2025 CVEs (page 13)
Page 13 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57834 | High | 7.5 | 2026-04-06 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-54602 | High | 7.0 | 2026-04-06 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-54328 | Critical | 10.0 | 2026-04-06 | An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-58349 | Critical | 9.1 | 2026-04-06 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-54324 | High | 7.5 | 2026-04-06 | An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-48651 | Medium | 5.5 | 2026-04-06 | In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead… |
CVE-2025-61166 | Medium | 6.1 | 2026-04-06 | An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2025-59440 | High | 7.5 | 2026-04-06 | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-57835 | High | 7.5 | 2026-04-06 | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-47400 | High | 7.1 | 2026-04-06 | Cryptographic issue while copying data to a destination buffer without validating its size. |
CVE-2025-47392 | High | 8.8 | 2026-04-06 | Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
CVE-2025-47391 | High | 7.8 | 2026-04-06 | Memory corruption while processing a frame request from user. |
CVE-2025-47390 | High | 7.8 | 2026-04-06 | Memory corruption while preprocessing IOCTL request in JPEG driver. |
CVE-2025-47389 | High | 7.8 | 2026-04-06 | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. |
CVE-2025-47374 | Medium | 6.5 | 2026-04-06 | Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling. |
CVE-2025-14938 | Medium | 5.3 | 2026-04-04 | The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_… |
CVE-2025-15064 | Medium | 6.4 | 2026-04-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-13368 | Medium | 6.4 | 2026-04-04 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting… |
CVE-2025-10681 | High | 8.6 | 2026-04-03 | Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire withi… |
CVE-2025-68153 | Medium | 6.5 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-68152 | Medium | 4.9 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-64340 | Medium | 6.7 | 2026-04-03 | FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause comma… |
CVE-2025-59711 | High | 8.3 | 2026-04-03 | An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to w… |
CVE-2025-59710 | High | 8.8 | 2026-04-03 | An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading… |
CVE-2025-59709 | Medium | 6.8 | 2026-04-03 | An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is… |
CVE-2025-7024 | High | 7.3 | 2026-04-03 | Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbi… |
CVE-2025-15620 | High | 8.6 | 2026-04-02 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows re… |
CVE-2025-43264 | High | 8.8 | 2026-04-02 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process me… |
CVE-2025-43257 | High | 8.7 | 2026-04-02 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox. |
CVE-2025-43238 | Medium | 6.2 | 2026-04-02 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
CVE-2025-43236 | Low | 3.3 | 2026-04-02 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An at… |
CVE-2025-43219 | High | 8.8 | 2026-04-02 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process me… |
CVE-2025-43210 | Medium | 6.3 | 2026-04-02 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6… |
CVE-2025-43202 | High | 8.8 | 2026-04-02 | This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memo… |
CVE-2025-65114 | High | 7.5 | 2026-04-02 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 1… |
CVE-2025-58136 | High | 7.5 | 2026-04-02 | A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 thro… |
CVE-2025-66487 | Low | 2.7 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flood… |
CVE-2025-66486 | Medium | 4.8 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-66485 | Medium | 5.4 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2025-66484 | Medium | 5.5 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2025-66483 | Medium | 6.3 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user o… |
CVE-2025-36375 | Medium | 6.5 | 2026-04-01 | IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 th… |
CVE-2025-36373 | Medium | 4.1 | 2026-04-01 | IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 th… |
CVE-2025-13916 | Medium | 5.9 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2025-66442 | Medium | 5.1 | 2026-04-01 | In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature… |
CVE-2025-67807 | Medium | 4.7 | 2026-04-01 | The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2025-67805 | Medium | 5.9 | 2026-04-01 | A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensiti… |
CVE-2025-13535 | Medium | 6.4 | 2026-04-01 | The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions… |
CVE-2025-15484 | Critical | 9.1 | 2026-04-01 | The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated req… |
CVE-2025-71282 | High | 7.5 | 2026-04-01 | XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain informatio… |
