2025 CVEs (page 187)
Page 187 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54112 | High | 7.0 | 2025-09-09 | Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-54111 | High | 7.8 | 2025-09-09 | Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. |
CVE-2025-54110 | High | 8.8 | 2025-09-09 | Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-54109 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54108 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2025-54107 | Medium | 4.3 | 2025-09-09 | Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-54106 | High | 8.8 | 2025-09-09 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-54105 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-54104 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54103 | High | 7.4 | 2025-09-09 | Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-54102 | High | 7.8 | 2025-09-09 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54101 | Medium | 4.8 | 2025-09-09 | Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network. |
CVE-2025-54099 | High | 7.0 | 2025-09-09 | Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-54098 | High | 7.8 | 2025-09-09 | Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-54097 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54096 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54095 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54094 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54093 | High | 7.0 | 2025-09-09 | Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
CVE-2025-54092 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-54091 | High | 7.8 | 2025-09-09 | Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53810 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53809 | Medium | 6.5 | 2025-09-09 | Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-53808 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53807 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-53806 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53805 | High | 7.5 | 2025-09-09 | Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-53804 | Medium | 5.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53803 | Medium | 5.5 | 2025-09-09 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53802 | High | 7.0 | 2025-09-09 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53801 | High | 7.8 | 2025-09-09 | Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally. |
CVE-2025-53800 | High | 7.8 | 2025-09-09 | No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-53799 | Medium | 5.5 | 2025-09-09 | Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-53798 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53797 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53796 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53348 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kaliu… |
CVE-2025-53340 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Suppor… |
CVE-2025-53303 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a… |
CVE-2025-53291 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5. |
CVE-2025-49860 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0. |
CVE-2025-49734 | High | 7.0 | 2025-09-09 | Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-49692 | High | 7.8 | 2025-09-09 | Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-49430 | High | 7.2 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video… |
CVE-2025-48101 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact fo… |
CVE-2025-47997 | Medium | 6.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information… |
CVE-2025-47695 | High | 7.5 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer… |
CVE-2025-47694 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue aff… |
CVE-2025-47579 | Critical | 9.0 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through… |
CVE-2025-47571 | High | 7.5 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder supersto… |
CVE-2025-47570 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-re… |
CVE-2025-47569 | Critical | 9.3 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultim… |
CVE-2025-47437 | Medium | 6.4 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through… |
CVE-2025-39553 | Medium | 4.3 | 2025-09-09 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9. |
CVE-2025-39541 | Medium | 6.5 | 2025-09-09 | Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/… |
CVE-2025-39523 | Medium | 4.7 | 2025-09-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26. |
CVE-2025-32689 | High | 7.5 | 2025-09-09 | Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2. |
CVE-2025-32688 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through… |
CVE-2025-32486 | Critical | 9.8 | 2025-09-09 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: f… |
CVE-2025-30875 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.Th… |
CVE-2025-9872 | High | 8.8 | 2025-09-09 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote cod… |
CVE-2025-9712 | High | 8.8 | 2025-09-09 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote cod… |
CVE-2025-8712 | Medium | 5.4 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivan… |
CVE-2025-8711 | Medium | 5.4 | 2025-09-09 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-55148 | High | 7.6 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55147 | High | 8.8 | 2025-09-09 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-55146 | Medium | 4.9 | 2025-09-09 | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and I… |
CVE-2025-55145 | High | 8.9 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivan… |
CVE-2025-55144 | Medium | 5.4 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55143 | Medium | 6.1 | 2025-09-09 | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iv… |
CVE-2025-55142 | High | 8.8 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55141 | High | 8.8 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55139 | Medium | 6.8 | 2025-09-09 | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-52915 | High | 7.2 | 2025-09-09 | K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that… |
CVE-2025-52322 | High | 7.5 | 2025-09-09 | An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), us… |
CVE-2025-52277 | Medium | 6.1 | 2025-09-09 | Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots… |
CVE-2025-43776 | Medium | 5.4 | 2025-09-09 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025… |
CVE-2025-10183 | Critical | 9.1 | 2025-09-09 | A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary… |
CVE-2025-10107 | Medium | 4.7 | 2025-09-09 | A vulnerability has been found in TRENDnet TEW-831DR 1.0 (601.130.1.1410). Impacted is an unknown function of the file /boafrm/formSysCmd. The manipulation of… |
CVE-2025-9994 | Critical | 9.8 | 2025-09-09 | The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with netw… |
CVE-2025-9951 | | 2025-09-09 | A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the… | |
CVE-2025-54236 | Critical | 9.1 | 2025-09-09 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-53609 | Medium | 4.9 | 2025-09-09 | A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an… |
CVE-2025-47416 | | 2025-09-09 | A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-de… | |
CVE-2025-33045 | High | 8.2 | 2025-09-09 | APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unautho… |
CVE-2025-9364 | High | 8.8 | 2025-09-09 | An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an att… |
CVE-2025-9166 | High | 7.5 | 2025-09-09 | A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward me… |
CVE-2025-9161 | High | 8.8 | 2025-09-09 | A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, whi… |
CVE-2025-9160 | | 2025-09-09 | A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a craf… | |
CVE-2025-9065 | High | 8.8 | 2025-09-09 | A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attac… |
CVE-2025-8008 | Medium | 6.5 | 2025-09-09 | A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a Forward Close operation can cause the devi… |
CVE-2025-8007 | Medium | 6.5 | 2025-09-09 | A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Majo… |
CVE-2025-7970 | High | 7.5 | 2025-09-09 | A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to dec… |
CVE-2025-7350 | | 2025-09-09 | A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by upload… | |
CVE-2025-8277 | Low | 3.1 | 2025-09-09 | A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory du… |
CVE-2025-48208 | High | 8.8 | 2025-09-09 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have… |
CVE-2025-24404 | High | 8.8 | 2025-09-09 | XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with ac… |
CVE-2025-10095 | | 2025-09-09 | A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain paramet… | |
CVE-2025-59019 | Medium | 4.3 | 2025-09-09 | Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclo… |
CVE-2025-59018 | Medium | 6.5 | 2025-09-09 | Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 all… |