2025 CVEs (page 187)
Page 187 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-44595 | Medium | 6.1 | 2025-09-09 | Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}. |
CVE-2025-44593 | Medium | 6.1 | 2025-09-09 | Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger st… |
CVE-2025-43491 | Critical | 9.8 | 2025-09-09 | A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM le… |
CVE-2025-34178 | Medium | 5.4 | 2025-09-09 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being direc… |
CVE-2025-34177 | Medium | 5.4 | 2025-09-09 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being direc… |
CVE-2025-34176 | Medium | 4.3 | 2025-09-09 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This… |
CVE-2025-23344 | High | 7.3 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to run code on the platform host as a non-privileged user. A successful exploit of thi… |
CVE-2025-23343 | High | 7.6 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components. A successful exploit of this vulnerability ma… |
CVE-2025-23342 | High | 8.2 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account . A successful exploit of this vulnerability ma… |
CVE-2025-10170 | High | 8.8 | 2025-09-09 | A security vulnerability has been detected in UTT 1200GW up to 3.0.0-170831. This affects the function sub_4B48F8 of the file /goform/formApLbConfig. Such mani… |
CVE-2025-10169 | High | 8.8 | 2025-09-09 | A weakness has been identified in UTT 1200GW up to 3.0.0-170831. Affected by this issue is some unknown functionality of the file /goform/ConfigWirelessBase. T… |
CVE-2025-10159 | Critical | 9.8 | 2025-09-09 | An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmwar… |
CVE-2025-7635 | High | 7.7 | 2025-09-09 | Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. |
CVE-2025-58762 | Critical | 9.1 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use… |
CVE-2025-58761 | High | 8.6 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable… |
CVE-2025-58760 | High | 8.6 | 2025-09-09 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path… |
CVE-2025-58759 | Medium | 5.1 | 2025-09-09 | TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values… |
CVE-2025-58758 | Medium | 5.1 | 2025-09-09 | TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist w… |
CVE-2025-58753 | High | 7.5 | 2025-09-09 | Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a… |
CVE-2025-58442 | Medium | 5.3 | 2025-09-09 | Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may r… |
CVE-2025-58435 | | 2025-09-09 | Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when Turbo… | |
CVE-2025-58430 | Medium | 6.1 | 2025-09-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the sessio… |
CVE-2025-58180 | High | 8.8 | 2025-09-09 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows a… |
CVE-2025-58063 | High | 7.1 | 2025-09-09 | CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerabil… |
CVE-2025-55054 | Medium | 6.1 | 2025-09-09 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55053 | Medium | 6.5 | 2025-09-09 | CWE-328: Use of Weak Hash |
CVE-2025-54257 | High | 7.8 | 2025-09-09 | Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-54255 | Medium | 4.0 | 2025-09-09 | Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could r… |
CVE-2025-53914 | | 2025-09-09 | Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE… | |
CVE-2025-53913 | | 2025-09-09 | Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE… | |
CVE-2025-47415 | | 2025-09-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CRESTRON TOUCHSCREENS x70 allows Relative Path Traversal.This i… | |
CVE-2025-44594 | Critical | 9.1 | 2025-09-09 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. |
CVE-2025-43786 | Medium | 5.3 | 2025-09-09 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024… |
CVE-2025-36125 | Medium | 6.4 | 2025-09-09 | IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36011 | Medium | 4.3 | 2025-09-09 | IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to… |
CVE-2025-34175 | Medium | 6.1 | 2025-09-09 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related cha… |
CVE-2025-34174 | Medium | 5.4 | 2025-09-09 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related… |
CVE-2025-34173 | Medium | 4.3 | 2025-09-09 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/string… |
CVE-2025-34172 | Medium | 6.1 | 2025-09-09 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests… |
CVE-2025-57278 | High | 8.8 | 2025-09-09 | The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user aut… |
CVE-2025-57060 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dns_forward_rule_store function. This vulnerability allows… |
CVE-2025-55730 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55729 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55728 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55727 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55052 | Medium | 4.3 | 2025-09-09 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-55051 | Critical | 10.0 | 2025-09-09 | CWE-1392: Use of Default Credentials |
CVE-2025-55050 | Critical | 9.8 | 2025-09-09 | CWE-1242: Inclusion of Undocumented Features |
CVE-2025-55049 | Critical | 9.1 | 2025-09-09 | Use of Default Cryptographic Key (CWE-1394) |
CVE-2025-55048 | Critical | 9.8 | 2025-09-09 | Multiple CWE-78 |
CVE-2025-55047 | High | 8.4 | 2025-09-09 | CWE-798 Use of Hard-coded Credentials |
CVE-2025-54256 | High | 8.6 | 2025-09-09 | Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in arbitrary code execution i… |
CVE-2025-54242 | High | 7.8 | 2025-09-09 | Premiere Pro versions 25.3, 24.6.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of t… |
CVE-2025-43781 | Medium | 6.1 | 2025-09-09 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 throug… |
CVE-2025-43775 | Medium | 5.4 | 2025-09-09 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024… |
CVE-2025-29089 | High | 7.5 | 2025-09-09 | An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information |
CVE-2025-10164 | High | 7.3 | 2025-09-09 | A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The man… |
CVE-2025-9269 | | 2025-09-09 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leverag… | |
CVE-2025-57665 | Medium | 6.4 | 2025-09-09 | Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that… |
CVE-2025-57086 | High | 7.5 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows… |
CVE-2025-57085 | Critical | 9.8 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to… |
CVE-2025-57078 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhiteMac function. Thi… |
CVE-2025-10199 | High | 7.8 | 2025-09-09 | A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. |
CVE-2025-10198 | High | 7.8 | 2025-09-09 | Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-write… |
CVE-2025-5500 | Medium | 5.3 | 2025-09-09 | A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xi… |
CVE-2025-5005 | High | 7.3 | 2025-09-09 | A vulnerability was detected in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. This affects an unknown function of the file crm/WeiXinApp… |
CVE-2025-59008 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-ba… |
CVE-2025-59005 | Medium | 4.3 | 2025-09-09 | Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58997 | Critical | 9.6 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10. |
CVE-2025-58993 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue a… |
CVE-2025-58991 | High | 7.1 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking B… |
CVE-2025-58990 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.Th… |
CVE-2025-58989 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dy… |
CVE-2025-58988 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This i… |
CVE-2025-58987 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.Th… |
CVE-2025-58985 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce… |
CVE-2025-58984 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored… |
CVE-2025-58983 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.Thi… |
CVE-2025-58982 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-prote… |
CVE-2025-58981 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configure… |
CVE-2025-58980 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Const… |
CVE-2025-58979 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqW… |
CVE-2025-58978 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-58977 | Medium | 4.9 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue aff… |
CVE-2025-58976 | Medium | 4.3 | 2025-09-09 | Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configure… |
CVE-2025-58975 | Medium | 4.3 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-58215 | High | 8.1 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local… |
CVE-2025-57540 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment… |
CVE-2025-57539 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authe… |
CVE-2025-57538 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 al… |
CVE-2025-57087 | High | 7.5 | 2025-09-09 | Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability al… |
CVE-2025-57072 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute function. This vulnerabili… |
CVE-2025-57071 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function. This vulnerability allows att… |
CVE-2025-57070 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function. This vulnerability allows a… |
CVE-2025-57069 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function. This vulnerability allows at… |
CVE-2025-57064 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows… |
CVE-2025-57063 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. This vulnerability… |
CVE-2025-57062 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function. This vulnerability allows… |
CVE-2025-57061 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark param… |
CVE-2025-57059 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. This vulnerability allows attack… |