2025 CVEs (page 186)
Page 186 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57572 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl. |
CVE-2025-57571 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList parameter in goform/setNAT. |
CVE-2025-57570 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS. |
CVE-2025-57569 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT. |
CVE-2025-43938 | Medium | 5.0 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with… |
CVE-2025-43888 | High | 8.8 | 2025-09-10 | Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privil… |
CVE-2025-43887 | High | 7.0 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with l… |
CVE-2025-43886 | Medium | 4.4 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. A high privileged attacker with loc… |
CVE-2025-43885 | High | 7.8 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comman… |
CVE-2025-43884 | High | 8.2 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comman… |
CVE-2025-43725 | High | 7.8 | 2025-09-10 | Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. A low privile… |
CVE-2025-29592 | Medium | 5.6 | 2025-09-10 | oasys v1.1 is vulnerable to Directory Traversal in ProcedureController. |
CVE-2025-20340 | High | 7.4 | 2025-09-10 | A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a… |
CVE-2025-20248 | Medium | 6.0 | 2025-09-10 | A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signatu… |
CVE-2025-20159 | Medium | 5.3 | 2025-09-10 | A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attack… |
CVE-2025-56578 | Medium | 5.7 | 2025-09-10 | An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms |
CVE-2025-56466 | High | 7.5 | 2025-09-10 | Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information. |
CVE-2025-56413 | High | 8.8 | 2025-09-10 | OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /… |
CVE-2025-56407 | High | 8.8 | 2025-09-10 | A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/… |
CVE-2025-56406 | High | 7.5 | 2025-09-10 | An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supp… |
CVE-2025-56405 | High | 7.5 | 2025-09-10 | An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE pr… |
CVE-2025-56404 | High | 7.5 | 2025-09-10 | An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. |
CVE-2025-10231 | High | 7.0 | 2025-09-10 | An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to… |
CVE-2025-7718 | High | 8.8 | 2025-09-10 | The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up… |
CVE-2025-10227 | Medium | 4.6 | 2025-09-10 | Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a loca… |
CVE-2025-10226 | Critical | 9.8 | 2025-09-10 | Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allo… |
CVE-2025-10225 | High | 7.5 | 2025-09-10 | Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and… |
CVE-2025-10224 | Medium | 5.4 | 2025-09-10 | Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated… |
CVE-2025-10223 | Medium | 5.4 | 2025-09-10 | Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticat… |
CVE-2025-10222 | Low | 3.3 | 2025-09-10 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 o… |
CVE-2025-10221 | Medium | 5.5 | 2025-09-10 | Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Window… |
CVE-2025-10220 | Critical | 9.8 | 2025-09-10 | Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a rem… |
CVE-2025-40979 | | 2025-09-10 | DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers wi… | |
CVE-2025-40725 | | 2025-09-10 | Reflected Cross-Site Scripting (XSS) vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser… | |
CVE-2025-10215 | High | 7.8 | 2025-09-10 | DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by… |
CVE-2025-10214 | High | 7.8 | 2025-09-10 | DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by… |
CVE-2025-10213 | High | 7.8 | 2025-09-10 | DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by… |
CVE-2025-36759 | | 2025-09-10 | Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and p… | |
CVE-2025-36758 | | 2025-09-10 | It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle. | |
CVE-2025-36757 | | 2025-09-10 | It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited a… | |
CVE-2025-36756 | | 2025-09-10 | A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known. | |
CVE-2025-9979 | Medium | 4.3 | 2025-09-10 | The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spaml… |
CVE-2025-9943 | Critical | 9.1 | 2025-09-10 | An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is… |
CVE-2025-9888 | Medium | 4.3 | 2025-09-10 | The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due… |
CVE-2025-9857 | Medium | 6.4 | 2025-09-10 | The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode i… |
CVE-2025-9622 | Medium | 4.3 | 2025-09-10 | The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is… |
CVE-2025-9463 | Medium | 6.5 | 2025-09-10 | The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection v… |
CVE-2025-9367 | Medium | 5.5 | 2025-09-10 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insu… |
CVE-2025-8778 | Medium | 4.3 | 2025-09-10 | The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax()… |
CVE-2025-7843 | Medium | 6.4 | 2025-09-10 | The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetc… |
CVE-2025-7826 | Medium | 6.5 | 2025-09-10 | The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insuff… |
