2025 CVEs (page 178)
Page 178 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7989 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-7988 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-7987 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-7986 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-7985 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-7984 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-7983 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2025-7982 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-7981 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-7980 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-7979 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-7978 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-7977 | High | 7.8 | 2025-09-17 | Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-59415 | Medium | 4.6 | 2025-09-17 | Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learni… |
CVE-2025-10644 | Critical | 9.4 | 2025-09-17 | Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2025-10643 | Critical | 9.1 | 2025-09-17 | Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication o… |
CVE-2025-10619 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-pr… |
CVE-2025-10618 | Medium | 6.3 | 2025-09-17 | A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-10617 | Medium | 6.3 | 2025-09-17 | A weakness has been identified in SourceCodester Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/posit… |
CVE-2025-10616 | Medium | 6.3 | 2025-09-17 | A security flaw has been discovered in itsourcecode E-Commerce Website 1.0. Affected is an unknown function of the file /admin/users.php. The manipulation resu… |
CVE-2025-59410 | Low | 3.7 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is… |
CVE-2025-59354 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, includi… |
CVE-2025-59353 | High | 7.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary… |
CVE-2025-59352 | Critical | 9.8 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests… |
CVE-2025-59351 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced eve… |
CVE-2025-59350 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses… |
CVE-2025-59349 | Low | 3.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certa… |
CVE-2025-59348 | High | 7.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the st… |
CVE-2025-59347 | Medium | 6.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTT… |
CVE-2025-59346 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vul… |
CVE-2025-59340 | Critical | 9.8 | 2025-09-17 | jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().c… |
CVE-2025-37122 | Medium | 6.1 | 2025-09-17 | A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected… |
CVE-2025-10615 | Medium | 6.3 | 2025-09-17 | A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads… |
CVE-2025-10614 | Medium | 4.3 | 2025-09-17 | A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown function of the file… |
CVE-2025-59416 | | 2025-09-17 | The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will mak… | |
CVE-2025-59414 | Low | 3.1 | 2025-09-17 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload rev… |
CVE-2025-59345 | Critical | 9.1 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web… |
CVE-2025-56648 | Medium | 6.5 | 2025-09-17 | npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development se… |
CVE-2025-10613 | Medium | 6.3 | 2025-09-17 | A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such ma… |
CVE-2025-10608 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipu… |
CVE-2025-59342 | | 2025-09-17 | esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP h… | |
CVE-2025-59341 | | 2025-09-17 | esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm… | |
CVE-2025-59339 | Medium | 4.4 | 2025-09-17 | The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provi… |
CVE-2025-58767 | Medium | 5.3 | 2025-09-17 | REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need… |
CVE-2025-58766 | Critical | 9.0 | 2025-09-17 | Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to… |
CVE-2025-58432 | High | 7.8 | 2025-09-17 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/up… |
CVE-2025-58431 | Medium | 6.2 | 2025-09-17 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endp… |
CVE-2025-10607 | Medium | 4.3 | 2025-09-17 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such man… |
CVE-2025-10606 | Medium | 4.3 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovim… |
CVE-2025-10605 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda_preferencias.php. The manipu… |
CVE-2025-10604 | High | 7.3 | 2025-09-17 | A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. This affects an unknown part of the file /admin/edit_member.php. The manipulation of… |
CVE-2025-59304 | Critical | 9.8 | 2025-09-17 | A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP requ… |
CVE-2025-35436 | Medium | 5.3 | 2025-09-17 | CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by provid… |
CVE-2025-35435 | Medium | 4.3 | 2025-09-17 | CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit… |
CVE-2025-35434 | Medium | 4.2 | 2025-09-17 | CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonat… |
CVE-2025-35433 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log i… |
CVE-2025-35432 | Medium | 5.3 | 2025-09-17 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user… |
CVE-2025-35431 | Medium | 5.4 | 2025-09-17 | CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group me… |
CVE-2025-35430 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker coul… |
CVE-2025-10603 | High | 7.3 | 2025-09-17 | A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/s… |
CVE-2025-10602 | Medium | 6.3 | 2025-09-17 | A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/dele… |
CVE-2025-10601 | High | 7.3 | 2025-09-17 | A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulati… |
CVE-2025-10600 | High | 7.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the a… |
CVE-2025-10599 | High | 7.3 | 2025-09-17 | A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the… |
CVE-2025-10598 | High | 7.3 | 2025-09-17 | A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_pro… |
CVE-2025-10597 | High | 7.3 | 2025-09-17 | A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the f… |
CVE-2025-9862 | Medium | 6.5 | 2025-09-17 | Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, f… |
CVE-2025-57055 | Medium | 6.5 | 2025-09-17 | WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply… |
CVE-2025-54390 | Medium | 6.3 | 2025-09-17 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswor… |
CVE-2025-40933 | High | 7.5 | 2025-09-17 | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call… |
CVE-2025-10596 | High | 7.3 | 2025-09-17 | A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /index.php. The manipulation of the argum… |
CVE-2025-10595 | Medium | 6.3 | 2025-09-17 | A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-10205 | High | 8.8 | 2025-09-17 | Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions |
CVE-2025-59476 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messag… |
CVE-2025-59475 | Medium | 4.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers wit… |
CVE-2025-59474 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Ove… |
CVE-2025-55904 | Medium | 4.0 | 2025-09-17 | Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST reques… |
CVE-2025-50709 | Medium | 4.3 | 2025-09-17 | An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter |
CVE-2025-10594 | Medium | 6.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2025-10593 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/update_student.php… |
CVE-2025-8463 | Medium | 5.3 | 2025-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHar… |
CVE-2025-8077 | Critical | 9.8 | 2025-09-17 | A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account… |
CVE-2025-54467 | Medium | 5.3 | 2025-09-17 | When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector secur… |
CVE-2025-53884 | Medium | 5.3 | 2025-09-17 | NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of k… |
CVE-2025-10592 | Medium | 6.3 | 2025-09-17 | A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of… |
CVE-2025-0879 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site S… |
CVE-2025-8999 | Medium | 5.3 | 2025-09-17 | The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all v… |
CVE-2025-8411 | High | 7.1 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product… |
CVE-2025-10439 | Critical | 9.8 | 2025-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allow… |
CVE-2025-10157 | High | 7.8 | 2025-09-17 | A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals… |
CVE-2025-0546 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2025-10591 | Low | 3.5 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_funcao_cad.php of the component… |
CVE-2025-10590 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php… |
CVE-2025-10156 | Critical | 9.8 | 2025-09-17 | An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass… |
CVE-2025-10155 | High | 7.8 | 2025-09-17 | An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypas… |
CVE-2025-0420 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripti… |
CVE-2025-59458 | High | 8.3 | 2025-09-17 | In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2… |
CVE-2025-59457 | High | 7.7 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows |
CVE-2025-59456 | Medium | 5.5 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload |
CVE-2025-59455 | Medium | 4.2 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition |