2025 CVEs (page 144)
Page 144 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10648 | Medium | 5.3 | 2025-10-15 | The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo… |
CVE-2025-10575 | Medium | 6.5 | 2025-10-15 | The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_p… |
CVE-2025-10486 | Medium | 5.3 | 2025-10-15 | The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed lo… |
CVE-2025-10313 | High | 7.2 | 2025-10-15 | The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due… |
CVE-2025-10312 | Medium | 4.3 | 2025-10-15 | The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce val… |
CVE-2025-10310 | Medium | 4.9 | 2025-10-15 | The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due t… |
CVE-2025-10303 | Medium | 4.3 | 2025-10-15 | The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_man… |
CVE-2025-10301 | Medium | 4.3 | 2025-10-15 | The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrec… |
CVE-2025-10300 | Medium | 4.3 | 2025-10-15 | The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect no… |
CVE-2025-10299 | High | 8.8 | 2025-10-15 | The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the… |
CVE-2025-10294 | Critical | 9.8 | 2025-10-15 | The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin… |
CVE-2025-10293 | High | 8.8 | 2025-10-15 | The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu… |
CVE-2025-10194 | Medium | 6.4 | 2025-10-15 | The Shortcode Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including… |
CVE-2025-10186 | Medium | 5.3 | 2025-10-15 | The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability che… |
CVE-2025-10141 | Medium | 6.4 | 2025-10-15 | The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due… |
CVE-2025-10140 | Medium | 6.4 | 2025-10-15 | The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and in… |
CVE-2025-10139 | Medium | 6.4 | 2025-10-15 | The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including… |
CVE-2025-10135 | Medium | 6.4 | 2025-10-15 | The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0… |
CVE-2025-10133 | Medium | 6.4 | 2025-10-15 | The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to… |
CVE-2025-10132 | Medium | 6.4 | 2025-10-15 | The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0… |
CVE-2025-10056 | Medium | 4.4 | 2025-10-15 | The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task… |
CVE-2025-10051 | High | 7.2 | 2025-10-15 | The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1… |
CVE-2025-10045 | Medium | 4.9 | 2025-10-15 | The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to i… |
CVE-2025-10041 | Critical | 9.8 | 2025-10-15 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function… |
CVE-2025-10038 | Medium | 6.5 | 2025-10-15 | The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role… |
CVE-2025-61941 | High | 7.2 | 2025-10-15 | A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to… |
CVE-2025-55039 | Medium | 6.5 | 2025-10-15 | This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network… |
CVE-2025-40000 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug obser… |
CVE-2025-39999 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags… | |
CVE-2025-39998 | High | 7.1 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer ov… |
CVE-2025-39997 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a7… | |
CVE-2025-39996 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The origi… | |
CVE-2025-39995 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->… | |
CVE-2025-39994 | High | 7.3 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_… |
CVE-2025-39993 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: K… |
CVE-2025-39992 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: mm: swap: check for stable address space before operating on the VMA It is possible to hi… | |
CVE-2025-39991 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to da… | |
CVE-2025-39990 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check the helper function is valid in get_helper_proto kernel test robot reported ve… |
CVE-2025-39988 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKE… |
CVE-2025-39987 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET al… |
CVE-2025-39986 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET… |
CVE-2025-39985 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET… |
CVE-2025-39984 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: net: tun: Update napi->skb after XDP process The syzbot report a UAF issue: BUG: KASAN… | |
CVE-2025-39983 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused… |
CVE-2025-39982 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in… |
CVE-2025-39981 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgm… |
CVE-2025-39980 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the crea… | |
CVE-2025-39979 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing… |
CVE-2025-39978 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rc… |
CVE-2025-39977 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following r… |
CVE-2025-39976 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: futex: Use correct exit on failure from futex_hash_allocate_default() copy_process() uses… |
CVE-2025-39975 | Critical | 9.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the l… |
CVE-2025-39974 | | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() When config osnoise cpu… | |
CVE-2025-39973 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual… |
CVE-2025-39972 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/… |
CVE-2025-39971 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initia… |
CVE-2025-39970 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal… |
CVE-2025-39969 | High | 8.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not th… |
CVE-2025-39968 | High | 7.3 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can… |
CVE-2025-39967 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in… |
CVE-2025-39966 | High | 7.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_ope… |
CVE-2025-11501 | High | 7.5 | 2025-10-15 | The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and including, 1.1 due t… |
CVE-2025-11161 | Medium | 6.4 | 2025-10-15 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and incl… |
CVE-2025-11160 | Medium | 6.4 | 2025-10-15 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6… |
CVE-2025-8561 | Medium | 6.4 | 2025-10-15 | The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to… |
CVE-2025-6042 | High | 7.3 | 2025-10-15 | The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions… |
CVE-2025-55080 | High | 7.1 | 2025-10-15 | In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary… |
CVE-2025-31702 | Medium | 6.8 | 2025-10-15 | A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability… |
CVE-2025-26861 | High | 7.8 | 2025-10-15 | RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed… |
CVE-2025-26860 | High | 7.8 | 2025-10-15 | RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed… |
CVE-2025-26859 | High | 7.8 | 2025-10-15 | RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same fol… |
CVE-2025-11176 | Medium | 4.3 | 2025-10-15 | The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_t… |
CVE-2025-10406 | Medium | 5.5 | 2025-10-15 | The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include functi… |
CVE-2025-55079 | Medium | 5.5 | 2025-10-15 | In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed… |
CVE-2025-11746 | High | 8.8 | 2025-10-15 | The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() functi… |
CVE-2025-54278 | Medium | 5.5 | 2025-10-15 | Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could lev… |
CVE-2025-54268 | High | 7.8 | 2025-10-15 | Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-61804 | High | 7.8 | 2025-10-15 | Animate versions 23.0.13, 24.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2025-54279 | High | 7.8 | 2025-10-15 | Animate versions 23.0.13, 24.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2025-54270 | Medium | 5.5 | 2025-10-15 | Animate versions 23.0.13, 24.0.10 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2025-54269 | Medium | 5.5 | 2025-10-15 | Animate versions 23.0.13, 24.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverag… |
CVE-2025-62376 | | 2025-10-14 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contain… | |
CVE-2025-61797 | Medium | 5.4 | 2025-10-14 | Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged a… |
CVE-2025-61796 | Medium | 5.4 | 2025-10-14 | Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged a… |
CVE-2025-54272 | Medium | 5.4 | 2025-10-14 | Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged a… |
CVE-2025-54196 | Medium | 4.3 | 2025-10-14 | Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vu… |
CVE-2025-49553 | Critical | 9.3 | 2025-10-14 | Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute… |
CVE-2025-49552 | High | 8.1 | 2025-10-14 | Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attac… |
CVE-2025-54267 | Medium | 6.5 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-54266 | Medium | 4.8 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulne… |
CVE-2025-54265 | Medium | 5.9 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-54264 | High | 8.1 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross… |
CVE-2025-54263 | High | 8.1 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-62374 | Medium | 6.4 | 2025-10-14 | Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attac… |
CVE-2025-61807 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution i… |
CVE-2025-61806 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-61805 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-61803 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution i… |
CVE-2025-61802 | High | 7.8 | 2025-10-14 | Substance3D - Stager versions 3.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61801 | High | 7.8 | 2025-10-14 | Dimension versions 4.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current… |