2025 CVEs (page 19)
Page 19 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62817 | High | 7.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in… |
CVE-2025-62816 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS4L_VERTEXIOC_BOOTUP input leads to a den… |
CVE-2025-66680 | High | 7.1 | 2026-03-03 | An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted reques… |
CVE-2025-66363 | High | 7.5 | 2026-03-03 | An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages. |
CVE-2025-62815 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of npu_proto_drv.ast.thread_ref in set_… |
CVE-2025-62814 | High | 7.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, and 2400. A NULL pointer dereference of ft_handle in load_fw_utc_vector() ca… |
CVE-2025-70821 | Critical | 9.8 | 2026-03-03 | renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component |
CVE-2025-64736 | Medium | 6.1 | 2026-03-03 | An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb0). A specially cra… |
CVE-2025-57622 | Critical | 9.8 | 2026-03-03 | An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) comp… |
CVE-2025-52365 | High | 7.8 | 2026-03-03 | A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via u… |
CVE-2025-59060 | Medium | 5.3 | 2026-03-03 | Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upg… |
CVE-2025-59059 | Critical | 9.8 | 2026-03-03 | Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2025-15595 | High | 7.8 | 2026-03-03 | Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions. |
CVE-2025-12345 | High | 8.8 | 2026-03-03 | A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the function agent_deploy_init of the file /agents… |
CVE-2025-47147 | Medium | 5.7 | 2026-03-03 | Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in… |
CVE-2025-48654 | High | 7.8 | 2026-03-02 | In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of… |
CVE-2025-48653 | High | 7.8 | 2026-03-02 | In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escal… |
CVE-2025-48650 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional exe… |
CVE-2025-48646 | High | 7.8 | 2026-03-02 | In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with… |
CVE-2025-48645 | High | 7.8 | 2026-03-02 | In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of pri… |
CVE-2025-48644 | Medium | 5.5 | 2026-03-02 | In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no ad… |
CVE-2025-48642 | Medium | 5.5 | 2026-03-02 | In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure… |
CVE-2025-48641 | High | 7.0 | 2026-03-02 | In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional… |
CVE-2025-48636 | High | 8.4 | 2026-03-02 | In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to lo… |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |
CVE-2025-48634 | High | 7.3 | 2026-03-02 | In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of pr… |
CVE-2025-48630 | High | 7.4 | 2026-03-02 | In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to l… |
CVE-2025-48619 | High | 8.4 | 2026-03-02 | In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. Thi… |
CVE-2025-48613 | High | 7.8 | 2026-03-02 | In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This coul… |
CVE-2025-48609 | Critical | 9.1 | 2026-03-02 | In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a pa… |
CVE-2025-48605 | High | 8.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48602 | High | 8.4 | 2026-03-02 | In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This… |
CVE-2025-48587 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48585 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48582 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to loc… |
CVE-2025-48579 | High | 8.4 | 2026-03-02 | In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local es… |
CVE-2025-48578 | High | 7.8 | 2026-03-02 | In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This co… |
CVE-2025-48577 | High | 7.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privi… |
CVE-2025-48574 | High | 8.4 | 2026-03-02 | In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This c… |
CVE-2025-48568 | High | 7.4 | 2026-03-02 | In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-48567 | High | 7.8 | 2026-03-02 | In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normaliza… |
CVE-2025-32313 | High | 8.4 | 2026-03-02 | In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… |
CVE-2025-70252 | High | 7.5 | 2026-03-02 | An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf… |
CVE-2025-64427 | High | 7.1 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or re… |
CVE-2025-59603 | High | 7.8 | 2026-03-02 | Memory Corruption when processing invalid user address with nonstandard buffer address. |
CVE-2025-59600 | High | 7.8 | 2026-03-02 | Memory Corruption when adding user-supplied data without checking available buffer space. |
CVE-2025-47386 | High | 7.8 | 2026-03-02 | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47385 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing trusted execution environment without proper privilege check. |
CVE-2025-47384 | Medium | 6.5 | 2026-03-02 | Transient DOS when MAC configures config id greater than supported maximum value. |
CVE-2025-47383 | High | 7.2 | 2026-03-02 | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
CVE-2025-47381 | High | 7.8 | 2026-03-02 | Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47379 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
CVE-2025-47378 | High | 7.1 | 2026-03-02 | Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. |
CVE-2025-47377 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
CVE-2025-47376 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
CVE-2025-47375 | High | 7.8 | 2026-03-02 | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
CVE-2025-47373 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing buffers with invalid length during TA invocation. |
CVE-2025-47371 | Medium | 6.5 | 2026-03-02 | Transient DOS when an LTE RLC packet with invalid TB is received by UE. |
CVE-2025-66880 | Medium | 6.1 | 2026-03-02 | Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Modu… |
CVE-2025-52998 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attack… |
CVE-2025-52564 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacke… |
CVE-2025-52563 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitizati… |
CVE-2025-52476 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization o… |
CVE-2025-52475 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php end… |
CVE-2025-52470 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php scr… |
CVE-2025-52469 | High | 7.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allo… |
CVE-2025-52468 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw… |
CVE-2025-50199 | Critical | 9.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This is… |
CVE-2025-50198 | Medium | 4.9 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import… |
CVE-2025-50197 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via… |
CVE-2025-50196 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php vi… |
CVE-2025-50195 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.p… |
CVE-2025-50194 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This… |
CVE-2025-50193 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the… |
CVE-2025-65465 | Medium | 6.1 | 2026-03-02 | A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute a… |
CVE-2025-58107 | High | 7.5 | 2026-03-02 | In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in… |
CVE-2025-52482 | High | 8.3 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teac… |
CVE-2025-50192 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. Thi… |
CVE-2025-50191 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes… |
CVE-2025-50190 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /in… |
CVE-2025-50189 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST… |
CVE-2025-50188 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET v… |
CVE-2025-50187 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execut… |
CVE-2025-50186 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of… |
CVE-2025-14532 | Critical | 9.8 | 2026-03-02 | DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result… |
CVE-2025-12462 | | 2026-03-02 | A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple… | |
CVE-2025-58406 | Medium | 4.3 | 2026-03-02 | The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe… |
CVE-2025-58405 | Medium | 6.1 | 2026-03-02 | The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting pr… |
CVE-2025-58402 | High | 7.5 | 2026-03-02 | The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET… |
CVE-2025-30062 | | 2026-03-02 | In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. | |
CVE-2025-30044 | | 2026-03-02 | In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl"… | |
CVE-2025-30042 | High | 7.8 | 2026-03-02 | The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certif… |
CVE-2025-30035 | | 2026-03-02 | The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username… | |
CVE-2025-10350 | | 2026-03-02 | SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to… | |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2025-13673 | High | 7.5 | 2026-02-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to… |
CVE-2025-69437 | High | 8.7 | 2026-02-27 | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsF… |
CVE-2025-15498 | | 2026-02-27 | Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass auth… | |
CVE-2025-10990 | High | 7.5 | 2026-02-27 | A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x… |