2025 CVEs (page 135)
Page 135 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-35981 | Medium | 5.5 | 2025-10-23 | Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal… |
CVE-2025-12104 | Critical | 9.8 | 2025-10-23 | Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11575 | High | 7.8 | 2025-10-23 | Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC d… |
CVE-2025-62710 | Medium | 5.9 | 2025-10-22 | Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (s… |
CVE-2025-62708 | High | 7.5 | 2025-10-22 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large m… |
CVE-2025-62707 | High | 7.5 | 2025-10-22 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infi… |
CVE-2025-62706 | Medium | 6.5 | 2025-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decomp… |
CVE-2025-62705 | Medium | 4.9 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when releva… |
CVE-2025-62617 | High | 7.2 | 2025-10-22 | Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data… |
CVE-2025-62614 | | 2025-10-22 | BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in… | |
CVE-2025-62613 | | 2025-10-22 | VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scri… | |
CVE-2025-62612 | Medium | 5.3 | 2025-10-22 | FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk… |
CVE-2025-62611 | | 2025-10-22 | aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local fi… | |
CVE-2025-62610 | High | 8.1 | 2025-10-22 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does… |
CVE-2025-62513 | High | 7.5 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP b… |
CVE-2025-62247 | Medium | 6.5 | 2025-10-22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 th… |
CVE-2025-62248 | Medium | 4.8 | 2025-10-22 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay… |
CVE-2025-58712 | Medium | 6.4 | 2025-10-22 | A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable perm… |
CVE-2025-60343 | High | 7.5 | 2025-10-22 | Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafte… |
CVE-2025-60342 | High | 7.5 | 2025-10-22 | Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function. This vulnerability allows attackers to… |
CVE-2025-60341 | High | 7.5 | 2025-10-22 | Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast_setting_wifi_set function. This vulnerability allows at… |
CVE-2025-60340 | High | 7.5 | 2025-10-22 | Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted… |
CVE-2025-60339 | High | 7.5 | 2025-10-22 | Multiple buffer overflow vulnerabilities in the openSchedWifi function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injec… |
CVE-2025-60337 | High | 7.5 | 2025-10-22 | Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed_dir parameter in the SetSpeedWan function. This vulnerability allows attack… |
CVE-2025-60336 | High | 7.5 | 2025-10-22 | A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a craft… |
CVE-2025-24934 | Medium | 5.4 | 2025-10-22 | Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a loa… |
CVE-2025-22178 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22177 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22176 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22175 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22174 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22173 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22172 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22171 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users. |
CVE-2025-22170 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular… |
CVE-2025-22169 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22168 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-11958 | Medium | 4.1 | 2025-10-22 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a… |
CVE-2025-11957 | High | 8.4 | 2025-10-22 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or app… |
CVE-2025-8677 | High | 7.5 | 2025-10-22 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions… |
CVE-2025-62659 | | 2025-10-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent e… | |
CVE-2025-62607 | Medium | 5.3 | 2025-10-22 | Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service… |
CVE-2025-60338 | High | 7.5 | 2025-10-22 | Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers… |
CVE-2025-60335 | High | 7.5 | 2025-10-22 | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTT… |
CVE-2025-60334 | High | 7.5 | 2025-10-22 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability… |
CVE-2025-60333 | High | 7.5 | 2025-10-22 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerab… |
CVE-2025-40780 | High | 8.6 | 2025-10-22 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source po… |
CVE-2025-40778 | High | 8.6 | 2025-10-22 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue aff… |
CVE-2025-23299 | Medium | 6.7 | 2025-10-22 | NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbi… |
CVE-2025-62606 | High | 8.8 | 2025-10-22 | my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL in… |
CVE-2025-62604 | High | 7.5 | 2025-10-22 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allo… |
CVE-2025-62526 | High | 7.9 | 2025-10-22 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registrati… |
CVE-2025-62525 | High | 7.9 | 2025-10-22 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory usin… |
CVE-2025-62073 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9. |
CVE-2025-62072 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33. |
CVE-2025-62071 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social… |
CVE-2025-62070 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13. |
CVE-2025-62069 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.T… |
CVE-2025-62068 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a thro… |
CVE-2025-62063 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.Thi… |
CVE-2025-62062 | Medium | 5.5 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data… |
CVE-2025-62061 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <=… |
CVE-2025-62060 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab… |
CVE-2025-62058 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-func… |
CVE-2025-62054 | High | 7.5 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionalit… |
CVE-2025-62052 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a… |
CVE-2025-62048 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through… |
CVE-2025-62042 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event… |
CVE-2025-62029 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themesion Grevo grevo.This issue affec… |
CVE-2025-62027 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3. |
CVE-2025-62026 | Medium | 4.3 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-62025 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8. |
CVE-2025-62024 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue af… |
CVE-2025-62023 | Critical | 9.0 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through <=… |
CVE-2025-62022 | High | 7.5 | 2025-10-22 | Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4. |
CVE-2025-62021 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3. |
CVE-2025-62020 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This iss… |
CVE-2025-62019 | Medium | 6.5 | 2025-10-22 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks f… |
CVE-2025-62015 | High | 7.6 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons ad… |
CVE-2025-62013 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0. |
CVE-2025-62009 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Re… |
CVE-2025-62008 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For Woo… |
CVE-2025-62007 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a… |
CVE-2025-62006 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1. |
CVE-2025-62005 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This iss… |
CVE-2025-60332 | High | 7.5 | 2025-10-22 | A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of Service (DoS) via a craft… |
CVE-2025-60331 | High | 7.5 | 2025-10-22 | D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint. This vulnerability allow… |
CVE-2025-60246 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calcul… |
CVE-2025-60238 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <=… |
CVE-2025-60234 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: fro… |
CVE-2025-60232 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro… |
CVE-2025-60228 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a throug… |
CVE-2025-60227 | High | 8.6 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue af… |
CVE-2025-60226 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a throu… |
CVE-2025-60225 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <… |
CVE-2025-60224 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe t… |
CVE-2025-60222 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affect… |
CVE-2025-60221 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync… |
CVE-2025-60220 | Critical | 9.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 3.0.0. |
CVE-2025-60217 | High | 7.7 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This… |