2025 CVEs (page 177)
Page 177 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59691 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or sy… |
CVE-2025-59220 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to eleva… |
CVE-2025-59216 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-59215 | High | 7.0 | 2025-09-18 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-54860 | High | 7.7 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as f… |
CVE-2025-54818 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-54810 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-54497 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and … |
CVE-2025-53969 | High | 8.8 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software… |
CVE-2025-52873 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and d… |
CVE-2025-10035 | Critical | 10.0 | 2025-09-18 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deseriali… |
CVE-2025-57295 | High | 8.0 | 2025-09-18 | H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no passw… |
CVE-2025-57293 | High | 8.8 | 2025-09-18 | A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt… |
CVE-2025-55068 | High | 8.2 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time t… |
CVE-2025-54807 | Critical | 9.8 | 2025-09-18 | The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypas… |
CVE-2025-54754 | High | 8.0 | 2025-09-18 | An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available sof… |
CVE-2025-53947 | High | 7.7 | 2025-09-18 | A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerability to corrupt sensitive data. A data f… |
CVE-2025-47698 | | 2025-09-18 | An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present duri… | |
CVE-2025-30519 | Critical | 9.8 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker w… |
CVE-2025-10689 | Medium | 6.3 | 2025-09-18 | A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument… |
CVE-2025-59424 | High | 7.3 | 2025-09-18 | LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system… |
CVE-2025-10688 | High | 7.3 | 2025-09-18 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/operation/pai… |
CVE-2025-47906 | Medium | 6.5 | 2025-09-18 | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and "..")… |
CVE-2025-26503 | Medium | 6.7 | 2025-09-18 | A crafted system call argument can cause memory corruption. |
CVE-2025-10650 | | 2025-09-18 | SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unautho… | |
CVE-2025-10687 | High | 7.3 | 2025-09-18 | A vulnerability was found in SourceCodester Responsive E-Learning System 1.0. This affects an unknown part of the file /admin/add_teacher.php. The manipulation… |
CVE-2025-55912 | High | 7.3 | 2025-09-18 | An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary… |
CVE-2025-50255 | High | 7.8 | 2025-09-18 | Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request. |
CVE-2025-36146 | Medium | 4.3 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks… |
CVE-2025-36143 | Medium | 4.7 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user su… |
CVE-2025-36139 | Medium | 5.5 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code i… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-59421 | | 2025-09-18 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood t… | |
CVE-2025-59417 | Medium | 6.1 | 2025-09-18 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handli… |
CVE-2025-59040 | Medium | 4.3 | 2025-09-18 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of… |
CVE-2025-57452 | Medium | 6.1 | 2025-09-18 | In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash… |
CVE-2025-55911 | Medium | 6.5 | 2025-09-18 | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter |
CVE-2025-10673 | High | 7.3 | 2025-09-18 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/module… |
CVE-2025-10672 | High | 7.8 | 2025-09-18 | A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swif… |
CVE-2025-10671 | Low | 3.7 | 2025-09-18 | A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\… |
CVE-2025-4444 | Low | 3.7 | 2025-09-18 | A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performi… |
CVE-2025-10670 | High | 7.3 | 2025-09-18 | A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /check_p… |
CVE-2025-10669 | Medium | 6.3 | 2025-09-18 | A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing ma… |
CVE-2025-10668 | High | 7.3 | 2025-09-18 | A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/compose_msg_admin.php… |
CVE-2025-10667 | High | 7.3 | 2025-09-18 | A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_m… |
CVE-2025-10666 | High | 8.8 | 2025-09-18 | A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipula… |
CVE-2025-40678 | | 2025-09-18 | Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerou… | |
CVE-2025-40677 | | 2025-09-18 | SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the databas… | |
CVE-2025-10665 | Medium | 6.3 | 2025-09-18 | A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Pro… |
CVE-2025-10664 | High | 7.3 | 2025-09-18 | A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argu… |
CVE-2025-10207 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. |
CVE-2025-10663 | High | 7.3 | 2025-09-18 | A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation o… |
CVE-2025-10662 | Medium | 4.7 | 2025-09-18 | A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation… |
CVE-2025-9992 | Medium | 6.4 | 2025-09-18 | The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in a… |
CVE-2025-8565 | High | 8.1 | 2025-09-18 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of funct… |
CVE-2025-30187 | Low | 3.7 | 2025-09-18 | In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a d… |
CVE-2025-6237 | Critical | 9.8 | 2025-09-18 | A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/downlo… |
CVE-2025-0547 | Medium | 4.7 | 2025-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting… |
CVE-2025-10493 | Medium | 5.3 | 2025-09-18 | The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mecha… |
CVE-2025-9083 | Critical | 9.8 | 2025-09-18 | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection… |
CVE-2025-8942 | Critical | 9.1 | 2025-09-18 | The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value… |
CVE-2025-5305 | Critical | 9.8 | 2025-09-18 | The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, poten… |
CVE-2025-10642 | Low | 3.5 | 2025-09-18 | A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php… |
CVE-2025-10634 | Medium | 6.3 | 2025-09-18 | A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the co… |
CVE-2025-10632 | Low | 3.5 | 2025-09-18 | A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. The affected element is an unknown function of the file availablefram… |
CVE-2025-10631 | Low | 3.5 | 2025-09-18 | A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Impacted is an unknown function of the file addcnp.php of the component Av… |
CVE-2025-10629 | Medium | 6.3 | 2025-09-18 | A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Ser… |
CVE-2025-10628 | Medium | 6.3 | 2025-09-18 | A vulnerability was found in D-Link DIR-852 1.00CN B09. This vulnerability affects unknown code of the file /htdocs/cgibin/hedwig.cgi of the component Web Mana… |
CVE-2025-10627 | Medium | 6.3 | 2025-09-18 | A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/delete_user.php. Such manipul… |
CVE-2025-10626 | Medium | 6.3 | 2025-09-18 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /admin/update_s3.php… |
CVE-2025-23337 | Medium | 6.7 | 2025-09-17 | NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access… |
CVE-2025-10625 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/da… |
CVE-2025-10624 | High | 7.3 | 2025-09-17 | A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation… |
CVE-2025-10623 | High | 7.3 | 2025-09-17 | A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteuser.php. Such man… |
CVE-2025-23336 | Medium | 4.4 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading a misconfigured mode… |
CVE-2025-23329 | High | 7.5 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corruption by identifying and accessing the… |
CVE-2025-23328 | High | 7.5 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write through a specially crafted… |
CVE-2025-23316 | Critical | 9.8 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by m… |
CVE-2025-23268 | High | 8.0 | 2025-09-17 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. A successful exploi… |
CVE-2025-10621 | High | 7.3 | 2025-09-17 | A vulnerability was determined in SourceCodester Hotel Reservation System 1.0. The affected element is an unknown function of the file editroomimage.php. This… |
CVE-2025-10620 | Medium | 6.3 | 2025-09-17 | A flaw has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file /editp2.php. Executing manipulat… |
CVE-2025-8006 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-8005 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-8004 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-8003 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-8002 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-8001 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-8000 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-7999 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-7998 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-7997 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-7996 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-7995 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-7994 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-7993 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-7992 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-7991 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-7990 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |