2025 CVEs (page 20)
Page 20 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69411 | High | 7.5 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus… |
CVE-2025-69343 | Medium | 6.5 | 2026-03-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored… |
CVE-2025-69340 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Confi… |
CVE-2025-69339 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Molla molla allows PHP Loca… |
CVE-2025-69338 | Critical | 9.3 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injecti… |
CVE-2025-69090 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Remons remons allows PHP Loca… |
CVE-2025-68555 | Critical | 9.9 | 2026-03-05 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Nutrie nutrie allows Upload a Web Shell to a Web Server.This issue affects Nutrie… |
CVE-2025-68554 | Critical | 9.9 | 2026-03-05 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/… |
CVE-2025-68553 | Critical | 9.9 | 2026-03-05 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz… |
CVE-2025-68515 | Medium | 5.8 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-54001 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5. |
CVE-2025-53335 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Berger berger allows PHP Loca… |
CVE-2025-40931 | Critical | 9.1 | 2026-03-05 | Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The… |
CVE-2025-40926 | Critical | 9.8 | 2026-03-05 | Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seede… |
CVE-2025-41257 | Medium | 4.8 | 2026-03-04 | Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabil… |
CVE-2025-70222 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode. |
CVE-2025-68467 | Low | 3.4 | 2026-03-04 | Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by analyzing the color… |
CVE-2025-66024 | Critical | 9.0 | 2026-03-04 | The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable t… |
CVE-2025-70225 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component |
CVE-2025-70221 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin. |
CVE-2025-46108 | Critical | 9.8 | 2026-03-04 | D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup. |
CVE-2025-70219 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot. |
CVE-2025-70226 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard. |
CVE-2025-70223 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork. |
CVE-2025-70220 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4. |
CVE-2025-70218 | Critical | 9.8 | 2026-03-04 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component. |
CVE-2025-69969 | Critical | 9.6 | 2026-03-04 | A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9… |
CVE-2025-66944 | Critical | 9.8 | 2026-03-04 | SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search… |
CVE-2025-66678 | Critical | 9.8 | 2026-03-04 | An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read a… |
CVE-2025-15558 | High | 8.0 | 2026-03-04 | Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker… |
CVE-2025-62879 | Medium | 6.8 | 2026-03-04 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-b… |
CVE-2025-59787 | Medium | 6.5 | 2026-03-04 | 2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipulated requests, indi… |
CVE-2025-59786 | Critical | 9.8 | 2026-03-04 | 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web appli… |
CVE-2025-59785 | High | 7.2 | 2026-03-04 | Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption. This… |
CVE-2025-59784 | High | 7.2 | 2026-03-04 | 2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validati… |
CVE-2025-59783 | High | 7.2 | 2026-03-04 | API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This… |
CVE-2025-12801 | Medium | 6.5 | 2026-03-04 | A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assi… |
CVE-2025-71238 | High | 7.8 | 2026-03-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353… |
CVE-2025-70342 | Medium | 6.6 | 2026-03-04 | erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attac… |
CVE-2025-70341 | High | 7.8 | 2026-03-04 | Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. |
CVE-2025-40896 | Medium | 6.5 | 2026-03-04 | The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and int… |
CVE-2025-40895 | Medium | 4.8 | 2026-03-04 | A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties. A… |
CVE-2025-40894 | Medium | 4.4 | 2026-03-04 | A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. A malici… |
CVE-2025-66168 | Medium | 5.4 | 2026-03-04 | WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq… |
CVE-2025-70240 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51. |
CVE-2025-70239 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55. |
CVE-2025-70234 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS. |
CVE-2025-14480 | Medium | 5.1 | 2026-03-03 | IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2025-14456 | Medium | 5.9 | 2026-03-03 | IBM MQ Appliance 9.4 CD through 9.4.4.0 to 9.4.4.1 |
CVE-2025-13688 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2025-13687 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2025-13686 | Medium | 6.3 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the syst… |
