2025 CVEs (page 168)
Page 168 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59814 | High | 8.8 | 2025-09-25 | This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read t… |
CVE-2025-57632 | High | 7.5 | 2025-09-25 | libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fix… |
CVE-2025-43993 | High | 7.8 | 2025-09-25 | Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerabili… |
CVE-2025-43816 | High | 7.5 | 2025-09-25 | A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 t… |
CVE-2025-10967 | High | 7.3 | 2025-09-25 | A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Pe… |
CVE-2025-10965 | Medium | 6.3 | 2025-09-25 | A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllm_call of the file lazyllm/components/d… |
CVE-2025-10964 | Medium | 6.3 | 2025-09-25 | A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulati… |
CVE-2025-29157 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page… |
CVE-2025-29156 | Medium | 6.1 | 2025-09-25 | Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet |
CVE-2025-10963 | Medium | 6.3 | 2025-09-25 | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation o… |
CVE-2025-10962 | Medium | 6.3 | 2025-09-25 | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetNam… |
CVE-2025-60249 | Medium | 6.4 | 2025-09-25 | vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or si… |
CVE-2025-57623 | Medium | 5.3 | 2025-09-25 | A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service. |
CVE-2025-48707 | High | 7.5 | 2025-09-25 | An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among adminis… |
CVE-2025-29155 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint |
CVE-2025-10961 | Medium | 5.5 | 2025-09-25 | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete… |
CVE-2025-10960 | Medium | 6.3 | 2025-09-25 | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component… |
CVE-2025-10959 | Medium | 6.3 | 2025-09-25 | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipu… |
CVE-2025-10958 | Medium | 6.3 | 2025-09-25 | A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. Thi… |
CVE-2025-34227 | High | 8.8 | 2025-09-25 | Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, a… |
CVE-2025-10880 | High | 7.5 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietar… |
CVE-2025-10879 | Medium | 5.3 | 2025-09-25 | All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current u… |
CVE-2025-60019 | Low | 3.7 | 2025-09-25 | glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result i… |
CVE-2025-60018 | Medium | 4.8 | 2025-09-25 | glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read. |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |
CVE-2025-57446 | High | 7.5 | 2025-09-25 | An issue in O-RAN Near Realtime RIC ric-plt-submgr in the J-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted reque… |
CVE-2025-55560 | High | 7.5 | 2025-09-25 | An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is c… |
CVE-2025-55559 | High | 7.5 | 2025-09-25 | An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D. |
CVE-2025-55558 | High | 7.5 | 2025-09-25 | A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() a… |
CVE-2025-55557 | High | 7.5 | 2025-09-25 | A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). |
CVE-2025-55556 | Medium | 6.5 | 2025-09-25 | TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. |
CVE-2025-55554 | Medium | 5.3 | 2025-09-25 | pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long(). |
CVE-2025-55553 | High | 7.5 | 2025-09-25 | A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). |
CVE-2025-55552 | High | 7.5 | 2025-09-25 | pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. |
CVE-2025-43943 | Medium | 6.7 | 2025-09-25 | Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection… |
CVE-2025-33116 | Medium | 4.4 | 2025-09-25 | IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbit… |
CVE-2025-26333 | Medium | 5.9 | 2025-09-25 | Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potential… |
CVE-2025-20363 | Critical | 9.0 | 2025-09-25 | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, C… |
CVE-2025-20362 | Medium | 6.5 | 2025-09-25 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases… |
CVE-2025-20333 | Critical | 9.9 | 2025-09-25 | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softwa… |
CVE-2025-10953 | High | 8.8 | 2025-09-25 | A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /gofor… |
CVE-2025-10952 | Medium | 5.3 | 2025-09-25 | A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler o… |
CVE-2025-10911 | Medium | 5.5 | 2025-09-25 | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. |
CVE-2025-59838 | Medium | 5.4 | 2025-09-25 | Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text resu… |
CVE-2025-59832 | Critical | 9.9 | 2025-09-25 | Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment ed… |
CVE-2025-59830 | High | 7.5 | 2025-09-25 | Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while sti… |
CVE-2025-59823 | Critical | 9.9 | 2025-09-25 | Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions f… |
CVE-2025-55551 | High | 7.5 | 2025-09-25 | An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. |
CVE-2025-46153 | Medium | 5.3 | 2025-09-25 | PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negativ… |
