2025 CVEs (page 14)
Page 14 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55272 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would all… |
CVE-2025-55271 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker… |
CVE-2025-55270 | Low | 3.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Inje… |
CVE-2025-55269 | Medium | 4.2 | 2026-03-26 | HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force technique… |
CVE-2025-55268 | Medium | 4.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and processing resources… |
CVE-2025-55267 | Medium | 5.7 | 2026-03-26 | HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over t… |
CVE-2025-55266 | Medium | 5.9 | 2026-03-26 | HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf o… |
CVE-2025-55265 | Medium | 6.5 | 2026-03-26 | HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it t… |
CVE-2025-41359 | High | 7.8 | 2026-03-26 | Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps… |
CVE-2025-41027 | Medium | 6.1 | 2026-03-26 | Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by s… |
CVE-2025-41026 | Medium | 6.1 | 2026-03-26 | Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by… |
CVE-2025-41368 | High | 8.1 | 2026-03-26 | Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions… |
CVE-2025-15488 | Medium | 6.5 | 2026-03-26 | The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute… |
CVE-2025-15433 | Medium | 6.8 | 2026-03-26 | The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php)… |
CVE-2025-15101 | High | 8.8 | 2026-03-26 | An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbit… |
CVE-2025-36187 | Medium | 4.4 | 2026-03-25 | IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log fil… |
CVE-2025-14684 | Medium | 4.0 | 2026-03-25 | IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neu… |
CVE-2025-64648 | Medium | 5.9 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques. |
CVE-2025-64647 | Medium | 5.9 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2025-64646 | Medium | 6.2 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources. |
CVE-2025-36440 | Medium | 5.1 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control. |
CVE-2025-36438 | Medium | 5.1 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended… |
CVE-2025-36422 | Medium | 4.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request forgery which could allo… |
CVE-2025-36258 | High | 7.1 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by… |
CVE-2025-14974 | Medium | 5.7 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR). |
CVE-2025-14917 | Medium | 6.7 | 2026-03-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when… |
CVE-2025-14915 | Medium | 6.5 | 2026-03-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged… |
CVE-2025-14912 | Medium | 5.4 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2025-14810 | Medium | 6.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 does not invalidate a session after privileges have been modified which could allow an authenticate… |
CVE-2025-14808 | Low | 3.1 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method… |
CVE-2025-14807 | Medium | 6.5 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers… |
CVE-2025-70888 | Critical | 9.8 | 2026-03-25 | An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component |
CVE-2025-14790 | Medium | 6.5 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently protected credentials. |
CVE-2025-12708 | Medium | 6.2 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user. |
CVE-2025-70952 | High | 7.5 | 2026-03-25 | pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory… |
CVE-2025-70887 | High | 8.8 | 2026-03-25 | An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signed_data.py and the context.py components |
CVE-2025-67030 | High | 8.8 | 2026-03-25 | Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642… |
CVE-2025-69358 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-69347 | High | 8.6 | 2026-03-25 | Authorization Bypass Through User-Controlled Key vulnerability in Convers Lab WPSubscription subscription allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-69096 | High | 7.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affec… |
CVE-2025-14595 | Medium | 4.3 | 2026-03-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain con… |
CVE-2025-13436 | Medium | 6.5 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have all… |
CVE-2025-13078 | Medium | 6.5 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have al… |
CVE-2025-59707 | Critical | 9.8 | 2026-03-25 | In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability. |
CVE-2025-59706 | Critical | 9.8 | 2026-03-25 | In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution. |
CVE-2025-32991 | Critical | 9.0 | 2026-03-25 | In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution. |
CVE-2025-40842 | Medium | 6.1 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to unauthorized disclo… |
CVE-2025-40841 | Medium | 4.3 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized… |
CVE-2025-27260 | High | 7.5 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauth… |
CVE-2025-43534 | Medium | 6.8 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.2 and iPadOS 26.2. A user with physic… |
