2025 CVEs (page 183)
Page 183 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39766 | High | 7.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setu… |
CVE-2025-39765 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix ida_free call while not allocated In the snd_utimer_create() function, i… |
CVE-2025-39764 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous… |
CVE-2025-39763 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a sy… |
CVE-2025-39762 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check [WHY] Prevents null pointer dereferences to enhance funct… |
CVE-2025-39761 | High | 8.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not de… |
CVE-2025-39760 | High | 7.1 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoin… |
CVE-2025-39759 | High | 7.0 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race betwe… |
CVE-2025-39758 | Critical | 9.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76… |
CVE-2025-39757 | High | 7.1 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors… |
CVE-2025-39756 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is se… |
CVE-2025-39754 | Medium | 4.7 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handle… |
CVE-2025-39753 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee36472… |
CVE-2025-39752 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary C… |
CVE-2025-39750 | High | 8.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs dur… |
CVE-2025-39749 | High | 7.0 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y… |
CVE-2025-39748 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to… |
CVE-2025-39747 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Add error handling for krealloc in metadata setup Function msm_ioctl_gem_info_se… |
CVE-2025-39746 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose… |
CVE-2025-39745 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_P… |
CVE-2025-39744 | High | 7.1 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if… |
CVE-2025-39743 | High | 7.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy fr… |
CVE-2025-39742 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides num… |
CVE-2025-39741 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: don't overflow max copy size With non-page aligned copy, we need to use 4… |
CVE-2025-39740 | High | 7.8 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if th… |
CVE-2025-39739 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients… |
CVE-2025-39738 | High | 7.3 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal… |
CVE-2025-39737 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was obser… |
CVE-2025-39736 | Medium | 5.5 | 2025-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is ena… |
CVE-2025-26499 | Medium | 6.0 | 2025-09-11 | Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a to… |
CVE-2025-10255 | Low | 3.5 | 2025-09-11 | A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of… |
CVE-2025-10254 | Low | 3.5 | 2025-09-11 | A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.as… |
CVE-2025-8716 | | 2025-09-11 | In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server… | |
CVE-2025-58145 | High | 7.5 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related… |
CVE-2025-58144 | High | 7.5 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related… |
CVE-2025-58143 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues rel… |
CVE-2025-58142 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues rel… |
CVE-2025-27466 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues rel… |
CVE-2025-10253 | Low | 3.5 | 2025-09-11 | A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handle… |
CVE-2025-10252 | Low | 3.1 | 2025-09-11 | A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation cau… |
CVE-2025-10193 | | 2025-09-11 | DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocat… | |
CVE-2025-10251 | Medium | 6.3 | 2025-09-11 | A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulat… |
CVE-2025-9018 | High | 8.8 | 2025-09-11 | The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_fun… |
CVE-2025-40696 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40695 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40694 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40693 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of pr… |
CVE-2025-40692 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40691 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40690 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'te… |
CVE-2025-40689 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40687 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-10250 | Medium | 5.0 | 2025-09-11 | A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Exe… |
CVE-2025-58321 | Critical | 10.0 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-58320 | High | 7.3 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-48041 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerabili… | |
CVE-2025-48040 | | 2025-09-11 | Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated wi… | |
CVE-2025-48039 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-48038 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-9918 | | 2025-09-11 | A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an… | |
CVE-2025-9874 | High | 7.5 | 2025-09-11 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard'… |
CVE-2025-9861 | Medium | 6.4 | 2025-09-11 | The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and i… |
CVE-2025-9860 | Medium | 6.4 | 2025-09-11 | The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 du… |
CVE-2025-9855 | Medium | 6.4 | 2025-09-11 | The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to… |
CVE-2025-9850 | Medium | 6.4 | 2025-09-11 | The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and incl… |
CVE-2025-9693 | High | 8.0 | 2025-09-11 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2025-9635 | Medium | 4.3 | 2025-09-11 | The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to mis… |
CVE-2025-9634 | Medium | 4.3 | 2025-09-11 | The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing o… |
CVE-2025-9633 | Medium | 4.3 | 2025-09-11 | The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect… |
CVE-2025-9632 | Medium | 4.3 | 2025-09-11 | The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
CVE-2025-9631 | Medium | 4.3 | 2025-09-11 | The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrec… |
CVE-2025-9628 | Medium | 4.3 | 2025-09-11 | The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to… |
CVE-2025-9627 | Medium | 4.3 | 2025-09-11 | The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect… |
CVE-2025-9623 | Medium | 4.3 | 2025-09-11 | The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to mis… |
CVE-2025-9620 | Medium | 6.1 | 2025-09-11 | The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorre… |
CVE-2025-9617 | Medium | 5.3 | 2025-09-11 | The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inco… |
CVE-2025-9451 | Medium | 6.5 | 2025-09-11 | The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and includin… |
CVE-2025-9128 | Medium | 6.4 | 2025-09-11 | The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insuff… |
CVE-2025-9123 | Medium | 6.4 | 2025-09-11 | The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address paramet… |
CVE-2025-9073 | High | 7.5 | 2025-09-11 | The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insuff… |
CVE-2025-8721 | Medium | 6.4 | 2025-09-11 | The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and includin… |
CVE-2025-8692 | Medium | 4.9 | 2025-09-11 | The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log_duration’ parameter in all versions up to, and including, 6.2.12 due to insuffi… |
CVE-2025-8691 | Medium | 6.4 | 2025-09-11 | The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to… |
CVE-2025-8689 | Medium | 6.4 | 2025-09-11 | The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets i… |
CVE-2025-8686 | Medium | 6.4 | 2025-09-11 | The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including… |
CVE-2025-8570 | Critical | 9.8 | 2025-09-11 | The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determin… |
CVE-2025-8492 | Medium | 5.3 | 2025-09-11 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data du… |
CVE-2025-8481 | Medium | 4.3 | 2025-09-11 | The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This… |
CVE-2025-8445 | Medium | 6.4 | 2025-09-11 | The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to… |
CVE-2025-8425 | High | 8.8 | 2025-09-11 | The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-8423 | Medium | 5.4 | 2025-09-11 | The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and… |
CVE-2025-8422 | High | 7.5 | 2025-09-11 | The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via… |
CVE-2025-8417 | High | 8.1 | 2025-09-11 | The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to re… |
CVE-2025-8398 | Medium | 6.4 | 2025-09-11 | The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including… |
CVE-2025-8392 | Medium | 6.4 | 2025-09-11 | The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 d… |
CVE-2025-8318 | Medium | 6.4 | 2025-09-11 | The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to ins… |
CVE-2025-8316 | Medium | 6.4 | 2025-09-11 | The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to… |
CVE-2025-8215 | Medium | 6.4 | 2025-09-11 | The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including… |
CVE-2025-5801 | Medium | 6.4 | 2025-09-11 | The Digital Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘column’ parameter in all versions up to, and including… |
CVE-2025-0763 | Medium | 4.3 | 2025-09-11 | The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_f… |