2025 CVEs (page 206)
Page 206 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52581 | Critical | 9.8 | 2025-08-25 | An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially craft… |
CVE-2025-52461 | High | 8.2 | 2025-08-25 | An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially cra… |
CVE-2025-48005 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A sp… |
CVE-2025-46411 | High | 8.1 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-45968 | Critical | 9.8 | 2025-08-25 | An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Dire… |
CVE-2025-43960 | High | 8.6 | 2025-08-25 | Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), lea… |
CVE-2025-29517 | Medium | 6.8 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 function. |
CVE-2025-29516 | High | 7.2 | 2025-08-25 | D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup function. |
CVE-2025-29515 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settin… |
CVE-2025-29514 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration… |
CVE-2025-26467 | High | 8.8 | 2025-08-25 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w… |
CVE-2025-9407 | Low | 3.5 | 2025-08-25 | A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulat… |
CVE-2025-8562 | Medium | 6.5 | 2025-08-25 | The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This make… |
CVE-2025-48303 | Medium | 4.3 | 2025-08-25 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affec… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-5191 | | 2025-08-25 | An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in t… | |
CVE-2025-9118 | | 2025-08-25 | A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other custo… | |
CVE-2025-8997 | | 2025-08-25 | An Information Exposure vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. | |
CVE-2025-54301 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped. | |
CVE-2025-54300 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads. | |
CVE-2025-5514 | Medium | 5.3 | 2025-08-25 | Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allow… |
CVE-2025-9406 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component c… |
CVE-2025-9405 | Medium | 5.3 | 2025-08-25 | A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipula… |
CVE-2025-9404 | Low | 2.4 | 2025-08-25 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder… |
CVE-2025-9403 | Low | 3.3 | 2025-08-25 | A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing mani… |
CVE-2025-9402 | Medium | 4.7 | 2025-08-25 | A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Co… |
CVE-2025-9401 | Low | 3.7 | 2025-08-25 | A vulnerability has been found in HuangDou UTCMS 9. This vulnerability affects unknown code of the file app/modules/ut-frame/admin/login.php of the component L… |
CVE-2025-9400 | Medium | 6.3 | 2025-08-25 | A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation… |
CVE-2025-9399 | Medium | 6.3 | 2025-08-25 | A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation… |
CVE-2025-9398 | Medium | 5.3 | 2025-08-25 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/b… |
CVE-2025-9397 | Medium | 6.3 | 2025-08-24 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of t… |
CVE-2025-9396 | Low | 3.3 | 2025-08-24 | A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing mani… |
CVE-2025-9395 | Medium | 6.3 | 2025-08-24 | A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileN… |
CVE-2025-9394 | Medium | 5.3 | 2025-08-24 | A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the… |
CVE-2025-9393 | High | 8.8 | 2025-08-24 | A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnera… |
CVE-2025-9392 | High | 8.8 | 2025-08-24 | A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001… |
CVE-2025-9391 | Medium | 6.3 | 2025-08-24 | A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.Servi… |
CVE-2025-9390 | Medium | 5.3 | 2025-08-24 | A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of the component xxd… |
CVE-2025-9389 | Low | 3.3 | 2025-08-24 | A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulatio… |
CVE-2025-9388 | Low | 3.5 | 2025-08-24 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument… |
CVE-2025-9387 | Medium | 6.3 | 2025-08-24 | A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ip_block.php of th… |
CVE-2025-9386 | Medium | 5.3 | 2025-08-24 | A vulnerability has been found in appneta tcpreplay up to 4.5.1. The impacted element is the function get_l2len_protocol of the file get.c of the component tcp… |
CVE-2025-9385 | Medium | 5.3 | 2025-08-24 | A flaw has been found in appneta tcpreplay up to 4.5.1. The affected element is the function fix_ipv6_checksums of the file edit_packet.c of the component tcpr… |
CVE-2025-9384 | Low | 3.3 | 2025-08-24 | A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpedit_post_args of the file /src/tcpedit/parse_args.c. The manipulati… |
CVE-2025-9383 | Low | 2.5 | 2025-08-24 | A security vulnerability has been detected in FNKvision Y215 CCTV Camera 10.194.120.40. This issue affects the function crypt of the file /etc/passwd. The mani… |
CVE-2025-9382 | Medium | 6.4 | 2025-08-24 | A weakness has been identified in FNKvision Y215 CCTV Camera 10.194.120.40. This vulnerability affects unknown code of the file s1_rf_test_config of the compon… |
CVE-2025-9381 | Low | 1.6 | 2025-08-24 | A security flaw has been discovered in FNKvision Y215 CCTV Camera 10.194.120.40. This affects an unknown part of the file /tmp/wpa_supplicant.conf. Performing… |
CVE-2025-9380 | High | 7.8 | 2025-08-24 | A vulnerability was identified in FNKvision Y215 CCTV Camera 10.194.120.40. Affected by this issue is some unknown functionality of the file /etc/passwd of the… |