CVE-2025-70241 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5. |
CVE-2025-70237 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr. |
CVE-2025-70236 | Critical | 9.8 | 2026-03-03 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter. |
CVE-2025-66945 | Critical | 9.1 | 2026-03-03 | A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files… |
CVE-2025-36364 | Medium | 6.2 | 2026-03-03 | IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system. |
CVE-2025-36363 | Medium | 5.9 | 2026-03-03 | IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2025-14923 | Medium | 4.7 | 2026-03-03 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when… |
CVE-2025-14604 | Medium | 6.6 | 2026-03-03 | IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigge… |
CVE-2025-13734 | Medium | 5.4 | 2026-03-03 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissi… |
CVE-2025-13616 | Medium | 6.5 | 2026-03-03 | IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the sys… |
CVE-2025-13490 | Medium | 5.9 | 2026-03-03 | IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Cert… |
CVE-2025-69765 | High | 7.5 | 2026-03-03 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption and enable remote c… |
CVE-2025-67840 | High | 7.2 | 2026-03-03 | Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_… |
CVE-2025-63912 | High | 7.5 | 2026-03-03 | Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowing attackers to tr… |
CVE-2025-63911 | High | 7.2 | 2026-03-03 | Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability. |
CVE-2025-63910 | High | 7.2 | 2026-03-03 | An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with Administrator privi… |
CVE-2025-63909 | High | 7.2 | 2026-03-03 | Incorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers to escal… |
CVE-2025-15599 | Medium | 6.1 | 2026-03-03 | DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by ex… |
CVE-2025-62817 | High | 7.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in… |
CVE-2025-62816 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS4L_VERTEXIOC_BOOTUP input leads to a den… |
CVE-2025-66680 | High | 7.1 | 2026-03-03 | An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted reques… |
CVE-2025-66363 | High | 7.5 | 2026-03-03 | An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages. |
CVE-2025-62815 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of npu_proto_drv.ast.thread_ref in set_… |
CVE-2025-62814 | High | 7.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, and 2400. A NULL pointer dereference of ft_handle in load_fw_utc_vector() ca… |
CVE-2025-70821 | Critical | 9.8 | 2026-03-03 | renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component |
CVE-2025-64736 | Medium | 6.1 | 2026-03-03 | An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb0). A specially cra… |
CVE-2025-57622 | Critical | 9.8 | 2026-03-03 | An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) comp… |
CVE-2025-52365 | High | 7.8 | 2026-03-03 | A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via u… |
CVE-2025-59060 | Medium | 5.3 | 2026-03-03 | Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to ver… |
CVE-2025-59059 | Critical | 9.8 | 2026-03-03 | Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2025-15595 | High | 7.8 | 2026-03-03 | Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions. |
CVE-2025-12345 | High | 8.8 | 2026-03-03 | A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the function agent_deploy_init of the file /agents… |
CVE-2025-47147 | Medium | 5.7 | 2026-03-03 | Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in… |
CVE-2025-48654 | High | 7.8 | 2026-03-02 | In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of… |
CVE-2025-48653 | High | 7.8 | 2026-03-02 | In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escal… |
CVE-2025-48650 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional exe… |
CVE-2025-48646 | High | 7.8 | 2026-03-02 | In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with… |
CVE-2025-48645 | High | 7.8 | 2026-03-02 | In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of pri… |
CVE-2025-48644 | Medium | 5.5 | 2026-03-02 | In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no ad… |
CVE-2025-48642 | Medium | 5.5 | 2026-03-02 | In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure… |
CVE-2025-48641 | High | 7.0 | 2026-03-02 | In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional… |
CVE-2025-48636 | High | 8.4 | 2026-03-02 | In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to lo… |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |
CVE-2025-48634 | High | 7.3 | 2026-03-02 | In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of pr… |
CVE-2025-48630 | High | 7.4 | 2026-03-02 | In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to l… |
CVE-2025-48619 | High | 8.4 | 2026-03-02 | In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. Thi… |
CVE-2025-48613 | High | 7.8 | 2026-03-02 | In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This coul… |