CVE-2025-71281 | High | 8.8 | 2026-04-01 | XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match fo… |
CVE-2025-71280 | Medium | 6.2 | 2026-04-01 | XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine… |
CVE-2025-71279 | Critical | 9.8 | 2026-04-01 | XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of… |
CVE-2025-71278 | High | 8.8 | 2026-04-01 | XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo… |
CVE-2025-13855 | High | 7.6 | 2026-04-01 | IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements… |
CVE-2025-62184 | Low | 3.4 | 2026-03-31 | Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… |
CVE-2025-14213 | | 2026-03-31 | Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interf… | |
CVE-2025-15618 | Critical | 9.1 | 2026-03-31 | Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTransaction generates a… |
CVE-2025-41357 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim'… |
CVE-2025-41356 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim'… |
CVE-2025-41355 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victi… |
CVE-2025-10559 | High | 7.1 | 2026-03-31 | A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPE… |
CVE-2025-10553 | High | 8.7 | 2026-03-31 | A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x thr… |
CVE-2025-10551 | High | 8.7 | 2026-03-31 | A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x thr… |
CVE-2025-32957 | High | 8.7 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then autom… |
CVE-2025-66215 | Low | 3.8 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or adminis… |
CVE-2025-66038 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In com… |
CVE-2025-66037 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to p… |
CVE-2025-49010 | Low | 3.8 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or adminis… |
CVE-2025-3716 | | 2026-03-30 | User enumeration in ESET Protect (on-prem) via Response Timing. | |
CVE-2025-15379 | Critical | 9.8 | 2026-03-30 | A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` fu… |
CVE-2025-15036 | Critical | 10.0 | 2026-03-30 | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow… |
CVE-2025-7741 | | 2026-03-30 | Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used for CENTUM Authenti… | |
CVE-2025-15604 | Critical | 9.8 | 2026-03-28 | Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.06 through 6.16, the random_string func… |
CVE-2025-9497 | Critical | 9.8 | 2026-03-28 | Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: befo… |
CVE-2025-15445 | Medium | 5.4 | 2026-03-28 | The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, lik… |
CVE-2025-12886 | High | 7.2 | 2026-03-28 | The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX… |
CVE-2025-15612 | Medium | 4.8 | 2026-03-27 | Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS cer… |
CVE-2025-15617 | Medium | 6.5 | 2026-03-27 | Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded ar… |
CVE-2025-15616 | Medium | 6.7 | 2026-03-27 | Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers… |
CVE-2025-15615 | Medium | 5.8 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerab… |
CVE-2025-15381 | High | 7.1 | 2026-03-27 | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This… |
CVE-2025-69988 | Medium | 6.5 | 2026-03-27 | BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated attacker in physical proximity can associate with this open netwo… |
CVE-2025-69986 | High | 7.2 | 2026-03-27 | A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application fails to validate the length of the Pro… |
CVE-2025-61190 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionality. The vulnerabil… |
CVE-2025-13478 | | 2026-03-27 | Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via… | |
CVE-2025-59032 | High | 7.5 | 2026-03-27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unava… |
CVE-2025-59031 | Medium | 4.3 | 2026-03-27 | Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted… |
CVE-2025-59028 | Medium | 5.3 | 2026-03-27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 d… |
CVE-2025-12805 | High | 8.1 | 2026-03-26 | A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other… |
CVE-2025-55264 | Medium | 5.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control… |
CVE-2025-55263 | High | 7.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories… |
CVE-2025-55262 | High | 8.3 | 2026-03-26 | HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database. |
CVE-2025-55261 | High | 8.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the applicat… |
CVE-2025-55277 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the… |
CVE-2025-55276 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout. |
CVE-2025-55275 | Low | 3.7 | 2026-03-26 | HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an… |
CVE-2025-55274 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to a… |
CVE-2025-55273 | Medium | 4.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker using external scripts can tamper with the DOM, altering the con… |