2025 CVEs (page 154)
Page 154 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59981 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59980 | Medium | 6.5 | 2025-10-09 | An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited r… |
CVE-2025-59978 | Critical | 9.0 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to sto… |
CVE-2025-11549 | High | 8.8 | 2025-10-09 | A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component H… |
CVE-2025-11371 | High | 7.5 | 2025-10-09 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended… |
CVE-2025-61577 | High | 7.5 | 2025-10-09 | D-Link DIR-816A2_FWv1.10CNB05 was discovered to contain a stack overflow via the statuscheckpppoeuser parameter in the dir_setWanWifi function. This vulnerabil… |
CVE-2025-61532 | Medium | 6.1 | 2025-10-09 | Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_page.php component |
CVE-2025-60302 | Medium | 6.1 | 2025-10-09 | code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malic… |
CVE-2025-60265 | Medium | 6.5 | 2025-10-09 | In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnera… |
CVE-2025-59976 | Medium | 6.5 | 2025-10-09 | An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET… |
CVE-2025-59975 | High | 7.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker… |
CVE-2025-59974 | High | 8.4 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to in… |
CVE-2025-59968 | High | 8.6 | 2025-10-09 | A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify… |
CVE-2025-59967 | Medium | 6.5 | 2025-10-09 | A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX… |
CVE-2025-59964 | High | 7.5 | 2025-10-09 | A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated… |
CVE-2025-59962 | Medium | 5.3 | 2025-10-09 | An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding confi… |
CVE-2025-59958 | Medium | 6.5 | 2025-10-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series… |
CVE-2025-59957 | Medium | 6.8 | 2025-10-09 | An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthent… |
CVE-2025-56426 | Medium | 6.5 | 2025-10-09 | An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logi… |
CVE-2025-52961 | Medium | 6.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of… |
CVE-2025-52960 | Medium | 5.9 | 2025-10-09 | A Buffer Copy without Checking Size of Input vulnerability in the Session Initialization Protocol (SIP) ALG of Juniper Networks Junos OS on MX Series and SRX… |
CVE-2025-11198 | High | 7.4 | 2025-10-09 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based att… |
CVE-2025-10284 | Critical | 9.6 | 2025-10-09 | BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote… |
CVE-2025-10283 | Critical | 9.6 | 2025-10-09 | BBOT's gitdumper module could be abused to execute commands through a malicious git repository. |
CVE-2025-10282 | Medium | 4.7 | 2025-10-09 | BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-10281 | Medium | 4.7 | 2025-10-09 | BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-56683 | Critical | 9.6 | 2025-10-09 | A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting ar… |
CVE-2025-45095 | High | 7.3 | 2025-10-09 | Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted servi… |
CVE-2025-39664 | Medium | 6.5 | 2025-10-09 | Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the stora… |
CVE-2025-32919 | High | 7.8 | 2025-10-09 | Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation. This issue affects Checkmk: fro… |
CVE-2025-32916 | Medium | 4.3 | 2025-10-09 | Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive… |
CVE-2025-62228 | High | 8.8 | 2025-10-09 | Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even thro… |
CVE-2025-36225 | Medium | 4.3 | 2025-10-09 | IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of retu… |
CVE-2025-36171 | Medium | 4.9 | 2025-10-09 | IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resour… |
CVE-2025-11561 | High | 8.8 | 2025-10-09 | A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerbero… |
CVE-2025-39963 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there… |
CVE-2025-39962 | High | 7.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: … |
CVE-2025-39961 | High | 8.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host pag… |
CVE-2025-39960 | High | 7.3 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: acpi: initialize acpi_gpio_info struct Since commit 7c010d463372 ("gpiolib: acpi… |
CVE-2025-10240 | High | 8.8 | 2025-10-09 | A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may… |
CVE-2025-10239 | High | 7.2 | 2025-10-09 | In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interfac… |
CVE-2025-9371 | Medium | 6.4 | 2025-10-09 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to… |
CVE-2025-2934 | Medium | 4.3 | 2025-10-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have… |
CVE-2025-11340 | High | 7.7 | 2025-10-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authe… |
CVE-2025-10249 | Medium | 6.5 | 2025-10-09 | The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions… |
CVE-2025-10004 | High | 7.5 | 2025-10-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab insta… |
CVE-2025-39959 | Medium | 5.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix incorrect retrival of acp_chip_info Use dev_get_drvdata(dev->parent)… |
CVE-2025-39958 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Make attach succeed when the device was surprise removed When a PCI device is… |
CVE-2025-39957 | High | 7.1 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: increase scan_ies_len for S1G Currently the S1G capability element is not… |