CVE-2025-46152 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument. |
CVE-2025-46150 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results. |
CVE-2025-46149 | Medium | 5.3 | 2025-09-25 | In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error. |
CVE-2025-46148 | Medium | 5.3 | 2025-09-25 | In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results. |
CVE-2025-40838 | High | 7.5 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disc… |
CVE-2025-40837 | High | 8.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges… |
CVE-2025-40836 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated pr… |
CVE-2025-36857 | Low | 3.3 | 2025-09-25 | Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, where… |
CVE-2025-36601 | Medium | 4.0 | 2025-09-25 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthentica… |
CVE-2025-27262 | High | 7.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges. |
CVE-2025-10951 | High | 7.3 | 2025-09-25 | A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function log_handler o… |
CVE-2025-10950 | Medium | 6.3 | 2025-09-25 | A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/s… |
CVE-2025-10949 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The ma… |
CVE-2025-10542 | Critical | 9.8 | 2025-09-25 | iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrato… |
CVE-2025-10541 | High | 7.8 | 2025-09-25 | iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechani… |
CVE-2025-5494 | Low | 3.9 | 2025-09-25 | ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through… |
CVE-2025-59839 | High | 8.6 | 2025-09-25 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2025-59834 | Critical | 9.8 | 2025-09-25 | ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is writte… |
CVE-2025-59831 | High | 8.8 | 2025-09-25 | git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerabil… |
CVE-2025-59426 | Medium | 4.3 | 2025-09-25 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host an… |
CVE-2025-59422 | Low | 3.1 | 2025-09-25 | Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?con… |
CVE-2025-57317 | High | 7.5 | 2025-09-25 | apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the preProcess function of a… |
CVE-2025-27261 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data. |
CVE-2025-26278 | High | 7.5 | 2025-09-25 | A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2025-10948 | High | 8.8 | 2025-09-25 | A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson… |
CVE-2025-10540 | Medium | 6.5 | 2025-09-25 | iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the ser… |
CVE-2025-10467 | High | 8.9 | 2025-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardware Service Trade Lt… |
CVE-2025-10947 | Medium | 5.3 | 2025-09-25 | A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/valid… |
CVE-2025-10946 | Low | 3.5 | 2025-09-25 | A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php… |
CVE-2025-10945 | Low | 3.5 | 2025-09-25 | A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php… |
CVE-2025-10944 | Low | 3.5 | 2025-09-25 | A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. Th… |
CVE-2025-10449 | High | 8.6 | 2025-09-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows… |
CVE-2025-40698 | | 2025-09-25 | SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases b… | |
CVE-2025-10957 | | 2025-09-25 | This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vu… | |
CVE-2025-10943 | Low | 3.5 | 2025-09-25 | A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function… |
CVE-2025-10942 | High | 8.8 | 2025-09-25 | A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of… |
CVE-2025-10941 | High | 7.8 | 2025-09-25 | A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0… |
CVE-2025-10940 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page… |
CVE-2025-10438 | High | 8.6 | 2025-09-25 | Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Kata… |
CVE-2025-21056 | Medium | 6.6 | 2025-09-25 | Improper input validation in Retail Mode prior to version 5.59.4 allows self attackers to execute privileged commands on their own devices. |
CVE-2025-54520 | | 2025-09-24 | Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platform resulting in a l… | |
CVE-2025-10894 | Critical | 9.6 | 2025-09-24 | Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, vi… |
CVE-2025-59833 | High | 7.5 | 2025-09-24 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plai… |
CVE-2025-59827 | Critical | 9.8 | 2025-09-24 | Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated… |
CVE-2025-57324 | Medium | 6.5 | 2025-09-24 | parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse… |
CVE-2025-57320 | Medium | 6.5 | 2025-09-24 | json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-sche… |
CVE-2025-57319 | High | 7.5 | 2025-09-24 | fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version… |
CVE-2025-57318 | High | 7.5 | 2025-09-24 | A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplyin… |
CVE-2025-59828 | Critical | 9.8 | 2025-09-24 | Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when… |
CVE-2025-59824 | Medium | 5.4 | 2025-09-24 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni an… |
CVE-2025-57329 | High | 7.5 | 2025-09-24 | web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-c… |