2025 CVEs (page 160)
Page 160 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54290 | Medium | 5.3 | 2025-10-02 | Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without auth… |
CVE-2025-54289 | High | 8.1 | 2025-10-02 | Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions… |
CVE-2025-54288 | Medium | 6.8 | 2025-10-02 | Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any con… |
CVE-2025-54287 | Medium | 6.5 | 2025-10-02 | Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitr… |
CVE-2025-54286 | High | 8.8 | 2025-10-02 | Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user c… |
CVE-2025-40646 | Medium | 5.4 | 2025-10-02 | Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP req… |
CVE-2025-40645 | | 2025-10-02 | Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sendi… | |
CVE-2025-9697 | Critical | 9.8 | 2025-10-02 | The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action avail… |
CVE-2025-9587 | High | 8.6 | 2025-10-02 | The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX act… |
CVE-2025-61692 | High | 7.8 | 2025-10-02 | VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the a… |
CVE-2025-61691 | High | 7.8 | 2025-10-02 | VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on… |
CVE-2025-61690 | High | 7.8 | 2025-10-02 | KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on th… |
CVE-2025-58777 | High | 7.8 | 2025-10-02 | VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specially crafted file, arbitrary code may be… |
CVE-2025-58776 | High | 7.8 | 2025-10-02 | KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be exe… |
CVE-2025-58775 | High | 7.8 | 2025-10-02 | KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed o… |
CVE-2025-11221 | High | 8.8 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFl… |
CVE-2025-11182 | Medium | 6.5 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allo… |
CVE-2025-11020 | High | 8.8 | 2025-10-02 | An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with… |
CVE-2025-61588 | | 2025-10-02 | RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-z… | |
CVE-2025-61583 | Medium | 4.3 | 2025-10-01 | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 an… |
CVE-2025-61582 | High | 7.5 | 2025-10-01 | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. Th… |
CVE-2025-61587 | Medium | 6.1 | 2025-10-01 | Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is confi… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-54811 | High | 7.1 | 2025-10-01 | OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and ex… |
CVE-2025-23355 | Medium | 6.7 | 2025-10-01 | NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A successful exploit… |
CVE-2025-23297 | High | 7.8 | 2025-10-01 | NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unprivileged access coul… |
CVE-2025-59538 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17… |
CVE-2025-59537 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1… |
CVE-2025-59531 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1… |
CVE-2025-59337 | Medium | 6.8 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed… |
CVE-2025-59150 | High | 7.5 | 2025-10-01 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of… |
CVE-2025-57389 | Medium | 5.4 | 2025-10-01 | A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Java… |
CVE-2025-61189 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers… |
CVE-2025-61188 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whiteliste… |
CVE-2025-59149 | Medium | 6.2 | 2025-10-01 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules… |
CVE-2025-59148 | High | 7.5 | 2025-10-01 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below… |
CVE-2025-59147 | High | 7.5 | 2025-10-01 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and belo… |
CVE-2025-58769 | Low | 3.3 | 2025-10-01 | auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with th… |
CVE-2025-57444 | Medium | 6.1 | 2025-10-01 | An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to… |
CVE-2025-56588 | High | 8.8 | 2025-10-01 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field param… |
CVE-2025-59682 | Low | 3.1 | 2025-10-01 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startap… |
CVE-2025-59681 | High | 7.1 | 2025-10-01 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-58054 | Low | 3.5 | 2025-10-01 | Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel… |
CVE-2025-46205 | High | 8.1 | 2025-10-01 | A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplyin… |
CVE-2025-43718 | Low | 2.9 | 2025-10-01 | Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) o… |
CVE-2025-10578 | High | 7.8 | 2025-10-01 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a… |
CVE-2025-8679 | Critical | 9.8 | 2025-10-01 | In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials… |
CVE-2025-60991 | High | 8.8 | 2025-10-01 | A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the contex… |
CVE-2025-57393 | High | 8.8 | 2025-10-01 | A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web… |
CVE-2025-28357 | High | 8.8 | 2025-10-01 | A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request. |
CVE-2025-34182 | | 2025-10-01 | In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-relat… | |
CVE-2025-20371 | High | 7.5 | 2025-10-01 | In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an un… |
CVE-2025-20370 | Medium | 4.9 | 2025-10-01 | In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a us… |
CVE-2025-20369 | Medium | 4.6 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-20368 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-20367 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privile… |
CVE-2025-20366 | Medium | 6.5 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privi… |
CVE-2025-20361 | Medium | 4.8 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2025-20357 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-20356 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-11233 | | 2025-10-01 | Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard l… | |
CVE-2025-56515 | High | 8.8 | 2025-10-01 | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowin… |
CVE-2025-56514 | Medium | 5.4 | 2025-10-01 | Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other us… |
CVE-2025-61045 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. |
CVE-2025-61044 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg functio… |
CVE-2025-59687 | Medium | 4.3 | 2025-10-01 | IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arb… |
CVE-2025-59686 | Medium | 6.5 | 2025-10-01 | Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id. |
CVE-2025-59685 | Medium | 5.3 | 2025-10-01 | Kazaar 1.25.12 allows a JWT with none in the alg field. |
CVE-2025-59684 | High | 8.8 | 2025-10-01 | DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking. |
CVE-2025-57275 | Medium | 5.5 | 2025-10-01 | Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf. |
CVE-2025-52042 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to… |
CVE-2025-52041 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Inje… |
CVE-2025-52040 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can ext… |
CVE-2025-52039 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable t… |
CVE-2025-41421 | Medium | 4.7 | 2025-10-01 | Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an… |
CVE-2025-40648 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'nu… | |
CVE-2025-40647 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'em… | |
CVE-2025-10847 | | 2025-10-01 | DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote atta… | |
CVE-2025-61622 | Critical | 9.8 | 2025-10-01 | Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary… |
CVE-2025-39928 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the… |
CVE-2025-39927 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix race condition validating r_parent before applying state Add validation to ensu… |
CVE-2025-39926 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: genetlink: fix genl_bind() invoking bind() after -EPERM Per family bind/unbind callbacks… |
CVE-2025-39925 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unreg… |
CVE-2025-39924 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix invalid algorithm for encoded extents The current algorithm sanity checks do n… |
CVE-2025-39923 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a… |
CVE-2025-39922 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix incorrect map used in eee linkmode incorrectly used ixgbe_lp_map in loops inte… |
CVE-2025-39921 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback … |
CVE-2025-39920 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem… |
CVE-2025-39919 | High | 8.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must n… |
CVE-2025-39918 | High | 8.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix linked list corruption Never leave scheduled wcid entries on the temporar… |
CVE-2025-39917 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt Stanislav reported that in bpf_cr… |
CVE-2025-39916 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() When creating… |
CVE-2025-39915 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: net: phy: transfer phy_config_inband() locking responsibility to phylink Problem descript… |
CVE-2025-39914 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: tracing: Silence warning when chunk allocation fails in trace_pid_write Syzkaller trigger… |
CVE-2025-39913 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. sy… |
CVE-2025-39912 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: nfs/localio: restore creds before releasing pageio data Otherwise if the nfsd filecache c… |
CVE-2025-39911 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vs… |
CVE-2025-39910 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() kasan_populate_vmalloc… |
CVE-2025-39909 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() Patch series… |