2025 CVEs (page 17)
Page 17 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71267 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop… |
CVE-2025-71266 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite lo… |
CVE-2025-71265 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an… |
CVE-2025-12518 | | 2026-03-18 | beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and… | |
CVE-2025-31703 | | 2026-03-18 | A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via th… | |
CVE-2025-15363 | Medium | 5.9 | 2026-03-18 | The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Script… |
CVE-2025-14031 | High | 7.5 | 2026-03-17 | IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 coul… |
CVE-2025-14806 | Medium | 5.7 | 2026-03-17 | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific resp… |
CVE-2025-15584 | | 2026-03-17 | Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2025-66633 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66617 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66503 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66342 | High | 7.8 | 2026-03-17 | A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead t… |
CVE-2025-66042 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66000 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-65119 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64776 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64735 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64733 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64301 | High | 7.8 | 2026-03-17 | An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this v… |
CVE-2025-62500 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-62403 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61979 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61952 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-58427 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-47873 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-13406 | | 2026-03-17 | NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink S… | |
CVE-2025-62320 | Medium | 4.7 | 2026-03-17 | HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |
CVE-2025-71239 | Medium | 5.5 | 2026-03-17 | In the Linux kernel, the following vulnerability has been resolved: audit: add fchmodat2() to change attributes class fchmodat2(), introduced in version 6.6… |
CVE-2025-69902 | Critical | 9.8 | 2026-03-16 | A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting… |
CVE-2025-50881 | High | 8.8 | 2026-03-16 | The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, th… |
CVE-2025-69693 | Medium | 5.4 | 2026-03-16 | Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the l… |
CVE-2025-68971 | Medium | 6.5 | 2026-03-16 | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an is… |
CVE-2025-69809 | Critical | 9.8 | 2026-03-16 | A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execu… |
CVE-2025-69808 | Critical | 9.1 | 2026-03-16 | An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Serv… |
CVE-2025-69727 | Medium | 5.3 | 2026-03-16 | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu… |
CVE-2025-69196 | Medium | 6.5 | 2026-03-16 | FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted… |
CVE-2025-69768 | High | 7.5 | 2026-03-16 | SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component |
CVE-2025-66687 | High | 7.5 | 2026-03-16 | Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files |
CVE-2025-65734 | Medium | 5.4 | 2026-03-16 | An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to… |
CVE-2025-69784 | High | 8.8 | 2026-03-16 | A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by t… |
CVE-2025-69783 | High | 7.8 | 2026-03-16 | A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsv… |
CVE-2025-62319 | Critical | 9.8 | 2026-03-16 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into app… |
CVE-2025-57543 | Medium | 6.1 | 2026-03-16 | Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the… |
CVE-2025-52649 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52645 | Low | 1.9 | 2026-03-16 | HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow… |
CVE-2025-52644 | Medium | 5.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce t… |
CVE-2025-52643 | Medium | 4.7 | 2026-03-16 | HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expos… |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2025-52636 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resou… |
CVE-2025-2274 | Medium | 6.1 | 2026-03-16 | Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security t… |
CVE-2025-71264 | Low | 3.7 | 2026-03-16 | Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). |
CVE-2025-6969 | Medium | 5.0 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-69246 | Critical | 9.8 | 2026-03-16 | Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering l… |
CVE-2025-69245 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authe… |
CVE-2025-69243 | Medium | 5.3 | 2026-03-16 | Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid… |
CVE-2025-69242 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, re… |
CVE-2025-69241 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML… |
CVE-2025-69240 | High | 8.8 | 2026-03-16 | Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) … |
CVE-2025-69239 | Low | 2.7 | 2026-03-16 | Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the UR… |
CVE-2025-69238 | Medium | 4.3 | 2026-03-16 | Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated v… |
CVE-2025-69237 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permissions to create con… |
CVE-2025-69236 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permissions to edit posts… |
CVE-2025-54920 | High | 8.8 | 2026-03-16 | This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summ… |
CVE-2025-52648 | Medium | 4.8 | 2026-03-16 | HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered image… |
CVE-2025-52638 | Medium | 5.6 | 2026-03-16 | HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may… |
CVE-2025-52637 | Medium | 4.5 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52458 | Medium | 5.5 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-41432 | Medium | 5.5 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-26474 | Low | 3.3 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenar… |
CVE-2025-25277 | Medium | 6.3 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerabil… |
CVE-2025-15587 | | 2026-03-16 | Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessin… | |
CVE-2025-15554 | High | 7.8 | 2026-03-16 | Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via di… |
CVE-2025-15553 | High | 7.1 | 2026-03-16 | Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via dis… |
CVE-2025-15552 | High | 7.8 | 2026-03-16 | Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disc… |
CVE-2025-15540 | High | 8.8 | 2026-03-16 | "Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restri… |
CVE-2025-15060 | Critical | 9.8 | 2026-03-16 | claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-14287 | High | 8.8 | 2026-03-16 | A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The… |
CVE-2025-13460 | Medium | 5.3 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy. |
CVE-2025-13459 | Low | 2.7 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow. |
CVE-2025-13212 | Medium | 5.3 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interacti… |
CVE-2025-12736 | Medium | 6.5 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource. |
CVE-2025-11500 | | 2026-03-16 | Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management an… | |
CVE-2025-10685 | | 2026-03-16 | Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webserver modules) allows overflow buffers… | |
CVE-2025-10461 | | 2026-03-16 | Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access… | |
CVE-2025-8766 | Medium | 6.4 | 2026-03-13 | A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-71263 | High | 7.4 | 2026-03-13 | In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A loca… |
CVE-2025-66249 | Medium | 6.3 | 2026-03-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before… |
CVE-2025-60012 | Medium | 6.3 | 2026-03-13 | Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3… |
CVE-2025-57849 | Medium | 6.4 | 2026-03-13 | A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permission… |
CVE-2025-36368 | Medium | 6.5 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to… |
CVE-2025-15515 | Medium | 5.5 | 2026-03-13 | The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a local network, it can… |
CVE-2025-14811 | Low | 3.1 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the qu… |
CVE-2025-14504 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 is vulne… |
CVE-2025-14483 | Medium | 4.3 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could di… |
CVE-2025-13779 | High | 8.3 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2025-13778 | Medium | 6.5 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2025-13777 | High | 8.3 | 2026-03-13 | Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1… |