2025 CVEs (page 158)
Page 158 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58581 | Medium | 4.3 | 2025-10-06 | When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal infor… |
CVE-2025-58580 | Medium | 6.5 | 2025-10-06 | An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can cr… |
CVE-2025-58579 | Medium | 5.3 | 2025-10-06 | Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enum… |
CVE-2025-58578 | Low | 3.8 | 2025-10-06 | A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, check… |
CVE-2025-11325 | High | 8.8 | 2025-10-06 | A security flaw has been discovered in Tenda AC18 15.03.05.19(6318). Affected by this issue is some unknown functionality of the file /goform/fast_setting_pppo… |
CVE-2025-11324 | High | 8.8 | 2025-10-06 | A vulnerability was identified in Tenda AC18 15.03.05.19(6318). Affected by this vulnerability is an unknown functionality of the file /goform/setNotUpgrade. S… |
CVE-2025-9710 | Medium | 6.3 | 2025-10-06 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticate… |
CVE-2025-9703 | Medium | 4.3 | 2025-10-06 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded… |
CVE-2025-57781 | High | 7.8 | 2025-10-06 | The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a… |
CVE-2025-11323 | High | 8.8 | 2025-10-06 | A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation… |
CVE-2025-11322 | Low | 3.7 | 2025-10-06 | A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creatio… |
CVE-2025-11321 | Medium | 4.3 | 2025-10-06 | A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/educat… |
CVE-2025-11320 | Medium | 6.3 | 2025-10-06 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/… |
CVE-2025-11319 | Medium | 6.3 | 2025-10-06 | A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some… |
CVE-2025-11318 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file u… |
CVE-2025-11317 | High | 7.3 | 2025-10-06 | A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSin… |
CVE-2025-11316 | High | 7.3 | 2025-10-06 | A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of… |
CVE-2025-50538 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. |
CVE-2025-29192 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. |
CVE-2025-11315 | High | 7.3 | 2025-10-06 | A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of… |
CVE-2025-11314 | High | 7.3 | 2025-10-06 | A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSing… |
CVE-2025-11313 | High | 7.3 | 2025-10-06 | A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do… |
CVE-2025-11312 | High | 7.3 | 2025-10-06 | A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findMod… |
CVE-2025-11311 | High | 7.3 | 2025-10-06 | A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenan… |
CVE-2025-11310 | High | 7.3 | 2025-10-06 | A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of… |
CVE-2025-11309 | High | 7.3 | 2025-10-05 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDep… |
CVE-2025-11308 | Low | 3.5 | 2025-10-05 | A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulat… |
CVE-2025-11306 | Medium | 4.3 | 2025-10-05 | A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulatio… |
CVE-2025-11305 | High | 8.8 | 2025-10-05 | A vulnerability has been found in UTT HiPER 840G up to 3.1.1-190328. Affected by this issue is the function strcpy of the file /goform/formTaskEdit. The manipu… |
CVE-2025-11304 | Medium | 6.3 | 2025-10-05 | A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing m… |
CVE-2025-11303 | Medium | 6.3 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument comma… |
CVE-2025-11302 | High | 8.8 | 2025-10-05 | A security vulnerability has been detected in Belkin F9K1015 1.00.10. This impacts an unknown function of the file /goform/formWpsStart. Such manipulation of t… |
CVE-2025-11301 | High | 8.8 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. This affects an unknown function of the file /goform/formWlanSetupWPS. This manipulation of the argum… |
CVE-2025-11300 | High | 8.8 | 2025-10-05 | A security flaw has been discovered in Belkin F9K1015 1.00.10. The impacted element is an unknown function of the file /goform/formWlanMP. The manipulation of… |
CVE-2025-11299 | High | 8.8 | 2025-10-05 | A vulnerability was identified in Belkin F9K1015 1.00.10. The affected element is an unknown function of the file /goform/formWanTcpipSetup. The manipulation o… |
CVE-2025-11298 | Medium | 6.3 | 2025-10-05 | A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the… |
CVE-2025-11297 | High | 8.8 | 2025-10-05 | A vulnerability was found in Belkin F9K1015 1.00.10. This issue affects some unknown processing of the file /goform/formSetLanguage. Performing a manipulation… |
CVE-2025-11296 | High | 8.8 | 2025-10-05 | A vulnerability has been found in Belkin F9K1015 1.00.10. This vulnerability affects unknown code of the file /goform/formPPTPSetup. Such manipulation of the a… |
CVE-2025-11295 | High | 8.8 | 2025-10-05 | A flaw has been found in Belkin F9K1015 1.00.10. This affects an unknown part of the file /goform/formPPPoESetup. This manipulation of the argument pppUserName… |
CVE-2025-11294 | High | 8.8 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected by this issue is some unknown functionality of the file /goform/formL2TPSetup. The manipulatio… |
CVE-2025-11293 | High | 8.8 | 2025-10-05 | A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality of the file /goform/formConnec… |