CVE-2025-33254 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may l… |
CVE-2025-33248 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously craft… |
CVE-2025-33247 | High | 7.8 | 2026-03-24 | NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulner… |
CVE-2025-33244 | Critical | 9.0 | 2026-03-24 | NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects envir… |
CVE-2025-33242 | Medium | 5.9 | 2026-03-24 | NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad state. A successful… |
CVE-2025-33238 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerabil… |
CVE-2025-33216 | Medium | 6.8 | 2026-03-24 | NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculation of buffer size by… |
CVE-2025-33215 | Medium | 6.8 | 2026-03-24 | NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending… |
CVE-2025-11571 | | 2026-03-24 | Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open execut… | |
CVE-2025-64998 | High | 7.2 | 2026-03-24 | Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessio… |
CVE-2025-41660 | High | 8.8 | 2026-03-24 | A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution. |
CVE-2025-60949 | Critical | 9.1 | 2026-03-23 | Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration fi… |
CVE-2025-60948 | Medium | 4.6 | 2026-03-23 | Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes… |
CVE-2025-60947 | High | 8.8 | 2026-03-23 | Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fix… |
CVE-2025-60946 | High | 8.8 | 2026-03-23 | Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha. |
CVE-2025-52204 | Medium | 6.1 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter |
CVE-2025-15606 | High | 7.5 | 2026-03-23 | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigg… |
CVE-2025-15605 | High | 7.3 | 2026-03-23 | A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device… |
CVE-2025-15519 | High | 7.2 | 2026-03-23 | Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15518 | High | 7.2 | 2026-03-23 | Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15517 | High | 8.1 | 2026-03-23 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
CVE-2025-41008 | | 2026-03-23 | SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter… | |
CVE-2025-41007 | | 2026-03-23 | SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search… | |
CVE-2025-6229 | Medium | 6.4 | 2026-03-23 | The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Te… |
CVE-2025-13997 | Medium | 5.3 | 2026-03-23 | The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthent… |
CVE-2025-10734 | Medium | 5.3 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive I… |
CVE-2025-10731 | Medium | 5.3 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive I… |
CVE-2025-10679 | High | 7.3 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary m… |
CVE-2025-10736 | Medium | 6.5 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorize… |
CVE-2025-71276 | Medium | 6.4 | 2026-03-22 | SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. |
CVE-2025-14037 | High | 8.1 | 2026-03-21 | The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This i… |
CVE-2025-13910 | Medium | 6.1 | 2026-03-21 | The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and i… |
CVE-2025-63261 | High | 7.8 | 2026-03-20 | AWStats 8.0 is vulnerable to Command Injection via the open function |
CVE-2025-55988 | High | 7.2 | 2026-03-20 | An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI… |
CVE-2025-63260 | Medium | 5.4 | 2026-03-20 | SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message. |
CVE-2025-62846 | Medium | 6.7 | 2026-03-20 | An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability t… |
CVE-2025-62845 | Medium | 6.7 | 2026-03-20 | An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator ac… |
CVE-2025-62844 | Medium | 5.5 | 2026-03-20 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to ga… |
CVE-2025-62843 | Medium | 6.8 | 2026-03-20 | An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, t… |
CVE-2025-59383 | Critical | 9.1 | 2026-03-20 | A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or… |
CVE-2025-15608 | Critical | 9.8 | 2026-03-20 | This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated param… |
CVE-2025-15607 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files… |
CVE-2025-67260 | High | 8.8 | 2026-03-20 | The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to e… |
CVE-2025-46597 | High | 7.5 | 2026-03-20 | Bitcoin Core 0.13.0 through 29.x has an integer overflow. |
CVE-2025-46598 | Medium | 5.3 | 2026-03-20 | Bitcoin Core through 29.0 allows a denial of service via a crafted transaction. |
CVE-2025-67115 | Medium | 6.5 | 2026-03-19 | A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote aut… |
CVE-2025-67114 | Critical | 9.8 | 2026-03-19 | Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804… |
CVE-2025-67113 | Critical | 9.8 | 2026-03-19 | OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote… |
CVE-2025-67112 | Critical | 9.8 | 2026-03-19 | Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3… |
CVE-2025-69720 | High | 7.3 | 2026-03-19 | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. |