CVE-2025-9379 | High | 7.2 | 2025-08-24 | A vulnerability was determined in Belkin AX1800 1.1.00.016. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler… |
CVE-2025-8208 | Medium | 6.4 | 2025-08-24 | The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and i… |
CVE-2025-36174 | High | 8.0 | 2025-08-24 | IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by anot… |
CVE-2025-36157 | Critical | 9.8 | 2025-08-24 | IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server… |
CVE-2025-9363 | High | 8.8 | 2025-08-23 | A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affec… |
CVE-2025-9362 | Medium | 6.3 | 2025-08-23 | A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. The impacted elemen… |
CVE-2025-9361 | High | 8.8 | 2025-08-23 | A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. The affected… |
CVE-2025-9360 | High | 8.8 | 2025-08-23 | A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001… |
CVE-2025-9359 | High | 8.8 | 2025-08-23 | A weakness has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue… |
CVE-2025-9358 | High | 8.8 | 2025-08-23 | A security flaw has been discovered in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This… |
CVE-2025-5821 | Critical | 9.8 | 2025-08-23 | The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not prop… |
CVE-2025-5352 | Critical | 9.6 | 2025-08-23 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_C… |
CVE-2025-5060 | High | 8.1 | 2025-08-23 | The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly… |
CVE-2025-9357 | High | 8.8 | 2025-08-23 | A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affec… |
CVE-2025-7813 | High | 7.2 | 2025-08-23 | The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… |
CVE-2025-9131 | Medium | 6.4 | 2025-08-23 | The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 d… |
CVE-2025-9048 | High | 8.1 | 2025-08-23 | The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() functi… |
CVE-2025-8062 | Medium | 6.4 | 2025-08-23 | The WS Theme Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ws_weather shortcode in all versions up to, and includin… |
CVE-2025-7957 | Medium | 6.4 | 2025-08-23 | The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up to, and including… |
CVE-2025-7842 | Medium | 4.3 | 2025-08-23 | The Silencesoft RSS Reader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.6. This is due to missing o… |
CVE-2025-7841 | Medium | 4.3 | 2025-08-23 | The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i… |
CVE-2025-7839 | Medium | 4.3 | 2025-08-23 | The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. Th… |
CVE-2025-7828 | Medium | 4.3 | 2025-08-23 | The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing… |
CVE-2025-7827 | Medium | 4.3 | 2025-08-23 | The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_… |
CVE-2025-7821 | Medium | 5.3 | 2025-08-23 | The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJ… |
CVE-2025-7642 | Critical | 9.8 | 2025-08-23 | The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a… |
CVE-2025-43766 | Critical | 9.8 | 2025-08-23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12… |
CVE-2025-43765 | Medium | 6.1 | 2025-08-23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 t… |
CVE-2025-43764 | Medium | 6.5 | 2025-08-23 | Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3… |
CVE-2025-43767 | Medium | 6.1 | 2025-08-23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024… |
CVE-2025-43769 | Medium | 6.1 | 2025-08-23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024… |
CVE-2025-43768 | High | 7.7 | 2025-08-23 | Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 thro… |
CVE-2025-43770 | Medium | 6.1 | 2025-08-23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 thro… |
CVE-2025-9356 | High | 8.8 | 2025-08-22 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected b… |
CVE-2025-9355 | High | 8.8 | 2025-08-22 | A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by thi… |
CVE-2025-55455 | Low | 3.5 | 2025-08-22 | DooTask v1.0.51 was dicovered to contain an authenticated arbitrary download vulnerability via the component /msg/sendtext. |
CVE-2025-52451 | High | 8.5 | 2025-08-22 | Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolu… |
CVE-2025-52450 | Medium | 6.5 | 2025-08-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create… |
CVE-2025-4609 | Critical | 9.6 | 2025-08-22 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
CVE-2025-43761 | Medium | 6.1 | 2025-08-22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 thro… |
CVE-2025-26498 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Abso… |
CVE-2025-26497 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Travers… |
CVE-2025-26496 | Critical | 9.3 | 2025-08-22 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload module… |
CVE-2025-57801 | Critical | 9.1 | 2025-08-22 | gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature w… |
CVE-2025-6791 | High | 8.8 | 2025-08-22 | In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Spec… |
CVE-2025-55454 | High | 8.8 | 2025-08-22 | An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrary code via uploadin… |
CVE-2025-54813 | High | 7.5 | 2025-08-22 | Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-sup… |
CVE-2025-54812 | Medium | 5.4 | 2025-08-22 | Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the… |
CVE-2025-51092 | Critical | 9.8 | 2025-08-22 | The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and… |
CVE-2025-50859 | Medium | 6.1 | 2025-08-22 | Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitra… |
CVE-2025-50858 | Medium | 6.1 | 2025-08-22 | Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute ar… |
CVE-2025-4650 | High | 7.2 | 2025-08-22 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in a… |