2025 CVEs (page 157)
Page 157 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8406 | High | 7.8 | 2025-10-05 | ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to vali… |
CVE-2025-11288 | Medium | 6.3 | 2025-10-05 | A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET P… |
CVE-2025-11287 | High | 7.3 | 2025-10-05 | A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/… |
CVE-2025-11286 | Medium | 4.7 | 2025-10-05 | A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component… |
CVE-2025-11285 | Medium | 6.3 | 2025-10-05 | A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController… |
CVE-2025-11284 | High | 7.3 | 2025-10-05 | A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-11280 | Low | 3.7 | 2025-10-05 | A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation… |
CVE-2025-11279 | Medium | 5.5 | 2025-10-05 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. Th… |
CVE-2025-11278 | Medium | 4.3 | 2025-10-05 | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulatio… |
CVE-2025-11277 | Medium | 5.3 | 2025-10-05 | A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLi… |
CVE-2025-11276 | Low | 3.5 | 2025-10-05 | A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing… |
CVE-2025-11275 | Medium | 5.3 | 2025-10-05 | A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the li… |
CVE-2025-11274 | Low | 3.3 | 2025-10-05 | A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib… |
CVE-2025-11273 | Medium | 6.3 | 2025-10-04 | A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provid… |
CVE-2025-11272 | Medium | 5.4 | 2025-10-04 | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionCo… |
CVE-2025-39953 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cg… |
CVE-2025-39952 | High | 8.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy… |
CVE-2025-39951 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device(… |
CVE-2025-39950 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR A NULL pointer… |
CVE-2025-39949 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: qed: Don't collect too many protection override GRC elements In the protection override d… |
CVE-2025-39948 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calli… |
CVE-2025-39947 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Harden uplink netdev access against device unbind The function mlx5_uplink_net… |
CVE-2025-39946 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket t… |
CVE-2025-39945 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_w… |
CVE-2025-39944 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on c… |
CVE-2025-39943 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer … |
CVE-2025-39942 | High | 7.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is… |
CVE-2025-39941 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: zram: fix slot write race condition Parallel concurrent writes to the same zram index res… |
CVE-2025-39940 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_… |
CVE-2025-39939 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix memory corruption when using identity domain zpci_get_iommu_ctrs() return… |
CVE-2025-39938 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed If earl… |
CVE-2025-39937 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d… |
CVE-2025-39936 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() When … |
CVE-2025-39935 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set… |
CVE-2025-39934 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ If the interrupt occurs… |
CVE-2025-39933 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This… |
CVE-2025-39932 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In… |
CVE-2025-39931 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_send… |
CVE-2025-39929 | High | 7.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of an… |
CVE-2025-9952 | Medium | 6.1 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '… |
CVE-2025-9886 | Medium | 4.3 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versio… |
CVE-2025-10383 | Medium | 6.4 | 2025-10-04 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field para… |
CVE-2025-9485 | Critical | 9.8 | 2025-10-04 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and inc… |
CVE-2025-9243 | High | 8.1 | 2025-10-04 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and u… |
CVE-2025-9030 | Medium | 5.4 | 2025-10-04 | The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versio… |
CVE-2025-9029 | Medium | 4.3 | 2025-10-04 | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorizatio… |
CVE-2025-8726 | Medium | 5.4 | 2025-10-04 | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input s… |
CVE-2025-61962 | Medium | 5.9 | 2025-10-04 | In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. |
CVE-2025-11228 | Medium | 5.3 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11227 | Medium | 6.5 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 v… |
CVE-2025-10746 | Medium | 6.5 | 2025-10-04 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing ca… |
CVE-2025-10751 | High | 7.8 | 2025-10-04 | MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1. |
CVE-2025-61685 | Medium | 6.5 | 2025-10-03 | Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack… |
CVE-2025-61681 | Medium | 5.4 | 2025-10-03 | KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exp… |
CVE-2025-61680 | | 2025-10-03 | Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's conf… | |
CVE-2025-61679 | High | 7.7 | 2025-10-03 | Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low pri… |
CVE-2025-61677 | Low | 2.5 | 2025-10-03 | DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted… |
CVE-2025-61673 | High | 8.6 | 2025-10-03 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when confi… |
CVE-2025-43825 | Medium | 6.5 | 2025-10-03 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3… |
CVE-2025-59944 | High | 8.0 | 2025-10-03 | Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive fil… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2025-10696 | Medium | 5.4 | 2025-10-03 | OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the own… |
CVE-2025-10695 | Medium | 5.3 | 2025-10-03 | Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed… |
CVE-2025-10692 | | 2025-10-03 | The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter bindi… | |
CVE-2025-59829 | Medium | 6.5 | 2025-10-03 | Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied C… |
CVE-2025-54374 | High | 8.8 | 2025-10-03 | Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker c… |
CVE-2025-53354 | Medium | 6.1 | 2025-10-03 | NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into t… |
CVE-2025-49844 | Critical | 9.9 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-57714 | High | 7.8 | 2025-10-03 | An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit… |
CVE-2025-54154 | Medium | 6.8 | 2025-10-03 | An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulner… |
CVE-2025-54153 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53595 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53407 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53406 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52867 | Medium | 6.5 | 2025-10-03 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-52866 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52862 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52860 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52859 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52858 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52857 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52855 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52854 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52853 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52658 | Low | 3.5 | 2025-10-03 | HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. |
CVE-2025-52656 | High | 7.6 | 2025-10-03 | HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects withou… |
CVE-2025-52654 | Medium | 4.6 | 2025-10-03 | HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially all… |
CVE-2025-52433 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52432 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52429 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52428 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52427 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52424 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48730 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-48729 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48728 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |