2025 CVEs (page 14)
Page 14 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57735 | Critical | 9.1 | 2026-04-09 | When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. I… |
CVE-2025-62188 | High | 7.5 | 2026-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actor… |
CVE-2025-9484 | Medium | 4.3 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain cir… |
CVE-2025-12664 | High | 7.5 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have all… |
CVE-2025-50673 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the http_lanport parameter in the /webgl.asp endpoint. |
CVE-2025-50672 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /yyxz_dlink.asp endpoint. |
CVE-2025-50671 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl_ref.asp endpoint. An attacker can explo… |
CVE-2025-50670 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwgl_bwr.asp endpoint. An attacker can explo… |
CVE-2025-50669 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 and DI-8003G 19.12.10A1 due to improper handling of the wan_ping parameter in the /wan_ping… |
CVE-2025-50668 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the s parameter in the /web_list_opt.asp endpoint. |
CVE-2025-50667 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the iface parameter in the /wan_line_detection.asp endpoint. |
CVE-2025-50666 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /web_post.asp endpoint. An attacker… |
CVE-2025-50665 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /web_keyword.asp endpoint. An attacker… |
CVE-2025-50664 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /user_group.asp endpoint. The attacker can ex… |
CVE-2025-50663 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /usb_paswd.asp endpoint. |
CVE-2025-50662 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url_group.asp endpoint. |
CVE-2025-50661 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /url_rule.asp endpoint. An attacker… |
CVE-2025-50660 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url_member.asp endpoint. |
CVE-2025-50659 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the custom_error parameter in the /user.asp endpoint. |
CVE-2025-50657 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the pid parameter in the /trace.asp endpoint. |
CVE-2025-50655 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /thd_group.asp endpoint. |
CVE-2025-50654 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of the id parameter in the /thd_member.asp endpoint. |
CVE-2025-50653 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name and mem parameters in the /time_group.asp endpoint. |
CVE-2025-50652 | High | 7.5 | 2026-04-08 | An issue in D-Link DI-8003 16.07.26A1 related to improper handling of the id parameter in the /saveparm_usb.asp endpoint. |
CVE-2025-50650 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate validation of input size in the routes_static parameter in the /router.as… |
CVE-2025-50649 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlan_name parameter in the /shut_set.asp endpoint. |
CVE-2025-50648 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate input validation in the /tggl.asp endpoint. |
CVE-2025-50647 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1, specifically in the handling of the wans parameter in the qos.asp endpoint. |
CVE-2025-50646 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to insufficient input validation on the name parameter in the /qos_type_asp.asp endpoin… |
CVE-2025-50645 | High | 7.5 | 2026-04-08 | A vulnerability has been discovered in D-Link DI-8003 16.07.26A1, which can lead to a buffer overflow when the s parameter in the pppoe_list_opt.asp endpoint i… |
CVE-2025-50644 | High | 7.5 | 2026-04-08 | A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of user input in the qj.asp endpoint. |
CVE-2025-30650 | Medium | 6.7 | 2026-04-08 | A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain acce… |
CVE-2025-52222 | High | 7.5 | 2026-04-08 | D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI… |
CVE-2025-52221 | Critical | 9.8 | 2026-04-08 | Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters. |
CVE-2025-45059 | High | 7.5 | 2026-04-08 | D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function. This vulnerability allows attackers to… |
CVE-2025-45058 | High | 7.5 | 2026-04-08 | D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fx parameter in the jingx_asp function. This vulnerability allows attackers to c… |
CVE-2025-45057 | High | 7.5 | 2026-04-08 | D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function. This vulnerability allows attacker… |
CVE-2025-57175 | Medium | 6.4 | 2026-04-08 | Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password. |
CVE-2025-14243 | Medium | 5.3 | 2026-04-08 | A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email address… |
CVE-2025-58713 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57854 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-57853 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable pe… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57847 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with g… |
CVE-2025-14816 | | 2026-04-08 | Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite… | |
CVE-2025-14815 | | 2026-04-08 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite version… | |
