2025 CVEs (page 197)
Page 197 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9324 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9323 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9830 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-servic… |
CVE-2025-9276 | Critical | 9.8 | 2025-09-02 | Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass au… |
CVE-2025-9275 | High | 7.8 | 2025-09-02 | Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-9274 | High | 7.8 | 2025-09-02 | Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2025-9273 | Medium | 4.3 | 2025-09-02 | CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on a… |
CVE-2025-8614 | High | 7.8 | 2025-09-02 | NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect… |
CVE-2025-8613 | High | 7.2 | 2025-09-02 | Vacron Camera ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2025-8302 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8301 | High | 7.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows lo… |
CVE-2025-8300 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8299 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows… |
CVE-2025-8298 | Low | 3.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows loc… |
CVE-2025-7976 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-7975 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-7974 | High | 7.5 | 2025-09-02 | rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affec… |
CVE-2025-6685 | High | 8.8 | 2025-09-02 | ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installatio… |
CVE-2025-9829 | High | 7.3 | 2025-09-02 | A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The man… |
CVE-2025-9189 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DA… |
CVE-2025-9188 | High | 7.8 | 2025-09-02 | There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploit… |
CVE-2025-57778 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASY… |
CVE-2025-57777 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. This vulnerability… |
CVE-2025-57776 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with Digilent DASYLab. T… |
CVE-2025-57775 | High | 7.8 | 2025-09-02 | There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulnerability may resu… |
CVE-2025-57774 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilent DASYLab. This vu… |
CVE-2025-43726 | Medium | 6.7 | 2025-09-02 | Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability… |
CVE-2025-36162 | Medium | 4.3 | 2025-09-02 | IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the… |
CVE-2025-55824 | Medium | 6.5 | 2025-09-02 | ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitiv… |
CVE-2025-55476 | Medium | 6.5 | 2025-09-02 | FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This par… |
CVE-2025-51966 | Medium | 6.1 | 2025-09-02 | A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, emb… |
CVE-2025-50565 | Medium | 6.5 | 2025-09-02 | Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. |
CVE-2025-32100 | Medium | 6.5 | 2025-09-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-32098 | Medium | 5.3 | 2025-09-02 | An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file d… |
CVE-2025-9828 | Low | 3.7 | 2025-09-02 | A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can le… |
CVE-2025-9696 | | 2025-09-02 | The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker… | |
CVE-2025-55474 | Medium | 6.1 | 2025-09-02 | Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed. |
CVE-2025-55473 | Medium | 6.1 | 2025-09-02 | Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in th… |
CVE-2025-55472 | Medium | 6.5 | 2025-09-02 | SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of use… |
CVE-2025-55373 | Medium | 5.3 | 2025-09-02 | Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute comman… |
CVE-2025-57616 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a… |
CVE-2025-57615 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor function allows an attacker… |
CVE-2025-57614 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method allows an attacker to… |
CVE-2025-57613 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor function allows an attac… |
CVE-2025-57612 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attacker to cause a de… |
CVE-2025-57611 | Medium | 5.3 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an attacker to cause a de… |
CVE-2025-55372 | Medium | 5.3 | 2025-09-02 | An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-54599 | High | 7.5 | 2025-09-02 | The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes… |
CVE-2025-50757 | Medium | 6.5 | 2025-09-02 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allo… |
CVE-2025-50755 | Medium | 6.5 | 2025-09-02 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. This vulnerability allow… |
CVE-2025-9784 | High | 7.5 | 2025-09-02 | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to a… |
CVE-2025-46047 | Medium | 6.5 | 2025-09-02 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid us… |
CVE-2025-2413 | High | 8.6 | 2025-09-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from… |
CVE-2025-0670 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.0… |
CVE-2025-6519 | Critical | 9.8 | 2025-09-02 | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the pas… |
CVE-2025-5662 | Critical | 9.8 | 2025-09-02 | A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remo… |
CVE-2025-57140 | Critical | 9.8 | 2025-09-02 | rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path. |
CVE-2025-56254 | Medium | 4.3 | 2025-09-02 | PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user c… |
CVE-2025-52551 | | 2025-09-02 | E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system. | |
CVE-2025-52550 | High | 7.2 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An a… |
CVE-2025-52549 | Critical | 9.8 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a… |
CVE-2025-52548 | Medium | 4.9 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist bu… |
CVE-2025-52547 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously… |
CVE-2025-52546 | Medium | 6.1 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl… |
CVE-2025-52545 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes fo… |
CVE-2025-52544 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl… |
CVE-2025-52543 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authent… |
CVE-2025-46810 | | 2025-09-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue… | |
CVE-2025-2414 | High | 8.6 | 2025-09-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from… |
CVE-2025-0640 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects OctoCloud: from s1.09.0… |
CVE-2025-9573 | | 2025-09-02 | The ns_backup extension through 13.0.2 for TYPO3 allows command injection. | |
CVE-2025-41031 | | 2025-09-02 | Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST reques… | |
CVE-2025-41030 | | 2025-09-02 | Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TIn… | |
CVE-2025-44017 | Medium | 4.3 | 2025-09-02 | "Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL… |
CVE-2025-41690 | High | 7.4 | 2025-09-02 | A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. Thi… |
CVE-2025-9815 | High | 7.8 | 2025-09-02 | A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHel… |
CVE-2025-9814 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/contact-us.php. The… |
CVE-2025-9813 | High | 8.8 | 2025-09-02 | A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of th… |
CVE-2025-9812 | High | 8.8 | 2025-09-02 | A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipula… |
CVE-2025-9811 | High | 7.3 | 2025-09-02 | A vulnerability was found in Campcodes Farm Management System 1.0. This affects an unknown part of the file /reviewInput.php. Performing manipulation of the ar… |
CVE-2025-8662 | Medium | 4.3 | 2025-09-02 | OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM… |
CVE-2025-9806 | Low | 1.9 | 2025-09-02 | A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administra… |
CVE-2025-9805 | Medium | 6.3 | 2025-09-02 | A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/ap… |
CVE-2025-58178 | High | 7.8 | 2025-09-02 | SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulne… |
CVE-2025-58162 | Medium | 6.5 | 2025-09-02 | MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary… |
CVE-2025-58161 | Medium | 4.3 | 2025-09-02 | MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, wh… |
CVE-2025-57808 | High | 8.1 | 2025-09-02 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server aut… |
CVE-2025-9802 | Medium | 4.7 | 2025-09-02 | A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID r… |
CVE-2025-9801 | Medium | 5.4 | 2025-09-01 | A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of… |
CVE-2025-9800 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file app… |
CVE-2025-9799 | Medium | 5.0 | 2025-09-01 | A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/feat… |
CVE-2025-9797 | Low | 2.4 | 2025-09-01 | A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/prod… |
CVE-2025-9796 | Low | 3.5 | 2025-09-01 | A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/Enco… |
CVE-2025-9795 | Medium | 6.3 | 2025-09-01 | A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/con… |
CVE-2025-9794 | High | 7.3 | 2025-09-01 | A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/pos_transac.php?acti… |
CVE-2025-9793 | High | 7.3 | 2025-09-01 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /setting/admin.php of the component S… |
CVE-2025-9792 | High | 7.3 | 2025-09-01 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /e_dashboard… |
CVE-2025-9810 | Medium | 6.8 | 2025-09-01 | TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") o… |
CVE-2025-9809 | Critical | 9.8 | 2025-09-01 | Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted… |
CVE-2025-9791 | High | 8.8 | 2025-09-01 | A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of… |