2025 CVEs (page 147)
Page 147 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37143 | Medium | 4.9 | 2025-10-14 | An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. S… |
CVE-2025-37142 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37141 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37140 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37139 | Medium | 6.0 | 2025-10-14 | A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may… |
CVE-2025-37138 | Medium | 6.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating sy… |
CVE-2025-37137 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37136 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37135 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37132 | High | 7.2 | 2025-10-14 | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating syst… |
CVE-2025-36730 | | 2025-10-14 | A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appende… | |
CVE-2025-25004 | High | 7.3 | 2025-10-14 | Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-24990 | High | 7.8 | 2025-10-14 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcem… |
CVE-2025-24052 | High | 7.8 | 2025-10-14 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcem… |
CVE-2025-11548 | | 2025-10-14 | A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenti… | |
CVE-2025-8429 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access confi… |
CVE-2025-62366 | | 2025-10-14 | mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.30 contain an HTML injection v… | |
CVE-2025-62172 | | 2025-10-14 | Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard… | |
CVE-2025-59921 | Medium | 6.5 | 2025-10-14 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1… |
CVE-2025-58903 | Low | 2.7 | 2025-10-14 | An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a… |
CVE-2025-58325 | High | 8.2 | 2025-10-14 | An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6… |
CVE-2025-58324 | Medium | 6.4 | 2025-10-14 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7… |
CVE-2025-57741 | High | 7.8 | 2025-10-14 | An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions… |
CVE-2025-57740 | High | 7.5 | 2025-10-14 | An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions… |
CVE-2025-57716 | Medium | 6.7 | 2025-10-14 | An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a loca… |
CVE-2025-54973 | Medium | 5.3 | 2025-10-14 | A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 t… |
CVE-2025-54893 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configu… |
CVE-2025-54822 | Medium | 4.3 | 2025-10-14 | An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0… |
CVE-2025-53845 | Medium | 6.5 | 2025-10-14 | An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to… |
CVE-2025-49201 | High | 8.1 | 2025-10-14 | A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1… |
CVE-2025-47890 | Low | 2.6 | 2025-10-14 | An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2… |
CVE-2025-46774 | High | 7.5 | 2025-10-14 | An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7… |
CVE-2025-37149 | Medium | 6.0 | 2025-10-14 | A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware. |
CVE-2025-31514 | Low | 2.7 | 2025-10-14 | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, F… |
CVE-2025-31366 | Medium | 4.7 | 2025-10-14 | An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 thro… |
CVE-2025-31365 | Medium | 5.8 | 2025-10-14 | An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an una… |
CVE-2025-25255 | Medium | 5.3 | 2025-10-14 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7… |
CVE-2025-25253 | High | 7.5 | 2025-10-14 | An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versio… |
CVE-2025-25252 | Medium | 4.8 | 2025-10-14 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0… |
CVE-2025-22258 | Medium | 6.5 | 2025-10-14 | A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1… |
CVE-2025-11577 | High | 7.6 | 2025-10-14 | Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verifica… |
CVE-2025-8428 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modu… |
CVE-2025-62157 | Medium | 6.5 | 2025-10-14 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and ve… |
CVE-2025-62156 | High | 8.1 | 2025-10-14 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 th… |
CVE-2025-5946 | High | 7.2 | 2025-10-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in t… |
CVE-2025-59428 | Medium | 5.4 | 2025-10-14 | EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including adm… |
CVE-2025-56747 | Medium | 6.5 | 2025-10-14 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated us… |
CVE-2025-54892 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group config… |
CVE-2025-54891 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access con… |
CVE-2025-54889 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer… |
CVE-2025-27906 | Medium | 5.3 | 2025-10-14 | IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files a… |
CVE-2025-10986 | Medium | 4.7 | 2025-10-14 | Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges t… |
CVE-2025-10985 | High | 7.2 | 2025-10-14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privil… |
CVE-2025-10243 | High | 7.2 | 2025-10-14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privil… |
CVE-2025-10242 | High | 7.2 | 2025-10-14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privil… |
CVE-2025-0033 | Medium | 6.0 | 2025-10-14 | Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a l… |
CVE-2025-47856 | High | 7.2 | 2025-10-14 | Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7… |
CVE-2025-33044 | High | 7.8 | 2025-10-14 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means… |
CVE-2025-22833 | High | 7.3 | 2025-10-14 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of… |
CVE-2025-22832 | High | 7.8 | 2025-10-14 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to… |
CVE-2025-22831 | High | 7.8 | 2025-10-14 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to… |
CVE-2025-9178 | | 2025-10-14 | A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP communication using crafted payloads. T… | |
CVE-2025-9177 | | 2025-10-14 | A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server… | |
CVE-2025-9124 | | 2025-10-14 | A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is… | |
CVE-2025-9068 | High | 7.8 | 2025-10-14 | A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authentic… |
CVE-2025-9067 | High | 7.8 | 2025-10-14 | A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can i… |
CVE-2025-9066 | | 2025-10-14 | A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perfor… | |
CVE-2025-9064 | Critical | 9.1 | 2025-10-14 | A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete… |
CVE-2025-9063 | Critical | 9.8 | 2025-10-14 | An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows… |
CVE-2025-7330 | Medium | 6.5 | 2025-10-14 | A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. Th… |
CVE-2025-7329 | Medium | 4.8 | 2025-10-14 | A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or… |
CVE-2025-7328 | Critical | 9.8 | 2025-10-14 | Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical function… |
CVE-2025-11721 | Critical | 9.8 | 2025-10-14 | Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could h… |
CVE-2025-11720 | High | 8.1 | 2025-10-14 | The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted… |
CVE-2025-11719 | Critical | 9.8 | 2025-10-14 | Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption… |
CVE-2025-11718 | Medium | 6.5 | 2025-10-14 | When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychang… |
CVE-2025-11717 | Critical | 9.1 | 2025-10-14 | When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one bein… |
CVE-2025-11716 | Medium | 6.5 | 2025-10-14 | Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thu… |
CVE-2025-11715 | High | 8.8 | 2025-10-14 | Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruptio… |
CVE-2025-11714 | High | 8.8 | 2025-10-14 | Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence… |
CVE-2025-11713 | High | 8.1 | 2025-10-14 | Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the app… |
CVE-2025-11712 | Medium | 6.1 | 2025-10-14 | A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a… |
CVE-2025-11711 | Medium | 6.5 | 2025-10-14 | There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefo… |
CVE-2025-11710 | Critical | 9.8 | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised proce… |
CVE-2025-11709 | Critical | 9.8 | 2025-10-14 | A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability… |
CVE-2025-11708 | Critical | 9.8 | 2025-10-14 | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. |
CVE-2025-11498 | Medium | 6.1 | 2025-10-14 | An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before… |
CVE-2025-10610 | Critical | 9.8 | 2025-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreig… |
CVE-2025-9437 | | 2025-10-14 | A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial… | |
CVE-2025-40812 | High | 7.8 | 2025-10-14 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected ap… |
CVE-2025-40811 | High | 7.8 | 2025-10-14 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected ap… |
CVE-2025-40810 | High | 7.8 | 2025-10-14 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected ap… |
CVE-2025-40809 | High | 7.8 | 2025-10-14 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected ap… |
CVE-2025-40774 | Medium | 4.4 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. De… |
CVE-2025-40773 | Low | 3.5 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. Th… |
CVE-2025-40772 | High | 7.4 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS… |
CVE-2025-40771 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All ver… |
CVE-2025-40765 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information di… |