2025 CVEs (page 191)
Page 191 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10072 | Medium | 6.3 | 2025-09-07 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performi… |
CVE-2025-10071 | Medium | 6.3 | 2025-09-07 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manip… |
CVE-2025-10070 | Medium | 6.3 | 2025-09-07 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper acces… |
CVE-2025-48042 | | 2025-09-07 | Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from… | |
CVE-2025-39734 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f19… |
CVE-2025-39733 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: team: replace team lock with rtnl lock syszbot reports various ordering issues for lower… |
CVE-2025-39732 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disab… |
CVE-2025-39731 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: f2fs: vm_unmap_ram() may be called from an invalid context When testing F2FS with xfstest… |
CVE-2025-39730 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the… |
CVE-2025-39729 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix dereferencing uninitialized error pointer Fix below smatch warnings: dr… |
CVE-2025-39727 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only… |
CVE-2025-10068 | High | 7.3 | 2025-09-07 | A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing man… |
CVE-2025-10067 | Medium | 4.3 | 2025-09-07 | A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/data… |
CVE-2025-36100 | Medium | 5.1 | 2025-09-07 | IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and… |
CVE-2025-10066 | Medium | 4.3 | 2025-09-07 | A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/mai… |
CVE-2025-10065 | Medium | 4.3 | 2025-09-07 | A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/uni… |
CVE-2025-10064 | Medium | 4.3 | 2025-09-07 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendor… |
CVE-2025-10063 | Medium | 4.3 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datata… |
CVE-2025-10062 | High | 7.3 | 2025-09-06 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing… |
CVE-2025-58445 | High | 7.5 | 2025-09-06 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed ver… |
CVE-2025-58443 | Critical | 9.1 | 2025-09-06 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerabili… |
CVE-2025-58446 | High | 7.5 | 2025-09-06 | xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large gramma… |
CVE-2025-58438 | | 2025-09-06 | internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerabilit… | |
CVE-2025-0034 | Medium | 4.7 | 2025-09-06 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write pa… |
CVE-2025-0032 | High | 7.2 | 2025-09-06 | Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially res… |
CVE-2025-0011 | Low | 3.3 | 2025-09-06 | Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potenti… |
CVE-2025-0010 | Medium | 6.1 | 2025-09-06 | An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity… |
CVE-2025-0009 | Medium | 5.5 | 2025-09-06 | A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss… |
CVE-2025-10034 | High | 8.8 | 2025-09-06 | A vulnerability was found in D-Link DIR-825 1.08.01. This impacts the function get_ping6_app_stat of the file ping6_response.cg of the component httpd. Perform… |
CVE-2025-10033 | High | 7.3 | 2025-09-06 | A vulnerability has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin. Such manipulation of the argum… |
CVE-2025-10032 | Medium | 4.3 | 2025-09-06 | A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. The affected element is an unknown function of the file /index.php. The manip… |
CVE-2025-10031 | High | 7.3 | 2025-09-06 | A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=de… |
CVE-2025-10030 | High | 7.3 | 2025-09-06 | A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=sav… |
CVE-2025-10029 | Low | 3.5 | 2025-09-06 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/d… |
CVE-2025-9961 | | 2025-09-06 | An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man… | |
CVE-2025-10046 | Medium | 4.9 | 2025-09-06 | The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versio… |
CVE-2025-10028 | Low | 3.5 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This affects an unknown part of the file /inventory/main/vendors/datatables/unit_t… |
CVE-2025-6757 | Medium | 6.4 | 2025-09-06 | The Recent Posts Widget Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rpwe' shortcode in all versions up to, and… |
CVE-2025-9493 | Medium | 6.4 | 2025-09-06 | The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1… |
CVE-2025-9442 | Medium | 6.4 | 2025-09-06 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all versions up to, and… |
CVE-2025-9126 | Medium | 6.4 | 2025-09-06 | The Smart Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.1 du… |
CVE-2025-8722 | Medium | 6.4 | 2025-09-06 | The Content Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid and List widgets in all versions up to, and including… |
CVE-2025-8564 | Medium | 6.4 | 2025-09-06 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.7 d… |
CVE-2025-8149 | Medium | 6.4 | 2025-09-06 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and… |
CVE-2025-7045 | Medium | 6.5 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_h… |
