2025 CVEs (page 166)
Page 166 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9984 | Medium | 5.3 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_po… |
CVE-2025-10037 | Medium | 4.9 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all version… |
CVE-2025-10036 | Medium | 4.9 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5… |
CVE-2025-9044 | Medium | 6.4 | 2025-09-26 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insuf… |
CVE-2025-11000 | Low | 3.3 | 2025-09-26 | A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipu… |
CVE-2025-10745 | Medium | 5.3 | 2025-09-26 | The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4… |
CVE-2025-10377 | Medium | 4.3 | 2025-09-26 | The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonc… |
CVE-2025-10173 | Low | 2.7 | 2025-09-26 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorr… |
CVE-2025-10999 | Low | 3.3 | 2025-09-26 | A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp… |
CVE-2025-10998 | Low | 3.3 | 2025-09-26 | A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/forma… |
CVE-2025-10997 | Medium | 5.3 | 2025-09-26 | A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing man… |
CVE-2025-10996 | Medium | 5.3 | 2025-09-26 | A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp… |
CVE-2025-8906 | Medium | 6.4 | 2025-09-26 | The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up t… |
CVE-2025-8200 | Medium | 6.4 | 2025-09-26 | The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versi… |
CVE-2025-10995 | Medium | 5.3 | 2025-09-26 | A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in… |
CVE-2025-10994 | Medium | 5.3 | 2025-09-26 | A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipul… |
CVE-2025-10993 | Medium | 4.7 | 2025-09-26 | A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template… |
CVE-2025-10992 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/look… |
CVE-2025-10752 | Medium | 4.3 | 2025-09-26 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. T… |
CVE-2025-10178 | Medium | 6.4 | 2025-09-26 | The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up… |
CVE-2025-60251 | Medium | 5.0 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring. |
CVE-2025-60250 | Medium | 4.7 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d… |
CVE-2025-60017 | High | 8.2 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within rest… |
CVE-2025-10989 | Medium | 6.3 | 2025-09-26 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Pe… |
CVE-2025-10988 | Medium | 6.3 | 2025-09-26 | A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads… |
CVE-2025-10987 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of t… |
CVE-2025-10981 | Medium | 4.3 | 2025-09-26 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in i… |
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-56769 | Medium | 6.5 | 2025-09-25 | An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and p… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10975 | Medium | 6.3 | 2025-09-25 | A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. This vulnerability affects the function experiments.robot.bridge… |
CVE-2025-10974 | Medium | 6.3 | 2025-09-25 | A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /ca… |
CVE-2025-59408 | High | 7.3 | 2025-09-25 | Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modified firmware with n… |
CVE-2025-59404 | High | 7.5 | 2025-09-25 | Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked. This permits bypass of Android Verified Boot (AVB) and… |
CVE-2025-59402 | Medium | 5.4 | 2025-09-25 | Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables… |
CVE-2025-26482 | Medium | 4.9 | 2025-09-25 | Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could… |
CVE-2025-11005 | Critical | 9.8 | 2025-09-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This is… |
CVE-2025-10973 | High | 7.3 | 2025-09-25 | A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionalit… |
CVE-2025-59817 | High | 8.4 | 2025-09-25 | This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploi… |
CVE-2025-59816 | High | 7.3 | 2025-09-25 | This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including… |
CVE-2025-59815 | High | 8.4 | 2025-09-25 | This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell acce… |
CVE-2025-59814 | High | 8.8 | 2025-09-25 | This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read t… |
CVE-2025-57632 | High | 7.5 | 2025-09-25 | libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fix… |
CVE-2025-43993 | High | 7.8 | 2025-09-25 | Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerabili… |
CVE-2025-43816 | High | 7.5 | 2025-09-25 | A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 t… |
CVE-2025-10967 | High | 7.3 | 2025-09-25 | A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Pe… |
CVE-2025-10965 | Medium | 6.3 | 2025-09-25 | A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllm_call of the file lazyllm/components/d… |
CVE-2025-10964 | Medium | 6.3 | 2025-09-25 | A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulati… |
