2025 CVEs (page 194)
Page 194 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-38687 | High | 7.3 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi… |
CVE-2025-38686 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE en… |
CVE-2025-38685 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a users… |
CVE-2025-38684 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets tes… |
CVE-2025-38683 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC… |
CVE-2025-38682 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2c_unregister_device() Before commit df6d7277e55… |
CVE-2025-38681 | Medium | 4.7 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps… |
CVE-2025-38680 | High | 7.1 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length ch… |
CVE-2025-38679 | High | 7.3 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_ch… |
CVE-2025-23302 | Medium | 4.2 | 2025-09-04 | NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access level. A successful expl… |
CVE-2025-23301 | Medium | 4.2 | 2025-09-04 | NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exp… |
CVE-2025-23262 | Medium | 6.3 | 2025-09-04 | NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the con… |
CVE-2025-23261 | Medium | 5.5 | 2025-09-04 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing in… |
CVE-2025-23259 | Medium | 6.5 | 2025-09-04 | NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure… |
CVE-2025-23258 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to escalate privileges… |
CVE-2025-23257 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate privileges. A successfu… |
CVE-2025-23256 | High | 8.7 | 2025-09-04 | NVIDIA BlueField contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the co… |
CVE-2025-8311 | | 2025-09-04 | dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query… | |
CVE-2025-6785 | | 2025-09-04 | Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to contro… | |
CVE-2025-2694 | Medium | 4.8 | 2025-09-04 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6… |
CVE-2025-2667 | Low | 2.7 | 2025-09-04 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6… |
CVE-2025-25048 | Medium | 6.5 | 2025-09-04 | IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files… |
CVE-2025-57263 | High | 7.2 | 2025-09-04 | An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST param… |
CVE-2025-7388 | High | 8.4 | 2025-09-04 | It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execut… |
CVE-2025-7385 | | 2025-09-04 | Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthen… | |
CVE-2025-41063 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user in… |
CVE-2025-41062 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user in… |
CVE-2025-41061 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41060 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41059 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41058 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41057 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41056 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41055 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41054 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41053 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41052 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41051 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41050 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41049 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41048 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41047 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41046 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41045 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41044 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41043 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41042 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41041 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41040 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41039 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41038 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41037 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41036 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41035 | Medium | 6.5 | 2025-09-04 | A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass th… |
CVE-2025-41034 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41033 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41032 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-9942 | Medium | 6.3 | 2025-09-04 | A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.php. The manipulatio… |
CVE-2025-9941 | Medium | 6.3 | 2025-09-04 | A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the… |
CVE-2025-9940 | Low | 3.5 | 2025-09-04 | A vulnerability was detected in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /feature.php. Performing manipulation… |
CVE-2025-9939 | Low | 3.5 | 2025-09-04 | A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /propertyvie… |
CVE-2025-9938 | High | 8.8 | 2025-09-04 | A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This manipulation of th… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2025-9935 | High | 7.3 | 2025-09-04 | A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstec… |
CVE-2025-9934 | Medium | 6.3 | 2025-09-04 | A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipula… |
CVE-2025-9933 | High | 7.3 | 2025-09-04 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view… |
CVE-2025-9932 | High | 7.3 | 2025-09-04 | A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-… |
CVE-2025-9931 | Medium | 4.3 | 2025-09-04 | A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of the component POST… |
CVE-2025-9930 | High | 7.3 | 2025-09-04 | A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the file /admin/contact-us… |
CVE-2025-9929 | Low | 2.4 | 2025-09-04 | A weakness has been identified in code-projects Responsive Blog Site 1.0. This affects an unknown function of the file blogs_view.php. Executing manipulation o… |
CVE-2025-9616 | Medium | 5.3 | 2025-09-04 | The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect non… |
CVE-2025-9519 | High | 7.2 | 2025-09-04 | The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due… |
CVE-2025-9518 | High | 7.2 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all vers… |
CVE-2025-9517 | High | 7.2 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This is… |
CVE-2025-9516 | Medium | 4.9 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This make… |
CVE-2025-9467 | | 2025-09-04 | When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affe… | |
CVE-2025-6984 | High | 7.5 | 2025-09-04 | The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing… |
CVE-2025-6085 | High | 7.2 | 2025-09-04 | The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all… |
CVE-2025-58358 | High | 7.5 | 2025-09-04 | Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caus… |
CVE-2025-58357 | Critical | 9.6 | 2025-09-04 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page'… |
CVE-2025-58355 | High | 7.7 | 2025-09-04 | Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled… |
CVE-2025-58064 | | 2025-09-04 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 throug… | |
CVE-2025-58057 | High | 7.5 | 2025-09-04 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty… |
CVE-2025-43772 | | 2025-09-04 | Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict t… | |
CVE-2025-36909 | Medium | 5.3 | 2025-09-04 | Information disclosure |
CVE-2025-36908 | Medium | 6.7 | 2025-09-04 | In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… |
CVE-2025-36907 | High | 7.3 | 2025-09-04 | In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalat… |
CVE-2025-36906 | High | 7.8 | 2025-09-04 | In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escala… |
CVE-2025-36905 | High | 7.8 | 2025-09-04 | In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privi… |
CVE-2025-36904 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. |
CVE-2025-36903 | High | 7.8 | 2025-09-04 | In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no addition… |
CVE-2025-36902 | Medium | 6.7 | 2025-09-04 | In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation… |
CVE-2025-36901 | High | 8.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. |
CVE-2025-36900 | Medium | 6.7 | 2025-09-04 | In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2025-36899 | High | 8.4 | 2025-09-04 | There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no… |
CVE-2025-36898 | High | 7.8 | 2025-09-04 | There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-36897 | Critical | 9.8 | 2025-09-04 | In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2025-36896 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
CVE-2025-36895 | High | 7.5 | 2025-09-04 | Information disclosure |