CVE-2025-11292 | Medium | 6.3 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of… |
CVE-2025-11291 | Medium | 4.3 | 2025-10-05 | A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php… |
CVE-2025-11290 | Medium | 5.6 | 2025-10-05 | A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argume… |
CVE-2025-8917 | Medium | 5.8 | 2025-10-05 | A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` functio… |
CVE-2025-11289 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/… |
CVE-2025-8406 | High | 7.8 | 2025-10-05 | ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to vali… |
CVE-2025-11288 | Medium | 6.3 | 2025-10-05 | A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET P… |
CVE-2025-11287 | High | 7.3 | 2025-10-05 | A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/… |
CVE-2025-11286 | Medium | 4.7 | 2025-10-05 | A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component… |
CVE-2025-11285 | Medium | 6.3 | 2025-10-05 | A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController… |
CVE-2025-11284 | High | 7.3 | 2025-10-05 | A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-11280 | Low | 3.7 | 2025-10-05 | A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation… |
CVE-2025-11279 | Medium | 5.5 | 2025-10-05 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. Th… |
CVE-2025-11278 | Medium | 4.3 | 2025-10-05 | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulatio… |
CVE-2025-11277 | Medium | 5.3 | 2025-10-05 | A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLi… |
CVE-2025-11276 | Low | 3.5 | 2025-10-05 | A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing… |
CVE-2025-11275 | Medium | 5.3 | 2025-10-05 | A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the li… |
CVE-2025-11274 | Low | 3.3 | 2025-10-05 | A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib… |
CVE-2025-11273 | Medium | 6.3 | 2025-10-04 | A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provid… |
CVE-2025-11272 | Medium | 5.4 | 2025-10-04 | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionCo… |
CVE-2025-39953 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cg… |
CVE-2025-39952 | High | 8.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy… |
CVE-2025-39951 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device(… |
CVE-2025-39950 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR A NULL pointer… |
CVE-2025-39949 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: qed: Don't collect too many protection override GRC elements In the protection override d… |
CVE-2025-39948 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calli… |
CVE-2025-39947 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Harden uplink netdev access against device unbind The function mlx5_uplink_net… |
CVE-2025-39946 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket t… |
CVE-2025-39945 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_w… |
CVE-2025-39944 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on c… |
CVE-2025-39943 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer … |
CVE-2025-39942 | High | 7.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is… |
CVE-2025-39941 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: zram: fix slot write race condition Parallel concurrent writes to the same zram index res… |
CVE-2025-39940 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_… |
CVE-2025-39939 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix memory corruption when using identity domain zpci_get_iommu_ctrs() return… |
CVE-2025-39938 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed If earl… |
CVE-2025-39937 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d… |
CVE-2025-39936 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() When … |
CVE-2025-39935 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set… |
CVE-2025-39934 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ If the interrupt occurs… |
CVE-2025-39933 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This… |
CVE-2025-39932 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In… |
CVE-2025-39931 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_send… |
CVE-2025-39929 | High | 7.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of an… |
CVE-2025-9952 | Medium | 6.1 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '… |
CVE-2025-9886 | Medium | 4.3 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versio… |
CVE-2025-10383 | Medium | 6.4 | 2025-10-04 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field para… |
CVE-2025-9485 | Critical | 9.8 | 2025-10-04 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and inc… |
CVE-2025-9243 | High | 8.1 | 2025-10-04 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and u… |
CVE-2025-9030 | Medium | 5.4 | 2025-10-04 | The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versio… |
CVE-2025-9029 | Medium | 4.3 | 2025-10-04 | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorizatio… |
CVE-2025-8726 | Medium | 5.4 | 2025-10-04 | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input s… |
CVE-2025-61962 | Medium | 5.9 | 2025-10-04 | In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. |
CVE-2025-11228 | Medium | 5.3 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11227 | Medium | 6.5 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 v… |