CVE-2025-39956 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: igc: don't fail igc_probe() on LED setup error When igc_led_setup() fails, igc_probe() fa… |
CVE-2025-39955 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below… |
CVE-2025-39954 | Medium | 5.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: mp: Fix dual-divider clock rate readback When dual-divider clock support w… |
CVE-2025-10862 | High | 7.5 | 2025-10-09 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in a… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-11522 | Critical | 9.8 | 2025-10-09 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and includin… |
CVE-2025-7634 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2025-7526 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insuffi… |
CVE-2025-6038 | High | 8.8 | 2025-10-09 | The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password up… |
CVE-2025-47355 | High | 7.8 | 2025-10-09 | Memory corruption while invoking remote procedure IOCTL calls. |
CVE-2025-47354 | High | 7.8 | 2025-10-09 | Memory corruption while allocating buffers in DSP service. |
CVE-2025-47351 | High | 7.8 | 2025-10-09 | Memory corruption while processing user buffers. |
CVE-2025-47349 | High | 7.8 | 2025-10-09 | Memory corruption while processing an escape call. |
CVE-2025-47347 | High | 7.8 | 2025-10-09 | Memory corruption while processing control commands in the virtual memory management interface. |
CVE-2025-47342 | High | 7.1 | 2025-10-09 | Transient DOS may occur when multi-profile concurrency arises with QHS enabled. |
CVE-2025-47341 | High | 7.8 | 2025-10-09 | memory corruption while processing an image encoding completion event. |
CVE-2025-47340 | High | 7.8 | 2025-10-09 | Memory corruption while processing IOCTL call to get the mapping. |
CVE-2025-47338 | High | 7.8 | 2025-10-09 | Memory corruption while processing escape commands from userspace. |
CVE-2025-27060 | High | 8.8 | 2025-10-09 | Memory corruption while performing SCM call with malformed inputs. |
CVE-2025-27059 | High | 8.8 | 2025-10-09 | Memory corruption while performing SCM call. |
CVE-2025-27054 | High | 7.8 | 2025-10-09 | Memory corruption while processing a malformed license file during reboot. |
CVE-2025-27053 | High | 7.8 | 2025-10-09 | Memory corruption during PlayReady APP usecase while processing TA commands. |
CVE-2025-27049 | Medium | 5.5 | 2025-10-09 | Transient DOS while processing IOCTL call for image encoding. |
CVE-2025-27048 | High | 7.8 | 2025-10-09 | Memory corruption while processing camera platform driver IOCTL calls. |
CVE-2025-27045 | Medium | 6.1 | 2025-10-09 | Information disclosure while processing batch command execution in Video driver. |
CVE-2025-27041 | Medium | 5.5 | 2025-10-09 | Transient DOS while processing video packets received from video firmware. |
CVE-2025-27040 | Medium | 6.5 | 2025-10-09 | Information disclosure may occur while processing the hypervisor log. |
CVE-2025-27039 | Medium | 6.6 | 2025-10-09 | Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request. |
CVE-2025-11530 | Medium | 6.3 | 2025-10-09 | A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation… |
CVE-2025-11529 | High | 7.3 | 2025-10-09 | A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddlewar… |
CVE-2025-11528 | High | 8.8 | 2025-10-09 | A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument ena… |
CVE-2025-11527 | High | 8.8 | 2025-10-09 | A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a ma… |
CVE-2025-11526 | High | 8.8 | 2025-10-09 | A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation… |
CVE-2025-11525 | High | 8.8 | 2025-10-09 | A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnp… |
CVE-2025-11524 | High | 8.8 | 2025-10-09 | A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument dd… |
CVE-2025-11523 | Medium | 6.3 | 2025-10-09 | A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argumen… |
CVE-2025-11166 | Medium | 5.4 | 2025-10-09 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46… |
CVE-2025-10586 | Critical | 9.8 | 2025-10-09 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to ins… |
CVE-2025-10496 | High | 7.2 | 2025-10-09 | The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6… |
CVE-2025-11516 | Medium | 6.3 | 2025-10-09 | A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Execut… |
CVE-2025-11515 | Medium | 6.3 | 2025-10-09 | A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-comp… |
CVE-2025-11514 | Medium | 6.3 | 2025-10-09 | A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manip… |
CVE-2025-11513 | High | 7.3 | 2025-10-09 | A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation… |
CVE-2025-11512 | Medium | 4.3 | 2025-10-09 | A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manip… |
CVE-2025-61913 | Critical | 9.9 | 2025-10-08 | Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise… |
CVE-2025-11511 | Medium | 6.3 | 2025-10-08 | A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of t… |
CVE-2025-11509 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/product_add.php. Performing manipulat… |
CVE-2025-11508 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipul… |
CVE-2025-11535 | | 2025-10-08 | MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB… | |
CVE-2025-11507 | High | 7.3 | 2025-10-08 | A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/search-invoic… |
CVE-2025-11506 | High | 7.3 | 2025-10-08 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/search-a… |