2025 CVEs (page 156)
Page 156 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43823 | Medium | 5.4 | 2025-10-07 | Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6… |
CVE-2025-11413 | Low | 3.3 | 2025-10-07 | A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The man… |
CVE-2025-11412 | Low | 3.3 | 2025-10-07 | A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The… |
CVE-2025-11410 | Medium | 6.3 | 2025-10-07 | A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing… |
CVE-2025-62187 | Low | 2.9 | 2025-10-07 | In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnam… |
CVE-2025-62186 | Medium | 6.7 | 2025-10-07 | Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling. |
CVE-2025-62185 | Medium | 6.7 | 2025-10-07 | In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link… |
CVE-2025-11409 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Per… |
CVE-2025-11408 | High | 8.8 | 2025-10-07 | A security vulnerability has been detected in D-Link DI-7001 MINI 24.04.18B1. The affected element is an unknown function of the file /dbsrv.asp. Such manipula… |
CVE-2025-6242 | High | 7.1 | 2025-10-07 | A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and l… |
CVE-2025-61910 | High | 7.5 | 2025-10-07 | The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension bl… |
CVE-2025-44824 | High | 8.5 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/a… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-43910 | Low | 2.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43727 | High | 7.5 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-36569 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-36567 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-36566 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-36565 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-11462 | High | 7.8 | 2025-10-07 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges… |
CVE-2025-11407 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the arg… |
CVE-2025-11406 | Medium | 4.3 | 2025-10-07 | A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers… |
CVE-2025-61784 | High | 7.6 | 2025-10-07 | LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows… |
CVE-2025-61776 | Medium | 4.7 | 2025-10-07 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5… |
CVE-2025-61670 | Low | 3.3 | 2025-10-07 | Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAss… |
CVE-2025-45375 | Medium | 4.4 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43934 | Medium | 6.0 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43913 | Medium | 5.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43912 | Medium | 5.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43909 | Low | 3.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43908 | Medium | 6.4 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43907 | Medium | 6.5 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43905 | Medium | 4.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43891 | Medium | 5.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43889 | Medium | 5.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4, LTS2024 release Versions 7.13.1.0 thro… |
CVE-2025-3449 | Medium | 4.2 | 2025-10-07 | A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticate… |
CVE-2025-3448 | Medium | 6.1 | 2025-10-07 | Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a rem… |
CVE-2025-11405 | Medium | 6.3 | 2025-10-07 | A vulnerability was identified in SourceCodester Hotel and Lodge Management System 1.0. This vulnerability affects unknown code of the file /del_tax.php. The m… |
CVE-2025-11404 | Medium | 6.3 | 2025-10-07 | A vulnerability was determined in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown part of the file /pages/save_tax.php. Executing… |
CVE-2025-11192 | High | 8.6 | 2025-10-07 | A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure… |
CVE-2025-8291 | Medium | 4.3 | 2025-10-07 | The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP6… |
CVE-2025-43914 | High | 7.5 | 2025-10-07 | Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 r… |
CVE-2025-43911 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43906 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-43890 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-3450 | Critical | 10.0 | 2025-10-07 | An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated net… |
CVE-2025-36156 | High | 7.4 | 2025-10-07 | IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local us… |
CVE-2025-1826 | Medium | 5.4 | 2025-10-07 | IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerab… |
CVE-2025-11403 | Medium | 6.3 | 2025-10-07 | A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this issue is some unknown functionality of the file /del_bookin… |
CVE-2025-11402 | Medium | 6.3 | 2025-10-07 | A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-56243 | Medium | 6.1 | 2025-10-07 | A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter i… |
CVE-2025-52021 | Critical | 9.8 | 2025-10-07 | A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafe… |
CVE-2025-11401 | Medium | 6.3 | 2025-10-07 | A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulat… |
CVE-2025-60312 | Medium | 6.1 | 2025-10-07 | Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remote attacker to injec… |
CVE-2025-11400 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /del_room.php. The manipulat… |
CVE-2025-11399 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /pages/save_ro… |
CVE-2025-61772 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a mul… |
CVE-2025-61771 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts with… |
CVE-2025-61770 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (b… |
CVE-2025-11398 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of… |
CVE-2025-59425 | High | 7.5 | 2025-10-07 | vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a met… |
CVE-2025-57564 | High | 8.2 | 2025-10-07 | CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bu… |
CVE-2025-54406 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP reque… |
CVE-2025-54405 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP reque… |
CVE-2025-54404 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead… |
CVE-2025-54403 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead… |
CVE-2025-54402 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54401 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54400 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54399 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-53476 | Medium | 5.3 | 2025-10-07 | A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted ser… |
CVE-2025-50505 | High | 7.8 | 2025-10-07 | Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the un… |
CVE-2025-48826 | High | 8.8 | 2025-10-07 | A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to… |
CVE-2025-37728 | Medium | 5.4 | 2025-10-07 | Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credenti… |
CVE-2025-25009 | High | 8.7 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. |
CVE-2025-11397 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /login.php… |
CVE-2025-40889 | High | 8.1 | 2025-10-07 | A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with l… |
CVE-2025-40888 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited priv… |
CVE-2025-40887 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40886 | High | 7.5 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40885 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with li… |
CVE-2025-40676 | | 2025-10-07 | Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This… | |
CVE-2025-40649 | | 2025-10-07 | Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a… | |
CVE-2025-3719 | High | 8.1 | 2025-10-07 | An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited… |
CVE-2025-3718 | High | 7.9 | 2025-10-07 | A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authent… |
CVE-2025-11396 | High | 7.3 | 2025-10-07 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of… |
CVE-2025-11390 | Medium | 4.3 | 2025-10-07 | A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.p… |
CVE-2025-11389 | High | 8.8 | 2025-10-07 | A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of th… |
CVE-2025-0603 | Critical | 9.8 | 2025-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQ… |
CVE-2025-11388 | High | 8.8 | 2025-10-07 | A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument… |
CVE-2025-11387 | High | 8.8 | 2025-10-07 | A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This manipulation of the… |
CVE-2025-11386 | High | 8.8 | 2025-10-07 | A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the component POST Parameter… |
CVE-2025-11385 | High | 8.8 | 2025-10-07 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The mani… |
CVE-2025-11360 | Medium | 4.3 | 2025-10-07 | A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component AP… |
CVE-2025-11359 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.p… |
CVE-2025-10645 | Medium | 5.3 | 2025-10-07 | The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method… |
CVE-2025-7400 | Medium | 6.4 | 2025-10-07 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions… |
CVE-2025-11358 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation… |
CVE-2025-11357 | Medium | 6.3 | 2025-10-07 | A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Perform… |
CVE-2025-11356 | High | 8.8 | 2025-10-07 | A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulatio… |