2025 CVEs (page 180)
Page 180 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39835 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a ver… |
CVE-2025-39834 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow When an invali… |
CVE-2025-39833 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TI… |
CVE-2025-39832 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggere… |
CVE-2025-39831 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: fbnic: Move phylink resume out of service_task and into open/close The fbnic driver was p… |
CVE-2025-39830 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In the error path of hws… |
CVE-2025-7355 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-55834 | Medium | 6.1 | 2025-09-16 | A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2025-55117 | Medium | 5.3 | 2025-09-16 | A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The… |
CVE-2025-55116 | High | 8.8 | 2025-09-16 | A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabil… |
CVE-2025-55115 | High | 8.8 | 2025-09-16 | A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabilit… |
CVE-2025-55114 | Medium | 5.3 | 2025-09-16 | The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake… |
CVE-2025-55113 | Critical | 9.0 | 2025-09-16 | If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 a… |
CVE-2025-55112 | High | 7.4 | 2025-09-16 | Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cry… |
CVE-2025-55111 | Medium | 5.5 | 2025-09-16 | Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupp… |
CVE-2025-55110 | Medium | 5.5 | 2025-09-16 | Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the… |
CVE-2025-55109 | Critical | 9.0 | 2025-09-16 | An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when… |
CVE-2025-39829 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier This warning was trig… |
CVE-2025-39828 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat… |
CVE-2025-39827 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintain… |
CVE-2025-39826 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used… |
CVE-2025-39825 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename reque… |
CVE-2025-39824 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinp… |
CVE-2025-39823 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are gu… |
CVE-2025-39822 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, b… |
CVE-2025-39821 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start(… |
CVE-2025-39820 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset The drm_atomic_get_new_co… |
CVE-2025-39819 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was ide… |
CVE-2025-39818 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper… |
CVE-2025-39817 | High | 7.1 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on… |
CVE-2025-39816 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buff… |
CVE-2025-39815 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: fix stack overrun when loading vlenb The userspace load can put up to 2048 b… |
CVE-2025-39814 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when t… |
CVE-2025-39813 | Medium | 4.7 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_… |
CVE-2025-39812 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not… |
CVE-2025-39811 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an err… |
CVE-2025-39810 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings… |
CVE-2025-39809 | High | 8.4 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD… |
CVE-2025-39808 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report… |
CVE-2025-39807 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error han… |
CVE-2025-39806 | High | 8.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID devic… |
CVE-2025-39805 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix unregister_netdev call order in macb_remove() When removing a macb device… |
CVE-2025-10546 | | 2025-09-16 | This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal… | |
CVE-2025-10537 | High | 8.8 | 2025-09-16 | Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruptio… |
CVE-2025-10536 | Medium | 6.2 | 2025-09-16 | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
CVE-2025-10535 | High | 7.5 | 2025-09-16 | Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143. |
CVE-2025-10534 | High | 8.1 | 2025-09-16 | Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10533 | High | 8.8 | 2025-09-16 | Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
CVE-2025-10532 | Medium | 6.5 | 2025-09-16 | Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird… |
CVE-2025-10531 | Medium | 5.4 | 2025-09-16 | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10530 | Medium | 6.5 | 2025-09-16 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10529 | Medium | 6.5 | 2025-09-16 | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. |
CVE-2025-10528 | High | 7.3 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3… |
CVE-2025-10527 | High | 7.1 | 2025-09-16 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and… |
CVE-2025-10290 | Medium | 6.5 | 2025-09-16 | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers t… |
CVE-2025-8446 | Medium | 4.3 | 2025-09-16 | The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer… |
CVE-2025-7744 | Critical | 9.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affect… |
CVE-2025-7743 | Critical | 9.6 | 2025-09-16 | Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: befor… |
CVE-2025-6575 | Medium | 5.4 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue… |
CVE-2025-56706 | High | 8.0 | 2025-09-16 | Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function. |
CVE-2025-56697 | Medium | 6.1 | 2025-09-16 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1… |
CVE-2025-41249 | High | 7.5 | 2025-09-16 | The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type wi… |
CVE-2025-41248 | High | 7.5 | 2025-09-16 | The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type wit… |
CVE-2025-26711 | Medium | 5.7 | 2025-09-16 | There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain… |
CVE-2025-26710 | Low | 3.5 | 2025-09-16 | There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain informati… |
CVE-2025-10016 | | 2025-09-16 | The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request install… | |
CVE-2025-10015 | | 2025-09-16 | The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged atta… | |
CVE-2025-4688 | Critical | 9.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BGS Interactive SINAV.LINK Exam Result Module allows SQL… |
CVE-2025-2404 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-S… |
CVE-2025-10316 | | 2025-09-16 | The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from… | |
CVE-2025-5519 | Medium | 6.5 | 2025-09-16 | Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4… |
CVE-2025-5518 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue… |
CVE-2025-9808 | Medium | 5.3 | 2025-09-16 | The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This mak… |
CVE-2025-59453 | Low | 3.2 | 2025-09-16 | Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the… |
CVE-2025-59437 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic… |
CVE-2025-59436 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable v… |
CVE-2025-43375 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process. |
CVE-2025-43372 | High | 7.8 | 2025-09-15 | The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26… |
CVE-2025-43371 | High | 8.2 | 2025-09-15 | This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox. |
CVE-2025-43370 | Medium | 4.0 | 2025-09-15 | A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process. |
CVE-2025-43369 | Medium | 5.5 | 2025-09-15 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data. |
CVE-2025-43368 | Medium | 4.3 | 2025-09-15 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing malici… |
CVE-2025-43367 | Medium | 5.5 | 2025-09-15 | A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user d… |
CVE-2025-43366 | Medium | 5.5 | 2025-09-15 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to disclose coprocessor memory. |
CVE-2025-43362 | Critical | 9.8 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to monitor keystrokes w… |
CVE-2025-43359 | Critical | 9.8 | 2025-09-15 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS So… |
CVE-2025-43358 | High | 8.8 | 2025-09-15 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15… |
CVE-2025-43357 | Low | 3.3 | 2025-09-15 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43356 | Medium | 6.5 | 2025-09-15 | The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvO… |
CVE-2025-43355 | Medium | 5.5 | 2025-09-15 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7… |
CVE-2025-43354 | Medium | 5.5 | 2025-09-15 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An a… |
CVE-2025-43353 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. Processing a maliciously cra… |
CVE-2025-43349 | Low | 2.8 | 2025-09-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43347 | Critical | 9.8 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An inp… |
CVE-2025-43346 | Medium | 5.5 | 2025-09-15 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 2… |
CVE-2025-43344 | Low | 3.3 | 2025-09-15 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, w… |
CVE-2025-43343 | Critical | 9.8 | 2025-09-15 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26… |
CVE-2025-43342 | Critical | 9.8 | 2025-09-15 | A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS… |
CVE-2025-43341 | High | 7.8 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privi… |