CVE-2025-29157 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page… |
CVE-2025-29156 | Medium | 6.1 | 2025-09-25 | Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet |
CVE-2025-10963 | Medium | 6.3 | 2025-09-25 | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation o… |
CVE-2025-10962 | Medium | 6.3 | 2025-09-25 | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetNam… |
CVE-2025-60249 | Medium | 6.4 | 2025-09-25 | vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or si… |
CVE-2025-57623 | Medium | 5.3 | 2025-09-25 | A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service. |
CVE-2025-48707 | High | 7.5 | 2025-09-25 | An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among adminis… |
CVE-2025-29155 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint |
CVE-2025-10961 | Medium | 5.5 | 2025-09-25 | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete… |
CVE-2025-10960 | Medium | 6.3 | 2025-09-25 | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component… |
CVE-2025-10959 | Medium | 6.3 | 2025-09-25 | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipu… |
CVE-2025-10958 | Medium | 6.3 | 2025-09-25 | A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. Thi… |
CVE-2025-34227 | High | 8.8 | 2025-09-25 | Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, a… |
CVE-2025-10880 | High | 7.5 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietar… |
CVE-2025-10879 | Medium | 5.3 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current u… |
CVE-2025-60019 | Low | 3.7 | 2025-09-25 | glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result i… |
CVE-2025-60018 | Medium | 4.8 | 2025-09-25 | glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read. |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |
CVE-2025-57446 | High | 7.5 | 2025-09-25 | An issue in O-RAN Near Realtime RIC ric-plt-submgr in the J-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted reque… |
CVE-2025-55560 | High | 7.5 | 2025-09-25 | An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is c… |
CVE-2025-55559 | High | 7.5 | 2025-09-25 | An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D. |
CVE-2025-55558 | High | 7.5 | 2025-09-25 | A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() a… |
CVE-2025-55557 | High | 7.5 | 2025-09-25 | A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). |
CVE-2025-55556 | Medium | 6.5 | 2025-09-25 | TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. |
CVE-2025-55554 | Medium | 5.3 | 2025-09-25 | pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long(). |
CVE-2025-55553 | High | 7.5 | 2025-09-25 | A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). |
CVE-2025-55552 | High | 7.5 | 2025-09-25 | pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. |
CVE-2025-43943 | Medium | 6.7 | 2025-09-25 | Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection… |
CVE-2025-33116 | Medium | 4.4 | 2025-09-25 | IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbit… |
CVE-2025-26333 | Medium | 5.9 | 2025-09-25 | Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potential… |
CVE-2025-20363 | Critical | 9.0 | 2025-09-25 | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, C… |
CVE-2025-20362 | Medium | 6.5 | 2025-09-25 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases… |
CVE-2025-20333 | Critical | 9.9 | 2025-09-25 | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softwa… |
CVE-2025-10953 | High | 8.8 | 2025-09-25 | A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /gofor… |
CVE-2025-10952 | Medium | 5.3 | 2025-09-25 | A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler o… |
CVE-2025-10911 | Medium | 5.5 | 2025-09-25 | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. |
CVE-2025-59838 | Medium | 5.4 | 2025-09-25 | Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text resu… |
CVE-2025-59832 | Critical | 9.9 | 2025-09-25 | Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment ed… |
CVE-2025-59830 | High | 7.5 | 2025-09-25 | Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while sti… |
CVE-2025-59823 | Critical | 9.9 | 2025-09-25 | Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions f… |
CVE-2025-55551 | High | 7.5 | 2025-09-25 | An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. |
CVE-2025-46153 | Medium | 5.3 | 2025-09-25 | PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negativ… |
CVE-2025-46152 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument. |
CVE-2025-46150 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results. |
CVE-2025-46149 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error. |
CVE-2025-46148 | Medium | 5.3 | 2025-09-25 | In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results. |
CVE-2025-40838 | High | 7.5 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disc… |
CVE-2025-40837 | High | 8.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges… |
CVE-2025-40836 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated pr… |