CVE-2025-1794 | Medium | 5.4 | 2026-04-08 | The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to… |
CVE-2025-14732 | Medium | 6.4 | 2026-04-08 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters i… |
CVE-2025-20628 | | 2026-04-07 | An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly con… | |
CVE-2025-69515 | Critical | 9.1 | 2026-04-07 | An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as le… |
CVE-2025-56015 | High | 7.5 | 2026-04-07 | In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. |
CVE-2025-14859 | | 2026-04-07 | The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a… | |
CVE-2025-14858 | | 2026-04-07 | The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionali… | |
CVE-2025-14857 | | 2026-04-07 | An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessib… | |
CVE-2025-71058 | Critical | 9.1 | 2026-04-07 | Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream… |
CVE-2025-70844 | Medium | 6.1 | 2026-04-07 | yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-grou… |
CVE-2025-14944 | Medium | 5.3 | 2026-04-07 | The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capabili… |
CVE-2025-14821 | High | 7.8 | 2026-04-07 | A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation… |
CVE-2025-52908 | Critical | 9.8 | 2026-04-07 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W… |
CVE-2025-24819 | Medium | 5.7 | 2026-04-07 | Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager… |
CVE-2025-24818 | High | 8.0 | 2026-04-07 | Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search… |
CVE-2025-24817 | High | 8.0 | 2026-04-07 | Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Co… |
CVE-2025-62818 | Critical | 9.8 | 2026-04-07 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-52909 | Critical | 9.8 | 2026-04-07 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W… |
CVE-2025-39666 | High | 7.3 | 2026-04-07 | Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows… |
CVE-2025-15611 | Medium | 5.4 | 2026-04-07 | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauth… |
CVE-2025-65116 | Medium | 5.5 | 2026-04-07 | Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management… |
CVE-2025-65115 | High | 8.8 | 2026-04-07 | Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Mana… |
CVE-2025-13044 | Medium | 6.2 | 2026-04-07 | IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. |
CVE-2025-54601 | High | 7.0 | 2026-04-06 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-57834 | High | 7.5 | 2026-04-06 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-54602 | High | 7.0 | 2026-04-06 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-54328 | Critical | 10.0 | 2026-04-06 | An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-58349 | Critical | 9.1 | 2026-04-06 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-54324 | High | 7.5 | 2026-04-06 | An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-48651 | Medium | 5.5 | 2026-04-06 | In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead… |
CVE-2025-61166 | Medium | 6.1 | 2026-04-06 | An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2025-59440 | High | 7.5 | 2026-04-06 | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-57835 | High | 7.5 | 2026-04-06 | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-47400 | High | 7.1 | 2026-04-06 | Cryptographic issue while copying data to a destination buffer without validating its size. |
CVE-2025-47392 | High | 8.8 | 2026-04-06 | Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
CVE-2025-47391 | High | 7.8 | 2026-04-06 | Memory corruption while processing a frame request from user. |
CVE-2025-47390 | High | 7.8 | 2026-04-06 | Memory corruption while preprocessing IOCTL request in JPEG driver. |
CVE-2025-47389 | High | 7.8 | 2026-04-06 | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. |
CVE-2025-47374 | Medium | 6.5 | 2026-04-06 | Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling. |
CVE-2025-14938 | Medium | 5.3 | 2026-04-04 | The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_… |
CVE-2025-15064 | Medium | 6.4 | 2026-04-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-13368 | Medium | 6.4 | 2026-04-04 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting… |
CVE-2025-10681 | High | 8.6 | 2026-04-03 | Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire withi… |
CVE-2025-68153 | Medium | 6.5 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-68152 | Medium | 4.9 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-64340 | Medium | 6.7 | 2026-04-03 | FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause comma… |
CVE-2025-59711 | High | 8.3 | 2026-04-03 | An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to w… |
CVE-2025-59710 | High | 8.8 | 2026-04-03 | An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading… |
CVE-2025-59709 | Medium | 6.8 | 2026-04-03 | An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is… |
CVE-2025-7024 | High | 7.3 | 2026-04-03 | Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbi… |
CVE-2025-15620 | High | 8.6 | 2026-04-02 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows re… |
CVE-2025-43264 | High | 8.8 | 2026-04-02 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process me… |
CVE-2025-43257 | High | 8.7 | 2026-04-02 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox. |
CVE-2025-43238 | Medium | 6.2 | 2026-04-02 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |