2025 CVEs (page 188)
Page 188 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57058 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and pModule parameters… |
CVE-2025-57057 | High | 7.5 | 2025-09-09 | Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. This vulnerability allows a… |
CVE-2025-55317 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-55316 | High | 7.8 | 2025-09-09 | External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55245 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. |
CVE-2025-55243 | High | 7.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55236 | High | 7.3 | 2025-09-09 | Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2025-55234 | High | 8.8 | 2025-09-09 | SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform rel… |
CVE-2025-55232 | Critical | 9.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. |
CVE-2025-55228 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55227 | High | 8.8 | 2025-09-09 | Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a ne… |
CVE-2025-55226 | Medium | 6.7 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code lo… |
CVE-2025-55225 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-55224 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-55223 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privile… |
CVE-2025-54919 | High | 7.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute c… |
CVE-2025-54918 | High | 8.8 | 2025-09-09 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-54917 | Medium | 4.3 | 2025-09-09 | Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-54916 | High | 7.8 | 2025-09-09 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
CVE-2025-54915 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54913 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized att… |
CVE-2025-54912 | High | 7.8 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54911 | High | 7.3 | 2025-09-09 | Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
CVE-2025-54910 | High | 8.4 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54908 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-54907 | High | 7.8 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-54906 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-54905 | High | 7.1 | 2025-09-09 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2025-54904 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54903 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54902 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54901 | Medium | 5.5 | 2025-09-09 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-54900 | High | 7.8 | 2025-09-09 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54899 | High | 7.8 | 2025-09-09 | Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54898 | High | 7.8 | 2025-09-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54897 | High | 8.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-54896 | High | 7.8 | 2025-09-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-54895 | High | 7.8 | 2025-09-09 | Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. |
CVE-2025-54894 | High | 7.8 | 2025-09-09 | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability |
CVE-2025-54709 | High | 8.1 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: f… |
CVE-2025-54261 | Critical | 10.0 | 2025-09-09 | ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-54252 | Medium | 5.4 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileg… |
CVE-2025-54251 | Medium | 4.3 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-pri… |
CVE-2025-54250 | Medium | 4.9 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54249 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security featu… |
CVE-2025-54248 | High | 7.7 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54247 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54246 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass… |
CVE-2025-54116 | High | 7.3 | 2025-09-09 | Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-54115 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-54114 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2025-54113 | High | 8.8 | 2025-09-09 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-54112 | High | 7.0 | 2025-09-09 | Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-54111 | High | 7.8 | 2025-09-09 | Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. |
CVE-2025-54110 | High | 8.8 | 2025-09-09 | Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-54109 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54108 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authoriz… |
CVE-2025-54107 | Medium | 4.3 | 2025-09-09 | Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-54106 | High | 8.8 | 2025-09-09 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-54105 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-54104 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54103 | High | 7.4 | 2025-09-09 | Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-54102 | High | 7.8 | 2025-09-09 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54101 | Medium | 4.8 | 2025-09-09 | Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network. |
CVE-2025-54099 | High | 7.0 | 2025-09-09 | Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-54098 | High | 7.8 | 2025-09-09 | Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-54097 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54096 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54095 | Medium | 6.5 | 2025-09-09 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-54094 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-54093 | High | 7.0 | 2025-09-09 | Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
CVE-2025-54092 | High | 7.8 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-54091 | High | 7.8 | 2025-09-09 | Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53810 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53809 | Medium | 6.5 | 2025-09-09 | Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-53808 | Medium | 6.7 | 2025-09-09 | Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53807 | High | 7.0 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-53806 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53805 | High | 7.5 | 2025-09-09 | Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-53804 | Medium | 5.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53803 | Medium | 5.5 | 2025-09-09 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53802 | High | 7.0 | 2025-09-09 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53801 | High | 7.8 | 2025-09-09 | Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally. |
CVE-2025-53800 | High | 7.8 | 2025-09-09 | No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-53799 | Medium | 5.5 | 2025-09-09 | Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-53798 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53797 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53796 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53348 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kaliu… |
CVE-2025-53340 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Suppor… |
CVE-2025-53303 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a… |
CVE-2025-53291 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5. |
CVE-2025-49860 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0. |
CVE-2025-49734 | High | 7.0 | 2025-09-09 | Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-49692 | High | 7.8 | 2025-09-09 | Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-49430 | High | 7.2 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video… |
CVE-2025-48101 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact fo… |
CVE-2025-47997 | Medium | 6.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information… |
CVE-2025-47695 | High | 7.5 | 2025-09-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer… |
CVE-2025-47694 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue aff… |