CVE-2025-7040 | High | 8.2 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings'… |
CVE-2025-9853 | Medium | 6.4 | 2025-09-06 | The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and in… |
CVE-2025-9515 | High | 7.2 | 2025-09-06 | The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versio… |
CVE-2025-9085 | Medium | 4.9 | 2025-09-06 | The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient esca… |
CVE-2025-8360 | Medium | 6.4 | 2025-09-06 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions u… |
CVE-2025-8359 | Critical | 9.8 | 2025-09-06 | The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly ver… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2025-58374 | High | 7.8 | 2025-09-06 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do n… |
CVE-2025-10003 | Medium | 6.5 | 2025-09-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2025-9849 | Medium | 6.4 | 2025-09-06 | The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, a… |
CVE-2025-7368 | Medium | 5.3 | 2025-09-06 | The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and inc… |
CVE-2025-7366 | High | 7.3 | 2025-09-06 | The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions u… |
CVE-2025-6067 | Medium | 6.4 | 2025-09-06 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` an… |
CVE-2025-58439 | High | 8.1 | 2025-09-06 | ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left ce… |
CVE-2025-58375 | High | 8.1 | 2025-09-06 | Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable… |
CVE-2025-58373 | Medium | 5.5 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections… |
CVE-2025-58372 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code worksp… |
CVE-2025-58371 | Critical | 9.8 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request m… |
CVE-2025-58370 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic wher… |
CVE-2025-58369 | Medium | 5.3 | 2025-09-05 | fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vuln… |
CVE-2025-58367 | | 2025-09-05 | DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta cl… | |
CVE-2025-58366 | | 2025-09-05 | Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials of private helm repositories in the pub… | |
CVE-2025-57807 | Low | 3.8 | 2025-09-05 | ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functio… |
CVE-2025-10027 | Low | 3.5 | 2025-09-05 | A vulnerability was determined in itsourcecode POS Point of Sale System 1.0. Affected by this issue is some unknown functionality of the file /inventory/main/v… |
CVE-2025-53791 | Medium | 4.7 | 2025-09-05 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-10060 | Medium | 6.5 | 2025-09-05 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and serve… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-9566 | High | 8.1 | 2025-09-05 | There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap… |
CVE-2025-10044 | Medium | 4.3 | 2025-09-05 | A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly… |
CVE-2025-10026 | Low | 3.5 | 2025-09-05 | A vulnerability was found in itsourcecode POS Point of Sale System 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory/main/… |
CVE-2025-10025 | High | 7.3 | 2025-09-05 | A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation… |
CVE-2025-9057 | Medium | 6.4 | 2025-09-05 | The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient… |
CVE-2025-9709 | | 2025-09-05 | On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor n… | |
CVE-2025-39726 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly… |
CVE-2025-39725 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(… |
CVE-2025-39724 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, th… |
CVE-2025-39723 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write… |
CVE-2025-39722 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP Since the CAAM on these SoC… |
CVE-2025-39721 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading… |
CVE-2025-39720 | High | 7.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->… |
CVE-2025-39719 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array ac… |
CVE-2025-39718 | High | 8.4 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock pa… |
CVE-2025-39717 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in c… |
CVE-2025-39716 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access supp… |
CVE-2025-39715 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instru… |
CVE-2025-39714 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and a… |
CVE-2025-39713 | Medium | 4.7 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt han… |
CVE-2025-39712 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval Getting / Setting t… |
CVE-2025-39711 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE… |
CVE-2025-39710 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to… |
CVE-2025-39709 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt ha… |
CVE-2025-39708 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix NULL pointer dereference A warning reported by smatch indicated a possib… |
CVE-2025-39707 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities HUBBUB structure is… |
CVE-2025-39706 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to… |