2025 CVEs (page 209)
Page 209 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-38665 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode An… |
CVE-2025-38664 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return v… |
CVE-2025-38663 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file types when reading inodes To prevent inodes with invalid file… |
CVE-2025-38662 | High | 7.1 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv Given mt8365_dai… |
CVE-2025-38661 | High | 7.1 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array Add missing empty member to `… |
CVE-2025-38660 | Critical | 9.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname()… |
CVE-2025-38659 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only no… |
CVE-2025-38658 | High | 8.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails Have nvmet_req_i… |
CVE-2025-38657 | High | 7.3 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch() The "link_id" value… |
CVE-2025-38656 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_s… |
CVE-2025-38655 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: add NULL check in DT parse Add a NULL check for the return value o… |
CVE-2025-38654 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix order of DT parse and pinctrl register Move DT parse before pi… |
CVE-2025-38653 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check p… |
CVE-2025-38652 | High | 7.3 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/0123456789012345… |
CVE-2025-38651 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix warning from KUnit tests get_id_range() expects a positive value as first a… |
CVE-2025-38650 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsp… |
CVE-2025-38649 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight An infi… |
CVE-2025-38648 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: spi: stm32: Check for cfg availability in stm32_spi_probe The stm32_spi_probe function no… |
CVE-2025-38647 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi The following asserti… |
CVE-2025-38646 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band … |
CVE-2025-38645 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage Add a NULL check before accessing devi… |
CVE-2025-38644 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a… |
CVE-2025-38643 | High | 8.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() Callers of wdev_chandef(… |
CVE-2025-38642 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix WARN_ON for monitor mode on some devices On devices without WANT_MONI… |
CVE-2025-38641 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix potential NULL dereference on kmalloc failure Avoid potential NULL… |
CVE-2025-38640 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nf_hook_run_bpf(). syzbot reported that the netfilter bpf prog… |
CVE-2025-38639 | High | 7.1 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-b… |
CVE-2025-38638 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: ipv6: add a retry logic in net6_rt_notify() inet6_rt_notify() can be called under RCU pro… |
CVE-2025-38636 | High | 7.1 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enabl… |
CVE-2025-38635 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: clk: davinci: Add NULL check in davinci_lpsc_clk_register() devm_kasprintf() returns NULL… |
CVE-2025-38634 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-charger: Fix null check for power_supply_get_by_name In the cpcap_us… |
CVE-2025-38633 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: mark K1 pll1_d8 as critical The pll1_d8 clock is enabled by the boot loade… |
CVE-2025-38632 | Medium | 4.7 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 ("pi… |
CVE-2025-38631 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: clk: imx95-blk-ctl: Fix synchronous abort When enabling runtime PM for clock suppliers th… |
CVE-2025-38630 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref fb_add_videomode() can fai… |
CVE-2025-38629 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up th… |
CVE-2025-38628 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix release of uninitialized resources on error path The commit in the fixes t… |
CVE-2025-38627 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic The decompress_io_ctx may be… |
CVE-2025-38626 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode w/ "mode=lfs" mou… |
CVE-2025-38625 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vfio/pds: Fix missing detach_ioas op When CONFIG_IOMMUFD is enabled and a device is bound… |
CVE-2025-38624 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge con… |
CVE-2025-38623 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code… |
CVE-2025-38622 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to t… |
CVE-2025-38621 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: md: make rdev_addable usable for rcu mode Our testcase trigger panic: BUG: kernel NULL p… |
CVE-2025-38620 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: zloop: fix KASAN use-after-free of tag set When a zoned loop device, or zloop device, is… |
CVE-2025-38619 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: fix list_del corruption If ti_csi2rx_start_dma() fails in ti_csi… |
CVE-2025-29366 | Critical | 9.8 | 2025-08-22 | In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary comman… |
CVE-2025-29365 | Critical | 9.8 | 2025-08-22 | spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL. |
CVE-2025-55573 | High | 8.8 | 2025-08-22 | QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2025-36042 | Medium | 5.4 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip… |
CVE-2025-33120 | High | 7.8 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unneces… |
CVE-2025-51825 | Medium | 6.5 | 2025-08-22 | JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which… |
CVE-2025-50691 | Medium | 5.3 | 2025-08-22 | MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data direct… |
CVE-2025-38618 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to… |
CVE-2025-38617 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring()… |
CVE-2025-38616 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive… |
CVE-2025-9331 | Medium | 4.3 | 2025-08-22 | The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' fu… |
CVE-2025-9259 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9258 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9257 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9256 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9255 | High | 7.5 | 2025-08-22 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database conte… |
CVE-2025-9254 | Critical | 9.8 | 2025-08-22 | WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by e… |
CVE-2025-57896 | Medium | 5.3 | 2025-08-22 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-57895 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-57894 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPi… |
CVE-2025-57893 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fas… |
CVE-2025-57892 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affect… |
CVE-2025-57891 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations recurring-donation… |
CVE-2025-57890 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions sessions allows Stored XSS.This is… |
CVE-2025-57888 | Medium | 5.3 | 2025-08-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensiti… |
CVE-2025-57887 | Medium | 6.5 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This… |
CVE-2025-57886 | Medium | 5.4 | 2025-08-22 | Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Explo… |
CVE-2025-57885 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Cross Site Request Forgery.This issue affects Fluent Su… |
CVE-2025-57884 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-9340 | | 2025-08-22 | Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated wit… | |
CVE-2025-9341 | | 2025-08-22 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-8678 | Medium | 5.9 | 2025-08-22 | The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This… |
CVE-2025-57699 | Medium | 6.7 | 2025-08-22 | Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permi… |
CVE-2025-8281 | High | 7.1 | 2025-08-22 | The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-41452 | | 2025-08-22 | Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow f… | |
CVE-2025-41451 | | 2025-08-22 | Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4… | |
CVE-2025-43752 | Medium | 6.5 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-43753 | Medium | 5.4 | 2025-08-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 t… |
CVE-2025-51606 | High | 8.8 | 2025-08-21 | hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled bin… |
CVE-2025-43747 | Medium | 6.5 | 2025-08-21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.d… |
CVE-2025-55231 | High | 7.5 | 2025-08-21 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code… |
CVE-2025-55230 | High | 7.8 | 2025-08-21 | Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-55229 | Medium | 5.3 | 2025-08-21 | Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55107 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticat… |
CVE-2025-55106 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55105 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55104 | Medium | 4.8 | 2025-08-21 | A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create o… |
CVE-2025-55103 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-54460 | High | 7.1 | 2025-08-21 | The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) t… |
CVE-2025-53795 | Critical | 9.1 | 2025-08-21 | Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-53763 | Critical | 9.8 | 2025-08-21 | Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-51989 | High | 7.0 | 2025-08-21 | HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "k… |
CVE-2025-41415 | Medium | 6.5 | 2025-08-21 | The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information tha… |
CVE-2025-3128 | Critical | 9.8 | 2025-08-21 | A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information… |