2025 CVEs (page 159)
Page 159 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10746 | Medium | 6.5 | 2025-10-04 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing ca… |
CVE-2025-10751 | High | 7.8 | 2025-10-04 | MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1. |
CVE-2025-61685 | Medium | 6.5 | 2025-10-03 | Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack… |
CVE-2025-61681 | Medium | 5.4 | 2025-10-03 | KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exp… |
CVE-2025-61680 | | 2025-10-03 | Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's conf… | |
CVE-2025-61679 | High | 7.7 | 2025-10-03 | Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low pri… |
CVE-2025-61677 | Low | 2.5 | 2025-10-03 | DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted… |
CVE-2025-61673 | High | 8.6 | 2025-10-03 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when confi… |
CVE-2025-43825 | Medium | 6.5 | 2025-10-03 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3… |
CVE-2025-59944 | High | 8.0 | 2025-10-03 | Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive fil… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2025-10696 | Medium | 5.4 | 2025-10-03 | OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the own… |
CVE-2025-10695 | Medium | 5.3 | 2025-10-03 | Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed… |
CVE-2025-10692 | | 2025-10-03 | The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter bindi… | |
CVE-2025-59829 | Medium | 6.5 | 2025-10-03 | Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied C… |
CVE-2025-54374 | High | 8.8 | 2025-10-03 | Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker c… |
CVE-2025-53354 | Medium | 6.1 | 2025-10-03 | NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into t… |
CVE-2025-49844 | Critical | 9.9 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-57714 | High | 7.8 | 2025-10-03 | An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit… |
CVE-2025-54154 | Medium | 6.8 | 2025-10-03 | An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulner… |
CVE-2025-54153 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53595 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53407 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53406 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52867 | Medium | 6.5 | 2025-10-03 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-52866 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52862 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52860 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52859 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52858 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52857 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52855 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52854 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52853 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52658 | Low | 3.5 | 2025-10-03 | HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. |
CVE-2025-52656 | High | 7.6 | 2025-10-03 | HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects withou… |
CVE-2025-52654 | Medium | 4.6 | 2025-10-03 | HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially all… |
CVE-2025-52433 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52432 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52429 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52428 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52427 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52424 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48730 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-48729 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48728 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48727 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48726 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47214 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47213 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47212 | High | 7.2 | 2025-10-03 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-47211 | Medium | 4.9 | 2025-10-03 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-47210 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-46819 | Medium | 6.3 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script t… |
CVE-2025-46818 | Medium | 6.0 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-44014 | High | 8.8 | 2025-10-03 | An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-44012 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44011 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44010 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44009 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44008 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-61593 | High | 7.1 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e… |
CVE-2025-61592 | High | 8.8 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current work… |
CVE-2025-52653 | High | 7.6 | 2025-10-03 | HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentia… |
CVE-2025-46817 | High | 7.0 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-44007 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44006 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33040 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33039 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33034 | Medium | 6.5 | 2025-10-03 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-61591 | High | 8.8 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker… |
CVE-2025-61590 | High | 7.5 | 2025-10-03 | Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code… |
CVE-2025-56551 | High | 8.2 | 2025-10-03 | An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-c… |
CVE-2025-60787 | High | 7.2 | 2025-10-03 | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to… |
CVE-2025-57423 | Medium | 6.5 | 2025-10-03 | A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, PersonName, lastUpdate… |
CVE-2025-55972 | High | 7.5 | 2025-10-03 | A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sendi… |
CVE-2025-55971 | Medium | 4.7 | 2025-10-03 | TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Re… |
CVE-2025-34226 | | 2025-10-03 | OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not valida… | |
CVE-2025-10729 | | 2025-10-03 | The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading t… | |
CVE-2025-10728 | | 2025-10-03 | When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS | |
CVE-2025-60454 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, spec… |
CVE-2025-60453 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, spe… |
CVE-2025-60452 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, s… |
CVE-2025-60451 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60450 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60449 | Medium | 4.9 | 2025-10-03 | An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ di… |
CVE-2025-60448 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file… |
CVE-2025-60447 | Medium | 5.9 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration compone… |
CVE-2025-60445 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SV… |
CVE-2025-59489 | High | 7.4 | 2025-10-03 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended l… |
CVE-2025-10609 | Medium | 5.9 | 2025-10-03 | Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects Tige… |
CVE-2025-9945 | Medium | 4.3 | 2025-10-03 | The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing o… |
CVE-2025-9897 | Medium | 4.3 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incor… |
CVE-2025-9895 | Medium | 4.3 | 2025-10-03 | The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or inco… |
CVE-2025-9892 | Medium | 5.3 | 2025-10-03 | The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to mis… |
CVE-2025-9889 | Medium | 4.3 | 2025-10-03 | The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to mi… |
CVE-2025-9885 | Medium | 4.3 | 2025-10-03 | The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1… |
CVE-2025-9884 | Medium | 6.1 | 2025-10-03 | The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing o… |
CVE-2025-9876 | Medium | 6.4 | 2025-10-03 | The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1… |
CVE-2025-9875 | Medium | 6.4 | 2025-10-03 | The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions u… |