025-40056 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't… | |
CVE-2025-40055 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->c… | |
CVE-2025-40054 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF issue in f2fs_merge_page_bio() As JY reported in bugzilla [1], Unable to h… |
CVE-2025-40053 | High | 7.5 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `n… |
CVE-2025-40052 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterl… | |
CVE-2025-40051 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_… |
CVE-2025-40050 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer In check_alu_op(), the verifi… | |
CVE-2025-40049 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-valu… | |
CVE-2025-40048 | High | 7.5 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interru… |
CVE-2025-40047 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful retur… |
CVE-2025-40046 | High | 8.6 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request ca… |
CVE-2025-40045 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd937x: set the comp soundwire port correctly For some reason we endup wit… |
CVE-2025-40044 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descrip… |
CVE-2025-40043 | High | 8.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized… |
CVE-2025-40042 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference The… | |
CVE-2025-40041 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign-extend struct ops return values properly The ns_bpf_qdisc selftest t… |
CVE-2025-40040 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following cras… |
CVE-2025-40039 | High | 8.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray ma… |
CVE-2025-40038 | High | 7.1 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and H… |
CVE-2025-40037 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can… | |
CVE-2025-40036 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpc_put_args copy_to_user() failure would cau… | |
CVE-2025-40035 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effe… | |
CVE-2025-40034 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplie… | |
CVE-2025-40033 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rpr… | |
CVE-2025-40032 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release The fields dm… | |
CVE-2025-40031 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for… | |
CVE-2025-40030 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract… | |
CVE-2025-40029 | | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platform_get_resource() platform_get_resource() return… | |
CVE-2025-55758 | Medium | 5.4 | 2025-10-28 | Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered. |
CVE-2025-41090 | | 2025-10-28 | microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other… | |
CVE-2025-40028 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when try… |
CVE-2025-40027 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: … |
CVE-2025-40026 | High | 7.9 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emu… |
CVE-2025-40025 | High | 7.8 | 2025-10-28 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below… |
CVE-2025-10151 | | 2025-10-28 | Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects smartLin… | |
CVE-2025-10150 | | 2025-10-28 | Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects smartLink HW-PN: from 1.02 thro… | |
CVE-2025-12378 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. P… |
CVE-2025-11735 | High | 7.5 | 2025-10-28 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions u… |
CVE-2025-62777 | High | 8.8 | 2025-10-28 | Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affect… |
CVE-2025-10939 | Low | 3.7 | 2025-10-28 | A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occur… |
CVE-2025-12347 | Medium | 6.3 | 2025-10-28 | A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file… |
CVE-2025-12346 | Medium | 6.3 | 2025-10-28 | A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-… |
CVE-2025-12344 | Medium | 6.3 | 2025-10-28 | A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the com… |
CVE-2025-12342 | High | 7.3 | 2025-10-28 | A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login… |
CVE-2025-12341 | High | 7.8 | 2025-10-28 | A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete… |
CVE-2025-12339 | High | 7.3 | 2025-10-28 | A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-12338 | High | 7.3 | 2025-10-28 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.p… |
CVE-2025-12337 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Pe… |
CVE-2025-12336 | High | 7.3 | 2025-10-28 | A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-43024 | High | 7.5 | 2025-10-28 | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
CVE-2025-33133 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33132 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33131 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33126 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1… |
CVE-2025-12335 | Medium | 4.3 | 2025-10-28 | A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_… |
CVE-2025-12332 | Low | 2.4 | 2025-10-28 | A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulat… |
CVE-2025-62259 | Medium | 5.4 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through u… |
CVE-2025-62258 | Medium | 6.5 | 2025-10-27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA thr… |
CVE-2025-12334 | Medium | 4.3 | 2025-10-27 | A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the… |
CVE-2025-12333 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation… |
CVE-2025-62793 | Medium | 6.8 | 2025-10-27 | eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an… |
CVE-2025-62781 | Medium | 5.0 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password whi… |
CVE-2025-62779 | Medium | 5.4 | 2025-10-27 | Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input… |
CVE-2025-62778 | Medium | 5.3 | 2025-10-27 | Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the… |
CVE-2025-62261 | Medium | 6.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through up… |
CVE-2025-62260 | High | 7.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported v… |
CVE-2025-12331 | Medium | 4.7 | 2025-10-27 | A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted… |
CVE-2025-12330 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add… |
CVE-2025-12329 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the fil… |
CVE-2025-12328 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Impacted is an unknown function of the file /contestproblem… |
CVE-2025-62784 | Medium | 5.3 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with th… |
CVE-2025-62783 | Medium | 5.0 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using… |
CVE-2025-62782 | Medium | 5.3 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiSt… |
CVE-2025-62725 | | 2025-10-27 | Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.do… | |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-62523 | Medium | 6.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misco… |
CVE-2025-62262 | Medium | 4.4 | 2025-10-27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Lifera… |
CVE-2025-12327 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /des… |
CVE-2025-12326 | High | 7.3 | 2025-10-27 | A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php… |
CVE-2025-12325 | High | 7.3 | 2025-10-27 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The man… |
CVE-2025-12322 | High | 8.8 | 2025-10-27 | A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a mani… |
CVE-2025-12316 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The mani… |
CVE-2025-62594 | Medium | 4.7 | 2025-10-27 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service d… |
CVE-2025-62263 | Medium | 5.4 | 2025-10-27 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through upda… |
CVE-2025-61105 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c. This vulnerabil… |
CVE-2025-61102 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vul… |
CVE-2025-61101 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c. Thi… |
CVE-2025-59151 | High | 8.2 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-58356 | | 2025-10-27 | Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted… | |
CVE-2025-12315 | Medium | 4.7 | 2025-10-27 | A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulatio… |
CVE-2025-12314 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing… |
CVE-2025-12313 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipu… |
CVE-2025-12312 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of… |
CVE-2025-12311 | Low | 2.4 | 2025-10-27 | A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php… |
CVE-2025-12310 | Medium | 5.3 | 2025-10-27 | A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/_settings of the component E… |
CVE-2025-62253 | Medium | 6.1 | 2025-10-27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3… |
CVE-2025-61100 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c. This vulne… |
CVE-2025-61099 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c. This vulnera… |