2025 CVEs (page 2)
Page 2 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8945 | Medium | 5.3 | 2026-09-02 | The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API. |
CVE-2025-15692 | Low | 3.5 | 2026-09-02 | The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which coul… |
CVE-2025-15490 | Medium | 5.3 | 2026-09-02 | The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via cra… |
CVE-2025-15489 | Medium | 5.3 | 2026-09-02 | The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password… |
CVE-2025-15485 | High | 8.2 | 2026-09-02 | The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them an… |
CVE-2025-15481 | Medium | 5.3 | 2026-09-02 | The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails. |
CVE-2025-7963 | Medium | 6.4 | 2026-09-02 | The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up t… |
CVE-2025-15664 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled cl… |
CVE-2025-15663 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled cli… |
CVE-2025-46418 | High | 7.6 | 2026-09-02 | Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition. |
CVE-2025-12768 | | 2026-09-01 | A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve re… | |
CVE-2025-15613 | Medium | 6.5 | 2026-09-01 | Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (C… |
CVE-2025-63607 | Medium | 6.1 | 2026-08-31 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitt… |
CVE-2025-64649 | Medium | 5.9 | 2026-08-28 | IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate va… |
CVE-2025-36290 | Medium | 5.9 | 2026-08-28 | IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to… |
CVE-2025-36271 | Medium | 5.9 | 2026-08-28 | IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2025-30156 | High | 8.9 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication… |
CVE-2025-62343 | Low | 3.1 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or s… |
CVE-2025-62342 | Medium | 6.4 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions n… |
CVE-2025-62341 | Low | 3.7 | 2026-08-26 | HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized r… |
CVE-2025-61480 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofe… |
CVE-2025-61479 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SP… |
CVE-2025-61478 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofe… |
CVE-2025-51679 | Critical | 9.1 | 2026-08-26 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior. |
CVE-2025-51675 | High | 7.5 | 2026-08-26 | An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service… |
CVE-2025-70340 | Medium | 6.5 | 2026-08-26 | A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticate… |
CVE-2025-70293 | Critical | 9.8 | 2026-08-26 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead… |
CVE-2025-70290 | Critical | 9.8 | 2026-08-26 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk me… |
CVE-2025-61165 | Critical | 9.8 | 2026-08-26 | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploa… |
CVE-2025-61164 | High | 7.5 | 2026-08-26 | Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. |
CVE-2025-61163 | Critical | 9.8 | 2026-08-26 | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to valid… |
CVE-2025-61162 | High | 7.5 | 2026-08-26 | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{US… |
CVE-2025-56798 | High | 8.8 | 2026-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges… |
CVE-2025-29419 | High | 7.1 | 2026-08-26 | CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack. |
CVE-2025-10903 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain con… |
CVE-2025-9878 | Medium | 6.4 | 2026-08-25 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp… |
CVE-2025-26238 | High | 8.1 | 2026-08-24 | In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code. |
CVE-2025-26237 | High | 8.1 | 2026-08-24 | D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands. |
CVE-2025-36940 | High | 8.8 | 2026-08-24 | Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP) |
CVE-2025-36939 | Medium | 5.7 | 2026-08-24 | Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packe… |
CVE-2025-68825 | High | 7.5 | 2026-08-24 | HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sens… |
CVE-2025-68833 | Medium | 5.3 | 2026-08-24 | HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources. |
CVE-2025-63080 | | 2026-08-24 | Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. sy… | |
CVE-2025-15671 | Medium | 5.4 | 2026-08-21 | The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-… |
CVE-2025-52182 | High | 7.5 | 2026-08-20 | The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability. |
CVE-2025-62306 | Medium | 5.0 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an a… |
CVE-2025-62300 | Medium | 5.9 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredicta… |
CVE-2025-62299 | Medium | 6.6 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privil… |
CVE-2025-62307 | Medium | 5.4 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables… |
CVE-2025-53999 | Medium | 6.5 | 2026-08-20 | Unauthenticated Broken Access Control in Altair <= 5.2.2 versions. |
CVE-2025-15689 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions. |
CVE-2025-15688 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Capella <= 2.5.5 versions. |
CVE-2025-15637 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. |
CVE-2025-14601 | | 2026-08-20 | An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands… | |
CVE-2025-14602 | | 2026-08-20 | The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately g… | |
CVE-2025-36398 | Medium | 5.4 | 2026-08-19 | IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another… |
CVE-2025-36255 | High | 7.5 | 2026-08-19 | IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with pri… |
CVE-2025-36254 | High | 7.4 | 2026-08-19 | IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication d… |
CVE-2025-14603 | | 2026-08-19 | The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposi… | |
CVE-2025-14600 | | 2026-08-19 | An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configurat… | |
CVE-2025-11729 | Medium | 4.3 | 2026-08-19 | The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capabilit… |
CVE-2025-9211 | Medium | 6.7 | 2026-08-18 | Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalat… |
CVE-2025-9210 | High | 8.1 | 2026-08-18 | Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate pri… |
CVE-2025-27772 | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to rem… | |
CVE-2025-27771 | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/add_prompts` endpoint is vulnerable to… | |
CVE-2025-27770 | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable… | |
CVE-2025-27621 | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default us… | |
CVE-2025-10005 | Medium | 4.3 | 2026-08-16 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2025-7639 | High | 7.1 | 2026-08-14 | The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially… |
CVE-2025-71405 | | 2026-08-14 | chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect UR… | |
CVE-2025-10308 | Medium | 4.3 | 2026-08-14 | The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing n… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2025-62315 | Low | 3.4 | 2026-08-13 | HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be a… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2025-52640 | Medium | 4.7 | 2026-08-13 | HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes shar… |
CVE-2025-9486 | Low | 3.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2025-59324 | Critical | 9.1 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity c… |
CVE-2025-59323 | High | 8.4 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing… |
CVE-2025-59322 | High | 7.5 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext. |
CVE-2025-59321 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to b… |
CVE-2025-59320 | Medium | 4.6 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker wit… |
CVE-2025-59319 | High | 7.2 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matc… |
CVE-2025-59327 | High | 7.5 | 2026-08-12 | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro… |
CVE-2025-59326 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be… |
CVE-2025-59325 | High | 7.5 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2025-41770 | High | 7.5 | 2026-08-12 | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via th… |
CVE-2025-41769 | Critical | 9.8 | 2026-08-12 | The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could… |
CVE-2025-15687 | Medium | 4.3 | 2026-08-12 | A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handl… |
CVE-2025-15686 | Medium | 4.3 | 2026-08-12 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation o… |
CVE-2025-15685 | Medium | 6.3 | 2026-08-12 | A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation cause… |
CVE-2025-15684 | Medium | 5.3 | 2026-08-12 | A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler… |
CVE-2025-54512 | | 2026-08-11 | A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulti… | |
CVE-2025-0046 | | 2026-08-11 | Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution. | |
CVE-2025-8087 | | 2026-08-11 | A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, pote… | |
CVE-2025-61970 | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resu… | |
CVE-2025-48506 | | 2026-08-11 | Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulti… | |
CVE-2025-48505 | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentia… | |
CVE-2025-35987 | | 2026-08-11 | Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a deni… | |
CVE-2025-35973 | | 2026-08-11 | Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized a… |