2025 CVEs (page 186)
Page 186 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9269 | | 2025-09-09 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leverag… | |
CVE-2025-57665 | Medium | 6.4 | 2025-09-09 | Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that… |
CVE-2025-57086 | High | 7.5 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows… |
CVE-2025-57085 | Critical | 9.8 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to… |
CVE-2025-57078 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhiteMac function. Thi… |
CVE-2025-10199 | High | 7.8 | 2025-09-09 | A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. |
CVE-2025-10198 | High | 7.8 | 2025-09-09 | Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-write… |
CVE-2025-5500 | Medium | 5.3 | 2025-09-09 | A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xi… |
CVE-2025-5005 | High | 7.3 | 2025-09-09 | A vulnerability was detected in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. This affects an unknown function of the file crm/WeiXinApp… |
CVE-2025-59008 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-ba… |
CVE-2025-59005 | Medium | 4.3 | 2025-09-09 | Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58997 | Critical | 9.6 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10. |
CVE-2025-58993 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue a… |
CVE-2025-58991 | High | 7.1 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking B… |
CVE-2025-58990 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.Th… |
CVE-2025-58989 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dy… |
CVE-2025-58988 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This i… |
CVE-2025-58987 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.Th… |
CVE-2025-58985 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce… |
CVE-2025-58984 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored… |
CVE-2025-58983 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.Thi… |
CVE-2025-58982 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-prote… |
CVE-2025-58981 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configure… |
CVE-2025-58980 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Const… |
CVE-2025-58979 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqW… |
CVE-2025-58978 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-58977 | Medium | 4.9 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue aff… |
CVE-2025-58976 | Medium | 4.3 | 2025-09-09 | Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configure… |
CVE-2025-58975 | Medium | 4.3 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-58215 | High | 8.1 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local… |
CVE-2025-57540 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment… |
CVE-2025-57539 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authe… |
CVE-2025-57538 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 al… |
CVE-2025-57087 | High | 7.5 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability al… |
CVE-2025-57072 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute function. This vulnerabili… |
CVE-2025-57071 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function. This vulnerability allows att… |
CVE-2025-57070 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function. This vulnerability allows a… |
CVE-2025-57069 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function. This vulnerability allows at… |
CVE-2025-57064 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows… |
CVE-2025-57063 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. This vulnerability… |
CVE-2025-57062 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function. This vulnerability allows… |
CVE-2025-57061 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark param… |
CVE-2025-57059 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. This vulnerability allows attack… |
CVE-2025-57058 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and pModule parameters… |
CVE-2025-57057 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. This vulnerability allows a… |
CVE-2025-55317 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-55316 | High | 7.8 | 2025-09-09 | External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55245 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. |
CVE-2025-55243 | High | 7.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55236 | High | 7.3 | 2025-09-09 | Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2025-55234 | High | 8.8 | 2025-09-09 | SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform rel… |
CVE-2025-55232 | Critical | 9.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. |
CVE-2025-55228 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55227 | High | 8.8 | 2025-09-09 | Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a ne… |
CVE-2025-55226 | Medium | 6.7 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code lo… |
CVE-2025-55225 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-55224 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55223 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privile… |
CVE-2025-54919 | High | 7.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-54918 | High | 8.8 | 2025-09-09 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-54917 | Medium | 4.3 | 2025-09-09 | Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-54916 | High | 7.8 | 2025-09-09 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
CVE-2025-54915 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54913 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized att… |
CVE-2025-54912 | High | 7.8 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54911 | High | 7.3 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54910 | High | 8.4 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54908 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-54907 | High | 7.8 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-54906 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54905 | High | 7.1 | 2025-09-09 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2025-54904 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54903 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54902 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54901 | Medium | 5.5 | 2025-09-09 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-54900 | High | 7.8 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54899 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54898 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54897 | High | 8.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-54896 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54895 | High | 7.8 | 2025-09-09 | Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. |
CVE-2025-54894 | High | 7.8 | 2025-09-09 | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability |
CVE-2025-54709 | High | 8.1 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: f… |
CVE-2025-54261 | Critical | 10.0 | 2025-09-09 | ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-54252 | Medium | 5.4 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileg… |
CVE-2025-54251 | Medium | 4.3 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-pri… |
CVE-2025-54250 | Medium | 4.9 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54249 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security featu… |
CVE-2025-54248 | High | 7.7 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54247 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54246 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass… |
CVE-2025-54116 | High | 7.3 | 2025-09-09 | Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-54115 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-54114 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2025-54113 | High | 8.8 | 2025-09-09 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-54112 | High | 7.0 | 2025-09-09 | Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-54111 | High | 7.8 | 2025-09-09 | Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. |
CVE-2025-54110 | High | 8.8 | 2025-09-09 | Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-54109 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54108 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |