2025 CVEs (page 15)
Page 15 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71260 | High | 8.8 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlin… |
CVE-2025-71259 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that… |
CVE-2025-71258 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows… |
CVE-2025-71257 | High | 7.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on re… |
CVE-2025-14716 | Medium | 6.5 | 2026-03-19 | Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0. |
CVE-2025-68836 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator allows Reflected X… |
CVE-2025-67618 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ArtstudioWorks Brookside allows Reflected XSS.This issue… |
CVE-2025-62043 | Medium | 6.5 | 2026-03-19 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPSight WPCasa allows DOM-Based XSS.This issue affects WP… |
CVE-2025-60237 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0. |
CVE-2025-60233 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2. |
CVE-2025-53222 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Refle… |
CVE-2025-50001 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.T… |
CVE-2025-32223 | Medium | 6.5 | 2026-03-19 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-36051 | Medium | 6.2 | 2026-03-19 | IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 stores potentially sensitive information in configuration files that could be read by a local user. |
CVE-2025-15051 | Medium | 5.4 | 2026-03-19 | IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2025-13995 | Medium | 5.0 | 2026-03-19 | IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account. |
CVE-2025-15031 | Critical | 9.1 | 2026-03-18 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use o… |
CVE-2025-58112 | High | 8.8 | 2026-03-18 | Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .r… |
CVE-2025-71270 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable exception fixup for specific ADE subcode This patch allows the LoongArc… |
CVE-2025-71269 | High | 7.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to… |
CVE-2025-71268 | High | 7.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail t… |
CVE-2025-67830 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. |
CVE-2025-67829 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. |
CVE-2025-55046 | High | 8.1 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a sim… |
CVE-2025-55045 | High | 7.1 | 2026-03-18 | The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.up… |
CVE-2025-55044 | High | 8.8 | 2026-03-18 | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CS… |
CVE-2025-55043 | Medium | 6.5 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated atta… |
CVE-2025-55041 | High | 8.0 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attacker… |
CVE-2025-55040 | High | 8.8 | 2026-03-18 | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vuln… |
CVE-2025-41258 | High | 8.0 | 2026-03-18 | LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG A… |
CVE-2025-71267 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop… |
CVE-2025-71266 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite lo… |
CVE-2025-71265 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an… |
CVE-2025-12518 | | 2026-03-18 | beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and… | |
CVE-2025-31703 | | 2026-03-18 | A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via th… | |
CVE-2025-15363 | Medium | 5.9 | 2026-03-18 | The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Script… |
CVE-2025-14031 | High | 7.5 | 2026-03-17 | IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 coul… |
CVE-2025-14806 | Medium | 5.7 | 2026-03-17 | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific resp… |
CVE-2025-15584 | | 2026-03-17 | Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2025-66633 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66617 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66503 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66342 | High | 7.8 | 2026-03-17 | A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead t… |
CVE-2025-66042 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66000 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-65119 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64776 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64735 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64733 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64301 | High | 7.8 | 2026-03-17 | An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this v… |
CVE-2025-62500 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-62403 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61979 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61952 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-58427 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-47873 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-13406 | | 2026-03-17 | NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink S… | |
CVE-2025-62320 | Medium | 4.7 | 2026-03-17 | HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |
CVE-2025-71239 | Medium | 5.5 | 2026-03-17 | In the Linux kernel, the following vulnerability has been resolved: audit: add fchmodat2() to change attributes class fchmodat2(), introduced in version 6.6… |
CVE-2025-69902 | Critical | 9.8 | 2026-03-16 | A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting… |
CVE-2025-50881 | High | 8.8 | 2026-03-16 | The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, th… |
CVE-2025-69693 | Medium | 5.4 | 2026-03-16 | Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the l… |
CVE-2025-68971 | Medium | 6.5 | 2026-03-16 | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an is… |
CVE-2025-69809 | Critical | 9.8 | 2026-03-16 | A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execu… |
CVE-2025-69808 | Critical | 9.1 | 2026-03-16 | An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Serv… |
CVE-2025-69727 | Medium | 5.3 | 2026-03-16 | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu… |
CVE-2025-69196 | Medium | 6.5 | 2026-03-16 | FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted… |
CVE-2025-69768 | High | 7.5 | 2026-03-16 | SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component |
CVE-2025-66687 | High | 7.5 | 2026-03-16 | Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files |
CVE-2025-65734 | Medium | 5.4 | 2026-03-16 | An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to… |
CVE-2025-69784 | High | 8.8 | 2026-03-16 | A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by t… |
CVE-2025-69783 | High | 7.8 | 2026-03-16 | A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsv… |
CVE-2025-62319 | Critical | 9.8 | 2026-03-16 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into app… |
CVE-2025-57543 | Medium | 6.1 | 2026-03-16 | Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the… |
CVE-2025-52649 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52645 | Low | 1.9 | 2026-03-16 | HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow… |
CVE-2025-52644 | Medium | 5.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce t… |
CVE-2025-52643 | Medium | 4.7 | 2026-03-16 | HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expos… |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2025-52636 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resou… |
CVE-2025-2274 | Medium | 6.1 | 2026-03-16 | Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security t… |
CVE-2025-71264 | Low | 3.7 | 2026-03-16 | Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). |
CVE-2025-6969 | Medium | 5.0 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-69246 | Critical | 9.8 | 2026-03-16 | Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering l… |
CVE-2025-69245 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authe… |
CVE-2025-69243 | Medium | 5.3 | 2026-03-16 | Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid… |
CVE-2025-69242 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, re… |
CVE-2025-69241 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML… |
CVE-2025-69240 | High | 8.8 | 2026-03-16 | Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) … |
CVE-2025-69239 | Low | 2.7 | 2026-03-16 | Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the UR… |
CVE-2025-69238 | Medium | 4.3 | 2026-03-16 | Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated v… |
CVE-2025-69237 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permissions to create con… |
CVE-2025-69236 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permissions to edit posts… |
CVE-2025-54920 | High | 8.8 | 2026-03-16 | This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summ… |
CVE-2025-52648 | Medium | 4.8 | 2026-03-16 | HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered image… |
CVE-2025-52638 | Medium | 5.6 | 2026-03-16 | HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may… |
CVE-2025-52637 | Medium | 4.5 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52458 | Medium | 5.5 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |