2025 CVEs (page 135)
Page 135 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60551 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot. |
CVE-2025-60550 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. |
CVE-2025-60549 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4. |
CVE-2025-60548 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings. |
CVE-2025-60547 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7. |
CVE-2025-12176 | Critical | 9.8 | 2025-10-24 | Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BL… |
CVE-2025-8536 | | 2025-10-24 | A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Inj… | |
CVE-2025-61430 | Medium | 6.5 | 2025-10-24 | Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request p… |
CVE-2025-60938 | High | 7.5 | 2025-10-24 | Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the ta… |
CVE-2025-60936 | Medium | 6.1 | 2025-10-24 | Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicio… |
CVE-2025-60572 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork. |
CVE-2025-60571 | High | 7.5 | 2025-10-24 | D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS. |
CVE-2025-60570 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery. |
CVE-2025-60569 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute. |
CVE-2025-60568 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall. |
CVE-2025-56438 | Medium | 6.8 | 2025-10-24 | An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privil… |
CVE-2025-43995 | Critical | 9.8 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote ac… |
CVE-2025-43994 | High | 8.6 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-46425 | Medium | 6.5 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privil… |
CVE-2025-46185 | Medium | 6.2 | 2025-10-24 | An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and… |
CVE-2025-46183 | High | 8.2 | 2025-10-24 | The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file… |
CVE-2025-40024 | High | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a t… |
CVE-2025-40023 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_C… | |
CVE-2025-40022 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto… | |
CVE-2025-40021 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interfac… | |
CVE-2025-40020 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the n… | |
CVE-2025-11576 | Medium | 4.3 | 2025-10-24 | The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and incl… |
CVE-2025-40019 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check t… | |
CVE-2025-40018 | High | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_… |
CVE-2025-10861 | High | 7.5 | 2025-10-24 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Reques… |
CVE-2025-5605 | Medium | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate… |
CVE-2025-5350 | Medium | 5.9 | 2025-10-24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users… |
CVE-2025-36361 | Medium | 6.3 | 2025-10-24 | IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on cust… |
CVE-2025-12136 | Medium | 6.8 | 2025-10-24 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-12134 | Medium | 5.3 | 2025-10-24 | The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized m… |
CVE-2025-10680 | High | 8.8 | 2025-10-24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown… |
CVE-2025-12096 | Medium | 6.4 | 2025-10-24 | The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up t… |
CVE-2025-12072 | Medium | 4.3 | 2025-10-24 | The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. Th… |
CVE-2025-12028 | High | 8.8 | 2025-10-24 | The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verifi… |
CVE-2025-12017 | Medium | 6.1 | 2025-10-24 | The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including… |
CVE-2025-12016 | Medium | 4.4 | 2025-10-24 | The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and incl… |
CVE-2025-12014 | Medium | 4.3 | 2025-10-24 | The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer… |
CVE-2025-11992 | Medium | 6.1 | 2025-10-24 | The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to mis… |
CVE-2025-11889 | High | 7.2 | 2025-10-24 | The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import funct… |
CVE-2025-11887 | Medium | 4.3 | 2025-10-24 | The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versi… |
CVE-2025-11504 | High | 7.5 | 2025-10-24 | The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plug… |
CVE-2025-11257 | Medium | 4.3 | 2025-10-24 | The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blog… |
CVE-2025-11253 | Critical | 9.8 | 2025-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. Th… |
CVE-2025-11172 | Medium | 4.3 | 2025-10-24 | The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse… |
CVE-2025-10902 | Medium | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove'… |
CVE-2025-10901 | Medium | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' functio… |
CVE-2025-10749 | Medium | 5.4 | 2025-10-24 | The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5… |
CVE-2025-10748 | Medium | 6.5 | 2025-10-24 | The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficien… |
CVE-2025-10740 | Medium | 6.3 | 2025-10-24 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capabili… |
CVE-2025-10701 | Medium | 6.4 | 2025-10-24 | The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all… |
CVE-2025-6440 | Critical | 9.8 | 2025-10-24 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file upl… |
CVE-2025-62868 | High | 8.1 | 2025-10-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local… |
CVE-2025-9978 | Medium | 6.8 | 2025-10-24 | The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vu… |
CVE-2025-9158 | | 2025-10-24 | The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sa… | |
CVE-2025-61931 | Medium | 5.4 | 2025-10-24 | Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a… |
CVE-2025-58070 | Medium | 6.1 | 2025-10-24 | Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged… |
CVE-2025-10874 | Medium | 5.5 | 2025-10-24 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used… |
CVE-2025-10723 | Low | 2.7 | 2025-10-24 | The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any… |
CVE-2025-7730 | Medium | 6.4 | 2025-10-23 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5… |
CVE-2025-62254 | High | 7.5 | 2025-10-23 | The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023… |
CVE-2025-60023 | Medium | 4.0 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-59776 | Medium | 4.0 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-58429 | High | 7.5 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-62688 | High | 7.1 | 2025-10-23 | An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allo… |
CVE-2025-62498 | High | 8.8 | 2025-10-23 | A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker who ca… |
CVE-2025-61977 | High | 7.0 | 2025-10-23 | A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allo… |
CVE-2025-61934 | Critical | 10.0 | 2025-10-23 | A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthentica… |
CVE-2025-59503 | Critical | 10.0 | 2025-10-23 | Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-59500 | High | 7.7 | 2025-10-23 | Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-59273 | High | 7.3 | 2025-10-23 | Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-58456 | Medium | 6.8 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote… |
CVE-2025-58078 | High | 7.5 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote… |
CVE-2025-12100 | High | 7.8 | 2025-10-23 | Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1… |
CVE-2025-62517 | Medium | 5.9 | 2025-10-23 | Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prot… |
CVE-2025-62236 | Medium | 5.3 | 2025-10-23 | The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote… |
CVE-2025-58428 | Critical | 9.9 | 2025-10-23 | The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attacker… |
CVE-2025-57848 | Medium | 6.4 | 2025-10-23 | A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-55067 | High | 7.1 | 2025-10-23 | The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038… |
CVE-2025-54966 | Medium | 4.3 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situati… |
CVE-2025-54964 | High | 8.4 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If… |
CVE-2025-54963 | Medium | 6.5 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may submit a crafted job request tha… |
CVE-2025-12044 | High | 7.5 | 2025-10-23 | Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from… |
CVE-2025-6980 | High | 7.5 | 2025-10-23 | Captive Portal can expose sensitive information |
CVE-2025-6979 | High | 8.8 | 2025-10-23 | Captive Portal can allow authentication bypass |
CVE-2025-6978 | High | 7.2 | 2025-10-23 | Diagnostics command injection vulnerability |
CVE-2025-62255 | Medium | 6.1 | 2025-10-23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions… |
CVE-2025-60859 | Medium | 6.1 | 2025-10-23 | Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_com… |
CVE-2025-60837 | Medium | 6.1 | 2025-10-23 | A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a c… |
CVE-2025-54808 | High | 7.8 | 2025-10-23 | Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory… |
CVE-2025-23352 | High | 7.8 | 2025-10-23 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitialized pointer access. A successful exploi… |
CVE-2025-23347 | High | 7.8 | 2025-10-23 | NVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful exploit of this vulnerability might lead… |
CVE-2025-23345 | Medium | 4.4 | 2025-10-23 | NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause an out-of-bounds read. A successful expl… |
CVE-2025-23332 | Medium | 5.0 | 2025-10-23 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer deference. A successful… |
CVE-2025-23330 | Medium | 5.5 | 2025-10-23 | NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer dereference. A successful exploit of this vu… |