2025 CVEs (page 178)
Page 178 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56557 | Critical | 9.1 | 2025-09-16 | An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol. |
CVE-2025-49728 | Medium | 4.0 | 2025-09-16 | Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-47967 | Medium | 4.7 | 2025-09-16 | Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-10562 | High | 7.3 | 2025-09-16 | A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=save_product. This man… |
CVE-2025-57625 | High | 8.8 | 2025-09-16 | CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privi… |
CVE-2025-57624 | High | 7.8 | 2025-09-16 | A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple DLLs. |
CVE-2025-56562 | High | 7.5 | 2025-09-16 | An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC address. |
CVE-2025-54262 | High | 7.8 | 2025-09-16 | Substance3D - Stager versions 3.1.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-54237 | Medium | 5.5 | 2025-09-16 | Substance3D - Stager versions 3.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could lever… |
CVE-2025-59336 | | 2025-09-16 | Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime f… | |
CVE-2025-59334 | Critical | 9.6 | 2025-09-16 | Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of… |
CVE-2025-59161 | | 2025-09-16 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of ro… | |
CVE-2025-59160 | | 2025-09-16 | Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor… | |
CVE-2025-59050 | High | 8.4 | 2025-09-16 | Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message u… |
CVE-2025-58174 | Medium | 4.6 | 2025-09-16 | LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile… |
CVE-2025-43801 | High | 7.5 | 2025-09-16 | Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4… |
CVE-2025-10492 | Critical | 9.8 | 2025-09-16 | A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute ar… |
CVE-2025-58749 | Medium | 5.3 | 2025-09-16 | WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the ru… |
CVE-2025-30075 | Low | 2.2 | 2025-09-16 | In Alludo MindManager before 25.0.208 on Windows, attackers could potentially execute code as other local users on the same machine if they could write DLL fil… |
CVE-2025-8894 | High | 7.8 | 2025-09-16 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage th… |
CVE-2025-8893 | High | 7.8 | 2025-09-16 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-59333 | High | 8.1 | 2025-09-16 | The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate secu… |
CVE-2025-59270 | Low | 3.1 | 2025-09-16 | psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process. An unauthenticate… |
CVE-2025-57145 | Medium | 5.4 | 2025-09-16 | A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize… |
CVE-2025-56295 | High | 7.3 | 2025-09-16 | code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying p… |
CVE-2025-56293 | Medium | 5.4 | 2025-09-16 | code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the Childs Name field. |
CVE-2025-56289 | Medium | 5.4 | 2025-09-16 | code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie information by entering ma… |
CVE-2025-56280 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. |
CVE-2025-4953 | High | 7.4 | 2025-09-16 | A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can… |
CVE-2025-41243 | Critical | 10.0 | 2025-09-16 | Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the… |
CVE-2025-36244 | High | 7.4 | 2025-09-16 | IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with… |
CVE-2025-8276 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization o… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-57119 | Critical | 9.8 | 2025-09-16 | An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function |
CVE-2025-56276 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters malicious JavaScript… |
CVE-2025-52044 | High | 7.5 | 2025-09-16 | In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all… |
CVE-2025-44034 | High | 8.0 | 2025-09-16 | SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/… |
CVE-2025-39836 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: efi: stmm: Fix incorrect buffer allocation method The communication buffer allocated by s… |
CVE-2025-39835 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a ver… |
CVE-2025-39834 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow When an invali… |
CVE-2025-39833 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TI… |
CVE-2025-39832 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggere… |
CVE-2025-39831 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: fbnic: Move phylink resume out of service_task and into open/close The fbnic driver was p… |
CVE-2025-39830 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In the error path of hws… |
CVE-2025-7355 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-55834 | Medium | 6.1 | 2025-09-16 | A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2025-55117 | Medium | 5.3 | 2025-09-16 | A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The… |
CVE-2025-55116 | High | 8.8 | 2025-09-16 | A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabil… |
CVE-2025-55115 | High | 8.8 | 2025-09-16 | A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabilit… |
CVE-2025-55114 | Medium | 5.3 | 2025-09-16 | The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake… |
CVE-2025-55113 | Critical | 9.0 | 2025-09-16 | If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 a… |
CVE-2025-55112 | High | 7.4 | 2025-09-16 | Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cry… |
CVE-2025-55111 | Medium | 5.5 | 2025-09-16 | Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupp… |
CVE-2025-55110 | Medium | 5.5 | 2025-09-16 | Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the… |
CVE-2025-55109 | Critical | 9.0 | 2025-09-16 | An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when… |
CVE-2025-39829 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier This warning was trig… |
CVE-2025-39828 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat… |
CVE-2025-39827 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintain… |
CVE-2025-39826 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used… |
CVE-2025-39825 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename reque… |
CVE-2025-39824 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinp… |
CVE-2025-39823 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are gu… |
CVE-2025-39822 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, b… |
CVE-2025-39821 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start(… |
CVE-2025-39820 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset The drm_atomic_get_new_co… |
CVE-2025-39819 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was ide… |
CVE-2025-39818 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper… |
CVE-2025-39817 | High | 7.1 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on… |
CVE-2025-39816 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buff… |
CVE-2025-39815 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: fix stack overrun when loading vlenb The userspace load can put up to 2048 b… |
CVE-2025-39814 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when t… |
CVE-2025-39813 | Medium | 4.7 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_… |
CVE-2025-39812 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not… |
CVE-2025-39811 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an err… |
CVE-2025-39810 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings… |
CVE-2025-39809 | High | 8.4 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD… |
CVE-2025-39808 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report… |
CVE-2025-39807 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error han… |
CVE-2025-39806 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID devic… |
CVE-2025-39805 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix unregister_netdev call order in macb_remove() When removing a macb device… |
CVE-2025-10546 | | 2025-09-16 | This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal… | |
CVE-2025-10537 | High | 8.8 | 2025-09-16 | Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruptio… |
CVE-2025-10536 | Medium | 6.2 | 2025-09-16 | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
CVE-2025-10535 | High | 7.5 | 2025-09-16 | Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143. |
CVE-2025-10534 | High | 8.1 | 2025-09-16 | Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10533 | High | 8.8 | 2025-09-16 | Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
CVE-2025-10532 | Medium | 6.5 | 2025-09-16 | Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird… |
CVE-2025-10531 | Medium | 5.4 | 2025-09-16 | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10530 | Medium | 6.5 | 2025-09-16 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10529 | Medium | 6.5 | 2025-09-16 | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. |
CVE-2025-10528 | High | 7.3 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3… |
CVE-2025-10527 | High | 7.1 | 2025-09-16 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and… |
CVE-2025-10290 | Medium | 6.5 | 2025-09-16 | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers t… |
CVE-2025-8446 | Medium | 4.3 | 2025-09-16 | The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer… |
CVE-2025-7744 | Critical | 9.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affect… |
CVE-2025-7743 | Critical | 9.6 | 2025-09-16 | Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: befor… |
CVE-2025-6575 | Medium | 5.4 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue… |
CVE-2025-56706 | High | 8.0 | 2025-09-16 | Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function. |
CVE-2025-56697 | Medium | 6.1 | 2025-09-16 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1… |