2025 CVEs (page 198)
Page 198 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58176 | High | 8.8 | 2025-09-03 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click… |
CVE-2025-9848 | High | 7.3 | 2025-09-03 | A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. The affected element is an unknown function of the file /admin/… |
CVE-2025-9847 | Medium | 6.3 | 2025-09-03 | A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation… |
CVE-2025-7039 | Low | 3.7 | 2025-09-03 | A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perfo… |
CVE-2025-58163 | High | 8.8 | 2025-09-03 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vul… |
CVE-2025-9845 | Low | 3.5 | 2025-09-03 | A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Affected by this vulnerability is an unknown functionality of the file produc… |
CVE-2025-9843 | Medium | 5.3 | 2025-09-03 | A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes i… |
CVE-2025-57806 | | 2025-09-03 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including A… | |
CVE-2025-9842 | Medium | 5.3 | 2025-09-03 | A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation re… |
CVE-2025-9841 | Medium | 6.3 | 2025-09-03 | A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php… |
CVE-2025-9260 | Medium | 6.5 | 2025-09-03 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versio… |
CVE-2025-54588 | High | 7.5 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 cont… |
CVE-2025-9840 | Medium | 6.3 | 2025-09-02 | A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Execu… |
CVE-2025-9839 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/m… |
CVE-2025-9838 | High | 7.3 | 2025-09-02 | A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/in… |
CVE-2025-26416 | Critical | 9.8 | 2025-09-02 | In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of… |
CVE-2025-22442 | High | 7.0 | 2025-09-02 | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to… |
CVE-2025-22439 | High | 7.3 | 2025-09-02 | In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This… |
CVE-2025-22438 | High | 7.8 | 2025-09-02 | In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additi… |
CVE-2025-22437 | High | 7.8 | 2025-09-02 | In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This coul… |
CVE-2025-22435 | Critical | 9.8 | 2025-09-02 | In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no a… |
CVE-2025-22434 | High | 7.8 | 2025-09-02 | In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalati… |
CVE-2025-22433 | High | 7.8 | 2025-09-02 | In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due t… |
CVE-2025-22431 | Medium | 5.5 | 2025-09-02 | In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in… |
CVE-2025-22430 | Medium | 5.5 | 2025-09-02 | In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local… |
CVE-2025-22429 | Critical | 9.8 | 2025-09-02 | In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit… |
CVE-2025-22428 | High | 7.8 | 2025-09-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user… |
CVE-2025-22427 | High | 7.3 | 2025-09-02 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in… |
CVE-2025-22423 | High | 7.5 | 2025-09-02 | In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with… |
CVE-2025-22422 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another du… |
CVE-2025-22421 | Medium | 5.5 | 2025-09-02 | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error i… |
CVE-2025-22419 | High | 7.3 | 2025-09-02 | In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This coul… |
CVE-2025-22418 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional executio… |
CVE-2025-22417 | High | 7.3 | 2025-09-02 | In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to l… |
CVE-2025-22416 | High | 7.8 | 2025-09-02 | In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of priv… |
CVE-2025-9837 | High | 7.3 | 2025-09-02 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-9834 | Low | 3.5 | 2025-09-02 | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation o… |
CVE-2025-9833 | High | 7.3 | 2025-09-02 | A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login… |
CVE-2025-9832 | High | 7.3 | 2025-09-02 | A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register… |
CVE-2025-9831 | High | 7.3 | 2025-09-02 | A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This… |
CVE-2025-9330 | High | 7.8 | 2025-09-02 | Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat… |
CVE-2025-9329 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-9328 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-9327 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9326 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-9325 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9324 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9323 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9830 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-servic… |
CVE-2025-9276 | Critical | 9.8 | 2025-09-02 | Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass au… |
CVE-2025-9275 | High | 7.8 | 2025-09-02 | Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-9274 | High | 7.8 | 2025-09-02 | Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2025-9273 | Medium | 4.3 | 2025-09-02 | CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on a… |
CVE-2025-8614 | High | 7.8 | 2025-09-02 | NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect… |
CVE-2025-8613 | High | 7.2 | 2025-09-02 | Vacron Camera ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2025-8302 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8301 | High | 7.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows lo… |
CVE-2025-8300 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8299 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows… |
CVE-2025-8298 | Low | 3.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows loc… |
CVE-2025-7976 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-7975 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-7974 | High | 7.5 | 2025-09-02 | rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affec… |
CVE-2025-6685 | High | 8.8 | 2025-09-02 | ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installatio… |
CVE-2025-9829 | High | 7.3 | 2025-09-02 | A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The man… |
CVE-2025-9189 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DA… |
CVE-2025-9188 | High | 7.8 | 2025-09-02 | There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploit… |
CVE-2025-57778 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASY… |
CVE-2025-57777 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. This vulnerability… |
CVE-2025-57776 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with Digilent DASYLab. T… |
CVE-2025-57775 | High | 7.8 | 2025-09-02 | There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulnerability may resu… |
CVE-2025-57774 | High | 7.8 | 2025-09-02 | There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilent DASYLab. This vu… |
CVE-2025-43726 | Medium | 6.7 | 2025-09-02 | Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability… |
CVE-2025-36162 | Medium | 4.3 | 2025-09-02 | IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the… |
CVE-2025-55824 | Medium | 6.5 | 2025-09-02 | ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitiv… |
CVE-2025-55476 | Medium | 6.5 | 2025-09-02 | FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This par… |
CVE-2025-51966 | Medium | 6.1 | 2025-09-02 | A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, emb… |
CVE-2025-50565 | Medium | 6.5 | 2025-09-02 | Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. |
CVE-2025-32100 | Medium | 6.5 | 2025-09-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-32098 | Medium | 5.3 | 2025-09-02 | An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file d… |
CVE-2025-9828 | Low | 3.7 | 2025-09-02 | A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can le… |
CVE-2025-9696 | | 2025-09-02 | The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker… | |
CVE-2025-55474 | Medium | 6.1 | 2025-09-02 | Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed. |
CVE-2025-55473 | Medium | 6.1 | 2025-09-02 | Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in th… |
CVE-2025-55472 | Medium | 6.5 | 2025-09-02 | SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of use… |
CVE-2025-55373 | Medium | 5.3 | 2025-09-02 | Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute comman… |
CVE-2025-57616 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a… |
CVE-2025-57615 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor function allows an attacker… |
CVE-2025-57614 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method allows an attacker to… |
CVE-2025-57613 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor function allows an attac… |
CVE-2025-57612 | High | 7.5 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attacker to cause a de… |
CVE-2025-57611 | Medium | 5.3 | 2025-09-02 | An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an attacker to cause a de… |
CVE-2025-55372 | Medium | 5.3 | 2025-09-02 | An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-54599 | High | 7.5 | 2025-09-02 | The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes… |
CVE-2025-50757 | Medium | 6.5 | 2025-09-02 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allo… |
CVE-2025-50755 | Medium | 6.5 | 2025-09-02 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. This vulnerability allow… |
CVE-2025-9784 | High | 7.5 | 2025-09-02 | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to a… |
CVE-2025-46047 | Medium | 6.5 | 2025-09-02 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid us… |