2025 CVEs (page 190)
Page 190 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8360 | Medium | 6.4 | 2025-09-06 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions u… |
CVE-2025-8359 | Critical | 9.8 | 2025-09-06 | The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly ver… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2025-58374 | High | 7.8 | 2025-09-06 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do n… |
CVE-2025-10003 | Medium | 6.5 | 2025-09-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2025-9849 | Medium | 6.4 | 2025-09-06 | The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, a… |
CVE-2025-7368 | Medium | 5.3 | 2025-09-06 | The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and inc… |
CVE-2025-7366 | High | 7.3 | 2025-09-06 | The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions u… |
CVE-2025-6067 | Medium | 6.4 | 2025-09-06 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` an… |
CVE-2025-58439 | High | 8.1 | 2025-09-06 | ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left ce… |
CVE-2025-58375 | High | 8.1 | 2025-09-06 | Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable… |
CVE-2025-58373 | Medium | 5.5 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections… |
CVE-2025-58372 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code worksp… |
CVE-2025-58371 | Critical | 9.8 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request m… |
CVE-2025-58370 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic wher… |
CVE-2025-58369 | Medium | 5.3 | 2025-09-05 | fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vuln… |
CVE-2025-58367 | | 2025-09-05 | DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta cl… | |
CVE-2025-58366 | | 2025-09-05 | Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials of private helm repositories in the pub… | |
CVE-2025-57807 | Low | 3.8 | 2025-09-05 | ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functio… |
CVE-2025-10027 | Low | 3.5 | 2025-09-05 | A vulnerability was determined in itsourcecode POS Point of Sale System 1.0. Affected by this issue is some unknown functionality of the file /inventory/main/v… |
CVE-2025-53791 | Medium | 4.7 | 2025-09-05 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-10060 | Medium | 6.5 | 2025-09-05 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and serve… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-9566 | High | 8.1 | 2025-09-05 | There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap… |
CVE-2025-10044 | Medium | 4.3 | 2025-09-05 | A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly… |
CVE-2025-10026 | Low | 3.5 | 2025-09-05 | A vulnerability was found in itsourcecode POS Point of Sale System 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory/main/… |
CVE-2025-10025 | High | 7.3 | 2025-09-05 | A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation… |
CVE-2025-9057 | Medium | 6.4 | 2025-09-05 | The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient… |
CVE-2025-9709 | | 2025-09-05 | On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor n… | |
CVE-2025-39726 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly… |
CVE-2025-39725 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(… |
CVE-2025-39724 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, th… |
CVE-2025-39723 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write… |
CVE-2025-39722 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP Since the CAAM on these SoC… |
CVE-2025-39721 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading… |
CVE-2025-39720 | High | 7.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->… |
CVE-2025-39719 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array ac… |
CVE-2025-39718 | High | 8.4 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock pa… |
CVE-2025-39717 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in c… |
CVE-2025-39716 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access supp… |
CVE-2025-39715 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instru… |
CVE-2025-39714 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and a… |
CVE-2025-39713 | Medium | 4.7 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt han… |
CVE-2025-39712 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval Getting / Setting t… |
CVE-2025-39711 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE… |
CVE-2025-39710 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to… |
CVE-2025-39709 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt ha… |
CVE-2025-39708 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix NULL pointer dereference A warning reported by smatch indicated a possib… |
CVE-2025-39707 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities HUBBUB structure is… |
CVE-2025-39706 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to… |
CVE-2025-39705 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a Null pointer dereference vulnerability [Why] A null pointer derefe… |
CVE-2025-39704 | High | 8.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix stack protector issue in send_ipi_data() Function kvm_io_bus_read() i… |
CVE-2025-39703 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient sp… |
CVE-2025-39702 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to… |
CVE-2025-39701 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check s… |
CVE-2025-39700 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() trie… |
CVE-2025-39699 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: prevent NULL deref in iova_to_phys The riscv_iommu_pte_fetch() function retu… |
CVE-2025-39698 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is… |
CVE-2025-39697 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests… |
CVE-2025-39696 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv During the conversion to unify… |
CVE-2025-39695 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Flush delayed SKBs while releasing RXE resources When skb packets are sent out… |
CVE-2025-39694 | High | 7.3 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler conta… |
CVE-2025-39693 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_… |
CVE-2025-39692 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call… |
CVE-2025-39691 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: K… |
CVE-2025-39690 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized… |
CVE-2025-39689 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of s… |
CVE-2025-39687 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a… |
CVE-2025-39686 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` funct… |
CVE-2025-39685 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008… |
CVE-2025-39684 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot… |
CVE-2025-39683 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the… |
CVE-2025-39682 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process… |
CVE-2025-39681 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd… |
CVE-2025-39680 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer The data->block[0] variable… |
CVE-2025-39679 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). When the nvif_vmm_type is… |
CVE-2025-39678 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address i… |
CVE-2025-39677 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the fo… |
CVE-2025-39676 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() fu… |
CVE-2025-39675 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function m… |
CVE-2025-39674 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix ESI null pointer dereference ESI/MSI is a performance optimizati… |
CVE-2025-39673 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race co… |
CVE-2025-38737 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise b… |
CVE-2025-38736 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported s… |
CVE-2025-38735 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invo… |
CVE-2025-38734 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [… |
CVE-2025-38733 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to… |
CVE-2025-38732 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add… |
CVE-2025-38731 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fail… |
CVE-2025-35452 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
CVE-2025-35451 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30199 | High | 7.2 | 2025-09-05 | ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection betw… |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-9999 | | 2025-09-05 | Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an atta… | |
CVE-2025-9998 | | 2025-09-05 | The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted mess… | |
CVE-2025-58628 | Critical | 9.3 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injec… |
CVE-2025-58214 | High | 8.1 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Loca… |