CVE-2025-7049 | High | 8.8 | 2025-09-10 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ… |
CVE-2025-6189 | Medium | 6.5 | 2025-09-10 | The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter in all versions up to, and including, 2… |
CVE-2025-41714 | High | 8.8 | 2025-09-10 | The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the se… |
CVE-2025-10142 | Medium | 4.9 | 2025-09-10 | The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and incl… |
CVE-2025-10126 | Medium | 6.4 | 2025-09-10 | The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and includi… |
CVE-2025-10049 | High | 7.2 | 2025-09-10 | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_… |
CVE-2025-10040 | High | 7.7 | 2025-09-10 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |
CVE-2025-10001 | High | 7.2 | 2025-09-10 | The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the impo… |
CVE-2025-8388 | Medium | 6.4 | 2025-09-10 | The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor_url’… |
CVE-2025-10197 | Medium | 6.3 | 2025-09-10 | A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-10195 | Medium | 5.3 | 2025-09-10 | A vulnerability has been found in Seismic App 2.4.2 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.seismic.do… |
CVE-2025-59046 | Critical | 9.8 | 2025-09-09 | The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name… |
CVE-2025-59044 | Medium | 4.4 | 2025-09-09 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group displ… |
CVE-2025-59042 | | 2025-09-09 | PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path` during the bootstr… | |
CVE-2025-59039 | | 2025-09-09 | Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related m… | |
CVE-2025-59038 | | 2025-09-09 | Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by… | |
CVE-2025-58750 | High | 8.2 | 2025-09-09 | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound c… |
CVE-2025-58448 | Critical | 9.1 | 2025-09-09 | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection… |
CVE-2025-58447 | Critical | 9.8 | 2025-09-09 | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buf… |
CVE-2025-10172 | High | 8.8 | 2025-09-09 | A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. Executing manipulation of… |
CVE-2025-9997 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in B… | |
CVE-2025-59036 | Medium | 5.5 | 2025-09-09 | Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tok… |
CVE-2025-58135 | Medium | 5.3 | 2025-09-09 | Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network… |
CVE-2025-58134 | Medium | 4.3 | 2025-09-09 | Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access. |
CVE-2025-58131 | Medium | 6.6 | 2025-09-09 | Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respec… |
CVE-2025-54260 | High | 7.8 | 2025-09-09 | Substance3D - Modeler versions 1.22.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read… |
CVE-2025-54259 | High | 7.8 | 2025-09-09 | Substance3D - Modeler versions 1.22.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution… |
CVE-2025-54258 | High | 7.8 | 2025-09-09 | Substance3D - Modeler versions 1.22.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context o… |
CVE-2025-49461 | Medium | 4.3 | 2025-09-09 | Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-49460 | Medium | 4.3 | 2025-09-09 | Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-49459 | High | 7.8 | 2025-09-09 | Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of p… |
CVE-2025-49458 | Medium | 6.5 | 2025-09-09 | Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-10171 | High | 8.8 | 2025-09-09 | A vulnerability was detected in UTT 1250GW up to 3.2.2-200710. This vulnerability affects the function sub_453DC of the file /goform/formConfigApConfTemp. Perf… |
CVE-2025-9996 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any s… | |
CVE-2025-7746 | | 2025-09-09 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected… | |
CVE-2025-59037 | | 2025-09-09 | DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malwar… | |
CVE-2025-58768 | Critical | 9.6 | 2025-09-09 | DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of dir… |
CVE-2025-58765 | High | 7.1 | 2025-09-09 | wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2025-58763 | High | 8.0 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers… |
CVE-2025-58462 | Critical | 9.8 | 2025-09-09 | OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could r… |
CVE-2025-57633 | Critical | 9.8 | 2025-09-09 | A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html e… |
CVE-2025-54245 | High | 7.8 | 2025-09-09 | Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-54244 | High | 7.8 | 2025-09-09 | Substance3D - Viewer versions 0.25.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-54243 | High | 7.8 | 2025-09-09 | Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-54241 | Medium | 5.5 | 2025-09-09 | After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing… |
CVE-2025-54240 | Medium | 5.5 | 2025-09-09 | After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing… |
CVE-2025-54239 | Medium | 5.5 | 2025-09-09 | After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing… |
CVE-2025-54084 | | 2025-09-09 | OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials… | |
CVE-2025-54083 | | 2025-09-09 | Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue aff… |