2025 CVEs (page 140)
Page 140 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61885 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affect… |
CVE-2025-61881 | Medium | 5.9 | 2025-10-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to… |
CVE-2025-61764 | Medium | 5.3 | 2025-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-61763 | High | 8.1 | 2025-10-21 | Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability all… |
CVE-2025-61762 | Medium | 6.3 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Payables). The supported version that is affected is 9.2. Ea… |
CVE-2025-61761 | Medium | 5.4 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version… |
CVE-2025-61760 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Diff… |
CVE-2025-61759 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi… |
CVE-2025-61758 | Medium | 6.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Management). The supported version that… |
CVE-2025-61757 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2025-61755 | Low | 3.7 | 2025-10-21 | Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK… |
CVE-2025-61754 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 7.6.0.0.0 and 8.2… |
CVE-2025-61753 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-61752 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14… |
CVE-2025-61751 | High | 8.1 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-61750 | Medium | 4.3 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61 and 8.6… |
CVE-2025-61749 | Low | 2.7 | 2025-10-21 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulnerability a… |
CVE-2025-61748 | Low | 3.7 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2025-53072 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2… |
CVE-2025-53071 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments). Supported versions that are affected ar… |
CVE-2025-53070 | Medium | 5.5 | 2025-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulne… |
CVE-2025-53069 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4… |
CVE-2025-53068 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2025-53067 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploit… |
CVE-2025-53066 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2025-53065 | Medium | 5.4 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-53064 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2025-53063 | Medium | 5.4 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-53062 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53061 | Medium | 5.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-53060 | Medium | 6.1 | 2025-10-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-53059 | Medium | 4.9 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected a… |
CVE-2025-53058 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Interfaces). Supported versions that are a… |
CVE-2025-53057 | Medium | 5.9 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2025-53056 | Medium | 6.1 | 2025-10-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tech). Supported versions that are affecte… |
CVE-2025-53055 | Medium | 6.1 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-53054 | Medium | 5.5 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53053 | Medium | 5.5 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9… |
CVE-2025-53052 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12… |
CVE-2025-53051 | Low | 2.7 | 2025-10-21 | Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulner… |
CVE-2025-53050 | High | 7.5 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are… |
CVE-2025-53049 | High | 8.4 | 2025-10-21 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions… |
CVE-2025-53048 | Medium | 5.4 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Supported versions that are affected are 8… |
CVE-2025-53047 | Medium | 5.8 | 2025-10-21 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9… |
CVE-2025-53046 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). The supported version that is affected is 8.8. Easily… |
CVE-2025-53045 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53044 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9… |
CVE-2025-53043 | High | 8.1 | 2025-10-21 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-53042 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 a… |
CVE-2025-53041 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.5-12.2.14. Eas… |
CVE-2025-53040 | Medium | 4.9 | 2025-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 a… |
CVE-2025-53037 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-53036 | High | 8.6 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-53035 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-53034 | Medium | 5.4 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-52079 | High | 8.8 | 2025-10-21 | The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted PO… |
CVE-2025-50075 | Medium | 6.5 | 2025-10-21 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management… |
CVE-2025-50074 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management… |
CVE-2025-62249 | Medium | 6.1 | 2025-10-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 thro… |
CVE-2025-61457 | Medium | 6.1 | 2025-10-21 | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. |
CVE-2025-61255 | Medium | 6.1 | 2025-10-21 | Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows… |
CVE-2025-56802 | Medium | 5.1 | 2025-10-21 | The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access t… |
CVE-2025-56801 | Medium | 5.1 | 2025-10-21 | The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing atta… |
CVE-2025-56800 | Medium | 5.1 | 2025-10-21 | Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entir… |
CVE-2025-56799 | Medium | 6.5 | 2025-10-21 | Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this… |
CVE-2025-8050 | Medium | 6.5 | 2025-10-21 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on… |
CVE-2025-60790 | Medium | 6.5 | 2025-10-21 | ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to… |
CVE-2025-60507 | High | 8.9 | 2025-10-21 | Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded J… |
CVE-2025-60427 | Medium | 6.5 | 2025-10-21 | LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI an… |
CVE-2025-12031 | Medium | 5.3 | 2025-10-21 | HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BL… |
CVE-2025-11757 | | 2025-10-21 | The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should… | |
CVE-2025-62763 | Medium | 5.0 | 2025-10-21 | Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. |
CVE-2025-62605 | Medium | 4.3 | 2025-10-21 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was… |
CVE-2025-62598 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-62597 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-62595 | Medium | 4.3 | 2025-10-21 | Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129… |
CVE-2025-62518 | High | 8.1 | 2025-10-21 | astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability… |
CVE-2025-60772 | Critical | 9.8 | 2025-10-21 | Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges… |
CVE-2025-60511 | Medium | 4.3 | 2025-10-21 | Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the… |
CVE-2025-60506 | Medium | 5.4 | 2025-10-21 | Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account… |
CVE-2025-60500 | High | 7.2 | 2025-10-21 | QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media up… |
CVE-2025-11534 | | 2025-10-21 | The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access with… | |
CVE-2025-62250 | Medium | 6.5 | 2025-10-21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4… |
CVE-2025-61220 | High | 7.5 | 2025-10-21 | The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to… |
CVE-2025-61194 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php. |
CVE-2025-61181 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature. |
CVE-2025-60751 | High | 7.5 | 2025-10-21 | GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode. |
CVE-2025-60280 | Medium | 6.1 | 2025-10-21 | Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This… |
CVE-2025-22166 | High | 7.5 | 2025-10-21 | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability… |
CVE-2025-60934 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to… |
CVE-2025-60933 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers t… |
CVE-2025-60932 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers… |
CVE-2025-60344 | High | 8.6 | 2025-10-21 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used f… |
CVE-2025-59438 | Medium | 5.3 | 2025-10-21 | Mbed TLS through 3.6.4 has an Observable Timing Discrepancy. |
CVE-2025-57521 | Medium | 6.1 | 2025-10-21 | Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a netwo… |
CVE-2025-56450 | Medium | 6.5 | 2025-10-21 | Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` e… |
CVE-2025-9339 | | 2025-10-21 | SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potent… | |
CVE-2025-11625 | Critical | 9.8 | 2025-10-21 | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. |
CVE-2025-11624 | Critical | 9.8 | 2025-10-21 | Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descrip… |
CVE-2025-11151 | High | 8.2 | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz B… |