2025 CVEs (page 176)
Page 176 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34199 | High | 8.1 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) c… |
CVE-2025-34198 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain sha… |
CVE-2025-34197 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an und… |
CVE-2025-34195 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a… |
CVE-2025-34194 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments)… |
CVE-2025-34193 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client compo… |
CVE-2025-34192 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployme… |
CVE-2025-34191 | High | 8.4 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) cont… |
CVE-2025-34190 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployme… |
CVE-2025-34189 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deploymen… |
CVE-2025-34188 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) conta… |
CVE-2025-26517 | Medium | 5.4 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful expl… |
CVE-2025-26516 | Medium | 5.3 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit… |
CVE-2025-26515 | High | 7.5 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request… |
CVE-2025-26514 | Medium | 6.4 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Succ… |
CVE-2025-48703 | Critical | 9.0 | 2025-09-19 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total paramete… |
CVE-2025-10722 | Medium | 5.3 | 2025-09-19 | A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of the component com.dw… |
CVE-2025-10721 | Medium | 5.3 | 2025-09-19 | A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml… |
CVE-2025-36248 | Medium | 6.1 | 2025-09-19 | IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in… |
CVE-2025-59427 | | 2025-09-19 | The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default c… | |
CVE-2025-59344 | High | 7.7 | 2025-09-19 | AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extractio… |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-57296 | Medium | 6.5 | 2025-09-19 | Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCf… |
CVE-2025-56869 | Medium | 5.3 | 2025-09-19 | Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.sa… |
CVE-2025-55910 | Medium | 6.3 | 2025-09-19 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. |
CVE-2025-39866 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurre… |
CVE-2025-39865 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereferenc… |
CVE-2025-39864 | High | 8.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in… |
CVE-2025-39863 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btc… |
CVE-2025-39862 | High | 8.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix list corruption after hardware restart Since stations are recreat… |
CVE-2025-39861 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation… |
CVE-2025-39860 | High | 8.0 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat be… |
CVE-2025-39859 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog The ptp_ocp_detach() only s… |
CVE-2025-39858 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring Replace NULL check wi… |
CVE-2025-39857 | High | 7.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL po… |
CVE-2025-39856 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX comple… |
CVE-2025-39855 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "l… |
CVE-2025-39854 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware… |
CVE-2025-39853 | High | 7.1 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never return… |
CVE-2025-39852 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_… |
CVE-2025-39851 | High | 7.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can p… |
CVE-2025-39850 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option… |
CVE-2025-39849 | High | 8.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen… |
CVE-2025-39848 | High | 8.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression appar… |
CVE-2025-39847 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it r… |
CVE-2025-39846 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_reg… |
CVE-2025-39845 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_P… |
CVE-2025-39844 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we… |
CVE-2025-39843 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock re… |
CVE-2025-39842 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_o… |
CVE-2025-39841 | Critical | 9.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free win… |
CVE-2025-39840 | High | 7.1 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is comb… |
CVE-2025-39839 | High | 8.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() tru… |
CVE-2025-39838 | Medium | 5.5 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer de… |
CVE-2025-39837 | High | 7.8 | 2025-09-19 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called f… |
CVE-2025-10718 | Medium | 5.3 | 2025-09-19 | A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipul… |
CVE-2025-8664 | Medium | 6.3 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-57528 | High | 7.7 | 2025-09-19 | An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara… |
CVE-2025-10717 | Medium | 5.3 | 2025-09-19 | A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidMan… |
CVE-2025-10716 | Medium | 5.3 | 2025-09-19 | A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml… |
CVE-2025-58114 | Medium | 4.8 | 2025-09-19 | Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-57880 | Medium | 5.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This is… |
CVE-2025-48007 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue… |
CVE-2025-46703 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affect… |
CVE-2025-10715 | Medium | 5.3 | 2025-09-19 | A security flaw has been discovered in APEUni PTE Exam Practice App up to 10.8.0 on Android. The impacted element is an unknown function of the file AndroidMan… |
CVE-2025-10712 | High | 7.3 | 2025-09-19 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Pe… |
CVE-2025-7665 | High | 8.1 | 2025-09-19 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofir… |
CVE-2025-10711 | Medium | 4.3 | 2025-09-19 | A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /index.php/sysmanage/Log… |
CVE-2025-10710 | Medium | 4.3 | 2025-09-19 | A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argumen… |
CVE-2025-9969 | High | 7.1 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Conte… |
CVE-2025-10709 | Medium | 5.3 | 2025-09-19 | A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /hi… |
CVE-2025-10708 | Medium | 5.3 | 2025-09-19 | A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10468 | High | 7.5 | 2025-09-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affe… |
CVE-2025-8531 | Medium | 6.8 | 2025-09-19 | Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU… |
CVE-2025-10719 | Medium | 4.3 | 2025-09-19 | Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specifi… |
CVE-2025-10630 | Medium | 4.3 | 2025-09-19 | Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix a… |
CVE-2025-9906 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras mo… |
CVE-2025-9905 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5… |
CVE-2025-10647 | High | 8.8 | 2025-09-19 | The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_med… |
CVE-2025-7702 | Medium | 4.7 | 2025-09-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry and Trade Ltd. Co. Manageable Email Sen… |
CVE-2025-7403 | High | 7.6 | 2025-09-19 | Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precis… |
CVE-2025-5948 | Critical | 9.8 | 2025-09-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-10458 | High | 7.6 | 2025-09-19 | Parameters are not validated or sanitized, and are later used in various internal operations. |
CVE-2025-10457 | Medium | 4.3 | 2025-09-19 | The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a conne… |
CVE-2025-10456 | High | 7.1 | 2025-09-19 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a fla… |
CVE-2025-5955 | High | 8.1 | 2025-09-19 | The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugi… |
CVE-2025-10146 | Medium | 6.1 | 2025-09-19 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3… |
CVE-2025-8487 | Medium | 5.4 | 2025-09-19 | The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-insta… |
CVE-2025-59717 | Medium | 5.4 | 2025-09-19 | In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedCl… |
CVE-2025-7937 | High | 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially… |
CVE-2025-59715 | Medium | 4.8 | 2025-09-19 | SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. |
CVE-2025-59714 | Medium | 6.5 | 2025-09-19 | In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. |
CVE-2025-59713 | Medium | 6.8 | 2025-09-19 | Snipe-IT before 8.1.18 allows unsafe deserialization. |
CVE-2025-59712 | Medium | 6.4 | 2025-09-19 | Snipe-IT before 8.1.18 allows XSS. |
CVE-2025-10690 | Critical | 9.8 | 2025-09-19 | The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the… |
CVE-2025-6198 | High | 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a special… |
CVE-2025-30755 | Medium | 6.1 | 2025-09-19 | OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revisio… |
CVE-2025-59692 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT pol… |