2025 CVEs (page 192)
Page 192 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39705 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a Null pointer dereference vulnerability [Why] A null pointer derefe… |
CVE-2025-39704 | High | 8.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix stack protector issue in send_ipi_data() Function kvm_io_bus_read() i… |
CVE-2025-39703 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient sp… |
CVE-2025-39702 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to… |
CVE-2025-39701 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check s… |
CVE-2025-39700 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() trie… |
CVE-2025-39699 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: prevent NULL deref in iova_to_phys The riscv_iommu_pte_fetch() function retu… |
CVE-2025-39698 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is… |
CVE-2025-39697 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests… |
CVE-2025-39696 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv During the conversion to unify… |
CVE-2025-39695 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Flush delayed SKBs while releasing RXE resources When skb packets are sent out… |
CVE-2025-39694 | High | 7.3 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler conta… |
CVE-2025-39693 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_… |
CVE-2025-39692 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call… |
CVE-2025-39691 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: K… |
CVE-2025-39690 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized… |
CVE-2025-39689 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of s… |
CVE-2025-39687 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a… |
CVE-2025-39686 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` funct… |
CVE-2025-39685 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008… |
CVE-2025-39684 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot… |
CVE-2025-39683 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the… |
CVE-2025-39682 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process… |
CVE-2025-39681 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd… |
CVE-2025-39680 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer The data->block[0] variable… |
CVE-2025-39679 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). When the nvif_vmm_type is… |
CVE-2025-39678 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address i… |
CVE-2025-39677 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the fo… |
CVE-2025-39676 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() fu… |
CVE-2025-39675 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function m… |
CVE-2025-39674 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix ESI null pointer dereference ESI/MSI is a performance optimizati… |
CVE-2025-39673 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race co… |
CVE-2025-38737 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise b… |
CVE-2025-38736 | High | 7.1 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported s… |
CVE-2025-38735 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invo… |
CVE-2025-38734 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [… |
CVE-2025-38733 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to… |
CVE-2025-38732 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add… |
CVE-2025-38731 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fail… |
CVE-2025-35452 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
CVE-2025-35451 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30199 | High | 7.2 | 2025-09-05 | ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection betw… |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-10014 | Low | 3.1 | 2025-09-05 | A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address… |
CVE-2025-9999 | | 2025-09-05 | Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an atta… | |
CVE-2025-9998 | | 2025-09-05 | The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted mess… | |
CVE-2025-58628 | Critical | 9.3 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injec… |
CVE-2025-58214 | High | 8.1 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Loca… |
CVE-2025-58206 | High | 8.1 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP… |
CVE-2025-57889 | High | 7.5 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-galle… |
CVE-2025-54744 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-53571 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-53307 | High | 7.1 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder WordPress Assistant assistant allows Refle… |
CVE-2025-49401 | Critical | 9.8 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through <= 4… |
CVE-2025-48317 | High | 7.5 | 2025-09-05 | Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traver… |
CVE-2025-48105 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows… |
CVE-2025-48104 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floa… |
CVE-2025-48103 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allo… |
CVE-2025-48102 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Me… |
CVE-2025-32320 | High | 7.8 | 2025-09-05 | In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional… |
CVE-2025-32318 | High | 8.8 | 2025-09-05 | In Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution… |
CVE-2025-32317 | Medium | 5.5 | 2025-09-05 | In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional executio… |
CVE-2025-32316 | Medium | 5.5 | 2025-09-05 | In gralloc4, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional executio… |
CVE-2025-27003 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Q… |
CVE-2025-26461 | Low | 3.3 | 2025-09-05 | In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a… |
CVE-2025-26434 | Medium | 5.5 | 2025-09-05 | In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privi… |
CVE-2025-10013 | Medium | 6.3 | 2025-09-05 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation re… |
CVE-2025-58780 | High | 7.2 | 2025-09-05 | index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it "inaccurately… |
CVE-2025-10012 | Medium | 6.3 | 2025-09-05 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_… |
CVE-2025-8695 | Medium | 5.4 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This i… |
CVE-2025-58887 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG… |
CVE-2025-58886 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tan Nguyen Instant Locations instant-locations allows Sto… |
CVE-2025-58884 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS… |
CVE-2025-58883 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows St… |
CVE-2025-58882 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in w1zzard Simple Text Slider simple-text-slider allows Stor… |
CVE-2025-58881 | High | 8.5 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus New Simple Gallery new-simple-gallery allows Bli… |
CVE-2025-58880 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode transl… |
CVE-2025-58878 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in usamafarooq Woocommerce Gifts Product woo-gift-product allows Cross Site Request Forgery.This issue affects… |
CVE-2025-58876 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows… |
CVE-2025-58875 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored X… |
CVE-2025-58874 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in josepsitjar StoryMap wp-storymap allows DOM-Based XSS.Thi… |
CVE-2025-58873 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows… |
CVE-2025-58872 | Medium | 6.5 | 2025-09-05 | Insertion of Sensitive Information Into Sent Data vulnerability in premiumbizthemes Simple Price Calculator simple-price-calculator-basic allows Retrieve Embed… |
CVE-2025-58871 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Paper Collapse Toggle master-paper-colla… |
CVE-2025-58870 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP-GraphViz wp-graphviz allows DOM-Based XSS.This… |
CVE-2025-58869 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a thro… |
CVE-2025-58868 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stor… |
CVE-2025-58867 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Download Media Counter easy-download-med… |
CVE-2025-58866 | Low | 2.7 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve… |
CVE-2025-58865 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in reimund Compact Admin compact-admin allows Cross Site Request Forgery.This issue affects Compact Admin: from… |
CVE-2025-58864 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamroody 金数据 jinshuju allows Stored XSS.This issue affect… |
CVE-2025-58863 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SdeWijs Zoomify embed for WP zoom-image-shortcode allows… |
CVE-2025-58862 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Sexton WordPress Events Calendar Plugin – connectD… |
CVE-2025-58861 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calenda… |
CVE-2025-58860 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Enable Latex enable-latex allows Stored XSS.This issue affects Enable Latex: from n/a through <… |
CVE-2025-58859 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a throu… |
CVE-2025-58858 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Image Widget wpb-image-widget allows Stored XS… |
CVE-2025-58857 | High | 7.1 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Table of content content-table allows Stored… |
CVE-2025-58856 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issu… |